Alerts This Week
Warning Icon 1 677
Alerts This Week
Warning Icon 1 677

Stay Secure with the Latest Linux Advisories

Filter Icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":545,"type":"x","order":1,"pct":78.42,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.32,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.89,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.37,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found -6 articles for you...
91

Gentoo: GLSA-202310-12 Urgent Mitigation for Apache HTTP Server Flaw

Multiple vulnerabilities were found in WordNet, possibly allowing for the execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200810-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: WordNet: Execution of arbitrary code Date: October 07, 2008 Bugs: #211491 ID: 200810-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities were found in WordNet, possibly allowing for the execution of arbitrary code. Background ========= WordNet is a large lexical database of English. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-dicts/wordnet < 3.0-r2 > = 3.0-r2 Description ========== Jukka Ruohonen initially reported a boundary error within the searchwn() function in src/wn.c. A thorough investigation by the oCERT team revealed several other vulnerabilities in WordNet: * Jukka Ruohonen and Rob Holland (oCERT) reported multiple boundary errors within the searchwn() function in src/wn.c, the wngrep() function in lib/search.c, the morphstr() and morphword() functions in lib/morph.c, and the getindex() in lib/search.c, which lead to stack-based buffer overflows. * Rob Holland (oCERT) reported two boundary errors within the do_init() function in lib/morph.c, which lead to stack-based buffer overflows via specially crafted "WNSEARCHDIR" or "WNHOME" environment variables. * Rob Holland (oCERT) reported multiple boundary errors in the bin_search() and bin_search_key() functions inbinsrch.c, which lead to stack-based buffer overflows via specially crafted data files. * Rob Holland (oCERT) reported a boundary error within the parse_index() function in lib/search.c, which leads to a heap-based buffer overflow via specially crafted data files. Impact ===== * In case the application is accessible e.g. via a web server, a remote attacker could pass overly long strings as arguments to the "wm" binary, possibly leading to the execution of arbitrary code. * A local attacker could exploit the second vulnerability via specially crafted "WNSEARCHDIR" or "WNHOME" environment variables, possibly leading to the execution of arbitrary code with escalated privileges. * A local attacker could exploit the third and fourth vulnerability by making the application use specially crafted data files, possibly leading to the execution of arbitrary code. Workaround ========= There is no known workaround at this time. Resolution ========= All WordNet users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-dicts/wordnet-3.0-r2" References ========= [ 1 ] CVE-2008-2149 https://www.cve.org/CVERecord?id=CVE-2008-2149 [ 2 ] CVE-2008-3908 https://www.cve.org/CVERecord?id=CVE-2008-3908 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200810-01 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to This email address is being protected from spambots. You need JavaScript enabled to view it. or alternatively, you may file a bug at https://bugs.gentoo.org/. License ====== Copyright 2008 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5/ . To tackle execution vulnerabilitiesin WordNet, consult the Gentoo Security Advisory for comprehensive guidelines and upgrade steps to ensure security.. WordNet Threat, Gentoo Security, Code Execution, Software Update. . LinuxSecurity.com Team

