Post Defult Details Esm W900

Thank you for reading the Linux Advisory Watch Security Newsletter. The purpose of this document is to provide our readers with a quick summary of each week's vendor security bulletins and pointers on methods to improve the security posture of your open source system.

Vulnerabilities affect nearly every vendor virtually every week, so be sure to read through to find the updates your distributor have made available.

LinuxSecurity.com Feature Extras:

Essential tools for hardening and securing Unix based Environments - System administrators are aware as how important their systems security is, not just the runtime of their servers. Intruders, spammers, DDOS attack, crackers, are all out there trying to get into people's computers, servers and everywhere they can lay hands on and interrupt the normal runtime of services.

Securing a Linux Web Server - With the significant prevalence of Linux web servers globally, security is often touted as a strength of the platform for such a purpose. However, a Linux based web server is only as secure as its configuration and very often many are quite vulnerable to compromise. While specific configurations vary wildly due to environments or specific use, there are various general steps that can be taken to insure basic security considerations are in place.

  (Oct 6)
 

Security Report Summary
  (Oct 6)
 

Security Report Summary
 
  (Oct 9)
 

* CVE-2015-6815: net: e1000: infinite loop issue (bz #1260225) * CVE-2015-6855:ide: divide by zero issue (bz #1261793) * CVE-2015-5278: Infinite loop inne2000_receive() (bz #1263284) * CVE-2015-5279: Heap overflow vulnerability inne2000_receive() (bz #1263287) * Make block copy more stable (bz #1264416) * Fixhang at start of live merge for large images (bz #1262901) ---- *CVE-2015-5225: heap memory corruption in vnc_refresh_server_surface (bz#1255899)
  (Oct 9)
 

* Fix typo causing qemu-img to link against entire world (bz #1260996) *CVE-2015-6815: net: e1000: infinite loop issue (bz #1260225) * CVE-2015-6855:ide: divide by zero issue (bz #1261793) * CVE-2015-5278: Infinite loop inne2000_receive() (bz #1263284) * CVE-2015-5279: Heap overflow vulnerability inne2000_receive() (bz #1263287) * Make block copy more stable (bz #1264416) * Fixhang at start of live merge for large images (bz #1262901) ---- Fix emulationof various instructions, required by libm in F22 ppc64 guests.
  (Oct 9)
 

kernel-4.1.10-200.fc22 - Linxu v4.1.10 - Add patch to fix soft lockups innetwork stack (rhbz 1266691)
  (Oct 9)
 

The 4.2.3 stable kernel update contains a number of important fixes across thetree. kernel-4.2.3-300.fc23 - Linux v4.2.3 - Netdev fix race inresq_queue_unlink
  (Oct 8)
 

389-ds-base-1.3.3.13-1.fc21 - release 1.3.3.13 - Ticket 48265 - Complexfilter in a search request doen't work as expected. (regression) - Ticket 47981- COS cache doesn't properly mark vattr cache as invalid when there are multiplesuffixes - Ticket 48252 - db2index creates index entry from deleted records -Ticket 48228 - wrong password check if passwordInHistory is decreased. - Ticket48252 - db2index creates index entry from deleted records - Ticket 48254 - CLIdb2index fails with usage errors - Ticket 47831 - remove debug logging fromretro cl - Ticket 48245 - Man pages and help for remove-ds.pl doesn't display"-a" option - Ticket 47931 - Fix coverity issues - Ticket 47931 - memberOf &retrocl deadlocks - Ticket 48228 - wrong password check if passwordInHistory isdecreased. - Ticket 48215 - update dbverify usage in main.c - Ticket 48215 -update dbverify usage - Ticket 48215 - verify_db.pl doesn't verify DB specifiedby -a option - Ticket 47810 - memberOf plugin not properly rejecting updates -Ticket 48231 - logconv autobind handling regression caused by 47446 - Ticket48232 - winsync lastlogon attribute not syncing between DS and AD. - Ticket48206 - Crash during retro changelog trimming - Ticket 48224 - redux 2 -logconv.pl should handle *.tar.xz, *.txz, *.xz log files - Ticket 48226 - InMMR, double free coould occur under some special condition - Ticket 48224 -redux - logconv.pl should handle *.tar.xz, *.txz, *.xz log files - Ticket 48224- redux - logconv.pl should handle *.tar.xz, *.txz, *.xz log files - Ticket48224 - logconv.pl should handle *.tar.xz, *.txz, *.xz log files - Ticket 48192- Individual abandoned simple paged results request has no chance to be cleanedup - Ticket 48212 - Dynamic nsMatchingRule changes had no effect on the attrinfothus following reindexing, as well. - Ticket 48195 - Slow replication whendeleting large quantities of multi-valued attributes - Ticket 48175 - Avoidusing regex in ACL if possible
  (Oct 7)
 

