Exploring Research System Operating Systems: May 15, 2022 Highlights

Date: Tue, 14 Oct 2008 16:16:19 -0500
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: Re: Security ERRATA for thunderbird on SL4.x, SL5.x i386/x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 
In-Reply-To: <48E3DDC3.3070601@fnal.gov>

We had a compiling problem on the SL4 x86_64 rpms. The compiling problem has
been fixed and is working now. Both the x86_64 and i386 rpm's have been
rebuilt with the new name to keep consistency.
No code has been changed. The rpm's were only recompiled.

SL 4.x

 SRPMS:
thunderbird-1.5.0.12-16.el4.sl.src.rpm
 i386:
thunderbird-1.5.0.12-16.el4.sl.i386.rpm
 x86_64:
thunderbird-1.5.0.12-16.el4.sl.x86_64.rpm

Troy Dawson

Troy J Dawson wrote:
> Synopsis: Moderate: thunderbird security update
> Issue date: 2008-10-01
> CVE Names: CVE-2008-0016 CVE-2008-3835 CVE-2008-4058
> CVE-2008-4059 CVE-2008-4060 CVE-2008-4061
> CVE-2008-4062 CVE-2008-4065 CVE-2008-4066
> CVE-2008-4067 CVE-2008-4068 CVE-2008-4070
>
>
> Several flaws were found in the processing of malformed HTML mail content.
> An HTML mail message containing malicious content could cause Thunderbird
> to crash or, potentially, execute arbitrary code as the user running
> Thunderbird. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060,
> CVE-2008-4061, CVE-2008-4062)
>
> Several flaws were found in the way malformed HTML mail content was
> displayed. An HTML mail message containing specially crafted content could
> potentially trick a Thunderbird user into surrendering sensitive
> information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068)
>
> A flaw was found in Thunderbird that caused certain characters to be
> stripped from JavaScript code. This flaw could allow malicious JavaScript
> to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066)
>
> Note: JavaScript support is disabled by default in Thunderbird; the above
> issue is not exploitable unless JavaScript is enabled.
>
> A heap based buffer overflow flaw was found in the handling of cancelled
> newsgroup messages. If the user cancels a specially crafted newsgroup
> message it could cause Thunderbird to crash or, potentially, execute
> arbitrary code as the user running Thunderbird. (CVE-2008-4070)
>
> Note2: On SL4 this updates fixes the bug that when a URL link is clicked,
> firefox wouldn't start. Firefox now starts when a URL link is clicked.
>
> SL 4.x
>
> SRPMS:
> thunderbird-1.5.0.12-16.el4.src.rpm
> i386:
> thunderbird-1.5.0.12-16.el4.i386.rpm
> x86_64:
> thunderbird-1.5.0.12-16.el4.x86_64.rpm
>
> SL 5.x
>
> SRPMS:
> thunderbird-2.0.0.17-1.el5.src.rpm
> i386:
> thunderbird-2.0.0.17-1.el5.i386.rpm
> x86_64:
> thunderbird-2.0.0.17-1.el5.x86_64.rpm
>
> -Connie Sieh
> -Troy Dawson
>
>
>

--
__________________________________________________
Troy Dawson This email address is being protected from spambots. You need JavaScript enabled to view it. (630)840-6468
Fermilab ComputingDivision/LCSI/CSI DSS Group
__________________________________________________
Date: Tue, 14 Oct 2008 16:16:21 -0500
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: Re: Security ERRATA for cups on SL3.x, SL4.x, SL5.x i386/x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 
In-Reply-To: <48EFA6F5.4010005@fnal.gov>

We had a compiling problem on the SL4 x86_64 rpms. The compiling problem has
been fixed and is working now. Both the x86_64 and i386 rpm's have been
rebuilt with the new name to keep consistency.
No code has been changed. The rpm's were only recompiled.

SL 4.x

 SRPMS:
cups-1.1.22-0.rc1.9.27.el4_7.1.sl.src.rpm
 i386:
cups-1.1.22-0.rc1.9.27.el4_7.1.sl.i386.rpm
cups-devel-1.1.22-0.rc1.9.27.el4_7.1.sl.i386.rpm
cups-libs-1.1.22-0.rc1.9.27.el4_7.1.sl.i386.rpm
 x86_64:
cups-1.1.22-0.rc1.9.27.el4_7.1.sl.x86_64.rpm
cups-devel-1.1.22-0.rc1.9.27.el4_7.1.sl.x86_64.rpm
cups-libs-1.1.22-0.rc1.9.27.el4_7.1.sl.i386.rpm
cups-libs-1.1.22-0.rc1.9.27.el4_7.1.sl.x86_64.rpm

