[slackware-security] gnutls

New gnutls packages are available for Slackware 14.0, and -current to fix a security issue. Here are the details from the Slackware 14.0 ChangeLog: patches/packages/gnutls-3.0.26-i486-1slack14.0.txz: Upgraded. This update prevents a side-channel attack which may allow remote attackers to conduct...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 13.37, 14.0, and -current to fix security issues. Here are the details from the Slackware 14.0 ChangeLog: patches/packages/mozilla-firefox-17.0.8esr-i486-1slack14.0.txz: Upgraded. This release contains security fixes and improvements. For...

Oracle Linux 6 : rsync (ELSA-2011-0390)

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2011-0390 advisory. 3.0.6-5.1 - Add upstream patch to fix CVE-2011-1097 - Incremental file-list corruption due to temporary fileextracnt increments Resolves: 684932 Tenable has...

mozilla-thunderbird x86_64 packages

New mozilla-thunderbird packages are available for Slackware64 13.37 and 14.0. These were accidentally omitted from the last upload. Here are the details from the Slackware64 14.0 ChangeLog: patches/packages/mozilla-thunderbird-17.0.6-x8664-1slack14.0.txz: Upgraded. Here's the package that was...

seamonkey

New seamonkey packages are available for Slackware 13.37, 14.0, and -current to fix security issues. Here are the details from the Slackware 14.0 ChangeLog: patches/packages/seamonkey-2.17-i486-1slack14.0.txz: Upgraded. This update contains security fixes and improvements. For more information,...

subversion

New subversion packages are available for Slackware 13.0, 13.1, 13.37, 14.0, and -current to fix security issues. Here are the details from the Slackware 14.0 ChangeLog: patches/packages/subversion-1.7.9-i486-1slack14.0.txz: Upgraded. This update fixes some denial of service bugs: moddavsvn...

mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 13.37, 14.0, and -current to fix security issues. Here are the details from the Slackware 14.0 ChangeLog: patches/packages/mozilla-thunderbird-17.0.5-i486-1slack14.0.txz: Upgraded. This release contains security fixes and improvements...

mozilla-thunderbird

New mozilla-thunderbird packages are available for Slackware 13.37, 14.0, and -current to fix a security issue. Here are the details from the Slackware 14.0 ChangeLog: patches/packages/mozilla-thunderbird-17.0.4esr-i486-1slack14.0.txz: Upgraded. This release contains security fixes and...

CVE-2012-2252

Incomplete blacklist vulnerability in rssh before 2.3.4, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via the --rsh command line option...

Design/Logic Flaw

Incomplete blacklist vulnerability in rssh before 2.3.4, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via the --rsh command line option...

CVE-2012-2252

Incomplete blacklist vulnerability in rssh before 2.3.4, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via the --rsh command line option...

CVE-2012-2251

rssh 2.3.2, as used by Debian, Fedora, and others, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via a 1 "-e" or 2 "--" command line option...

CVE-2012-2251

rssh 2.3.2, as used by Debian, Fedora, and others, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via a 1 "-e" or 2 "--" command line option...

UBUNTU-CVE-2012-2251

rssh 2.3.2, as used by Debian, Fedora, and others, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via a 1 "-e" or 2 "--" command line option...

CVE-2012-2251

Removed by vendor...

CVE-2012-2251

rssh 2.3.2, as used by Debian, Fedora, and others, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via a 1 "-e" or 2 "--" command line option...

CVE-2012-2251

CVE-2012-2251 affects rssh 2.3.2 (used by Debian, Fedora and others) where, with rsync enabled, local users can bypass restricted shell via the "-e" or "--" options. The issue, per sources, yields partial confidentiality/integrity/availability impact. Fedora addressed this with rssh 2.3.4-1.fc18 ...

CVE-2012-2252

Removed by vendor...

[slackware-security] libssh

New libssh packages are available for Slackware 14.0, and -current to fix security issues. Here are the details from the Slackware 14.0 ChangeLog: patches/packages/libssh-0.5.3-i486-1slack14.0.txz: Upgraded. This release fixes several security bugs. For more information, see:...

Re: rssh security announcement

All, Today I released rssh-2.3.4, which fixes an old issue, and a new issue: On Tue, May 08, 2012 at 01:14:26PM -0500, Derek Martin wrote: rssh is a shell for restricting SSH access to a machine to only scp, sftp, or a small set of similar applications. http://www.pizzashack.org/rssh/ Henrik...