Slackware 10.2 / 11.0 / current : libexif (SSA:2007-164-01)

New libexif packages are available for Slackware 10.2, 11.0, and -current to fix a crash and potential security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2007-164-01. The text...

Slackware 11.0 / 12.0 : seamonkey (SSA:2007-205-02)

New SeaMonkey packages are available for Slackware 11.0 and 12.0 to fix possible security issues. While this update has been reported to MozillaZine to 'fix several security issues', details are not yet available. Presumably the issues are similar to the ones that were recently addressed in Firef...

Slackware 11.0 / 12.0 : firefox (SSA:2007-200-01)

New mozilla-firefox packages are available for Slackware 11.0 and 12.0 to fix security issues. Note that Firefox 1.5.x has reached its EOL end of life and is no longer being updated by mozilla.com. Users of Firefox 1.5.x are encouraged to upgrade to Firefox 2.x. Since we use the official Firefox...

Slackware current : thunderbird (SSA:2007-165-01)

A new thunderbird package is available for Slackware -current to fix two possible security issues. This package may also be used on many older versions of Slackware though we're not certain how far back... %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package check...

Slackware 11.0 / 12.0 : thunderbird (SSA:2007-205-01)

New Thunderbird packages are available for Slackware 11.0 and 12.0 to fix two possible security issues. This package may also be used on many older versions of Slackware though we're not certain how far back... %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Slackware 11.0 / current : gd (SSA:2007-178-01)

GD is an open source code library for the dynamic creation of images. New gd packages are available for Slackware 11.0, and -current to fix possible security issues. Please see: http://www.libgd.org/ReleaseNote020035 for complete release notes. 'Upgrading is strongly recommended.' %NASLMINLEVEL...

[slackware-security] bind

New bind packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, and 12.0 to fix security issues. The first issue which allows remote attackers to make recursive queries only affects Slackware 12.0. More details about this issue may be found in the Common Vulnerabilities and...

[slackware-security] seamonkey

New SeaMonkey packages are available for Slackware 11.0 and 12.0 to fix possible security issues. While this update has been reported to MozillaZine to "fix several security issues", details are not yet available. Presumably the issues are similar to the ones that were recently addressed in Firef...

[slackware-security] thunderbird

New Thunderbird packages are available for Slackware 11.0 and 12.0 to fix two possible security issues. This package may also be used on many older versions of Slackware though we're not certain how far back... More details about the issues may be found here:...

[slackware-security] firefox

New mozilla-firefox packages are available for Slackware 11.0 and 12.0 to fix security issues. Note that Firefox 1.5.x has reached its EOL end of life and is no longer being updated by mozilla.com. Users of Firefox 1.5.x are encouraged to upgrade to Firefox 2.x. Since we use the official Firefox...

PHP .Htaccess Safe_Mode和Open_Basedir限制绕过漏洞

BUGTRAQ ID: 24661 CVE ID:CVE-2007-3378 CNCVE ID:CNCVE-20073378 PHP是一款广泛使用的WEB开发脚本语言。 PHP存在'safemode'和'openbasedir'限制绕过问题，远程攻击者可以利用漏洞写文件到未授权系统位置。 当使用PHP作为Apache模块，可以通过在.htaccess文件中使用指示进行培植二十时亿兆时毫...

[slackware-security] gd

GD is an open source code library for the dynamic creation of images. New gd packages are available for Slackware 11.0, and -current to fix possible security issues. Please see: http://www.libgd.org/ReleaseNote020035 for complete release notes. "Upgrading is strongly recommended." Here are the...

[slackware-security] thunderbird

A new thunderbird package is available for Slackware -current to fix two possible security issues. This package may also be used on many older versions of Slackware though we're not certain how far back... More details about the issues may be found here:...

[slackware-security] libexif

New libexif packages are available for Slackware 10.2, 11.0, and -current to fix a crash and potential security issue. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2007-4168 Here are the details from the Slackware...

GNU Locate旧格式locate数据库本地缓冲区溢出漏洞

GNU locate是可以在文件数据库里搜索那些匹配用户提供的文件名的程序。 GNU locate读取旧格式locate数据库的文件名存在缓冲区溢出，本地攻击者可以利用漏洞以应用程序权限执行任意指令。 当GNU locate读取旧格式locate数据库的文件名时会拷贝到分配在堆上的固定缓冲区中，文件名超过1026字节可导致缓冲区溢出，溢出的数据可以由用户选择来控制建立本地系统上的文件名。 GNU findutils 4.2.30 + Slackware Linux 8.0 + Slackware Linux 7.1 GNU findutils 4.2.29 + Slackware Lin...

PHP EXT/Session HTTP应答头注入漏洞

PHP是一款广泛使用的WEB开发脚本语言。 PHP的ext/session在置于会话COOKIE前没有URL编码会话ID，远程攻击者可以利用漏洞可以对会话COOKIE进行注入攻击。 当PHP' ext/session调用sessionstart，会在部分情况下发送新会话COOKIE，这些情况如下： - session id嵌入到PATHINFO - session id重生成 - session id通过sessionid设置 - sessionstart多次调用...

Slackware 10.2 / 11.0 / current : firefox-seamonkey-thunderbird (SSA:2007-152-02)

New mozilla-firefox and seamonkey packages are available for Slackware 10.2, 11.0, and -current to fix security issues. New thunderbird packages are are available for Slackware 10.2 and 11.0 to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Slackware 10.2 / 11.0 / current : php5 (SSA:2007-152-01)

New php5 packages are available for Slackware 10.2, 11.0, and -current to fix security issues. PHP5 was considered a test package in Slackware 10.2, and an 'extra' package in Slackware 11.0. If you are currently running PHP4 you may wish to stick with that, as upgrading to PHP5 will probably...

[slackware-security] firefox-seamonkey-thunderbird

New mozilla-firefox and seamonkey packages are available for Slackware 10.2, 11.0, and -current to fix security issues. New thunderbird packages are are available for Slackware 10.2 and 11.0 to fix security issues. More details about this issue may be found at these links:...

[slackware-security] php5

New php5 packages are available for Slackware 10.2, 11.0, and -current to fix security issues. PHP5 was considered a test package in Slackware 10.2, and an "extra" package in Slackware 11.0. If you are currently running PHP4 you may wish to stick with that, as upgrading to PHP5 will probably...