Troy Dawson

Troy J Dawson wrote:
> Synopsis: Important: cups security update
> Issue date: 2008-10-10
> CVE Names: CVE-2008-3639 CVE-2008-3640 CVE-2008-3641
>
> A buffer overflow flaw was discovered in the SGI image format decoding
> routines used by the CUPS image converting filter "imagetops". An attacker
> could create a malicious SGI image file that could, possibly, execute
> arbitrary code as the "lp" user if the file was printed. (CVE-2008-3639)
>
> An integer overflow flaw leading to a heap buffer overflow was discovered
> in the Text-to-PostScript "texttops" filter. An attacker could create a
> malicious text file that could, possibly, execute arbitrary code as the
> "lp" user if the file was printed. (CVE-2008-3640)
>
> An insufficient buffer bounds checking flaw was discovered in the
> HP-GL/2-to-PostScript "hpgltops" filter. An attacker could create a
> malicious HP-GL/2 file that could, possibly, execute arbitrary code as the
> "lp" user if the file was printed. (CVE-2008-3641)
>
> SL 3.0.x
>
> SRPMS:
> cups-1.1.17-13.3.54.src.rpm
> i386:
> cups-1.1.17-13.3.54.i386.rpm
> cups-devel-1.1.17-13.3.54.i386.rpm
> cups-libs-1.1.17-13.3.54.i386.rpm
> x86_64:
> cups-1.1.17-13.3.54.x86_64.rpm
> cups-devel-1.1.17-13.3.54.x86_64.rpm
> cups-libs-1.1.17-13.3.54.i386.rpm
> cups-libs-1.1.17-13.3.54.x86_64.rpm
>
> SL 4.x
>
> SRPMS:
> cups-1.1.22-0.rc1.9.27.el4_7.1.src.rpm
> i386:
> cups-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm
> cups-devel-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm
> cups-libs-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm
> x86_64:
> cups-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm
> cups-devel-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm
> cups-libs-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm
> cups-libs-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm
>
> SL 5.x
>
> SRPMS:
> cups-1.2.4-11.18.el5_2.2.src.rpm
> i386:
> cups-1.2.4-11.18.el5_2.2.i386.rpm
> cups-devel-1.2.4-11.18.el5_2.2.i386.rpm
> cups-libs-1.2.4-11.18.el5_2.2.i386.rpm
> cups-lpd-1.2.4-11.18.el5_2.2.i386.rpm
> x86_64:
> cups-1.2.4-11.18.el5_2.2.x86_64.rpm
> cups-devel-1.2.4-11.18.el5_2.2.i386.rpm
> cups-devel-1.2.4-11.18.el5_2.2.x86_64.rpm
> cups-libs-1.2.4-11.18.el5_2.2.i386.rpm
> cups-libs-1.2.4-11.18.el5_2.2.x86_64.rpm
> cups-lpd-1.2.4-11.18.el5_2.2.x86_64.rpm
>
> -Connie Sieh
> -Troy Dawson
>
>
>

--
__________________________________________________
Troy Dawson This email address is being protected from spambots. You need JavaScript enabled to view it. (630)840-6468
Fermilab ComputingDivision/LCSI/CSI DSS Group
__________________________________________________
Date: Wed, 15 Oct 2008 14:01:54 -0500
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: FASTBUGS for SL 4.x i386/x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 

The following FASTBUGS have been uploaded to

 i386:
bash-3.0-19.7.el4_7.1.x86_64.rpm
net-snmp-5.1.2-13.el4_7.1.i386.rpm
net-snmp-devel-5.1.2-13.el4_7.1.i386.rpm
net-snmp-libs-5.1.2-13.el4_7.1.i386.rpm
net-snmp-perl-5.1.2-13.el4_7.1.i386.rpm
net-snmp-utils-5.1.2-13.el4_7.1.i386.rpm
net-tools-1.60-40.el4.i386.rpm
nspr-4.7.1-1.el4.i386.rpm
nspr-4.7.1-1.el4.x86_64.rpm
nspr-devel-4.7.1-1.el4.x86_64.rpm
nss-3.12.1.1-1.el4.i386.rpm
nss-3.12.1.1-1.el4.x86_64.rpm
nss-devel-3.12.1.1-1.el4.x86_64.rpm
 x86_64:
bash-3.0-19.7.el4_7.1.x86_64.rpm
net-snmp-5.1.2-13.el4_7.1.x86_64.rpm
net-snmp-devel-5.1.2-13.el4_7.1.x86_64.rpm
net-snmp-libs-5.1.2-13.el4_7.1.i386.rpm
net-snmp-libs-5.1.2-13.el4_7.1.x86_64.rpm
net-snmp-perl-5.1.2-13.el4_7.1.x86_64.rpm
net-snmp-utils-5.1.2-13.el4_7.1.x86_64.rpm
net-tools-1.60-40.el4.x86_64.rpm
nspr-4.7.1-1.el4.i386.rpm
nspr-4.7.1-1.el4.x86_64.rpm
nspr-devel-4.7.1-1.el4.x86_64.rpm
nss-3.12.1.1-1.el4.i386.rpm
nss-3.12.1.1-1.el4.x86_64.rpm
nss-devel-3.12.1.1-1.el4.x86_64.rpm

-Connie Sieh
-Troy Dawson
Date: Wed, 15 Oct 2008 14:03:23 -0500
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: FASTBUGS for SL 5.x i386/x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 

