Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found 11 articles for you...
200
security advisorybuffer overflowenscriptScientific Linux: Moderate Enscripting Update CVE-2008-3863 Buffer Overflow
Moderate: enscript security update. Date: Tue, 16 Dec 2008 13:36:23 -0600 Reply-To: Troy Dawson Sender: Security Errata for Scientific Linux From: Troy Dawson Subject: Security ERRATA for enscript on SL3.x, SL4.x, SL5.x i386/x86_64 Comments: To: "
Dec 16, 2008
Scientific Linux
98
security advisorysecurity updateRed HatRed Hat: RHSA-2008:1021-02 Moderate: Enscript Buffer Overflow
An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team.. ==================================================================== Red Hat Security Advisory Synopsis: Moderate: enscript security update Advisory ID: RHSA-2008:1021-02 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2008:1021.html Issue date: 2008-12-15 CVE Names: CVE-2008-3863 CVE-2008-4306 CVE-2008-5078 ==================================================================== 1. Summary: An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Description: GNU enscript converts ASCII files to PostScript(R) language files and spools the generated output to a specified printer or saves it to a file. Enscript can be extended to handle different output media and includes options for customizing printouts. Several buffer overflow flaws were found inGNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the "special escapes" option (-e or --escapes) enabled. (CVE-2008-3863, CVE-2008-4306, CVE-2008-5078) All users of enscript should upgrade to these updated packages, which contain backported patches to correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at 5. Package List: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 : Source: i386: enscript-1.6.1-16.7.i386.rpm ia64: enscript-1.6.1-16.7.ia64.rpm Red Hat Linux Advanced Workstation 2.1: Source: ia64: enscript-1.6.1-16.7.ia64.rpm Red Hat Enterprise Linux ES version 2.1: Source: i386: enscript-1.6.1-16.7.i386.rpm Red Hat Enterprise Linux WS version 2.1: Source: i386: enscript-1.6.1-16.7.i386.rpm Red Hat Enterprise Linux AS version 3: Source: i386: enscript-1.6.1-24.7.i386.rpm enscript-debuginfo-1.6.1-24.7.i386.rpm ia64: enscript-1.6.1-24.7.ia64.rpm enscript-debuginfo-1.6.1-24.7.ia64.rpm ppc: enscript-1.6.1-24.7.ppc.rpm enscript-debuginfo-1.6.1-24.7.ppc.rpm s390: enscript-1.6.1-24.7.s390.rpm enscript-debuginfo-1.6.1-24.7.s390.rpm s390x: enscript-1.6.1-24.7.s390x.rpm enscript-debuginfo-1.6.1-24.7.s390x.rpm x86_64: enscript-1.6.1-24.7.x86_64.rpm enscript-debuginfo-1.6.1-24.7.x86_64.rpm Red Hat Desktop version 3: Source: i386: enscript-1.6.1-24.7.i386.rpm enscript-debuginfo-1.6.1-24.7.i386.rpm x86_64: enscript-1.6.1-24.7.x86_64.rpm enscript-debuginfo-1.6.1-24.7.x86_64.rpm Red Hat Enterprise Linux ES version3: Source: i386: enscript-1.6.1-24.7.i386.rpm enscript-debuginfo-1.6.1-24.7.i386.rpm ia64: enscript-1.6.1-24.7.ia64.rpm enscript-debuginfo-1.6.1-24.7.ia64.rpm x86_64: enscript-1.6.1-24.7.x86_64.rpm enscript-debuginfo-1.6.1-24.7.x86_64.rpm Red Hat Enterprise Linux WS version 3: Source: i386: enscript-1.6.1-24.7.i386.rpm enscript-debuginfo-1.6.1-24.7.i386.rpm ia64: enscript-1.6.1-24.7.ia64.rpm enscript-debuginfo-1.6.1-24.7.ia64.rpm x86_64: enscript-1.6.1-24.7.x86_64.rpm enscript-debuginfo-1.6.1-24.7.x86_64.rpm Red Hat Enterprise Linux AS version 4: Source: i386: enscript-1.6.1-33.el4_7.1.i386.rpm enscript-debuginfo-1.6.1-33.el4_7.1.i386.rpm ia64: enscript-1.6.1-33.el4_7.1.ia64.rpm enscript-debuginfo-1.6.1-33.el4_7.1.ia64.rpm ppc: enscript-1.6.1-33.el4_7.1.ppc.rpm enscript-debuginfo-1.6.1-33.el4_7.1.ppc.rpm s390: enscript-1.6.1-33.el4_7.1.s390.rpm enscript-debuginfo-1.6.1-33.el4_7.1.s390.rpm s390x: enscript-1.6.1-33.el4_7.1.s390x.rpm enscript-debuginfo-1.6.1-33.el4_7.1.s390x.rpm x86_64: enscript-1.6.1-33.el4_7.1.x86_64.rpm enscript-debuginfo-1.6.1-33.el4_7.1.