Low: Red Hat Bug Fix Advisory: conga bug fix update

Updated conga packages that provide critical bug fixes are now available. The Conga package is a web-based administration tool for remote cluster and storage management. This erratum applies the following bug fixes: - The borrowed Zope packages used by Conga have been patched to eliminate a...

CentOS 3 / 4 : SquirrelMail (CESA-2005:595)

An updated squirrelmail package that fixes two security issues is now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Updated 04 Aug 2005 The previous SquirrelMail package released with this errata contained a bug which rendered the...

CentOS 3 / 4 : sudo (CESA-2005:535)

An updated sudo package is available that fixes a race condition in sudo's pathname validation. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The sudo superuser do utility allows system administrators to give certain users the ability to run...

CentOS 3 / 4 : cpio (CESA-2005:378)

An updated cpio package that fixes multiple issues is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. GNU cpio copies files into or out of a cpio or tar archive. A race condition bug was found in cpio. It is possible for a local...

CentOS 3 / 4 : mozilla (CESA-2006:0329)

Updated mozilla packages that fix several security bugs are now available. This update has been rated as having critical security impact by the Red Hat Security Response Team. Updated 24 Apr 2006 The erratum text has been updated to include the details of additional issues that were fixed by thes...

FreeBSD : bind -- buffer overrun vulnerability (947f4b14-1c89-11da-bc01-000e0c2e438a)

An ISC advisory reports a buffer overrun vulnerability within bind. The vulnerability could result in a Denial of Service. A workaround is available by disabling recursion and glue fetching. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

FreeBSD : unzip -- permission race vulnerability (9750cf22-216d-11da-bc01-000e0c2e438a)

Imran Ghory reports a vulnerability within unzip. The vulnerability is caused by a race condition between extracting an archive and changing the permissions of the extracted files. This would give an attacker enough time to remove a file and hardlink it to another file owned by the user running...

DSA-1011-1 kernel-patch-server, util-vserver - missing attribute support

Bulletin has no description...

Mandrake Linux Security Advisory : kdegraphics (MDKSA-2006:054)

Marcelo Ricardo Leitner discovered the official published kpdf patches for several previous xpdf vulnerabilities were lacking some hunks published by upstream xpdf. As a result, kpdf is still vulnerable to certain carefully crafted pdf files. Although previous updates captured most of these...

Moderate: Red Hat Security Advisory: RHAPS security and enhancement update

Red Hat Application Server Release 2 Update 1 is now available. This update contains an upgrade of several RHAPS components to newer releases, including JOnAS 4.6.3, Tomcat 5.5.12 and Struts 1.2.8. This update has been rated as having moderate security impact by the Red Hat Security Response Team...

Mandrake Linux Security Advisory : php (MDKSA-2006:028)

Multiple response splitting vulnerabilities in PHP allow remote attackers to inject arbitrary HTTP headers via unknown attack vectors, possibly involving a crafted Set-Cookie header, related to the 1 session extension aka ext/session and the 2 header function. CVE-2006-0207 Multiple cross-site...

Ubuntu 4.10 / 5.04 / 5.10 : courier vulnerability (USN-226-1)

Patrick Cheong Shu Yang discovered a flaw in the user account handling of courier-authdaemon. After successful authorization, the Courier mail server granted access to deactivated accounts. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu...

Mandrake Linux Security Advisory : webmin (MDKSA-2005:223)

Jack Louis discovered a format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled. This can allow remote attackers to cause a denial of service crash or memory consumption and possibly execute arbitrary code via format...

[Full-disclosure] [SECURITY] [DSA 930-1] New smstools packages fix format string vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 930-1 [email protected] http://www.debian.org/security/ Steve Kemp Jan 9, 2006 http://www.debian.org/security/faq -...

pam security update

CentOS Errata and Security Advisory CESA-2005:805 An updated pam package that fixes a security weakness is now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Security Response Team. PAM Pluggable Authentication Modules is a system...

[SECURITY] [DSA 873-1] New net-snmp packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 873-1 [email protected] http://www.debian.org/security/ Martin Schulze October 26th, 2005 http://www.debian.org/security/faq -...

Mandrake Linux Security Advisory : xine-lib (MDKSA-2005:180)

When playing an Audio CD, a xine-lib based media application contacts a CDDB server to retrieve metadata like the title and artist's name. During processing of this data, a response from the server, which is located in memory on the stack, is passed to the fprintf function as a format string. An...

Mandrake Linux Security Advisory : proftpd (MDKSA-2005:140)

Two format string vulnerabilities were discovered in ProFTPD. The first exists when displaying a shutdown message containin the name of the current directory. This could be exploited by a user who creates a directory containing format specifiers and sets the directory as the current directory whe...

Low: Red Hat Bug Fix Advisory: gdb bug fix update

An updated gdb package that fixes various bugs is now available. GDB, the GNU debugger, allows debugging of programs written in C, C++, and other languages, by executing them in a controlled fashion, and then printing their data. This updated package addresses the following issues: - GDB on ia64...

netpbm security update

CentOS Errata and Security Advisory CESA-2005:743 Updated netpbm packages that fix a security issue are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The netpbm package contains a library of functions that support programs for...