- Enable libnl3 (see rhbz#1207386, rhbz#1247566) - Remove airpcap switch(doesn't have any effect on Linux) - Backport patch no. 11 - Fixedbuilding with F24+ * Ver. 1.12.7
  (Oct 7)
 

fix /var/lib/openhpi permissions (#1233521).
  (Oct 5)
 

unzip-6.0-22.fc21 - Fix heap overflow and infinite loop when invalid input isgiven (#1260947) unzip-6.0-22.fc22 - Fix heap overflow and infinite loop wheninvalid input is given (#1260947) unzip-6.0-23.fc23 - Fix heap overflow andinfinite loop when invalid input is given (#1260947)
  (Oct 5)
 

libvpx-1.3.0-7.fc21 - set --size-limit=16384x16384 to fix CVE-2015-1258libvpx-1.3.0-7.fc22 - set --size-limit=16384x16384 to fix CVE-2015-1258libvpx-1.4.0-5.fc23 - set --size-limit=16384x16384 to avoid CVE-2015-1258
  (Oct 5)
 

webkitgtk-2.4.9-2.fc21 - rhbz#1189303 - [abrt] midori:WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV Initializestring in SQLiteStatement before using it webkitgtk-2.4.9-2.fc22 -rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killedby SIGSEGV Initialize string in SQLiteStatement before using itwebkitgtk-2.4.9-3.fc23 - rhbz#1189303 - [abrt] midori:WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV Initializestring in SQLiteStatement before using it webkitgtk3-2.4.9-2.fc21 -rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killedby SIGSEGV Initialize string in SQLiteStatement before using itwebkitgtk3-2.4.9-2.fc22 - rhbz#1189303 - [abrt] midori:WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV Initializestring in SQLiteStatement before using it webkitgtk3-2.4.9-3.fc23 -rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killedby SIGSEGV Initialize string in SQLiteStatement before using it
  (Oct 5)
 

webkitgtk-2.4.9-2.fc21 - rhbz#1189303 - [abrt] midori:WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV Initializestring in SQLiteStatement before using it webkitgtk-2.4.9-2.fc22 -rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killedby SIGSEGV Initialize string in SQLiteStatement before using itwebkitgtk-2.4.9-3.fc23 - rhbz#1189303 - [abrt] midori:WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV Initializestring in SQLiteStatement before using it webkitgtk3-2.4.9-2.fc21 -rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killedby SIGSEGV Initialize string in SQLiteStatement before using itwebkitgtk3-2.4.9-2.fc22 - rhbz#1189303 - [abrt] midori:WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV Initializestring in SQLiteStatement before using it webkitgtk3-2.4.9-3.fc23 -rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killedby SIGSEGV Initialize string in SQLiteStatement before using it
  (Oct 5)
 

This update adds a fix for CVE-2015-6581 (double free vulnerability).
  (Oct 5)
 

Security release to fix buffer overflow bug
  (Oct 5)
 

webkitgtk-2.4.9-2.fc21 - rhbz#1189303 - [abrt] midori:WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV Initializestring in SQLiteStatement before using it webkitgtk-2.4.9-2.fc22 -rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killedby SIGSEGV Initialize string in SQLiteStatement before using itwebkitgtk-2.4.9-3.fc23 - rhbz#1189303 - [abrt] midori:WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV Initializestring in SQLiteStatement before using it webkitgtk3-2.4.9-2.fc21 -rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killedby SIGSEGV Initialize string in SQLiteStatement before using itwebkitgtk3-2.4.9-2.fc22 - rhbz#1189303 - [abrt] midori:WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV Initializestring in SQLiteStatement before using it webkitgtk3-2.4.9-3.fc23 -rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killedby SIGSEGV Initialize string in SQLiteStatement before using it
  (Oct 5)
 

webkitgtk-2.4.9-2.fc21 - rhbz#1189303 - [abrt] midori:WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV Initializestring in SQLiteStatement before using it webkitgtk-2.4.9-2.fc22 -rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killedby SIGSEGV Initialize string in SQLiteStatement before using itwebkitgtk-2.4.9-3.fc23 - rhbz#1189303 - [abrt] midori:WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV Initializestring in SQLiteStatement before using it webkitgtk3-2.4.9-2.fc21 -rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killedby SIGSEGV Initialize string in SQLiteStatement before using itwebkitgtk3-2.4.9-2.fc22 - rhbz#1189303 - [abrt] midori:WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV Initializestring in SQLiteStatement before using it webkitgtk3-2.4.9-3.fc23 -rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killedby SIGSEGV Initialize string in SQLiteStatement before using it
  (Oct 5)
 