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: Source: i386: enscript-1.6.1-33.el4_7.1.i386.rpm enscript-debuginfo-1.6.1-33.el4_7.1.i386.rpm x86_64: enscript-1.6.1-33.el4_7.1.x86_64.rpm enscript-debuginfo-1.6.1-33.el4_7.1.x86_64.rpm Red Hat Enterprise Linux ES version 4: Source: i386: enscript-1.6.1-33.el4_7.1.i386.rpm enscript-debuginfo-1.6.1-33.el4_7.1.i386.rpm ia64: enscript-1.6.1-33.el4_7.1.ia64.rpm enscript-debuginfo-1.6.1-33.el4_7.1.ia64.rpm x86_64: enscript-1.6.1-33.el4_7.1.x86_64.rpm enscript-debuginfo-1.6.1-33.el4_7.1.x86_64.rpm Red Hat Enterprise Linux WS version4: Source: i386: enscript-1.6.1-33.el4_7.1.i386.rpm enscript-debuginfo-1.6.1-33.el4_7.1.i386.rpm ia64: enscript-1.6.1-33.el4_7.1.ia64.rpm enscript-debuginfo-1.6.1-33.el4_7.1.ia64.rpm x86_64: enscript-1.6.1-33.el4_7.1.x86_64.rpm enscript-debuginfo-1.6.1-33.el4_7.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 6. References: https://www.cve.org/CVERecord?id=CVE-2008-3863 https://www.cve.org/CVERecord?id=CVE-2008-4306 https://www.cve.org/CVERecord?id=CVE-2008-5078 https://access.redhat.com/security/updates/classification#moderate 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. . This notice pertains to a significant software vulnerability notification for Ubuntu Linux releases 16.04, 18.04, and 20.04.. enscript Security Update, Red Hat Advisory, Security Patch. . LinuxSecurity.com Team
Dec 15, 2008
Red Hat
98
security advisorybuffer overflowsecurity fixSUSE Linux: SLE-2018:0012-01 Medium: Enscript Memory Leak
An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.. ==================================================================== Red Hat Security Advisory Synopsis: Moderate: enscript security update Advisory ID: RHSA-2008:1016-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2008:1016.html Issue date: 2008-12-15 CVE Names: CVE-2008-3863 CVE-2008-4306 ==================================================================== 1. Summary: An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: GNU enscript converts ASCII files to PostScript(R) language files and spools the generated output to a specified printer or saves it to a file. Enscript can be extended to handle different output media and includes options for customizing printouts. Two buffer overflow flaws were found in GNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the "special escapes" option (-e or --escapes) enabled. (CVE-2008-3863, CVE-2008-4306) All users of enscript should upgrade to these updated packages, which contain backported patches to correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update areavailable at 5. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: i386: enscript-1.6.4-4.1.1.el5_2.i386.rpm enscript-debuginfo-1.6.4-4.1.1.el5_2.i386.rpm x86_64: enscript-1.6.4-4.1.1.el5_2.x86_64.rpm enscript-debuginfo-1.6.4-4.1.1.el5_2.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: i386: enscript-1.6.4-4.1.1.el5_2.i386.rpm enscript-debuginfo-1.6.4-4.1.1.el5_2.i386.rpm ia64: enscript-1.6.4-4.1.1.el5_2.ia64.rpm enscript-debuginfo-1.6.4-4.1.1.el5_2.ia64.rpm ppc: enscript-1.6.4-4.1.1.el5_2.ppc.rpm enscript-debuginfo-1.6.4-4.1.1.el5_2.ppc.rpm s390x: enscript-1.6.4-4.1.1.el5_2.s390x.rpm enscript-debuginfo-1.6.4-4.1.1.el5_2.s390x.rpm x86_64: enscript-1.6.4-4.1.1.el5_2.x86_64.rpm enscript-debuginfo-1.6.4-4.1.1.el5_2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 6. References: https://www.cve.org/CVERecord?id=CVE-2008-3863 https://www.cve.org/CVERecord?id=CVE-2008-4306 https://access.redhat.com/security/updates/classification#moderate 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. . Ubuntu releases a patch for vim tackling critical vulnerabilities. Users urged to enhance system protection.. RedHat, Enscript, Security Update, Linux Update, Red Hat Enterprise. . LinuxSecurity.com Team
Dec 15, 2008
Red Hat
91
security advisorygentoobuffer overflowGentoo: GLSA-200812-02 Normal: Enscrip Arbitrary Code Execution Threat
