+----------------------------------------------------------------------+ | LinuxSecurity.com Linux Advisory Watch | | January 7th, 2011 Volume 12, Number 2 | | | | Editorial Team: Dave Wreski <dwreski@xxxxxxxxxxxxxxxxx> | | Benjamin D. Thomas <bthomas@xxxxxxxxxxxxxxxxx> | +----------------------------------------------------------------------+ Thank you for reading the Linux Advisory Watch Security Newsletter. The purpose of this document is to provide our readers with a quick summary of each week's vendor security bulletins and pointers on methods to improve the security posture of your open source system. Vulnerabilities affect nearly every vendor virtually every week, so be sure to read through to find the updates your distributor have made available. Review: The Official Ubuntu Book -------------------------------- If you haven't used Linux before, are new to Ubuntu, or would like a quick update on the latest in open source advancements for the desktop, then The Official Ubuntu Book is a great place to start. http://www.linuxsecurity.com/content/view/153159 --> Take advantage of the LinuxSecurity.com Quick Reference Card! <-- --> http://www.linuxsecurity.com/docs/QuickRefCard.pdf <-- ------------------------------------------------------------------------ * EnGarde Secure Community 3.0.22 Now Available! ---------------------------------------------- Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.22 (Version 3.0, Release 22). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy. http://www.linuxsecurity.com/content/view/145668 ------------------------------------------------------------------------ * Debian: 2142-1: dpkg: directory traversal (Jan 6) ------------------------------------------------- Jakub Wilk discovered that the dpkg-source component of dpkg, the Debian package management system, doesn't correctly handle paths in patches of source packages, which could make it traverse directories. Raphaël Hertzog additionally discovered that symbolic links in the .pc [More...] http://www.linuxsecurity.com/content/view/154082 * Debian: 2141-3: apache2: backward compatibility opti (Jan 5) ------------------------------------------------------------ DSA-2141-1 changed the behaviour of the openssl libraries in a server environment to only allow SSL/TLS renegotiation for clients that support the RFC5746 renegotiation extension. This update to apache2 adds the new SSLInsecureRenegotiation configuration option that allows [More...] http://www.linuxsecurity.com/content/view/154079 * Debian: 2141-2: nss: SSL/TLS insecure renegotiat (Jan 5) -------------------------------------------------------- CVE-2009-3555: Marsh Ray, Steve Dispensa, and Martin Rex discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle [More...] http://www.linuxsecurity.com/content/view/154078 * Debian: 2141-1: openssl: SSL/TLS insecure renegotiat (Jan 5) ------------------------------------------------------------ CVE-2009-3555: Marsh Ray, Steve Dispensa, and Martin Rex discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle [More...] http://www.linuxsecurity.com/content/view/154077 * Debian: 2140-1: libapache2-mod-fcgid: stack overflow (Jan 5) ------------------------------------------------------------ A vulnerability has been found in Apache mod_fcgid. The Common Vulnerabilities and Exposures project identifies the following problem: [More...] http://www.linuxsecurity.com/content/view/154076 * Debian: 2139-1: phpmyadmin: Multiple vulnerabilities (Dec 31) ------------------------------------------------------------- Several vulnerabilities have been discovered in phpMyAdmin, a tool to administer MySQL over the web. The Common Vulnerabilities and Exposures project identifies the following problems: [More...] http://www.linuxsecurity.com/content/view/154053 ------------------------------------------------------------------------ * Gentoo: 201101-01: gif2png: User-assisted execution of arbitrary (Jan 4) ------------------------------------------------------------------------ gif2png contains a stack overflow vulnerability when parsing commandline arguments. http://www.linuxsecurity.com/content/view/154067 ------------------------------------------------------------------------ * Mandriva: 2011:001: dhcp (Jan 7) -------------------------------- A vulnerability has been found and corrected in dhcp: ISC DHCP server 4.2 before 4.2.0-P2, when configured to use failover partnerships, allows remote attackers to cause a denial of service (communications-interrupted state and DHCP client service loss) [More...] http://www.linuxsecurity.com/content/view/154090 * Mandriva: 2011:000: phpmyadmin (Jan 5) -------------------------------------- Multiple vulnerabilities has been found and corrected in phpmyadmin: error.php in PhpMyAdmin 3.3.8.1 and earlier allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted BBcode tag containing @ characters, as demonstrated using [a@url@page] [More...] http://www.linuxsecurity.com/content/view/154073 ------------------------------------------------------------------------ * Red Hat: 2011:0009-01: evince: Moderate Advisory (Jan 6) -------------------------------------------------------- Updated evince packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate [More...] http://www.linuxsecurity.com/content/view/154083 * Red Hat: 2011:0004-01: kernel: Important Advisory (Jan 4) --------------------------------------------------------- Updated kernel packages that fix multiple security issues, several bugs, and add an enhancement are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having [More...] http://www.linuxsecurity.com/content/view/154066 ------------------------------------------------------------------------ * SuSE: 2011-003: Mozilla (Jan 5) ------------------------------- Mozilla Firefox was updated to update 3.6.13 to fix several security issues. Also Mozilla Thunderbird and Seamonkey were updated on openSUSE. Following security issues were fixed: MFSA 2010-74: Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other [More...] http://www.linuxsecurity.com/content/view/154068 * SuSE: 2011-002: Linux kernel (Jan 3) ------------------------------------ This update of the openSUSE 11.2 kernel fixes various bugs and lots of security issues. Following security issues have been fixed: CVE-2010-4258: A local attacker could use a Oops (kernel crash) caused by other flaws to write a 0 byte to a attacker controlled address in the [More...] http://www.linuxsecurity.com/content/view/154061 * SuSE: 2011-001: Linux kernel (Jan 3) ------------------------------------ The openSUSE 11.3 kernel was updated to fix various bugs and security issues. Following security issues have been fixed: CVE-2010-4347: A local user could inject ACPI code into the kernel [More...] http://www.linuxsecurity.com/content/view/154060 ------------------------------------------------------------------------ * Ubuntu: 1040-1: Django vulnerabilities (Jan 6) ---------------------------------------------- Adam Baldwin discovered that Django did not properly validate query stringlookups. This could be exploited to provide an information leak to anattacker with admin privilieges. (CVE-2010-4534) [More...] http://www.linuxsecurity.com/content/view/154086 * Ubuntu: 1036-1: CUPS update (Jan 6) ----------------------------------- Under certain circumstances, CUPS could start before its AppArmor profilewas loaded and therefore run unconfined. This update ensures the AppArmorprofile is loaded before CUPS starts. [More...] http://www.linuxsecurity.com/content/view/154085 * Ubuntu: 1038-1: dpkg vulnerability (Jan 6) ------------------------------------------ Jakub Wilk and Raphaël Hertzog discovered that dpkg-source did notcorrectly handle certain paths and symlinks when unpacking source-formatversion 3.0 packages. If a user or an automated system were tricked intounpacking a specially crafted source package, a remote attacker couldmodify files outside the target unpack directory, leading to a denial [More...] http://www.linuxsecurity.com/content/view/154084 ------------------------------------------------------------------------ Distributed by: Guardian Digital, Inc. LinuxSecurity.com To unsubscribe email vuln-newsletter-request@xxxxxxxxxxxxxxxxx with "unsubscribe" in the subject of the message. ------------------------------------------------------------------------
