The realtime computer music and graphics system puredata does now terminate when dropping setuid privileges failed. For Debian 11 bullseye, this problem has been fixed in version . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3895-1
This update incorporates fixes from the upstream glibc 2.29 stable release branch, including a fix for a minor security vulnerability ([`LD_PREFER_MAP_32BIT_EXEC` not ignored in setuid binaries](https://bugzilla.redhat.com/show_bug.cgi?id=1774682)).. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-c32e4b271c 2020-02-06 01:02:41.743855 --------------------------------------------------------------------------------Name : glibc Product : Fedora 30 Version : 2.29 Release : 28.fc30 URL : Summary : The GNU libc libraries Description : The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important sets of shared libraries: the standard C library and the standard math library. Without these two libraries, a Linux system will not function. --------------------------------------------------------------------------------Update Information: This update incorporates fixes from the upstream glibc 2.29 stable release branch, including a fix for a minor security vulnerability ([`LD_PREFER_MAP_32BIT_EXEC` not ignored in setuid binaries](https://bugzilla.redhat.com/show_bug.cgi?id=1774682)). --------------------------------------------------------------------------------ChangeLog: * Tue Jan 21 2020 Florian Weimer - 2.29-28 - Auto-sync with upstream branch release/2.29/master, commit ea6f2c3174232ca7f66ab1524f0d5fedc7b26f23: - : Define __CORRECT_ISO_CPP_STRING_H_PROTO for Clang (swbz#25232) - x86: Assume --enable-cet if GCC defaults to CET (swbz#25225) - libio: Disable vtable validation for pre-2.1 interposed handles (swbz#25203) - CVE-2019-19126: LD_PREFER_MAP_32BIT_EXEC not ignored for SUID programs (#1774682) * Wed Dec 4 2019 Arjun Shankar - 2.29-27 -Rebuild to fix corrupt annobin data in crti.o and crtn.o [BZ# 1779399] * Tue Nov 19 2019 Arjun Shankar - 2.29-26 - Auto-sync with upstream branch release/2.29/master, commit 845278f2c6f93b1bb72c1e61529785740ea05f62: - Update Alpha libm-test-ulps - Improve performance of strstr - Improve performance of memmem - alpha: force old OSF1 syscalls for getegid, geteuid and getppid [BZ #24986] - Fix RISC-V vfork build with Linux 5.3 kernel headers. - Call _dl_open_check after relocation [BZ #24259] - support: Export bindir path on support_path - nss_db: fix endent wrt NULL mappings [BZ #24695] [BZ #24696] - elf: Refuse to dlopen PIE objects [BZ #24323] - mips: Force RWX stack for hard-float builds that can run on pre-4.8 kernels - Fix alignment of TLS variables for tls variant TLS_TCB_AT_TP [BZ #23403] - Fix assertion in malloc.c:tcache_get. - Small tcache improvements - malloc: Remove unwanted leading whitespace in malloc_info [BZ #24867] - malloc: Fix missing accounting of top chunk in malloc_info [BZ #24026] - Add glibc.malloc.mxfast tunable - malloc: Various cleanups for malloc/tst-mxfast - Base max_fast on alignment, not width, of bins (Bug 24903) - Linux: Use in-tree copy of SO_ constants for !__USE_MISC [BZ #24532] * Tue Oct 29 2019 Patsy Griffin - 2.29-25 - Implement --preload option for the dynamic linker.