Debian, Gentoo: Security Advisories and Fix Information

Several local vulnerabilities have been discovered in the Xen hypervisor packages which may lead to the execution of arbitrary code. By use of a specially crafted grub configuration file a domU user may be able to execute arbitrary code upon the dom0 when pygrub is being used.

advisories/debian/debian-new-xen-utils-packages-fix-several-vulnerabilities

A problem was discovered in lighttpd, a fast webserver with minimal memory footprint, which could allow the execution of arbitary code via the overflow of CGI variables when mod_fcgi was enabled.

advisories/debian/debian-new-lighttpd-packages-fix-buffer-overflow

An off-by-one error has been identified in the SSL_get_shared_ciphers() routine in OpenSSL, an implementation of Secure Socket Layer cryptographic libraries and utilities. This error could allow an attacker to crash an application making use of OpenSSL's libssl library, or potentially execute arbitrary code in the security context of the user running such an application.

advisories/debian/debian-new-openssl-packages-fix-arbitrary-code-execution-75110

Sean Larsson discovered that two code paths inside the X Font Server handle integer values insecurely, which may lead to the execution of arbitrary code.

advisories/debian/debian-new-xfs-packages-fix-arbitrary-code-execution

PHP contains several vulnerabilities including buffer and integer overflows which could lead to the remote execution of arbitrary code.

A buffer overflow vulnerability and several memory corruptions have been discovered in libvorbis. David Thiel of iSEC Partners discovered a heap-based buffer overflow in the _01inverse() function in res0.c and a boundary checking error in the vorbis_info_clear() function in info.c (CVE-2007-3106 and CVE-2007-4029). libvorbis is also prone to several Denial of Service vulnerabilities in form of infinite loops and invalid memory access with unknown impact (CVE-2007-4065 and CVE-2007-4066).

A buffer overflow vulnerability has been discovered in libsndfile. Robert Buchholz of the Gentoo Security team discovered that the flac_buffer_copy() function does not correctly handle FLAC streams with variable block sizes which leads to a heap-based buffer overflow (CVE-2007-4974).

A buffer overflow vulnerability has been discovered in Tk. Reinhard Max discovered a boundary error in Tk when processing an interlaced GIF with two frames where the second is smaller than the first one.

More vulnerabilities in libvorbis were found that could be used to cause an application linked to libvorbis to crash or execute arbitrary code if used to open a carefully crafted OGG file. Updated packages have been patched to prevent this issue.

Updated kdebase packages that resolve several security flaws are now available for Red Hat Enterprise Linux 4 and 5. Kees Huijgen found a flaw in the way KDM handled logins when autologin and "shutdown with password" were enabled. A local user would have been able to login via KDM as any user without requiring a password. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-moderate-kdebase-security-update-RHSA-2007-0905-01

Updated kdelibs packages that resolve several security flaws are now available for Red Hat Enterprise Linux 4 and 5. Two cross-site-scripting flaws were found in the way Konqueror processes certain HTML content. This could result in a malicious attacker presenting misleading content to an unsuspecting user. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-moderate-kdelibs-security-update-69675

Updated pwlib packages that fix a security issue are now available for Red Hat Enterprise Linux 5. A memory management flaw was discovered in PWLib. An attacker could use this flaw to crash an application, such as Ekiga, which is linked with pwlib (CVE-2007-4897). This update has been rated as having moderate security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-moderate-pwlib-security-update-RHSA-2007-0932-01

Updated opal packages that fix a security issue are now available for Red Hat Enterprise Linux 5. A flaw was discovered in the way opal handled certain Session Initiation Protocol (SIP) packets. An attacker could use this flaw to crash an application, such as Ekiga, which is linked with opal. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-moderate-opal-security-update-RHSA-2007-0957-01

Joris van Rantwijk discovered that the Xen host did not correctly validate the contents of a Xen guests's grug.conf file. Xen guest root users could exploit this to run arbitrary commands on the host when the guest system was rebooted.

advisories/ubuntu/ubuntu-xen-30-vulnerability

Neil Kettle discovered that MySQL could be made to dereference a NULL pointer and divide by zero. An authenticated user could exploit this with a crafted IF clause, leading to a denial of service. (CVE-2007-2583) Victoria Reznichenko discovered that MySQL did not always require the DROP privilege. An authenticated user could exploit this via RENAME TABLE statements to rename arbitrary tables, possibly gaining additional database access.

advisories/ubuntu/ubuntu-mysql-vulnerabilities-82610