+----------------------------------------------------------------------+ | LinuxSecurity.com Linux Advisory Watch | | December 16th, 2011 Volume 12, Number 51 | | | | Editorial Team: Dave Wreski <dwreski@xxxxxxxxxxxxxxxxx> | +----------------------------------------------------------------------+ Thank you for reading the Linux Advisory Watch Security Newsletter. The purpose of this document is to provide our readers with a quick summary of each week's vendor security bulletins and pointers on methods to improve the security posture of your open source system. Vulnerabilities affect nearly every vendor virtually every week, so be sure to read through to find the updates your distributor have made available. Password guessing as an attack vector ------------------------------------- Using password guessing as an attack vector. Over the years we've been taught a strong password must be long and complex to be considered secure. Some of us have taken that notion to heart and always ensure our passwords are strong. But some don't give a second thought to the complexity or length of our password. http://www.linuxsecurity.com/content/view/156412 ------------------------------------------------------------------------ * Debian: 2362-1: acpid: Multiple vulnerabilities (Dec 10) -------------------------------------------------------- Multiple vulnerabilities were found in the acpid, the Advanced Configuration and Power Interface event daemon: CVE-2011-1159 [More...] http://www.linuxsecurity.com/content/view/156392 ------------------------------------------------------------------------ * Mandriva: 2011:189: jasper (Dec 16) ----------------------------------- Multiple vulnerabilities has been discovered and corrected in jasper: Heap-based buffer overflow in the jpc_cox_getcompparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) [More...] http://www.linuxsecurity.com/content/view/156433 * Mandriva: 2011:188: libxml2 (Dec 15) ------------------------------------ Multiple vulnerabilities has been discovered and corrected in libxml2: Off-by-one error in libxml allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via a crafted web site CVE-2011-0216). [More...] http://www.linuxsecurity.com/content/view/156432 * Mandriva: 2011:187: php-pear (Dec 15) ------------------------------------- A vulnerability has been discovered and corrected in php-pear: The installer in PEAR before 1.9.2 allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and [More...] http://www.linuxsecurity.com/content/view/156431 * Mandriva: 2011:186: nfs-utils (Dec 12) -------------------------------------- A vulnerability has been discovered and corrected in nfs-utils: It was found that the mount.nfs tool did not handle certain errors correctly when updating the mtab (mounted file systems table) file. A local attacker could use this flaw to corrupt the mtab file [More...] http://www.linuxsecurity.com/content/view/156403 * Mandriva: 2011:185: libcap (Dec 12) ----------------------------------- A vulnerability has been discovered and corrected in libcap: capsh did not chdir(/) after callling chroot(). Programs could therefore access the current directory outside of the chroot (CVE-2011-4099). [More...] http://www.linuxsecurity.com/content/view/156395 * Mandriva: 2011:184: krb5 (Dec 12) --------------------------------- A vulnerability has been discovered and corrected in krb5: The process_tgs_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.2 allows remote authenticated users to cause a denial of service (NULL pointer [More...] http://www.linuxsecurity.com/content/view/156394 * Mandriva: 2011:183: pidgin (Dec 10) ----------------------------------- Multiple vulnerabilities has been discovered and corrected in pidgin: When receiving various stanzas related to voice and video chat, the XMPP protocol plugin failed to ensure that the incoming message contained all required fields, and would crash if certain fields [More...] http://www.linuxsecurity.com/content/view/156393 * Mandriva: 2011:182: dhcp (Dec 8) -------------------------------- A vulnerability has been discovered and corrected in dhcp: dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) [More...] http://www.linuxsecurity.com/content/view/156380 ------------------------------------------------------------------------ * Red Hat: 2011:1821-01: pidgin: Moderate Advisory (Dec 14) --------------------------------------------------------- Updated pidgin packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate [More...] http://www.linuxsecurity.com/content/view/156424 * Red Hat: 2011:1820-01: pidgin: Moderate Advisory (Dec 14) --------------------------------------------------------- Updated pidgin packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate [More...] http://www.linuxsecurity.com/content/view/156423 * Red Hat: 2011:1819-01: dhcp: Moderate Advisory (Dec 14) ------------------------------------------------------- Updated dhcp packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate [More...] http://www.linuxsecurity.com/content/view/156422 * Red Hat: 2011:1815-01: icu: Moderate Advisory (Dec 13) ------------------------------------------------------ Updated icu packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate [More...] http://www.linuxsecurity.com/content/view/156417 * Red Hat: 2011:1814-01: ipmitool: Moderate Advisory (Dec 13) ----------------------------------------------------------- An updated ipmitool package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate [More...] http://www.linuxsecurity.com/content/view/156416 * Red Hat: 2011:1813-01: kernel: Important Advisory (Dec 13) ---------------------------------------------------------- Updated kernel packages that fix several security issues and various bugs are now available for Red Hat Enterprise Linux 5.6 Extended Update Support. The Red Hat Security Response Team has rated this update as having [More...] http://www.linuxsecurity.com/content/view/156415 * Red Hat: 2011:1811-01: netpbm: Important Advisory (Dec 12) ---------------------------------------------------------- Updated netpbm packages that fix three security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having [More...] http://www.linuxsecurity.com/content/view/156402 * Red Hat: 2011:1807-01: jasper: Important Advisory (Dec 9) --------------------------------------------------------- Updated jasper packages that fix two security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having [More...] http://www.linuxsecurity.com/content/view/156387 * Red Hat: 2011:1801-01: qemu-kvm: Important Advisory (Dec 8) ----------------------------------------------------------- Updated qemu-kvm packages that fix one security issue are now available for Red Hat Enterprise Linux 6.1 Extended Update Support. The Red Hat Security Response Team has rated this update as having [More...] http://www.linuxsecurity.com/content/view/156385 * Red Hat: 2011:1797-01: perl: Moderate Advisory (Dec 8) ------------------------------------------------------ Updated perl packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate [More...] http://www.linuxsecurity.com/content/view/156384 ------------------------------------------------------------------------ * Ubuntu: 1309-1: DHCP vulnerability (Dec 15) ------------------------------------------- DHCP could be made to crash if it received specially crafted networktraffic. http://www.linuxsecurity.com/content/view/156430 * Ubuntu: 1308-1: bzip2 vulnerability (Dec 14) -------------------------------------------- Executables compressed by bzexe could be made to run programs as yourlogin. http://www.linuxsecurity.com/content/view/156425 * Ubuntu: 1307-1: PHP vulnerability (Dec 14) ------------------------------------------ PHP could be made to crash or disclose sensitive information if itprocessed a specially crafted image file. http://www.linuxsecurity.com/content/view/156421 * Ubuntu: 1305-1: Nova vulnerability (Dec 13) ------------------------------------------- Nova could be made to overwrite files. http://www.linuxsecurity.com/content/view/156413 * Ubuntu: 1304-1: Linux kernel (OMAP4) vulnerabilities (Dec 13) ------------------------------------------------------------- Several security issues were fixed in the kernel. http://www.linuxsecurity.com/content/view/156410 * Ubuntu: 1303-1: Linux kernel (Marvell DOVE) vulnerabilities (Dec 13) -------------------------------------------------------------------- Several security issues were fixed in the kernel. http://www.linuxsecurity.com/content/view/156409 * Ubuntu: 1302-1: Linux kernel (OMAP4) vulnerabilities (Dec 13) ------------------------------------------------------------- Several security issues were fixed in the kernel. http://www.linuxsecurity.com/content/view/156408 * Ubuntu: 1301-1: Linux kernel (Natty backport) vulnerabilities (Dec 13) ---------------------------------------------------------------------- Several security issues were fixed in the kernel. http://www.linuxsecurity.com/content/view/156407 * Ubuntu: 1300-1: Linux kernel (FSL-IMX51) vulnerabilities (Dec 13) ----------------------------------------------------------------- Several security issues were fixed in the kernel. http://www.linuxsecurity.com/content/view/156406 * Ubuntu: 1299-1: Linux kernel (EC2) vulnerabilities (Dec 13) ----------------------------------------------------------- Several security issues were fixed in the kernel. http://www.linuxsecurity.com/content/view/156405 * Ubuntu: 1298-1: Apache Commons Daemon vulnerability (Dec 12) ------------------------------------------------------------ Apache Commons Daemon would allow unintended access to files over thenetwork. http://www.linuxsecurity.com/content/view/156401 * Ubuntu: 1296-1: acpid vulnerabilities (Dec 8) --------------------------------------------- Several security issues were fixed in acpid. http://www.linuxsecurity.com/content/view/156386 * Ubuntu: 1294-1: Linux kernel (Oneiric backport) vulnerabilities (Dec 8) ----------------------------------------------------------------------- Several security issues were fixed in the kernel. http://www.linuxsecurity.com/content/view/156379 * Ubuntu: 1293-1: Linux kernel vulnerabilities (Dec 8) ---------------------------------------------------- Several security issues were fixed in the kernel. http://www.linuxsecurity.com/content/view/156378 * Ubuntu: 1292-1: Linux kernel (Maverick backport) vulnerabilities (Dec 8) ------------------------------------------------------------------------ Several security issues were fixed in the kernel. http://www.linuxsecurity.com/content/view/156377 * Ubuntu: 1291-1: Linux kernel vulnerabilities (Dec 8) ---------------------------------------------------- Several security issues were fixed in XXX-APP-XXX. http://www.linuxsecurity.com/content/view/156376 ------------------------------------------------------------------------ Distributed by: Guardian Digital, Inc. LinuxSecurity.com To unsubscribe email vuln-newsletter-request@xxxxxxxxxxxxxxxxx with "unsubscribe" in the subject of the message. ------------------------------------------------------------------------