(#1747453) * Mon Oct 28 2019 Patsy Griffin - 2.29-24 - Remove codecvt vtable. (#1764241) * Mon Sep 30 2019 Florian Weimer - 2.29-23 - Set the expects flags to clock_nanosleep (#1473680) * Wed Sep 4 2019 Florian Weimer - 2.29-22 - Avoid relocation-dependent IFUNC resolvers in librt (swbz#24959, #1473680) * Tue Sep 3 2019 Florian Weimer - 2.29-21 - ld.so: Support moving versioned symbols between sonames (swbz#24741) - malloc: Add nptl, htl dependency for the subdirectory (swbz#24757) - nptl: Remove vfork IFUNC-based forwarder from libpthread (swbz#20188) * Tue Sep 3 2019 Florian Weimer - 2.29-20 - Filter "ignore" autofs mount entries in getmntnt (#1748279) *Tue Sep 3 2019 Florian Weimer - 2.29-19 - Auto-sync with upstream branch release/2.29/master, commit 6d8eaf4a25c09256b53efe57d3f77f2f0bd77ede: - aarch64: handle STO_AARCH64_VARIANT_PCS - aarch64: add STO_AARCH64_VARIANT_PCS and DT_AARCH64_VARIANT_PCS - io: Remove copy_file_range emulation (#1724976) * Fri Jun 21 2019 Florian Weimer - 2.29-18 - Avoid ABI exposure of the NSS service_user type (#1722832) * Fri Jun 21 2019 Florian Weimer - 2.29-17 - Auto-sync with upstream branch release/2.29/master, commit 34fb5f61d3c3f4b8fc616ea259fa19168b58ecd4: - During exit, skip wide buffer handling for legacy stdio handles (#1722216) * Mon Jun 17 2019 Florian Weimer - 2.29-16 - Address conflict between and (#1721129) * Thu Jun 6 2019 Florian Weimer - 2.29-15 - locale: Add LOCPATH diagnostics (#1717492) * Wed Jun 5 2019 Florian Weimer - 2.29-14 - Delete /usr/lib/locale/locale-archive only on uninstall (#1717367) - Do not mark /usr/lib/locale/locale-archive as a configuration file because it is always automatically overwritten by build-locale-archive. * Wed Jun 5 2019 Florian Weimer - 2.29-13 - Fix --without benchtests builds. - Auto-sync with upstream branch release/2.29/master, commit 2ec0b166bf04e22bb6921a08bb1a1131b57889a1: - Use a proper C tokenizer to implement the obsolete typedefs test - malloc: Fix warnings in tests with GCC - Fix tcache count maximum (swbz#24531) - dlfcn: Guard __dlerror_main_freeres with __libc_once_get (once) (swbz#24476) - Fix crash in _IO_wfile_sync (#1710460) * Thu May 2 2019 Arjun Shankar - 2.29-12 - Auto-sync with upstream branch release/2.29/master, commit 52b7cd6e9a701bb203023d56e84551943dc6a4c0: - malloc: Check for large bin list corruption when inserting unsorted chunk (swbz#24216) * Fri Apr 26 2019 Florian Weimer - 2.29-11 - Auto-sync with upstream branch release/2.29/master, commit eaea1dfbe95a31c29adc259100569962cddb6f19: - Fix pldd hang (#1361689) - malloc: Set and reset all hooks for tracing (swbz#16573) *Fri Apr 26 2019 Florian Weimer - 2.29-10 - Increase BIND_NOW coverage (#1702671) --------------------------------------------------------------------------------References: [ 1 ] Bug #1774682 - CVE-2019-19126 glibc: LD_PREFER_MAP_32BIT_EXEC not ignored in setuid binaries [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1774682 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-c32e4b271c' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
flatpak 1.0.6 release. This release fixes an issue that lets system-wide installed applications create setuid root files inside their app dir (somewhere in /var/lib/flatpak/app). Setuid support is disabled inside flatpaks, so such files are only a risk if the user runs them manually outside flatpak. Installing a flatpak system-wide is needs root access, so this isn't a privilege. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-2f9521c82e 2018-11-18 03:55:01.924154 --------------------------------------------------------------------------------Name : flatpak Product : Fedora 29 Version : 1.0.6 Release : 1.fc29 URL : https://flatpak.org/ Summary : Application deployment framework for desktop apps Description : flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information. --------------------------------------------------------------------------------Update Information: flatpak 1.0.6 release. This release fixes an issue that lets system-wide installed applications