Debian, Ubuntu, Red Hat: Security Advisory Overview with Critical Updates

It was discovered that the PostgreSQL database performs insufficient validation of variables passed to privileged SQL statement called "security definers", which could lead to SQL privilege escalation.

advisories/debian/debian-subject-dsa-1311-1-new-postgresql-74-packages-fix-privilege-escalation

It was discovered that the Apache 1.3 connector for the Tomcat Java servlet engine decoded request URLs multiple times, which can lead to information disclosure.

advisories/debian/debian-subject-dsa-1312-1-new-libapache-mod-jk-packages-fix-information-disclosure

Stefan Cornelius and Reimar Doeffinger discovered that the MPlayer movie player performs insufficient boundary checks when accessing CDDB data, which might lead to the execution of arbitrary code.

advisories/debian/debian-subject-dsa-1313-1-new-mplayer-packages-fix-arbitrary-code-execution

Several local and remote vulnerabilities have been discovered in open-iscsi, a transport-independent iSCSI implementation. One of the security flaw discovered by Olaf Kirch was that due to a programming error access to the management interface socket was insufficiently protected, which allows denial of service.

advisories/debian/debian-subject-dsa-1314-1-new-open-iscsi-packages-fix-several-vulnerabilities

Thor Larholm discovered that libphp-phpmailer, an email transfer class for PHP, performs insufficient input validition if configured to use Sendmail. This allows the execution of arbitrary shell commands.

advisories/debian/debian-subject-dsa-1315-1-new-libphp-phpmailer-packages-fix-arbitrary-shell-command-execution

Several remote vulnerabilities have been discovered in ekg, a console Gadu Gadu client. It was discovered that memory alignment errors may allow remote attackers to cause a denial of service on certain architectures such as sparc. This only affects Debian Sarge.

advisories/debian/debian-subject-dsa-1318-1-new-ekg-packages-fix-denial-of-service

Several remote vulnerabilities have been discovered in MaraDNS, a simple security-aware Domain Name Service server. One flaw was that malformed DNS requests can trigger memory leaks, allowing denial of service.

advisories/debian/debian-subject-dsa-1319-1-new-maradns-packages-fix-denial-of-service

Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. The Common Vulnerabilities and Exposures project found the flaws. It was discovered that the NsPack decompression code performed insufficient sanitising on an internal length variable, resulting in a potential buffer overflow.

advisories/debian/debian-subject-dsa-1320-1-new-clamav-packages-fix-several-vulnerabilities

Several remote vulnerabilities have been discovered in the Wireshark network traffic analyzer, which may lead to denial of service. One security flaw was is Off-by-one overflows were discovered in the iSeries dissector.

advisories/debian/debian-subject-dsa-1322-1-new-wireshark-packages-fix-denial-of-service

Kazuhiro Nishiyama found a vulnerability in hiki, a Wiki engine written in Ruby, which could allow a remote attacker to delete arbitary files which are writable to the Hiki user, via a specially crafted session parameter.

advisories/debian/debian-subject-dsa-1324-1-new-hiki-packages-fix-missing-input-sanitising

Several remote vulnerabilities have been discovered in Evolution, a groupware suite with mail client and organizer. Ulf Harnhammer discovered that a format string vulnerability in the handling of shared calendars may allow the execution of arbitrary code.

advisories/debian/debian-new-evolution-packages-fix-arbitrary-code-execution-229

Steve Kemp from the Debian Security Audit project discovered that fireflier-server, an interactive firewall rule creation tool, uses temporary files in an unsafe manner which may be exploited to remove arbitary files from the local system.

advisories/debian/debian-new-fireflier-server-packages-fix-unsafe-temporary-files

Steve Kemp from the Debian Security Audit project discovered that gsambad, a GTK+ configuration tool for samba, uses temporary files in an unsafe manner which may be exploited to truncate arbitary files from the local system.

advisories/debian/debian-new-gsambad-packages-fix-unsafe-temporary-files

Steve Kemp from the Debian Security Audit project discovered that unicon-imc2, a Chinese input method library, makes unsafe use of an environmental variable, which may be exploited to execute arbitary code.