The following FASTBUGS have been uploaded to

 i386:
cdda2wav-2.01-10.7.el5.x86_64.rpm
cdrecord-2.01-10.7.el5.x86_64.rpm
cdrecord-devel-2.01-10.7.el5.i386.rpm
cdrecord-devel-2.01-10.7.el5.x86_64.rpm
freeradius-1.1.3-1.4.el5.x86_64.rpm
freeradius-mysql-1.1.3-1.4.el5.x86_64.rpm
freeradius-postgresql-1.1.3-1.4.el5.x86_64.rpm
freeradius-unixODBC-1.1.3-1.4.el5.x86_64.rpm
inews-2.4.3-8.el5.x86_64.rpm
inn-2.4.3-8.el5.x86_64.rpm
inn-devel-2.4.3-8.el5.i386.rpm
inn-devel-2.4.3-8.el5.x86_64.rpm
libdhcp-1.20-5.el5_2.1.i386.rpm
libdhcp-devel-1.20-5.el5_2.1.i386.rpm
mkisofs-2.01-10.7.el5.x86_64.rpm
OpenIPMI-2.0.6-6.el5_2.2.i386.rpm
OpenIPMI-devel-2.0.6-6.el5_2.2.i386.rpm
OpenIPMI-libs-2.0.6-6.el5_2.2.i386.rpm
OpenIPMI-perl-2.0.6-6.el5_2.2.i386.rpm
OpenIPMI-python-2.0.6-6.el5_2.2.i386.rpm
OpenIPMI-tools-2.0.6-6.el5_2.2.i386.rpm
sabayon-2.12.4-6.el5.x86_64.rpm
sabayon-apply-2.12.4-6.el5.x86_64.rpm
xfig-3.2.4-21.3.el5.x86_64.rpm

 x86_64:
cdda2wav-2.01-10.7.el5.i386.rpm
cdrecord-2.01-10.7.el5.i386.rpm
cdrecord-devel-2.01-10.7.el5.i386.rpm
freeradius-1.1.3-1.4.el5.i386.rpm
freeradius-mysql-1.1.3-1.4.el5.i386.rpm
freeradius-postgresql-1.1.3-1.4.el5.i386.rpm
freeradius-unixODBC-1.1.3-1.4.el5.i386.rpm
inews-2.4.3-8.el5.i386.rpm
inn-2.4.3-8.el5.i386.rpm
inn-devel-2.4.3-8.el5.i386.rpm
libdhcp-1.20-5.el5_2.1.i386.rpm
libdhcp-1.20-5.el5_2.1.x86_64.rpm
libdhcp-devel-1.20-5.el5_2.1.i386.rpm
libdhcp-devel-1.20-5.el5_2.1.x86_64.rpm
mkisofs-2.01-10.7.el5.i386.rpm
OpenIPMI-2.0.6-6.el5_2.2.x86_64.rpm
OpenIPMI-devel-2.0.6-6.el5_2.2.i386.rpm
OpenIPMI-devel-2.0.6-6.el5_2.2.x86_64.rpm
OpenIPMI-libs-2.0.6-6.el5_2.2.i386.rpm
OpenIPMI-libs-2.0.6-6.el5_2.2.x86_64.rpm
OpenIPMI-perl-2.0.6-6.el5_2.2.x86_64.rpm
OpenIPMI-python-2.0.6-6.el5_2.2.x86_64.rpm
OpenIPMI-tools-2.0.6-6.el5_2.2.x86_64.rpm
sabayon-2.12.4-6.el5.i386.rpm
sabayon-apply-2.12.4-6.el5.i386.rpm
xfig-3.2.4-21.3.el5.i386.rpm

-Connie Sieh
-Troy Dawson
Date: Wed, 22 Oct 2008 18:58:19 -0500
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: Security ERRATA for ed on SL3.x, SL4.x, SL5.x i386/x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 

Synopsis:	Moderate: ed security update
Issue date:	2008-10-21
CVE Names:	CVE-2008-3916

A heap-based buffer overflow was discovered in the way ed, the GNU line
editor, processed long file names. An attacker could create a file with
a specially-crafted name that could possibly execute an arbitrary code
when opened in the ed editor. (CVE-2008-3916)

SL 3.0.x

 SRPMS:
ed-0.2-33.30E.1.src.rpm
 i386:
ed-0.2-33.30E.1.i386.rpm
 x86_64:
ed-0.2-33.30E.1.x86_64.rpm

SL 4.x

 SRPMS:
ed-0.2-36.el4_7.1.src.rpm
 i386:
ed-0.2-36.el4_7.1.i386.rpm
 x86_64:
ed-0.2-36.el4_7.1.x86_64.rpm

SL 5.x

 SRPMS:
ed-0.2-39.el5_2.src.rpm
 i386:
ed-0.2-39.el5_2.i386.rpm
 x86_64:
ed-0.2-39.el5_2.x86_64.rpm

-Connie Sieh
-Troy Dawson