create setuid root files inside their app dir (somewhere in /var/lib/flatpak/app). Setuid support is disabled inside flatpaks, so such files are only a risk if the user runs them manually outside flatpak. Installing a flatpak system-wide is needs root access, so this isn't a privilege elevation for non-root users, and allowing root to install setuid files is something all traditional packaging systems allow. However flatpak tries to be better than that, in order to make it easier to trust third party repositories. Changes in this version: * The permissions of the files created by the apply_extra script is canonicalized and the script itself is run without any capabilities. * Better matching of existing remotes when the local and remote configuration differs wrt collection ids. * Newflatpakrepo DeployCollectionID replaces CollectionID, doing the same thing. It is recommended to use this instead because older versions of flatpak has bugs in the support of collection ids, and this key will only be respected in versions where it works. * The X11 socket is now mounted read-only. --------------------------------------------------------------------------------ChangeLog: * Fri Nov 16 2018 Kalev Lember - 1.0.6-1 - Update to 1.0.6 * Mon Nov 12 2018 Kalev Lember - 1.0.5-2 - Recommend p11-kit-server instead of just p11-kit (#1649049) * Mon Nov 12 2018 Kalev Lember - 1.0.5-1 - Update to 1.0.5 * Fri Oct 12 2018 Kalev Lember - 1.0.4-1 - Update to 1.0.4 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-2f9521c82e' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
It was discovered that a race condition in beep (if configured as setuid via debconf) allows local privilege escalation. For the oldstable distribution (jessie), this problem has been fixed . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4163-1
John Lightsey of the Debian Security Audit project discovered that the super package did not check for setuid failures, allowing local users to increase the privileges on kernel versions which do not guard against RLIMIT_NPROC attacks. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2917-1
Updated glibc packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Low: glibc security, bug fix, and enhancement update Advisory ID: RHSA-2011:1526-03 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2011:1526.html Issue date: 2011-12-06 CVE Names: CVE-2009-5064 CVE-2011-1089 ==================================================================== 1. Summary: Updated glibc packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly. Aflaw was found in the way the ldd utility identified dynamically linked libraries. If an attacker could trick a user into running ldd on a malicious binary, it could result in arbitrary code execution with the privileges of the user running ldd. (CVE-2009-5064) It was found that the glibc addmntent() function, used by various mount helper utilities, did not handle certain errors correctly when updating the mtab (mounted file systems table) file. If such utilities had the setuid bit set, a local attacker could use this flaw to corrupt the mtab file. (CVE-2011-1089) Red Hat would like to thank Dan Rosenberg for reporting the CVE-2011-1089 issue. This update also fixes several bugs and adds various enhancements. Documentation for these bug fixes and enhancements will be available shortly from the Technical Notes document, linked to in the References section. Users are advised to upgrade to these updated glibc packages, which contain backported patches to resolve these issues and add these enhancements. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 676467 - glibc-debuginfo.i686 and glibc-debuginfo.x86_64 conflict 688980 - CVE-2011-1089 glibc: Suid mount helpers fail to anticipate RLIMIT_FSIZE 692393 - CVE-2009-5064 glibc: ldd unexpected code execution issue 694386 - POWER4 strncmp crashes reading past zero byte 700507 - nscd start produce USER_AVC 706903 - getpwuid unreliable when using NIS, missing flag: -DUSE_BINDINGDIR=1 711987 - [RHEL-6] statvfs tries to stat unrelated mountpoints 712248 - getconf returns incorrect FILESIZEBITS for Lustre filesystem 713134 - CVE-2009-5064 glibc: ldd unexpected code execution issue [rhel-6.2] 714823 - getaddrinfo returns PTR name in ai_canonname when using DNS 729036 -Debuginfo package issues in glibc 730379 - libresolv is not compiled with the stack protector enabled 731042 - pthread_create dumps core when it fails to set real time policy 736346 - make initgroups (setgroups) thread aware 737778 - setlocale() fails if LC_CTYPE is set to Turkish locale 738665 - strange pthread/fork deadlock 738763 - need to add IP_MULTICAST_ALL option to glibc headers739184 - Statically-linked binaries that call gethostbyname crash when executed. 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: i386: glibc-2.12-1.47.el6.i686.rpm glibc-common-2.12-1.47.el6.i686.rpm glibc-debuginfo-2.12-1.47.el6.i686.rpm glibc-debuginfo-common-2.12-1.47.el6.i686.rpm glibc-devel-2.12-1.47.el6.i686.rpm glibc-headers-2.12-1.47.el6.i686.rpm glibc-utils-2.12-1.47.el6.i686.rpm nscd-2.12-1.47.el6.i686.rpm x86_64: glibc-2.12-1.47.el6.i686.rpm glibc-2.12-1.47.el6.x86_64.rpm glibc-common-2.12-1.47.el6.x86_64.rpm glibc-debuginfo-2.12-1.47.el6.i686.rpm glibc-debuginfo-2.12-1.47.el6.x86_64.rpm glibc-debuginfo-common-2.12-1.47.el6.i686.rpm glibc-debuginfo-common-2.12-1.47.el6.x86_64.rpm glibc-devel-2.12-1.47.el6.i686.rpm glibc-devel-2.12-1.47.el6.x86_64.rpm glibc-headers-2.12-1.47.el6.x86_64.rpm glibc-utils-2.12-1.47.el6.x86_64.rpm nscd-2.12-1.47.el6.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): Source: i386: glibc-debuginfo-2.12-1.47.el6.i686.rpm glibc-debuginfo-common-2.12-1.47.el6.i686.rpm glibc-static-2.12-1.47.el6.i686.rpm x86_64: glibc-debuginfo-2.12-1.47.el6.i686.rpm glibc-debuginfo-2.12-1.47.el6.x86_64.rpm glibc-debuginfo-common-2.12-1.47.el6.i686.rpm glibc-debuginfo-common-2.12-1.47.el6.x86_64.rpm glibc-static-2.12-1.47.el6.i686.rpm glibc-static-2.12-1.47.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node (v.6): Source: x86_64: glibc-2.12-1.47.el6.i686.rpm glibc-2.12-1.47.el6.x86_64.rpm glibc-common-2.12-1.47.el6.x86_64.rpm glibc-debuginfo-2.12-1.47.el6.i686.rpm glibc-debuginfo-2.12-1.47.el6.x86_64.rpm glibc-debuginfo-common-2.12-1.47.el6.i686.rpm glibc-debuginfo-common-2.12-1.47.el6.x86_64.rpm glibc-devel-2.12-1.47.el6.i686.rpm glibc-devel-2.12-1.47.el6.x86_64.rpm glibc-headers-2.12-1.47.el6.x86_64.rpm glibc-utils-2.12-1.47.el6.x86_64.rpm nscd-2.12-1.47.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: x86_64: glibc-debuginfo-2.12-1.47.el6.i686.rpm glibc-debuginfo-2.12-1.47.el6.x86_64.rpm glibc-debuginfo-common-2.12-1.47.el6.i686.rpm glibc-debuginfo-common-2.12-1.47.el6.x86_64.rpm glibc-static-2.12-1.47.el6.i686.rpm glibc-static-2.12-1.47.el6.x86_64.rpm Red Hat Enterprise Linux Server (v.6): Source: i386: glibc-2.12-1.47.el6.i686.rpm glibc-common-2.12-1.47.el6.i686.rpm glibc-debuginfo-2.12-1.47.el6.i686.rpm glibc-debuginfo-common-2.12-1.47.el6.i686.rpm glibc-devel-2.12-1.47.el6.i686.rpm glibc-headers-2.12-1.47.el6.i686.rpm glibc-utils-2.12-1.47.el6.i686.rpm nscd-2.12-1.47.el6.i686.rpm ppc64: glibc-2.12-1.47.el6.ppc.rpm glibc-2.12-1.47.el6.ppc64.rpm glibc-common-2.12-1.47.el6.ppc64.rpm glibc-debuginfo-2.12-1.47.el6.ppc.rpm