Linux Advisory Watch: December 16th, 2011

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



+----------------------------------------------------------------------+
| LinuxSecurity.com                               Linux Advisory Watch |
| December 16th, 2011                             Volume 12, Number 51 |
|                                                                      |
| Editorial Team:              Dave Wreski <dwreski@xxxxxxxxxxxxxxxxx> |
+----------------------------------------------------------------------+

Thank you for reading the Linux Advisory Watch Security Newsletter. The 
purpose of this document is to provide our readers with a quick summary of 
each week's vendor security bulletins and pointers on methods to improve 
the security posture of your open source system.

Vulnerabilities affect nearly every vendor virtually every week, so be 
sure to read through to find the updates your distributor have made 
available.

Password guessing as an attack vector
-------------------------------------
Using password guessing as an attack vector. Over the years we've been
taught a strong password must be long and complex to be considered
secure. Some of us have taken that notion to heart and always ensure
our passwords are strong. But some don't give a second thought to the
complexity or length of our password.

http://www.linuxsecurity.com/content/view/156412

------------------------------------------------------------------------
* Debian: 2362-1: acpid: Multiple vulnerabilities (Dec 10)
   --------------------------------------------------------
   Multiple vulnerabilities were found in the acpid, the Advanced
   Configuration and Power Interface event daemon: CVE-2011-1159
   [More...]

   http://www.linuxsecurity.com/content/view/156392

------------------------------------------------------------------------

* Mandriva: 2011:189: jasper (Dec 16)
   -----------------------------------
   Multiple vulnerabilities has been discovered and corrected in jasper:
   Heap-based buffer overflow in the jpc_cox_getcompparms function in
   libjasper/jpc/jpc_cs.c in JasPer 1.900.1 allows remote attackers to
   execute arbitrary code or cause a denial of service (memory
   corruption) [More...]

   http://www.linuxsecurity.com/content/view/156433

* Mandriva: 2011:188: libxml2 (Dec 15)
   ------------------------------------
   Multiple vulnerabilities has been discovered and corrected in
   libxml2: Off-by-one error in libxml allows remote attackers to
   execute arbitrary code or cause a denial of service (heap-based
   buffer overflow and application crash) via a crafted web site
   CVE-2011-0216). [More...]

   http://www.linuxsecurity.com/content/view/156432

* Mandriva: 2011:187: php-pear (Dec 15)
   -------------------------------------
   A vulnerability has been discovered and corrected in php-pear: The
   installer in PEAR before 1.9.2 allows local users to overwrite
   arbitrary files via a symlink attack on the package.xml file, related
   to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and [More...]

   http://www.linuxsecurity.com/content/view/156431

* Mandriva: 2011:186: nfs-utils (Dec 12)
   --------------------------------------
   A vulnerability has been discovered and corrected in nfs-utils: It
   was found that the mount.nfs tool did not handle certain errors
   correctly when updating the mtab (mounted file systems table) file. A
   local attacker could use this flaw to corrupt the mtab file [More...]

   http://www.linuxsecurity.com/content/view/156403

* Mandriva: 2011:185: libcap (Dec 12)
   -----------------------------------
   A vulnerability has been discovered and corrected in libcap: capsh
   did not chdir(/) after callling chroot(). Programs could therefore
   access the current directory outside of the chroot (CVE-2011-4099).
   [More...]

   http://www.linuxsecurity.com/content/view/156395

* Mandriva: 2011:184: krb5 (Dec 12)
   ---------------------------------
   A vulnerability has been discovered and corrected in krb5: The
   process_tgs_req function in do_tgs_req.c in the Key Distribution
   Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.2 allows
   remote authenticated users to cause a denial of service (NULL pointer
   [More...]

   http://www.linuxsecurity.com/content/view/156394

* Mandriva: 2011:183: pidgin (Dec 10)
   -----------------------------------
   Multiple vulnerabilities has been discovered and corrected in pidgin:
   When receiving various stanzas related to voice and video chat, the
   XMPP protocol plugin failed to ensure that the incoming message
   contained all required fields, and would crash if certain fields
   [More...]