advisories/debian/debian-new-unicon-imc2-packages-fix-buffer-overflow

Bugfixes against the recent security patches. The bug names are CVE-2007-2447 patch v2 and CVE-2007-2444 patch v2.

advisories/fedora/fedora-core-6-update-samba-3024-7fc6-10-12-00-128622

Integer underflow in the cpuset_tasks_read function in the Linux kernel before 2.6.20.13, and 2.6.21.x before 2.6.21.4, when the cpuset filesystem is mounted, allows local users to obtain kernel memory contents by using a large offset when reading the /dev/cpuset/tasks file.

advisories/fedora/fedora-core-5-update-kernel-2620-12320fc5-10-12-00-128624

An integer overflow flaw was found in the way libexif parses EXIF image tags. If a victim opens a carefully crafted EXIF image file it could cause the application linked against libexif to execute arbitrary code or crash. (CVE-2007-4168) Users of libexif should upgrade to these updated packages, which contain a backported patch and are not vulnerable to this issue.

advisories/fedora/fedora-core-5-update-libexif-0612-5-10-12-00-128625

A heap overflow flaw was found in the RTF import filer. An attacker could create a carefully crafted RTF file that could cause OpenOffice.org to crash or possibly execute arbitrary code if the file was opened by a victim. All users of OpenOffice.org are advised to upgrade to these updated packages, which contain a backported fix to correct this issue.

advisories/fedora/fedora-core-5-update-openofficeorg-202-5222-10-12-00-128626

Integer underflow in the cpuset_tasks_read function in the Linux kernel before 2.6.20.13, and 2.6.21.x before 2.6.21.4, when the cpuset filesystem is mounted, allows local users to obtain kernel memory contents by using a large offset when reading the /dev/cpuset/tasks file.

advisories/fedora/fedora-core-6-update-kernel-2620-12962fc6-10-12-00-128627

This update fixes a security flaw in Evolution's IMAP module. Adds a patch for a list of security bug which were reported.

advisories/fedora/fedora-core-5-update-evolution-data-server-163-5fc5-10-12-00-128628

This update fixes a security flaw in Evolution's IMAP module. It add a patch for RH bug #244287 (Camel IMAP security flaw).

advisories/fedora/fedora-core-6-update-evolution-data-server-183-7fc6-10-12-00-128629

The libexif package contains the EXIF library. Applications use this library to parse EXIF image files. An integer overflow flaw was found in the way libexif parses EXIF image tags. If a victim opens a carefully crafted EXIF image file it could cause the application linked against libexif to execute arbitrary code or crash. (CVE-2007-4168) Users of libexif should upgrade to these updated packages, which contain a backported patch and are not vulnerable to this issue.

advisories/fedora/fedora-core-6-update-libexif-0615-2fc6-10-12-00-128630

This update incorporates fixes for a stack buffer overflow and heap corruption in the RPC library, and a fix for a potential stack buffer overflow in kadmind.

advisories/fedora/fedora-core-5-update-krb5-143-55-10-12-00-128633

This update incorporates fixes for a stack buffer overflow and heap corruption in the RPC library, and a fix for a potential stack buffer overflow in kadmind.

advisories/fedora/fedora-core-6-update-krb5-15-211-10-12-00-128634

The Apache HTTP Server did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the Apache HTTP Server could manipulate the scoreboard and cause arbitrary processes to be terminated which could lead to a denial of service (CVE-2007-3304).

advisories/fedora/fedora-core-5-update-httpd-222-13-12-59-00-128699

Multiple vulnerabilities have been reported in Mozilla Firefox, Thunderbird, SeaMonkey and XULRunner, some of which may allow user-assisted arbitrary remote code execution.

Multiple vulnerabilities have been discovered in PHProjekt, allowing for the execution of arbitrary PHP and SQL code, and cross-site scripting attacks.An authenticated user could elevate their privileges by exploiting the vulnerabilities described above. Note that the magic_quotes_gpc PHP configuration setting must be set to "off" to exploit these vulnerabilities.