Two buffer overflows in enscript might lead to the execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200812-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: enscript: User-assisted execution of arbitrary code Date: December 02, 2008 Bugs: #243228 ID: 200812-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Two buffer overflows in enscript might lead to the execution of arbitrary code. Background ========= enscript is a powerful ASCII to PostScript file converter. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-text/enscript < 1.6.4-r4 > = 1.6.4-r4 Description ========== Two stack-based buffer overflows in the read_special_escape() function in src/psgen.c have been reported. Ulf Harnhammar of Secunia Research discovered a vulnerability related to the "setfilename" command (CVE-2008-3863), and Kees Cook of Ubuntu discovered a vulnerability related to the "font" escape sequence (CVE-2008-4306). Impact ===== An attacker could entice a user or automated system to process specially crafted input with the special escapes processing enabled using the "-e" option, possibly resulting in the execution of arbitrary code. Workaround ========= There is no known workaround at this time. Resolution ========= All enscript users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-text/enscript-1.6.4-r4" References ========= [ 1 ] CVE-2008-3863 https://www.cve.org/CVERecord?id=CVE-2008-3863 [ 2 ] CVE-2008-4306 https://www.cve.org/CVERecord?id=CVE-2008-4306 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200812-02 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Dec 02, 2008
Gentoo
87
security advisorybuffer overflowcriticalDebian 4.0 DSA-1670-2 Urgent: Enscript Memory Corruption Issue
Ulf Harnhammer discovered that a buffer overflow may lead to the execution of arbitrary code.. - ------------------------------------------------------------------------Debian Security Advisory DSA-1670-1
Nov 24, 2008
•Important
Debian
100
security advisoryapacheenscriptSUSE 2008:024 Minor Fixes: Apache, Yelp, Enscript Issues Overview
To avoid flooding mailing lists with SUSE Security Announcements for minor To avoid flooding mailing lists with SUSE Security Announcements for minor issues, SUSE Security releases weekly summary reports for the low profile issues, SUSE Security releases weekly summary reports for the low profile vulnerability fixes. The SUSE Security Summary Reports do not list or download URLs like the SUSE Secu [More...]. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Summary Report Announcement ID: SUSE-SR:2008:024 Date: Fri, 07 Nov 2008 14:00:00 +0000 Cross-References: CVE-2007-6420, CVE-2008-1678, CVE-2008-2939, CVE-2008-3533, CVE-2008-3863 Content of this advisory: 1) Solved Security Vulnerabilities: - yelp - apache2 - enscript - libcdaudio 2) Pending Vulnerabilities, Solutions, and Work-Arounds: none 3) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Solved Security Vulnerabilities To avoid flooding mailing lists with SUSE Security Announcements for minor issues, SUSE Security releases weekly summary reports for the low profile vulnerability fixes. The SUSE Security Summary Reports do not list or download URLs like the SUSE Security Announcements that are released for more severe vulnerabilities. Fixed packages for the following incidents are already available on our FTP server and via the YaST Online Update. - yelp Package yelp was updated to fix a format string bug. (CVE-2008-3533) Affected products: openSUSE 11.0 - apache2 Missing sanity checks of FTP URLs allowed cross site scripting (XSS) attacks via the mod_proxy_ftp module (CVE-2008-2939). Missing precautions allowed cross site request forgery (CSRF) via the mod_proxy_balancer interface (CVE-2007-6420). A memory leak in the SSL module could crash apache (CVE-2008-1678) Affected products: openSUSE 10.2-11.0, SLES10, SLES9, NLD9, OES, NLPOS9, SLED - enscript This update of enscript fixes buffer overflows in the setfilename (CVE-2008-3863), process_file and read_special_escape function (CVE-2008-4306) that can be exploited during file processing. Affected products: openSUSE 10.2-11.0, SLES10, SLES9, NLD9, OES, NLPOS9, SLED - libcdaudio A remote attacker can modify a CDDB entry on a CDDB server or just intercept a connection from the CDDB client to the server to execute arbitrary code on the client machine. Affected products: openSUSE 10.2-11.0 ______________________________________________________________________________ 2) Pending Vulnerabilities, Solutions, and Work-Arounds none ______________________________________________________________________________ 3) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify replacing with the name of the file containing the announcement. The output for a valid signature looks like: gpg: Signature made using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team " where is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the firstinstallation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and integrity of a package needs to be verified to ensure that it has not been tampered with. The internal RPM package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig to verify the signature of the package, replacing with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from
