Debian: Security Advisories Critical Updates and Security Issues

Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the security flaws. "moz_bug_r_a4" discovered that a regression in the handling of "about:blank" windows used by addons may lead to an attacker being able to modify the content of web sites.

advisories/debian/debian-new-iceweasel-packages-fix-several-vulnerabilities-60726

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the security flaws."moz_bug_r_a4" discovered that a regression in the handling of "about:blank" windows used by addons may lead to an attacker being able to modify the content of web sites.

advisories/debian/debian-new-xulrunner-packages-fix-several-vulnerabilities-73165

Several remote vulnerabilities have been discovered in the Iceape internet suite, an unbranded version of the Seamonkey Internet Suite. The Common Vulnerabilities and Exposures project identifies the security flaws. "moz_bug_r_a4" discovered that a regression in the handling of "about:blank" windows used by addons may lead to an attacker being able to modify the content of web sites.

advisories/debian/debian-new-iceape-packages-fix-several-vulnerabilities-79321

It was discovered that an integer overflow in the xpdf PDF viewer may lead to the execution of arbitrary code if a malformed PDF file is opened.

advisories/debian/debian-new-xpdf-packages-fix-arbitrary-code-execution-69822

It was discovered that an integer overflow in the xpdf PDF viewer may lead to the execution of arbitrary code if a malformed PDF file is opened.

advisories/debian/debian-new-poppler-packages-fix-arbitrary-code-execution

It was discovered that an integer overflow in the xpdf PDF viewer may lead to the execution of arbitrary code if a malformed PDF file is opened.

advisories/debian/debian-new-libextractor-packages-fix-arbitrary-code-execution-60012

It was discovered that an integer overflow in the xpdf PDF viewer may lead to the execution of arbitrary code if a malformed PDF file is opened.

advisories/debian/debian-new-tetex-bin-packages-fix-arbitrary-code-execution

Tavis Ormandy discovered that bochs, a highly portable IA-32 PC emulator, is vulnerable to a buffer overflow in the emulated NE2000 network device driver, which may lead to privilege escalation.

advisories/debian/debian-new-bochs-packages-fix-privilege-escalation

It was discovered that an integer overflow in the xpdf PDF viewer may lead to the execution of arbitrary code if a malformed PDF file is opened.

advisories/debian/debian-new-pdfkitframework-packages-fix-arbitrary-code

Gdm (the GNOME Display Manager) is a highly configurable reimplementation of xdm, the X Display Manager. JLANTHEA reported a denial of service flaw in the way that gdm listens on its unix domain socket. Any local user can crash the locally running X session.

advisories/fedora/fedora-core-6-update-gdm-2165-2fc6-10-18-00-128903

Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value.

advisories/fedora/fedora-core-6-update-tcpdump-394-11fc6-10-18-00-128904

The decode_choice function in net/netfilter/bf_conntrack_h323_asn1.c in the Linux kernel before 2.6.22 allows remote attackers to cause a denial of service (crash) via an encoded, out-of-range index value for a choice field, which triggers a NULL pointer dereference.

advisories/fedora/fedora-core-6-update-kernel-26221-32fc6-11-57-00-128958

Multiple vulnerabilities have been discovered in Macromedia Flash Player, allowing for the remote execution of arbitrary code. Mark Hills discovered some errors when interacting with a browser for keystrokes handling (CVE-2007-2022). Stefano Di Paola and Giorgio Fedon =66rom Minded Security discovered a boundary error when processing FLV files (CVE-2007-3456). An input validation error when processing HTTP referrers has also been reported (CVE-2007-3457).

Several array indexing vulnerabilities were discovered in Xvid. An attacker could exploit these vulnerabilities to execute arbitrary code by tricking a user or automated system into processing a malicious video file with an application that makes use of the Xvid library.

Multiple vulnerabilities were found in libarchive (formerly named as app-archive/bsdtar), possibly allowing for the execution of arbitrary code or a Denial of Service. CPNI, CERT-FI, Tim Kientzle, and Colin Percival reported a buffer overflow (CVE-2007-3641), an infinite loop (CVE-2007-3644), and a NULL pointer dereference (CVE-2007-3645) within the processing of archives having corrupted PaX extension headers.