Multiple vulnerabilities have been discovered in emul-linux-x86-java, possibly resulting in the execution of arbitrary code or a Denial of Service.

libexif does not properly handle image EXIF information, possibly allowing for the execution of arbitrary code.An attacker could entice a user of an application making use of a vulnerable version of libexif to load a specially crafted image file, possibly resulting in a crash of the application or the execution of arbitrary code with the rights of the user running the application.

A vulnerability has been discovered in Firebird, allowing for the execution of arbitrary code.Cody Pierce from TippingPoint DVLabs has discovered a buffer overflow when processing "connect" requests with an overly large "p_cnct_count" value.

Multiple vulnerabilities have been discovered in OpenOffice.org, allowing for the remote execution of arbitrary code.A remote attacker could entice a user to open a specially crafted document, possibly leading to execution of arbitrary code with the rights of the user running OpenOffice.org.

The IMAP client of Evolution contains a vulnerability potentially leading to the execution of arbitrary code.A malicious or compromised IMAP server could trigger the vulnerability and execute arbitrary code with the permissions of the user running Evolution.

An integer overflow in the dynamic loader, ld.so, could result in the execution of arbitrary code with escalated privileges.As the hardware capabilities mask is honored by the dynamic loader during the execution of suid and sgid programs, in theory this vulnerability could result in the execution of arbitrary code with root privileges. This update is provided as a precaution against currently unknown attack vectors.

The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels of header data, which can cause Apache to return HTTP headers containing previously-used data, which could be used to obtain potentially sensitive information by unauthorized users. Updated packages have been patched to prevent this issue.

Another integer overflow was found in the way libexif parses EXIF image tags. An individual who opened a carefully-crafted EXIF image file could cause the application linked against libexif to crash or possibly execute arbitrary code. Updated packages have been patched to prevent this issue.

A function in the JasPer JPEG-2000 library before 1.900 could allow a remote user-assisted attack to cause a crash and possibly corrupt the heap via malformed image files. Updated packages have been patched to prevent this issue.

The Auth API in ProFTPD, when multiple simultaneous authentication modules are configured, did not require that the module that checks authentication is the same module that retrieves authentication data, which could possibly be used to allow remote attackers to bypass authentication. The updated packages have been patched to prevent this issue.

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 2.0.0.4. This update provides the latest Thunderbird to correct these issues.

The 802.11 network stack in MadWifi prior to 0.9.3.1 would alloa remote attackers to cause a denial of service (system hang) via a crafted length field in nested 802.3 Ethernet frames in Fast Frame packets, which results in a NULL pointer dereference.

A vulnerability in emacs was discovered where it would crash when processing certain types of images. Updated packages have been patched to prevent this issue.

The vulnerability is xfs_fsr in xfsdump creates a .fsr temporary directory with insecure permissions, which allows local users to read or overwrite arbitrary files on xfs filesystems. Updated packages have been patched to prevent this issue.

A flaw in Evolution/evolution-data-server was found in how Evolution would process certain IMAP server messages. If a user were tricked into connecting to a malicious IMAP server, it was possible that arbitrary code could be executed with the privileges of the user using Evolution. Updated packages have been patched to prevent this issue.

A flaw in Evolution/evolution-data-server was found in how Evolution would process certain IMAP server messages. If a user were tricked into connecting to a malicious IMAP server, it was possible that arbitrary code could be executed with the privileges of the user using Evolution. Updated packages have been patched to prevent this issue.

David Coffey discovered an uninitialized pointer free flaw in the RPC library used by kadmind. A remote unauthenticated attacker who could access kadmind could trigger the flaw causing kadmind to crash or possibly execute arbitrary code.

The libblkid library contained in the libext2fs2 package contains a serious memory leak which can cause machines being used as NFS servers to rapidly consume system memory. This update fixes the memory leak.

