[CLA-2005:945] Conectiva Security Announcement - kernel

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- CONECTIVA LINUX SECURITY ANNOUNCEMENT - -------------------------------------------------------------------------- PACKAGE : kernel SUMMARY : Kernel fixes DATE : 2005-03-31...

Fedora Core 3 : postgresql-7.4.7-1.FC3.2 (2005-124)

Mon Feb 07 2005 Tom Lane 7.4.7-1.FC3.2 - Put regression tests under /usr/lib64 on 64-bit archs, since .so files are not architecture-independent. - Mon Feb 07 2005 Tom Lane 7.4.7-1.FC3.1 - Update to PostgreSQL 7.4.7 fixes CVE-2005-0227 and other issues. - Update to PyGreSQL 3.6.1. - Add...

SUSE-SA:2005:003: kernel

The remote host is missing the patch for the advisory SUSE-SA:2005:003 kernel. Several exploitable security problems were identified and fixed in the Linux kernel, the core of every SUSE Linux product. - Due to missing locking in the sysuselib system call a local attacker can gain root access. Th...

yamt -- buffer overflow and directory traversal issues

Stanislav Brabec discovered errors in yamt's path name handling that lead to buffer overflows and directory traversal issues. When processing a file with a maliciously crafted ID3 tag, yamt might overwrite arbitrary files or possibly execute arbitrary code. The SuSE package ChangeLog contains:...

DSA-642-1 gallery - several

Bulletin has no description...

Fedora Core 3 : kernel-2.6.10-1.737_FC3 (2005-013)

This update rebases the kernel to match the upstream 2.6.10 release, and adds a number of security fixes by means of adding the latest -ac patch. CVE-2004-1235 Paul Starzetz from isec.pl found a problem in the binary format loaders uselib function that could lead to potential priveledge escalatio...

Fedora Core 2 : kernel-2.6.10-1.8_FC2 (2005-014)

This update rebases the kernel to match the upstream 2.6.10 release, and adds a number of security fixes by means of adding the latest -ac patch. CVE-2004-1235 Paul Starzetz from isec.pl found a problem in the binary format loaders uselib function that could lead to potential priveledge escalatio...

Fedora Core 3 : kernel-2.6.9-1.724_FC3 (2004-582)

A large change over previous kernels has been made. The 4G:4G memory split patch has been dropped, and Fedora kernels now revert back to the upstream 3G:1G kernel/userspace split. A number of security fixes are present in this update. CVE-2004-1016: Paul Starzetz discovered a buffer overflow...

Fedora Core 2 : kernel-2.6.9-1.11_FC2 (2004-581)

A large change over previous kernels has been made. The 4G:4G memory split patch has been dropped, and Fedora kernels now revert back to the upstream 3G:1G kernel/userspace split. A number of security fixes are present in this update. CVE-2004-1016: Paul Starzetz discovered a buffer overflow...

Fedora Core 3 : php-4.3.10-3.2 (2004-568)

Tue Dec 21 2004 Joe Orton 4.3.10-3.2 - fix umask patch 143286 - Wed Dec 15 2004 Joe Orton 4.3.10-3.1 - update to 4.3.10, including security fixes 141135 : - unserializer integer overflows, CVE-2004-1019 - exif image parsing overflow, CVE-2004-1065 Note that Tenable Network Security has extracted...

Moderate: Red Hat Security Advisory: apache, mod_ssl security update for Stronghold

Updated versions of cross-platform Stronghold that fix security issues in modssl and the Apache HTTP Server are now available. Stronghold 4 contains a number of open source technologies, including modssl and the Apache HTTP Server. A buffer overflow in the gettag function in modinclude for Apache...

[slackware-security] apache, mod_ssl, php

New apache and modssl packages are available for Slackware 8.1, 9.0, 9.1, 10.0, and -current to fix security issues. Apache has been upgraded to version 1.3.32 which fixes a heap-based buffer overflow in modproxy. modssl was upgraded from version modssl-2.8.19-1.3.31 to version 2.8.21-1.3.32 whic...

GLSA-200410-22 : MySQL: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200410-22 MySQL: Multiple vulnerabilities The following vulnerabilities were found and fixed in MySQL: Oleksandr Byelkin found that ALTER TABLE ... RENAME checks CREATE/INSERT rights of the old table instead of the new one...

Microsoft Windows Kernel Local Denial of Service Vulnerability

Description The Microsoft Windows kernel is prone to a denial-of-service vulnerability that can allow a local attacker to cause a vulnerable computer to stop responding and to restart. This issue does not pose a privilege-escalation threat. Technologies Affected Avaya DefinityOne Media Servers...

Debian DSA-178-1 : heimdal - remote command execution

The SuSE Security Team has reviewed critical parts of the Heimdal package such as the kadmind and kdc server. While doing so several potential buffer overflows and other bugs have been uncovered and fixed. Remote attackers can probably gain remote root access on systems without fixes. Since these...

Debian DSA-423-1 : linux-kernel-2.4.17-ia64 - several vulnerabilities

The IA-64 maintainers fixed several security related bugs in the Linux kernel 2.4.17 used for the IA-64 architecture, mostly by backporting fixes from 2.4.18. The corrections are listed below with the identification from the Common Vulnerabilities and Exposures CVE project : - CAN-2003-0001 :...

Debian DSA-269-1 : heimdal - Cryptographic weakness

A cryptographic weakness in version 4 of the Kerberos protocol allows an attacker to use a chosen-plaintext attack to impersonate any principal in a realm. Additional cryptographic weaknesses in the krb4 implementation permit the use of cut-and-paste attacks to fabricate krb4 tickets for...

Fedora Core 2 : httpd-2.0.51-2.7 (2004-313)

Tue Sep 21 2004 Joe Orton 2.0.51-2.7 - aprgetlinecore fix from Rici Lake - Tue Sep 21 2004 Joe Orton 2.0.51-2.6 - fix 2.0.51 regression in Satisfy merging CVE-2004-0811 - Thu Sep 16 2004 Joe Orton 2.0.51-2.5 - modssl: prevent SIGHUP-triggers-SIGSEGV after upgrade from 2.0.50 - revert...

[slackware-security] Mozilla

New Mozilla 1.7.3 packages are available for Slackware 10.0 and -current to fix security issues. Here are the details from the Slackware 10.0 ChangeLog: patches/packages/mozilla-1.7.3-i486-1.tgz: Upgraded to mozilla-1.7.3. The Mozilla page says this fixes some "minor security holes". It also brea...

RHEL 3 : httpd (RHSA-2004:463)

Updated httpd packages that include fixes for security issues are now available. The Apache HTTP server is a powerful, full-featured, efficient, and freely-available Web server. Four issues have been discovered affecting releases of the Apache HTTP 2.0 Server, up to and including version 2.0.50 :...