Debian, Fedora, Gentoo Security Advisories - November 2008

Check out the hot Linux+ Magazine at Barnes & Noble or online. Included with this issue are:

• Installing Fedora 9
• Going Virtual with Ubuntu
• Intro to Digital Forensics
• Power Over Ethernet Tips
• Using OpenLDAP
• EnGarde Secure Linux Review
• Interview with Pavel Radda from Foundry.net
• Microsoft & Linux: What's the Deal?

Packed with useful Linux tips & tricks, DVD with hundreds of tools, and the full EnGarde Secure Linux distribution!

Read More

Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.21 (Version 3.0, Release 21). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy.

In distribution since 2001, EnGarde Secure Community was one of the very first security platforms developed entirely from open source, and has been engineered from the ground-up to provide users and organizations with complete, secure Web functionality, DNS, database, e-mail security and even e-commerce.

A symlink traversal vulnerability was discovered in MySQL, a relational database server. The weakness could permit an attacker having both CREATE TABLE access to a database and the ability to execute shell commands on the database server to bypass MySQL access controls, enabling them to write to tables in databases to which they would not ordinarily have access.

advisories/debian/debian-new-mysql-dfsg-50-packages-fix-authorization-bypass

A major code audit did show several unsecure use of /tmp. This update addresses those issues across the whole code.

advisories/fedora/fedora-9-update-rgmanager-20309-1fc9-22-02-00-144022

Addresses a security vulnerability in tmail and dmail:

advisories/fedora/fedora-8-update-uw-imap-2007d-1fc8-23-11-00-143910

There were found various buffer overflows in enscript. This update fixes CVE-2008-3863 and CVE-2008-4306

advisories/fedora/fedora-9-update-enscript-164-10fc9-23-08-00-143892

There were found various buffer overflows in enscript. This update fixes CVE-2008-3863 and CVE-2008-4306

advisories/fedora/fedora-8-update-enscript-164-9fc8-23-05-00-143866

A security release to address: - CVE-2008-2237: Manipulated WMF files - CVE-2008-2238: Manipulated EMF files as described at http://www.openoffice.org/security/bulletin.html

advisories/fedora/fedora-8-update-openofficeorg-230-617fc8-06-29-00-143832

Security update to address - CVE-2008-2237: Manipulated WMF files - CVE-2008-2238: Manipulated EMF files as described at http://www.openoffice.org/security/bulletin.html

advisories/fedora/fedora-9-update-openofficeorg-242-181fc9-06-24-00-143813

Multiple vulnerabilities have been discovered in Opera, allowing for the execution of arbitrary code.

A memory management error in libspf2 might allow for remote execution of arbitrary code.

A denial of service condition was found in Ruby's regular expression engine. If a Ruby script tried to process a large amount of data via a regular expression, it could cause Ruby to enter an infinite loop and crash (CVE-2008-3443).

A denial of service vulnerability was discovered in how Net-SNMP processed GETBULK requests. A remote attacker with read access to the SNMP server could issue a specially-crafted request which would cause snmpd to crash (CVE-2008-4309).

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel: The error-reporting functionality in (1) fs/ext2/dir.c, (2) fs/ext3/dir.c, and possibly (3) fs/ext4/dir.c in the Linux kernel 2.6.26.5 does not limit the number of printk console messages that report directory corruption, which allows physically proximate attackers to cause a denial of service (temporary system hang) by mounting a filesystem that has corrupted dir->i_size and dir->i_blocks values and performing (a) read or (b) write operations. NOTE: there are limited scenarios in which this crosses privilege boundaries. (CVE-2008-3528)

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel: Buffer overflow in format descriptor parsing in the uvc_parse_format function in drivers/media/video/uvc/uvc_driver.c in uvcvideo in the video4linux (V4L) implementation in the Linux kernel before 2.6.26.1 has unknown impact and attack vectors. (CVE-2008-3496)

Multiple vulnerabilities were discovered in FreeType's Printer Font Binary (PFB) font-file format parser. If a user were to load a carefully crafted font file with a program linked against FreeType, it could cause the application to crash or potentially execute arbitrary code (CVE-2008-1806, CVE-2008-1807, CVE-2008-1808). The updated packages have been patched to prevent this issue.

This update ensures that the distribution upgrade notification is not detected in incorrect cases, and ensures that a distribution upgrade is only suggested after all security updates have been applied. It also improves the distribution upgrade confirmation dialog and reliability of network package installation.

This update provides a new upstream version of OpenOffice.org - 2.4.1.10. It also corrects the following bugs: Under 2.4 versions of OpenOffice.org, the Orientation option was removed from printer properties which prevented users from printing on a booklet format in a way they were used to do. This OpenOffice.org update enables the Orientation printer option again.

Updated openoffice.org packages that correct security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. SureRun Security Team discovered an integer overflow flaw leading to a heap buffer overflow in the Windows Metafile (WMF) image format parser. An attacker could create a carefully crafted document containing a malicious WMF file that could cause OpenOffice.org to crash, or, possibly, execute arbitrary code if opened by a victim. This update has been rated as having important security impact by the RedHat Security Response Team.

advisories/red-hat/redhat-important-openofficeorg-security-update-69768

Updated kernel packages that resolve several security issues and fix various bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-important-kernel-security-and-bug-fix-update-30637

Updated net-snmp packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-important-net-snmp-security-update-RHSA-2008-0971-01

It was discovered that Netpbm could be made to overrun a buffer when loading certain images. If a user were tricked into opening a specially crafted GIF image, remote attackers could cause a denial of service or execute arbitrary code with user privileges.

advisories/ubuntu/ubuntu-netpbm-vulnerability

It was discovered that Tk could be made to overrun a buffer when loading certain images. If a user were tricked into opening a specially crafted GIF image, remote attackers could cause a denial of service or execute arbitrary code with user privileges.

advisories/ubuntu/ubuntu-tk-vulnerability-85503

Ulf H