Multiple cross-site scripting (XSS) vulnerabilities were discovered in pam_login.cgi in webmin prior to version 1.350, which could allow a remote attacker to inject arbitrary web script or HTML. Updated packages have been patched to prevent this issue.

MySQL 5.x before 5.0.36 allows local users to cause a denial of service (database crash) by performing information_schema table subselects and using ORDER BY to sort a single-row result, which prevents certain structure elements from being initialized and triggers a NULL dereference in the filesort function. This issue does not affect MySQL 5.0.37 in Mandriva Linux 2007.1.

vt-is-UTF8 utility included in console-tools package, and used by Mandriva initscripts, can hang, causing random problems like preventing a local/remote system reboot, unless user take interactive action (#27948). Also, when executed on a terminal different from a linux vt, it can cause errors and make it unresponsive. Updated packages fixes both problems, and also removes setkeycodes limit, better fix for a previous issue alread addressed (#21741).

A vulnerability was discovered in the the Apache mod_status module that could lead to a cross-site scripting attack on sites where the server-status page was publically accessible and ExtendedStatus was enabled (CVE-2006-5752).

A vulnerability was discovered in the the Apache mod_status module that could lead to a cross-site scripting attack on sites where the server-status page was publically accessible and ExtendedStatus was enabled.

A vulnerability was discovered in the the Apache mod_status module that could lead to a cross-site scripting attack on sites where the server-status page was publically accessible and ExtendedStatus was enabled (CVE-2006-5752).

Updated mod_perl packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1. The Apache::PerlRun module was found to not properly escape PATH_INFO before being used in a regular expression. If a server is configured to use Apache::PerlRun, an attacker could request a carefully crafted URI causing resource consumption, which could lead to a denial of service. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-moderate-modperl-security-update-2466

Updated mod_perl packages that fix a security issue are now available for Red Hat Application Stack. An issue was found in the "namespace_from_uri" method of the ModPerl::RegistryCooker class. If a server implemented a mod_perl registry module using this method, a remote attacker requesting a carefully crafted URI can cause resource consumption, which could lead to a denial of service This update has been rated as having low security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-low-modperl-security-update-68276

Updated evolution packages that fix a security bug are now available for Red Hat Enterprise Linux 3 and 4. A flaw was found in the way Evolution processes certain IMAP server messages. If a user can be tricked into connecting to a malicious IMAP server it may be possible to execute arbitrary code as the user running evolution. This update has been rated as having important security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-important-evolution-security-update-RHSA-2007-0509-01

Updated evolution-data-server package that fixes a security bug are now available for Red Hat Enterprise Linux 5.A flaw was found in the way evolution-data-server processes certain IMAP server messages. If a user can be tricked into connecting to a malicious IMAP server it may be possible to execute arbitrary code as the user running the evolution-data-server process. This update has been rated as having important security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-important-evolution-data-server-security-update-RHSA-2007-0510-01

Updated kernel packages that fix several security issues and bugs in the Red Hat Enterprise Linux 4 kernel are now available. A flaw in the connection tracking support for SCTP that allowed a remote user to cause a denial of service by dereferencing a NULL pointer. This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-important-kernel-security-update-85756

Updated Apache httpd packages that correct two security issues are now available for Red Hat Enterprise Linux 2.1. The Apache HTTP Server did not verify that a process was an Apache child process before sending it signals. A local attacker who has the ability to run scripts on the Apache HTTP Server could manipulate the scoreboard and cause arbitrary processes to be terminated, which could lead to a denial of service. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-moderate-apache-security-update-RHSA-2007-0532-01

Updated Apache httpd packages that correct two security issues are now available for Red Hat Enterprise Linux 4. A flaw was found in the Apache HTTP Server mod_status module. On sites where the server-status page is publicly accessible and ExtendedStatus is enabled this could lead to a cross-site scripting attack. On Red Hat Enterprise Linux the server-status page is not enabled by default and it is best practice to not make this publicly available. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-moderate-httpd-security-update-87284