   http://www.linuxsecurity.com/content/view/156393

* Mandriva: 2011:182: dhcp (Dec 8)
   --------------------------------
   A vulnerability has been discovered and corrected in dhcp: dhcpd in
   ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not
   properly handle regular expressions in dhcpd.conf, which allows
   remote attackers to cause a denial of service (daemon crash)
   [More...]

   http://www.linuxsecurity.com/content/view/156380

------------------------------------------------------------------------

* Red Hat: 2011:1821-01: pidgin: Moderate Advisory (Dec 14)
   ---------------------------------------------------------
   Updated pidgin packages that fix multiple security issues are now
   available for Red Hat Enterprise Linux 6. The Red Hat Security
   Response Team has rated this update as having moderate [More...]

   http://www.linuxsecurity.com/content/view/156424

* Red Hat: 2011:1820-01: pidgin: Moderate Advisory (Dec 14)
   ---------------------------------------------------------
   Updated pidgin packages that fix multiple security issues are now
   available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security
   Response Team has rated this update as having moderate [More...]

   http://www.linuxsecurity.com/content/view/156423

* Red Hat: 2011:1819-01: dhcp: Moderate Advisory (Dec 14)
   -------------------------------------------------------
   Updated dhcp packages that fix one security issue are now available
   for Red Hat Enterprise Linux 6. The Red Hat Security Response Team
   has rated this update as having moderate [More...]

   http://www.linuxsecurity.com/content/view/156422

* Red Hat: 2011:1815-01: icu: Moderate Advisory (Dec 13)
   ------------------------------------------------------
   Updated icu packages that fix one security issue are now available
   for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response
   Team has rated this update as having moderate [More...]

   http://www.linuxsecurity.com/content/view/156417

* Red Hat: 2011:1814-01: ipmitool: Moderate Advisory (Dec 13)
   -----------------------------------------------------------
   An updated ipmitool package that fixes one security issue is now
   available for Red Hat Enterprise Linux 6. The Red Hat Security
   Response Team has rated this update as having moderate [More...]

   http://www.linuxsecurity.com/content/view/156416

* Red Hat: 2011:1813-01: kernel: Important Advisory (Dec 13)
   ----------------------------------------------------------
   Updated kernel packages that fix several security issues and various
   bugs are now available for Red Hat Enterprise Linux 5.6 Extended
   Update Support. The Red Hat Security Response Team has rated this
   update as having [More...]

   http://www.linuxsecurity.com/content/view/156415

* Red Hat: 2011:1811-01: netpbm: Important Advisory (Dec 12)
   ----------------------------------------------------------
   Updated netpbm packages that fix three security issues are now
   available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security
   Response Team has rated this update as having [More...]

   http://www.linuxsecurity.com/content/view/156402

* Red Hat: 2011:1807-01: jasper: Important Advisory (Dec 9)
   ---------------------------------------------------------
   Updated jasper packages that fix two security issues are now
   available for Red Hat Enterprise Linux 6. The Red Hat Security
   Response Team has rated this update as having [More...]

   http://www.linuxsecurity.com/content/view/156387

* Red Hat: 2011:1801-01: qemu-kvm: Important Advisory (Dec 8)
   -----------------------------------------------------------
   Updated qemu-kvm packages that fix one security issue are now
   available for Red Hat Enterprise Linux 6.1 Extended Update Support.
   The Red Hat Security Response Team has rated this update as having
   [More...]

   http://www.linuxsecurity.com/content/view/156385

* Red Hat: 2011:1797-01: perl: Moderate Advisory (Dec 8)
   ------------------------------------------------------
   Updated perl packages that fix multiple security issues are now
   available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security
   Response Team has rated this update as having moderate [More...]

   http://www.linuxsecurity.com/content/view/156384

------------------------------------------------------------------------

* Ubuntu: 1309-1: DHCP vulnerability (Dec 15)
   -------------------------------------------
   DHCP could be made to crash if it received specially crafted
   networktraffic.