glibc-debuginfo-2.12-1.47.el6.ppc64.rpm glibc-debuginfo-common-2.12-1.47.el6.ppc.rpm glibc-debuginfo-common-2.12-1.47.el6.ppc64.rpm glibc-devel-2.12-1.47.el6.ppc.rpm glibc-devel-2.12-1.47.el6.ppc64.rpm glibc-headers-2.12-1.47.el6.ppc64.rpm glibc-utils-2.12-1.47.el6.ppc64.rpm nscd-2.12-1.47.el6.ppc64.rpm s390x: glibc-2.12-1.47.el6.s390.rpm glibc-2.12-1.47.el6.s390x.rpm glibc-common-2.12-1.47.el6.s390x.rpm glibc-debuginfo-2.12-1.47.el6.s390.rpm glibc-debuginfo-2.12-1.47.el6.s390x.rpm glibc-debuginfo-common-2.12-1.47.el6.s390.rpm glibc-debuginfo-common-2.12-1.47.el6.s390x.rpm glibc-devel-2.12-1.47.el6.s390.rpm glibc-devel-2.12-1.47.el6.s390x.rpm glibc-headers-2.12-1.47.el6.s390x.rpm glibc-utils-2.12-1.47.el6.s390x.rpm nscd-2.12-1.47.el6.s390x.rpm x86_64: glibc-2.12-1.47.el6.i686.rpm glibc-2.12-1.47.el6.x86_64.rpm glibc-common-2.12-1.47.el6.x86_64.rpm glibc-debuginfo-2.12-1.47.el6.i686.rpm glibc-debuginfo-2.12-1.47.el6.x86_64.rpm glibc-debuginfo-common-2.12-1.47.el6.i686.rpm glibc-debuginfo-common-2.12-1.47.el6.x86_64.rpm glibc-devel-2.12-1.47.el6.i686.rpm glibc-devel-2.12-1.47.el6.x86_64.rpm glibc-headers-2.12-1.47.el6.x86_64.rpm glibc-utils-2.12-1.47.el6.x86_64.rpm nscd-2.12-1.47.el6.x86_64.rpm Red Hat Enterprise Linux Server Optional (v.6): Source: i386: glibc-debuginfo-2.12-1.47.el6.i686.rpm glibc-debuginfo-common-2.12-1.47.el6.i686.rpm glibc-static-2.12-1.47.el6.i686.rpm ppc64: glibc-debuginfo-2.12-1.47.el6.ppc.rpm glibc-debuginfo-2.12-1.47.el6.ppc64.rpm glibc-debuginfo-common-2.12-1.47.el6.ppc.rpm glibc-debuginfo-common-2.12-1.47.el6.ppc64.rpm glibc-static-2.12-1.47.el6.ppc.rpm glibc-static-2.12-1.47.el6.ppc64.rpm s390x: glibc-debuginfo-2.12-1.47.el6.s390.rpm glibc-debuginfo-2.12-1.47.el6.s390x.rpm glibc-debuginfo-common-2.12-1.47.el6.s390.rpm glibc-debuginfo-common-2.12-1.47.el6.s390x.rpm glibc-static-2.12-1.47.el6.s390.rpm glibc-static-2.12-1.47.el6.s390x.rpm x86_64: glibc-debuginfo-2.12-1.47.el6.i686.rpm glibc-debuginfo-2.12-1.47.el6.x86_64.rpm glibc-debuginfo-common-2.12-1.47.el6.i686.rpm glibc-debuginfo-common-2.12-1.47.el6.x86_64.rpm glibc-static-2.12-1.47.el6.i686.rpm glibc-static-2.12-1.47.el6.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: i386: glibc-2.12-1.47.el6.i686.rpm glibc-common-2.12-1.47.el6.i686.rpm glibc-debuginfo-2.12-1.47.el6.i686.rpm glibc-debuginfo-common-2.12-1.47.el6.i686.rpm glibc-devel-2.12-1.47.el6.i686.rpm glibc-headers-2.12-1.47.el6.i686.rpm glibc-utils-2.12-1.47.el6.i686.rpm nscd-2.12-1.47.el6.i686.rpm x86_64: glibc-2.12-1.47.el6.i686.rpm glibc-2.12-1.47.el6.x86_64.rpm glibc-common-2.12-1.47.el6.x86_64.rpm glibc-debuginfo-2.12-1.47.el6.i686.rpm glibc-debuginfo-2.12-1.47.el6.x86_64.rpm glibc-debuginfo-common-2.12-1.47.el6.i686.rpm glibc-debuginfo-common-2.12-1.47.el6.x86_64.rpm glibc-devel-2.12-1.47.el6.i686.rpm glibc-devel-2.12-1.47.el6.x86_64.rpm glibc-headers-2.12-1.47.el6.x86_64.rpm glibc-utils-2.12-1.47.el6.x86_64.rpm nscd-2.12-1.47.el6.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v.6): Source: i386: glibc-debuginfo-2.12-1.47.el6.i686.rpm glibc-debuginfo-common-2.12-1.47.el6.i686.rpm glibc-static-2.12-1.47.el6.i686.rpm x86_64: glibc-debuginfo-2.12-1.47.el6.i686.rpm glibc-debuginfo-2.12-1.47.el6.x86_64.rpm glibc-debuginfo-common-2.12-1.47.el6.i686.rpm glibc-debuginfo-common-2.12-1.47.el6.x86_64.rpm glibc-static-2.12-1.47.el6.i686.rpm glibc-static-2.12-1.47.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://access.redhat.com/security/cve/CVE-2009-5064 https://access.redhat.com/security/cve/CVE-2011-1089 https://access.redhat.com/security/updates/classification/#low https://access.redhat.com/search/ 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2011 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFO3jLaXlSAg2UNWIIRAhJcAJ9+lERVfKF5uDcgmw1VP0K0aI4VFgCfXd2o Y/R8wzFTMAlQ80JF0eaA7Zw=OhRU -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Moderate: rpm security and bug fix update. Date: Tue, 7 Sep 2010 13:48:09 -0500 Reply-To: Troy Dawson Sender: Security Errata for Scientific Linux From: Troy Dawson Subject: Security ERRATA Moderate: rpm on SL5.x i386/x86_64 Comments: To: "