GD versions prior to 2.0.35 have a number of bugs which potentially lead to denial of service and possibly other issues. Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified remote attack vectors and impact. (CVE-2007-3472) The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure.

Updated java-1.4.2-ibm packages to correct a set of security issues are now available for Red Hat Enterprise Linux 3 and 4 Extras and Red Hat Enterprise Linux 5 Supplementary. A security vulnerability in the Java Web Start component was discovered. An untrusted application could elevate it's privileges and read and write local files that are accessible to the user running the Java Web Start application. This update has been rated as having critical security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-critical-java-142-ibm-security-update-6214

Updated java-1.5.0-sun packages that correct several security issues are available for Red Hat Enterprise Linux 4 Extras. The Javadoc tool was able to generate HTML documentation pages that contained cross-site scripting (XSS) vulnerabilities. A remote attacker could use this to inject arbitrary web script or HTML. This update has been rated as having critical security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-critical-java-150-sun-security-update-97079

An updated libgtop2 package that fixes a security issue and a functionality bug is now available for Red Hat Enterprise Linux 4.A flaw was found in the way libgtop2 handled long filenames mapped into the address space of a process. An attacker could execute arbitrary code on behalf of the user running gnome-system-monitor by executing a process and mapping a file with a specially crafted name into the processes' address space. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-moderate-libgtop2-security-update-RHSA-2007-0765-01

An updated gdm package that fixes a security issue is now available for Red Hat Enterprise Linux 5.A flaw was found in the way Gdm listens on its unix domain socket. A local user could crash a running X session by writing malicious data to Gdm's unix domain socket. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-moderate-gdm-security-and-bug-fix-update-RHSA-2007-0777-01

Updated java-1.5.0-ibm packages that correct several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary. A security vulnerability in the Java Web Start component was discovered. An untrusted application could elevate it's privileges, allowing it to read and write local files that are accessible to the user running the Java Web Start application. This update has been rated as having critical security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-critical-java-150-ibm-security-update-89380

Updated kernel packages that fix a number of security issues are now available for Red Hat Enterprise Linux 2.1 (32-bit architectures). This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-important-kernel-security-update-85756

Updated kernel packages that fix a number of security issues are now available for Red Hat Enterprise Linux 2.1 (64-bit architectures). This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-important-kernel-security-update-85756

New Thunderbird packages are available for Slackware 11.0 and 12.0 to fix two possible security issues. This package may also be used on many older versions of Slackware (though we're not certain how far back...) More details about the issues may be found here: https://www.mozilla.org/en-US/security/known-vulnerabilities/

Sean Larsson discovered multiple integer overflows in Gimp. By tricking a user into opening a specially crafted DICOM, PNM, PSD, PSP, RAS, XBM, or XWD image, a remote attacker could exploit this to execute arbitrary code with the user's privileges.

advisories/ubuntu/ubuntu-gimp-vulnerability-58725

Several format string vulnerabilities have been discovered in Qt warning messages. By causing an application to process specially crafted input data which triggered Qt warnings, this could be exploited to execute arbitrary code with the privilege of the user running the application.

advisories/ubuntu/ubuntu-qt-vulnerability-40968

Derek Noonburg discovered an integer overflow in the Xpdf function StreamPredictor::StreamPredictor(). By importing a specially crafted PDF file into KWord, this could be exploited to run arbitrary code with the user's privileges.

advisories/ubuntu/ubuntu-koffice-vulnerability-30092

USN-496-1 fixed a vulnerability in koffice. This update provides the corresponding updates for poppler, the library used for PDF handling in Gnome. Derek Noonburg discovered an integer overflow in the Xpdf function StreamPredictor::StreamPredictor(). By importing a specially crafted PDF file into KWord, this could be exploited to run arbitrary code with the user's privileges.

advisories/ubuntu/ubuntu-poppler-vulnerability-81822