Calendar 2 Oct 07, 2008 Gentoo
87

Debian 4.0: DSA-1634-2 Moderate: WordNet Code Execution Issue

A regression was discovered in the original patch addressing this issue for WordNet, which this update fixes. For reference the text of the original advisory follows.. - ------------------------------------------------------------------------Debian Security Advisory DSA-1634-2 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Thijs Kinkhorst September 20, 2008 http://www.debian.org/security/faq - ------------------------------------------------------------------------Package : wordnet Vulnerability : stack and heap overflows Problem type : local (remote) Debian-specific: no CVE id(s) : CVE-2008-2149 Debian Bug : 481186 498855 A regression was discovered in the original patch addressing this issue for WordNet, which this update fixes. For reference the text of the original advisory follows. Rob Holland discovered several programming errors in WordNet, an electronic lexical database of the English language. These flaws could allow arbitrary code execution when used with untrusted input, for example when WordNet is in use as a back end for a web application. For the stable distribution (etch), these problems have been fixed in version 1:2.1-4+etch2. For the unstable distribution (sid), these problems have been fixed in version 1:3.0-13. We recommend that you upgrade your wordnet package. Upgrade instructions - --------------------wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - -------------------------------Source archives: Size/MD5 checksum: 77279778d56b18a02598ee5b6fd96ab08a3 Size/MD5 checksum: 23138 e0c766b20c9b7a0af75d95ba45b450a1 Size/MD5 checksum: 6379385 95a6e8144254a92a5ea0e97771ef9d07 Architecture independent packages: Size/MD5 checksum: 8701512 4455bf81c9015708cb74eab60ccd2bcc Size/MD5 checksum: 2242610 07c445b555abf08a505128392008f993 alpha architecture (DEC Alpha) Size/MD5 checksum: 109538 4803d423c191e9faa98384326c8d6d70 Size/MD5 checksum: 80824 4dbf0d39d155acc639aea8483a08972b amd64 architecture (AMD x86_64 (AMD64)) Size/MD5 checksum: 65198 3cc2012ba668fd282398befb9afc1f32 Size/MD5 checksum: 105098 176e4394cb71c2dde0f7a7f67b9d5698 arm architecture (ARM) Size/MD5 checksum: 100134 4dabf40eafe6254f8f9d16ae7ab4bcdc Size/MD5 checksum: 61152 23f695939c47966390fccc29d8666d94 hppa architecture (HP PA RISC) Size/MD5 checksum: 69956 e32d6a37145ed84c9af98af9215a001e Size/MD5 checksum: 108402 2b7b1db48cde550ef290ea68518e7dd8 i386 architecture (Intel ia32) Size/MD5 checksum: 63156 de49f05b5e9a08a2c4cd4cc9ec1f7f64 Size/MD5 checksum: 101844 cb8c045b1f98f009fe976fa46e3b88e8 ia64 architecture (Intel ia64) Size/MD5 checksum: 119820 8ab8da0fa9022893263f77ef5b9f4dae Size/MD5 checksum: 83122 b728bb71e4557f34a8a57c06d4e7d075 mips architecture (MIPS (Big Endian)) Size/MD5 checksum: 105560 12a113044b150102f1f2503a2e03c082 Size/MD5 checksum: 73206 6e3ab13fbbdde8c87a3e74047438adfc mipsel architecture (MIPS (Little Endian)) Size/MD5 checksum: 104772 2354e8d8dc3d328cad3fe07d5f477392 Size/MD5 checksum: 71744 4be1791f3df308f53002d8bd25e6fa9b powerpc architecture (PowerPC) Size/MD5 checksum: 69922 4d9e3c840edd6ab17d2b6821d3d7cc97 Size/MD5 checksum: 108874 9265e4f871c578b4327f125e666dce0b s390 architecture (IBM S/390) Size/MD5 checksum: 107146 6d8d4beb4358469c7b09acb4074d043d Size/MD5 checksum: 65784 2da9f599826e67def06f5b5efba2b7dd sparc architecture (Sun SPARC/UltraSPARC) Size/MD5 checksum: 64894 418d78b3ff25b4402a4f5938672b7dbd Size/MD5 checksum: 102988 9041d53dab5cf6e39ebe4eed982df8d3 These files will probably be moved into the stable distribution on its next update. - ---------------------------------------------------------------------------------For apt-get: deb https://www.debian.org/security/ stable/updates main For dpkg-ftp: dists/stable/updates/main Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . An important patch resolves issues with the latest Jackrabbit modules, enhancing security features on Ubuntu environments.. Debian Security, WordNet Patch, Update Instructions. . Severity: Important. LinuxSecurity.com Team

