Network daemons not managed by the package system

Some daemon processes on the remote host are associated with programs that have been installed manually. System administration best practice dictates that an operating system's native package management tools be used to manage software installation, updates, and removal whenever possible. TRUSTED...

Portage: Information disclosure

Background Portage is the default Gentoo package management system. Description Mike Frysinger reported that the "etc-update" utility uses temporary files with the standard umask, which results in the files being world-readable when merging configuration files in a default setup. Impact A local...

[SECURITY] Fedora Core 6 Update: rpm-4.4.2.1-1.fc6

The RPM Package Manager RPM is a powerful command line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages. Each software package consists of an archive of files along with information about the package like its version, a...

[SECURITY] [DSA 953-1] New flyspray packages fix cross-site scripting

-------------------------------------------------------------------------- Debian Security Advisory DSA 953-1 [email protected] http://www.debian.org/security/ Martin Schulze January 24th, 2006 http://www.debian.org/security/faq -...

Mozilla/Firefox default installation file permission flaw

The remote host is using Mozilla and/or Firefox, an alternative web browser. The remote version of this software is prone to an improper file permission setting. This flaw only exists if the browser is installed by the Mozilla Foundation package management, thus this alert might be a false...

Gentoo Linux sandbox portage package management system utility symbolic links problem

Race conditions during temporary files creation...

sandbox: Insecure temporary file handling

Background sandbox is a Gentoo Linux utility used by the Portage package management system. Description The Gentoo Linux Security Audit Team discovered that the sandbox utility was vulnerable to multiple TOCTOU Time of Check, Time of Use file creation race conditions. Impact Local users may be ab...

[SECURITY] [DSA 498-1] New libpng packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 498-1 [email protected] http://www.debian.org/security/ Martin Schulze April 30th, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 282-1] New glibc packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 282-1 [email protected] http://www.debian.org/security/ Martin Schulze April 9th, 2003 http://www.debian.org/security/faq -...