Debian: Critical Security And Software Updates October 2 2007

Adam Litke reported a potential local denial of service (oops) on powerpc platforms resulting from unchecked VMA expansion into address space reserved for hugetlb pages.

advisories/debian/debian-new-linux-2618-packages-fix-several-vulnerabilities-45410

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code.

advisories/debian/debian-new-linux-2618-packages-fix-several-vulnerabilities-45410

Nikolaus Schulz discovered that a programming error in id3lib, an ID3 Tag Library, may lead to denial of service through symlink attacks.

advisories/debian/debian-new-id3lib383-packages-fix-denial-of-service-42421

An off-by-one error has been identified in the SSL_get_shared_ciphers() routine in the libssl library from OpenSSL, an implementation of Secure Socket Layer cryptographic libraries and utilities. This error could allow an attacker to crash an application making use of OpenSSL's libssl library, or potentially execute arbitrary code in the security context of the user running such an application.

advisories/debian/debian-new-openssl-packages-fix-arbitrary-code-execution-75110

Kalle Olavi Niemitalo discovered that elinks, an advanced text-mode WWW browser, sent HTTP POST data in cleartext when using an HTTPS proxy server potentially allowing private information to be disclosed.

advisories/debian/debian-new-elinks-packages-fix-information-disclosure

Several local vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems:

advisories/debian/debian-new-linux-2618-packages-fix-several-vulnerabilities-45410

It was discovered that BGP peers can trigger a NULL pointer dereference in the BGP daemon if debug logging is enabled, causing the BGP daemon to crash.

advisories/debian/debian-new-quagga-packages-fix-denial-of-service

Multiple vulnerabilities have been discovered in teTeX, allowing for user-assisted execution of arbitrary code.

Bugzilla contains several vulnerabilities, some of them possibly leading to the remote execution of arbitrary code.

A buffer overflow vulnerability was discovered in t1lib due to improper bounds checking. An attacker could send specially crafted input to an application linked against t1lib which could lead to a denial of service or the execution of arbitrary code. Updated packages have been patched to prevent this issue.

A vulnerability was discovered in KDM by Kees Huijgen where under certain circumstances and in particular configurations, KDM could be tricked into allowing users to login without a password. Updated packages have been patched to prevent this issue.

A heap-based buffer overflow in libsndfile could allow remote attackers to execute arbitrary code via a FLAC file with crafted PCM data which contains a block with a size exceeding that of the previous block. Updated packages have been patched to prevent this issue.

A heap-based buffer overflow was found in MPlayer's AVI handling that could allow a remote attacker to cause a denial of service or possibly execute arbitrary code via a crafted .avi file. Updated packages have been patched to prevent this issue.

Updated kernel packages that fix a security issue in the Red Hat Enterprise Linux 5 kernel are now available. A flaw was found in the IA32 system call emulation provided on AMD64 and Intel 64 platforms. An improperly validated 64-bit value could be stored in the %RAX register, which could trigger an out-of-bounds system call table access. An untrusted local user could exploit this flaw to run code in the kernel (ie a root privilege escalation).

advisories/red-hat/redhat-important-kernel-security-update-85756

Updated kernel packages that fix a security issue in the Red Hat Enterprise Linux 4 kernel are now available. A flaw was found in the IA32 system call emulation provided on AMD64 and Intel 64 platforms. An improperly validated 64-bit value could be stored in the %RAX register, which could trigger an out-of-bounds system call table access. An untrusted local user could exploit this flaw to run code in the kernel (ie a root privilege escalation).

advisories/red-hat/redhat-important-kernel-security-update-85756

Updated kernel packages that fix a security issue in the Red Hat Enterprise Linux 3 kernel are now available.A flaw was found in ia32 emulation affecting users running 64-bit versions of Red Hat Enterprise Linux on x86_64 architectures. A local user could use this flaw to gain elevated privileges.

advisories/red-hat/redhat-important-kernel-security-update-85756

An updated Xen package to fix multiple security issues is now available for Red Hat Enterprise Linux 5. Joris van Rantwijk found a flaw in the Pygrub utility which is used as a boot loader for guest domains. A malicious local administrator of a guest domain could create a carefully crafted grub.conf file which would trigger the execution of arbitrary code outside of that domain.

advisories/red-hat/redhat-important-xen-security-update-RHSA-2007-0323-01

An updated nfs-utils-lib package to correct two security flaws is now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-important-nfs-utils-lib-security-update-56402

An updated ELinks package that corrects a security vulnerability is now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-moderate-elinks-security-update-RHSA-2007-0933-01

A new pidgin package is available for Slackware 12.0 to fix a minor fix security issue. More details about this issue may be found here:

Luigi Auriemma discovered that libmodplug did not properly sanitize its input. A specially crafted AMF file could be used to exploit this situation to cause buffer overflows and possibly execute arbitrary code as the user.

advisories/ubuntu/ubuntu-libmodplug-vulnerability

It was discovered that OpenSSL did not correctly perform Montgomery multiplications. Local attackers might be able to reconstruct RSA private keys by examining another user's OpenSSL processes.

advisories/ubuntu/ubuntu-openssl-vulnerabilities-29155

Multiple vulnerabilities were found in the image decoders of ImageMagick. If a user or automated system were tricked into processing a malicious DCM, DIB, XBM, XCF, or XWD image, a remote attacker could execute arbitrary code with user privileges.

advisories/ubuntu/ubuntu-imagemagick-vulnerabilities-95420