Slackware 10.0 / 10.1 / 10.2 / 8.1 / 9.0 / 9.1 / current : Apache httpd redux (SSA:2006-130-01)

New Apache packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix a bug with Apache 1.3.35 and glibc that breaks wildcards in Include directives. It may not occur with all versions of glibc, but it has been verified on -current using an Include within a file...

glibc, nscd security update

CentOS Errata and Security Advisory CESA-2006:0279-5 Merged security bulletin from advisories: https://lists.centos.org/pipermail/centos-announce/2006-April/074965.html Affected packages: glibc glibc-common glibc-devel glibc-profile nscd...

glibc, nscd security update

CentOS Errata and Security Advisory CESA-2006:0208-7 Merged security bulletin from advisories: https://lists.centos.org/pipermail/centos-announce/2006-March/074927.html Affected packages: glibc glibc-common glibc-devel glibc-profile nscd...

crypt_blowfish 1.0

Hi, This is to announce the first mature version of cryptblowfish and the minor security fix that this version adds. cryptblowfish is a public domain implementation of a modern password hashing algorithm based on the Blowfish block cipher, provided via the crypt3 and a reentrant interface. It is...

Memory corruption

The convert-fcrontab program in fcron 3.0.0 might allow local users to gain privileges via a long command-line argument, which causes Linux glibc to report heap memory corruption, possibly because a strcpy in the strdup2 function can "overwrite some data."...

CVE-2006-0539

The convert-fcrontab program in fcron 3.0.0 might allow local users to gain privileges via a long command-line argument, which causes Linux glibc to report heap memory corruption, possibly because a strcpy in the strdup2 function can "overwrite some data."...

CVE-2006-0539

CVE-2006-0539 affects the convert-fcrontab component of the fcron 3.0.0 package. The vulnerability arises when a long command-line argument allows a local user to gain privileges, potentially because Linux glibc heap memory corruption can occur due to a strcpy in the strdup2 function overwriting ...

CVE-2006-0539

The convert-fcrontab program in fcron 3.0.0 might allow local users to gain privileges via a long command-line argument, which causes Linux glibc to report heap memory corruption, possibly because a strcpy in the strdup2 function can "overwrite some data."...

Fedora Core 4 : kernel-2.6.12-1.1456_FC4 (2005-906)

Thu Sep 22 2005 Dave Jones 2.6.12-1.1456FC4 - Disable crash driver on Xen kernels. - Wed Sep 14 2005 Dave Jones 2.6.12-1.1455FC4 - Fixes for CVE-2005-2490 and CVE-2005-2492 - Thu Sep 8 2005 Rik van Riel - upgrade to a newer Xen snapshot - exclude Xen TPM bits, since those conflict with 2.6.12.5 -...

SSA-18706 Security updates for Slackware 8.1

Several security updates are now available for Slackware 8.1, including updated packages for Apache, glibc, modssl, openssh, openssl, and php. %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated and is no longer used after a revamping of the Slackware generator. Disabled on...

Fedora Core 4 : krb5-1.4.1-5 (2005-553)

A double-free flaw was found in the krb5recvauth routine which may be triggered by a remote unauthenticated attacker. Fedora Core 4 contains checks within glibc that detect double-free flaws. Therefore, on Fedora Core 4, successful exploitation of this issue can only lead to a denial of service K...

FreeBSD : mysql -- mysql_real_connect buffer overflow vulnerability (835256b8-46ed-11d9-8ce0-00065be4b5b6)

The mysqlrealconnect function doesn't properly handle DNS replies by copying the IP address into a buffer without any length checking. A specially crafted DNS reply may therefore be used to cause a buffer overflow on affected systems. Note that whether this issue can be exploitable depends on the...

RHEL 3 : glibc (RHSA-2005:256)

Updated glibc packages that address several bugs are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The GNU libc packages known as glibc contain the standard C libraries used by applications. It was discovered that the use of LDDEBUG...

glibc, nptl, nscd security update

CentOS Errata and Security Advisory CESA-2005:256 Updated glibc packages that address several bugs are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The GNU libc packages known as glibc contain the standard C libraries used by...

glibc, nscd security update

CentOS Errata and Security Advisory CESA-2005:261-01 Updated glibc packages that address several bugs are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The GNU libc packages known as glibc contain the standard C libraries used by...

RHEL 2.1 : glibc (RHSA-2005:261)

Updated glibc packages that address several bugs are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The GNU libc packages known as glibc contain the standard C libraries used by applications. Flaws in the catchsegv and glibcbug scrip...

CVE-2004-1453

GNU glibc 2.3.4 before 2.3.4.20040619, 2.3.3 before 2.3.3.20040420, and 2.3.2 before 2.3.2-r10 does not restrict the use of LDDEBUG for a setuid program, which allows local users to gain sensitive information, such as the list of symbols used by the program...

CVE-2004-1453

CVE-2004-1453 affects the GNU C Library (glibc). The issue arises when LD_DEBUG, LD_SHOW_AUXV, and LD_DYNAMIC_WEAK are not restricted for setuid programs, allowing a local attacker to obtain sensitive information (e.g., the program’s symbol list). This is a local information disclosure vulnerabil...

CVE-2004-1453

GNU glibc 2.3.4 before 2.3.4.20040619, 2.3.3 before 2.3.3.20040420, and 2.3.2 before 2.3.2-r10 does not restrict the use of LDDEBUG for a setuid program, which allows local users to gain sensitive information, such as the list of symbols used by the program...

CVE-2004-1453

GNU glibc 2.3.4 before 2.3.4.20040619, 2.3.3 before 2.3.3.20040420, and 2.3.2 before 2.3.2-r10 does not restrict the use of LDDEBUG for a setuid program, which allows local users to gain sensitive information, such as the list of symbols used by the program...