Updated Apache httpd packages that correct three security issues are now available for Red Hat Enterprise Linux 5.The Apache HTTP Server did not verify that a process was an Apache child process before sending it signals. A local attacker with the ability to run scripts on the Apache HTTP Server could manipulate the scoreboard and cause arbitrary processes to be terminated which could lead to a denial of service. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-moderate-httpd-security-update-87284

Updated krb5 packages that fix several security flaws are now available for Red Hat Enterprise Linux 2.1 and 3. David Coffey discovered an uninitialized pointer free flaw in the RPC library used by kadmind. A remote unauthenticated attacker who can access kadmind could trigger this flaw and cause kadmind to crash or potentially execute arbitrary code as root. This update has been rated as having critical security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-critical-krb5-security-update-50912

Updated krb5 packages that fix several security flaws are now available for Red Hat Enterprise Linux 4 and 5.Kerberos is a network authentication system which allows clients and servers to authenticate to each other through use of symmetric encryption and a trusted third party, the KDC. kadmind is the KADM5 administration server. This update has been rated as having important security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-important-krb5-security-update-66067

An updated HelixPlayer package that fixes a buffer overflow flaw is now available. A buffer overflow flaw was found in the way HelixPlayer processed Synchronized Multimedia Integration Language (SMIL) files. It was possible for a malformed SMIL file to execute arbitrary code with the permissions of the user running HelixPlayer This update has been rated as having critical security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-critical-helixplayer-security-update-82453

Updated Apache httpd packages that correct two security issues and two bugs are now available for Red Hat Enterprise Linux 3.A flaw was found in the Apache HTTP Server mod_status module. On sites where the server-status page is publicly accessible and ExtendedStatus is enabled this could lead to a cross-site scripting attack. On Red Hat Enterprise Linux the server-status page is not enabled by default and it is best practice to not make this publicly available. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-moderate-httpd-security-update-87284

Updated cman packages that correct a security issue are now available for Red Hat Enterprise Linux 5.A flaw was found in the cman daemon. A local attacker could connect to the cman daemon and trigger a static buffer overflow leading to a denial of service or, potentially, an escalation of privileges This update has been rated as having important security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-important-cman-security-update-RHSA-2007-0559-01

GD is an open source code library for the dynamic creation of images. New gd packages are available for Slackware 11.0, and -current to fix possible security issues. Please see: for complete release notes. "Upgrading is strongly recommended."

Philip Van Hoof discovered that the IMAP client in Evolution did not correctly verify the SEQUENCE value. A malicious or spoofed server could exploit this to execute arbitrary code with user privileges.

advisories/ubuntu/ubuntu-evolution-data-server-vulnerability

Fabio Massimo Di Nitto discovered that cman did not correctly validate the size of client messages. A local user could send a specially crafted message and execute arbitrary code with cluster manager privileges or crash the manager, leading to a denial of service.

advisories/ubuntu/ubuntu-redhat-cluster-suite-vulnerability-26371

Wei Wang discovered that the krb5 RPC library did not correctly handle certain error conditions. A remote attacker could cause kadmind to free an uninitialized pointer, leading to a denial of service or possibly execution of arbitrary code with root privileges.

advisories/ubuntu/ubuntu-krb5-vulnerabilities

Sean Larsson discovered that libexif did not correctly verify the size of EXIF components. By tricking a user into opening an image with specially crafted EXIF headers, a remote attacker could cause the application using libexif to execute arbitrary code with user privileges.

advisories/ubuntu/ubuntu-libexif-vulnerability-98087

Multiple flaws in the MadWifi driver were discovered that could lead to a system crash. A physically near-by attacker could generate specially crafted wireless network traffic and cause a denial of service.

advisories/ubuntu/ubuntu-madwifi-vulnerabilities

Stefan Cornelius discovered that Gimp could miscalculate the size of heap buffers when processing PSD images. By tricking a user into opening a specially crafted PSD file with Gimp, an attacker could exploit this to execute arbitrary code with the user's privileges.

advisories/ubuntu/ubuntu-gimp-vulnerability-58725