Updated rpm packages that fix two security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Moderate: rpm security update Advisory ID: RHSA-2010:0678-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2010:0678.html Issue date: 2010-09-07 CVE Names: CVE-2005-4889 CVE-2010-2059 ==================================================================== 1. Summary: Updated rpm packages that fix two security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Description: The RPM Package Manager (RPM) is a command line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages. It was discovered that RPM did not remove setuid and setgid bits set on binaries when upgrading or removing packages. A local attacker able to create hard links to binaries could use this flaw to keep those binaries on the system, at a specific version level and with the setuid or setgid bit set, even if the package providing them was upgraded or removed by a system administrator. This could have security implications if a package was upgraded or removed because of a security flaw in a setuid or setgid program.(CVE-2005-4889, CVE-2010-2059) All users of rpm are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at 5. Bugs fixed (http://bugzilla.redhat.com/): 598775 - CVE-2010-2059 rpm: fails to drop SUID/SGID bits on package upgrade 625756 - CVE-2005-4889 rpm: fails to drop SUID/SGID bits on package removal 6. Package List: Red Hat Enterprise Linux AS version4: Source: i386: popt-1.9.1-33_nonptl.el4_8.1.i386.rpm rpm-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-build-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-devel-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-python-4.3.3-33_nonptl.el4_8.1.i386.rpm ia64: popt-1.9.1-33_nonptl.el4_8.1.i386.rpm popt-1.9.1-33_nonptl.el4_8.1.ia64.rpm rpm-4.3.3-33_nonptl.el4_8.1.ia64.rpm rpm-build-4.3.3-33_nonptl.el4_8.1.ia64.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.ia64.rpm rpm-devel-4.3.3-33_nonptl.el4_8.1.ia64.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.ia64.rpm rpm-python-4.3.3-33_nonptl.el4_8.1.ia64.rpm ppc: popt-1.9.1-33_nonptl.el4_8.1.ppc.rpm popt-1.9.1-33_nonptl.el4_8.1.ppc64.rpm rpm-4.3.3-33_nonptl.el4_8.1.ppc.rpm rpm-build-4.3.3-33_nonptl.el4_8.1.ppc.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.ppc.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.ppc64.rpm rpm-devel-4.3.3-33_nonptl.el4_8.1.ppc.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.ppc.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.ppc64.rpm rpm-python-4.3.3-33_nonptl.el4_8.1.ppc.rpm s390: popt-1.9.1-33_nonptl.el4_8.1.s390.rpm rpm-4.3.3-33_nonptl.el4_8.1.s390.rpm rpm-build-4.3.3-33_nonptl.el4_8.1.s390.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.s390.rpm rpm-devel-4.3.3-33_nonptl.el4_8.1.s390.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.s390.rpm rpm-python-4.3.3-33_nonptl.el4_8.1.s390.rpm s390x: popt-1.9.1-33_nonptl.el4_8.1.s390.rpm popt-1.9.1-33_nonptl.el4_8.1.s390x.rpm rpm-4.3.3-33_nonptl.el4_8.1.s390x.rpm rpm-build-4.3.3-33_nonptl.el4_8.1.s390x.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.s390.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.s390x.rpm rpm-devel-4.3.3-33_nonptl.el4_8.1.s390x.