   http://www.linuxsecurity.com/content/view/156430

* Ubuntu: 1308-1: bzip2 vulnerability (Dec 14)
   --------------------------------------------
   Executables compressed by bzexe could be made to run programs as
   yourlogin.

   http://www.linuxsecurity.com/content/view/156425

* Ubuntu: 1307-1: PHP vulnerability (Dec 14)
   ------------------------------------------
   PHP could be made to crash or disclose sensitive information if
   itprocessed a specially crafted image file.

   http://www.linuxsecurity.com/content/view/156421

* Ubuntu: 1305-1: Nova vulnerability (Dec 13)
   -------------------------------------------
   Nova could be made to overwrite files.

   http://www.linuxsecurity.com/content/view/156413

* Ubuntu: 1304-1: Linux kernel (OMAP4) vulnerabilities (Dec 13)
   -------------------------------------------------------------
   Several security issues were fixed in the kernel.

   http://www.linuxsecurity.com/content/view/156410

* Ubuntu: 1303-1: Linux kernel (Marvell DOVE) vulnerabilities (Dec 13)
   --------------------------------------------------------------------
   Several security issues were fixed in the kernel.

   http://www.linuxsecurity.com/content/view/156409

* Ubuntu: 1302-1: Linux kernel (OMAP4) vulnerabilities (Dec 13)
   -------------------------------------------------------------
   Several security issues were fixed in the kernel.

   http://www.linuxsecurity.com/content/view/156408

* Ubuntu: 1301-1: Linux kernel (Natty backport) vulnerabilities (Dec 13)
   ----------------------------------------------------------------------
   Several security issues were fixed in the kernel.

   http://www.linuxsecurity.com/content/view/156407

* Ubuntu: 1300-1: Linux kernel (FSL-IMX51) vulnerabilities (Dec 13)
   -----------------------------------------------------------------
   Several security issues were fixed in the kernel.

   http://www.linuxsecurity.com/content/view/156406

* Ubuntu: 1299-1: Linux kernel (EC2) vulnerabilities (Dec 13)
   -----------------------------------------------------------
   Several security issues were fixed in the kernel.

   http://www.linuxsecurity.com/content/view/156405

* Ubuntu: 1298-1: Apache Commons Daemon vulnerability (Dec 12)
   ------------------------------------------------------------
   Apache Commons Daemon would allow unintended access to files over
   thenetwork.

   http://www.linuxsecurity.com/content/view/156401

* Ubuntu: 1296-1: acpid vulnerabilities (Dec 8)
   ---------------------------------------------
   Several security issues were fixed in acpid.

   http://www.linuxsecurity.com/content/view/156386

* Ubuntu: 1294-1: Linux kernel (Oneiric backport) vulnerabilities (Dec 8)
   -----------------------------------------------------------------------
   Several security issues were fixed in the kernel.

   http://www.linuxsecurity.com/content/view/156379

* Ubuntu: 1293-1: Linux kernel vulnerabilities (Dec 8)
   ----------------------------------------------------
   Several security issues were fixed in the kernel.

   http://www.linuxsecurity.com/content/view/156378

* Ubuntu: 1292-1: Linux kernel (Maverick backport) vulnerabilities (Dec 8)
   ------------------------------------------------------------------------
   Several security issues were fixed in the kernel.

   http://www.linuxsecurity.com/content/view/156377

* Ubuntu: 1291-1: Linux kernel vulnerabilities (Dec 8)
   ----------------------------------------------------
   Several security issues were fixed in XXX-APP-XXX.

   http://www.linuxsecurity.com/content/view/156376
------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc.                LinuxSecurity.com

     To unsubscribe email vuln-newsletter-request@xxxxxxxxxxxxxxxxx
         with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------



[Index of Archives]     [Fedora Announce]     [Linux Crypto]     [Kernel]     [Netfilter]     [Bugtraq]     [USB]     [Fedora Security]

  Powered by Linux