Nov 07, 2008
SuSE
89
security advisorybuffer overflowFedoraFedora 10: 2009-1293 Critical: Enscript Memory Leak Patch
There were found various buffer overflows in enscript. This update fixes CVE-2008-3863 and CVE-2008-4306. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2008-9372 2008-11-06 02:58:05 --------------------------------------------------------------------------------Name : enscript Product : Fedora 9 Version : 1.6.4 Release : 10.fc9 URL : Summary : A plain ASCII to PostScript converter. Description : GNU enscript is a free replacement for Adobe's Enscript program. Enscript converts ASCII files to PostScript(TM) and spools generated PostScript output to the specified printer or saves it to a file. Enscript can be extended to handle different output media and includes many options for customizing printouts. --------------------------------------------------------------------------------Update Information: There were found various buffer overflows in enscript. This update fixes CVE-2008-3863 and CVE-2008-4306 --------------------------------------------------------------------------------ChangeLog: * Mon Nov 3 2008 Adam Tkac 1.6.4-10 - fixed various buffer overflows (CVE-2008-3863, CVE-2008-4306) --------------------------------------------------------------------------------References: [ 1 ] Bug #466771 - CVE-2008-3863 enscript: "setfilename" special escape buffer overflow https://bugzilla.redhat.com/show_bug.cgi?id=466771 [ 2 ] Bug #469311 - CVE-2008-4306 enscript: "font" special escape buffer overflows https://bugzilla.redhat.com/show_bug.cgi?id=469311 --------------------------------------------------------------------------------This update can be installed with the "yum" update program. Use su -c 'yum update enscript' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ Fedora-package-announce mailing list
Nov 05, 2008
•Critical
Fedora
89
security advisorybuffer overflowcriticalFedora: 2023-4601 Urgent: Fix For Enscrip Buffer Overflow
There were found various buffer overflows in enscript. This update fixes CVE-2008-3863 and CVE-2008-4306. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2008-9351 2008-11-06 02:56:25 --------------------------------------------------------------------------------Name : enscript Product : Fedora 8 Version : 1.6.4 Release : 9.fc8 URL : Summary : A plain ASCII to PostScript converter. Description : GNU enscript is a free replacement for Adobe's Enscript program. Enscript converts ASCII files to PostScript(TM) and spools generated PostScript output to the specified printer or saves it to a file. Enscript can be extended to handle different output media and includes many options for customizing printouts. --------------------------------------------------------------------------------Update Information: There were found various buffer overflows in enscript. This update fixes CVE-2008-3863 and CVE-2008-4306 --------------------------------------------------------------------------------ChangeLog: * Mon Nov 3 2008 Adam Tkac 1.6.4-9 - fixed various buffer overflows (CVE-2008-3863, CVE-2008-4306) --------------------------------------------------------------------------------References: [ 1 ] Bug #466771 - CVE-2008-3863 enscript: "setfilename" special escape buffer overflow https://bugzilla.redhat.com/show_bug.cgi?id=466771 [ 2 ] Bug #469311 - CVE-2008-4306 enscript: "font" special escape buffer overflows https://bugzilla.redhat.com/show_bug.cgi?id=469311 --------------------------------------------------------------------------------This update can be installed with the "yum" update program. Use su -c 'yum update enscript' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ Fedora-package-announce mailing list
Nov 05, 2008
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!