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.s390.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.s390x.rpm rpm-python-4.3.3-33_nonptl.el4_8.1.s390x.rpm x86_64: popt-1.9.1-33_nonptl.el4_8.1.i386.rpm popt-1.9.1-33_nonptl.el4_8.1.x86_64.rpm rpm-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-build-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-devel-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-python-4.3.3-33_nonptl.el4_8.1.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: Source: i386: popt-1.9.1-33_nonptl.el4_8.1.i386.rpm rpm-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-build-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-devel-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-python-4.3.3-33_nonptl.el4_8.1.i386.rpm x86_64: popt-1.9.1-33_nonptl.el4_8.1.i386.rpm popt-1.9.1-33_nonptl.el4_8.1.x86_64.rpm rpm-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-build-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-devel-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-python-4.3.3-33_nonptl.el4_8.1.x86_64.rpm Red Hat Enterprise Linux ES version4: Source: i386: popt-1.9.1-33_nonptl.el4_8.1.i386.rpm rpm-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-build-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-devel-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-python-4.3.3-33_nonptl.el4_8.1.i386.rpm ia64: popt-1.9.1-33_nonptl.el4_8.1.i386.rpm popt-1.9.1-33_nonptl.el4_8.1.ia64.rpm rpm-4.3.3-33_nonptl.el4_8.1.ia64.rpm rpm-build-4.3.3-33_nonptl.el4_8.1.ia64.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.ia64.rpm rpm-devel-4.3.3-33_nonptl.el4_8.1.ia64.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.ia64.rpm rpm-python-4.3.3-33_nonptl.el4_8.1.ia64.rpm x86_64: popt-1.9.1-33_nonptl.el4_8.1.i386.rpm popt-1.9.1-33_nonptl.el4_8.1.x86_64.rpm rpm-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-build-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-devel-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-python-4.3.3-33_nonptl.el4_8.1.x86_64.rpm Red Hat Enterprise Linux WS version4: Source: i386: popt-1.9.1-33_nonptl.el4_8.1.i386.rpm rpm-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-build-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-devel-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-python-4.3.3-33_nonptl.el4_8.1.i386.rpm ia64: popt-1.9.1-33_nonptl.el4_8.1.i386.rpm popt-1.9.1-33_nonptl.el4_8.1.ia64.rpm rpm-4.3.3-33_nonptl.el4_8.1.ia64.rpm rpm-build-4.3.3-33_nonptl.el4_8.1.ia64.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.ia64.rpm rpm-devel-4.3.3-33_nonptl.el4_8.1.ia64.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.ia64.rpm rpm-python-4.3.3-33_nonptl.el4_8.1.ia64.rpm x86_64: popt-1.9.1-33_nonptl.el4_8.1.i386.rpm popt-1.9.1-33_nonptl.el4_8.1.x86_64.rpm rpm-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-build-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-debuginfo-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-devel-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.i386.rpm rpm-libs-4.3.3-33_nonptl.el4_8.1.x86_64.rpm rpm-python-4.3.3-33_nonptl.el4_8.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://access.redhat.com/security/cve/CVE-2005-4889 https://access.redhat.com/security/cve/CVE-2010-2059 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2010 Red Hat, Inc. . Debian Linux repository security patch resolves vulnerabilities in software installation that may compromise system stability.. Red Hat Update, RPM Security, Package Management, Software Update. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.