Calendar 2 Sep 20, 2008 Important Debian
87

Debian: DSA-1634-1 Critical: WordNet Arbitrary Code Execution

Rob Holland discovered several programming errors in WordNet, an electronic lexical database of the English language. These flaws could allow arbitrary code execution when used with untrusted input, for example when WordNet is in use as a back end for a web application. . - ------------------------------------------------------------------------Debian Security Advisory DSA-1634-1 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Thijs Kinkhorst September 01, 2008 http://www.debian.org/security/faq - ------------------------------------------------------------------------Package : wordnet Vulnerability : stack and heap overflows Problem type : local (remote) Debian-specific: no CVE id(s) : CVE-2008-2149 Debian Bug : 481186 Rob Holland discovered several programming errors in WordNet, an electronic lexical database of the English language. These flaws could allow arbitrary code execution when used with untrusted input, for example when WordNet is in use as a back end for a web application. For the stable distribution (etch), these problems have been fixed in version 1:2.1-4+etch1. For the testing distribution (lenny), these problems have been fixed in version 1:3.0-11+lenny1. For the unstable distribution (sid), these problems will be fixed soon. We recommend that you upgrade your wordnet package. Upgrade instructions - --------------------wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - -------------------------------Source archives: Size/MD5 checksum: 77224980d288101a1c11e60e38fe5ea945a Size/MD5 checksum: 22912 bb970bd2ccd457c6310ba0c75e5ed2be Size/MD5 checksum: 6379385 95a6e8144254a92a5ea0e97771ef9d07 Architecture independent packages: Size/MD5 checksum: 2242538 dc75e162b0013a5d7d0c0679115b134c Size/MD5 checksum: 8701430 a680094a45ddf87dd0bcbb5fd63ceae2 alpha architecture (DEC Alpha) Size/MD5 checksum: 80734 3186aeb6b9365a333fdd608d5fa62ffe Size/MD5 checksum: 109466 cc441b73b2ded97fff9fc5c668f2fbb0 amd64 architecture (AMD x86_64 (AMD64)) Size/MD5 checksum: 104990 b7b3225b10df973e2d8a652f770a6e1b Size/MD5 checksum: 65118 bc75f17d4f5b1375fc3862ba80335d2f arm architecture (ARM) Size/MD5 checksum: 61020 57e49d1f532015f07cbf3f71bba24237 Size/MD5 checksum: 100056 43a1c7d6c272412f4f1eff5ff284fd54 hppa architecture (HP PA RISC) Size/MD5 checksum: 108312 f6ed8345d69a1e13e9cd87f7974566fd Size/MD5 checksum: 69896 a1649115a5bba73602f4c6dba8a57964 i386 architecture (Intel ia32) Size/MD5 checksum: 63096 ff93d37e8edeb63fd9268b19b052f3e2 Size/MD5 checksum: 101738 65a6a41a5bf4de85c6ce474de7155c73 ia64 architecture (Intel ia64) Size/MD5 checksum: 83014 98d7592aac60e394cca7262dbae45dc5 Size/MD5 checksum: 119716 a4a53c0fe7acf1828386d2e08e443b7a mips architecture (MIPS (Big Endian)) Size/MD5 checksum: 105498 f76685b8631f82c01b0fc604d22cb7b3 Size/MD5 checksum: 73082 73a315a1e3706cc313559c7f8532232f mipsel architecture (MIPS (Little Endian)) Size/MD5 checksum: 104700 22d5b12949930d49d4d49ac63f106747 Size/MD5 checksum: 71604 78f164f9758891934cb3854c8a10c6e7 powerpc architecture (PowerPC) Size/MD5 checksum: 108852 0b0448af12ac1052b11833252a269765 Size/MD5 checksum: 69846 44d14734b11f31fb1f3522d68fae68ad s390 architecture (IBM S/390) Size/MD5 checksum: 107032 a83524f4bc09a6f78a53216356043175 Size/MD5 checksum: 65640 241a7fa7673077cfc762492a44c7764d sparc architecture (Sun SPARC/UltraSPARC) Size/MD5 checksum: 102918 1f7f85106a3f41cfc2162db49ce0ac1f Size/MD5 checksum: 64812 89d27a34508044af76f2eeac4e1c696a These files will probably be moved into the stable distribution on its next update. - ---------------------------------------------------------------------------------For apt-get: deb https://www.debian.org/security/ stable/updates main For dpkg-ftp: dists/stable/updates/main Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Ubuntu notice USN-934-1 addresses security vulnerabilities in WordNet stemming from coding flaws. Update is advised.. Debian Security, WordNet, Code Execution, Remote Issues, Update Recommended. . Severity: Critical. LinuxSecurity.com Team

Calendar 2 Sep 01, 2008 Critical Debian
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":545,"type":"x","order":1,"pct":78.42,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.32,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.89,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.37,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Your message here