Security fix for CVE-2015-4499 A security problem was found in supportedversions of Bugzilla. Login names longer than 127 characters can be corrupted,which could lead to the creation of a user account with an unexpected emailaddress. Bugzilla 4.4.10 fixes the issue for the 4.4 branch of Bugzilla.
  (Oct 4)
 

Fixed https://bugzilla.redhat.com/show_bug.cgi?id=1259690
  (Oct 4)
 

ui/vnc: limit client_cut_text msg payload size [CVE-2015-5239] (#1259504),e1000: Avoid infinite loop in processing transmit descriptor [CVE-2015-6815](#1260224), net: add checks to validate ring buffer pointers [CVE-2015-5279](#1263278), net: avoid infinite loop when receiving packets [CVE-2015-5278](#1263281), qemu buffer overflow in virtio-serial [CVE-2015-5745] (#1251354)
  (Oct 4)
 

fix for CVE-2015-6524 (rhbz#1257246,1257248)
  (Oct 4)
 

ui/vnc: limit client_cut_text msg payload size [CVE-2015-5239] (#1259504),e1000: Avoid infinite loop in processing transmit descriptor [CVE-2015-6815](#1260224), net: add checks to validate ring buffer pointers [CVE-2015-5279](#1263278), net: avoid infinite loop when receiving packets [CVE-2015-5278](#1263281), qemu buffer overflow in virtio-serial [CVE-2015-5745] (#1251354)
  (Oct 4)
 

thunderbird-38.3.0-1.fc21 - Update to 38.3.0 - For changes see - Update to 38.3.0 - For changes see - Update to 38.3.0 - For changes seehttps://www.thunderbird.net/en-US/thunderbird/38.3.0/releasenotes/
  (Oct 4)
 

This update adds a fix for CVE-2015-6581 (double free vulnerability).
  (Oct 4)
 

thunderbird-38.3.0-1.fc21 - Update to 38.3.0 - For changes see - Update to 38.3.0 - For changes see - Update to 38.3.0 - For changes seehttps://www.thunderbird.net/en-US/thunderbird/38.3.0/releasenotes/
  (Oct 4)
 

ide: fix ATAPI command permissions [CVE-2015-6855] (#1261792)
  (Oct 3)
 

Update to 2.35 Fixes various security issues, seehttps://www.mozilla.org/en-US/security/known-vulnerabilities/seamonkey/ for moreinfo.
  (Oct 3)
 

kernel-4.1.8-100.fc21 - Linux v4.1.8
  (Oct 3)
 

libwmf-0.2.8.4-46.fc22 - Related: rhbz#1227244 CVE-2015-4696 fix patchcontext
  (Oct 3)
 

Update to 2.35 Fixes various security issues, seehttps://www.mozilla.org/en-US/security/known-vulnerabilities/seamonkey/ for moreinfo.
  (Oct 3)
 

kernel-4.1.8-200.fc22 - Linux v4.1.8
  (Oct 3)
 

Updated to securityupdate 1.6.1 https://mail.openjdk.org/pipermail/distro-pkg-dev/2015-September/033546.html . Improved gnome-software support.
  (Oct 3)
 

fix for CVE-2015-6524 (rhbz#1257246,1257248)
  (Oct 3)
 

ui/vnc: limit client_cut_text msg payload size [CVE-2015-5239] (#1259504),e1000: Avoid infinite loop in processing transmit descriptor [CVE-2015-6815](#1260224), net: add checks to validate ring buffer pointers [CVE-2015-5279](#1263278), net: avoid infinite loop when receiving packets [CVE-2015-5278](#1263281), qemu buffer overflow in virtio-serial [CVE-2015-5745] (#1251354)
  (Oct 3)
 

webkitgtk-2.4.9-2.fc21 - rhbz#1189303 - [abrt] midori:WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV Initializestring in SQLiteStatement before using it webkitgtk-2.4.9-2.fc22 -rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killedby SIGSEGV Initialize string in SQLiteStatement before using itwebkitgtk-2.4.9-3.fc23 - rhbz#1189303 - [abrt] midori:WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV Initializestring in SQLiteStatement before using it webkitgtk3-2.4.9-2.fc21 -rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killedby SIGSEGV Initialize string in SQLiteStatement before using itwebkitgtk3-2.4.9-2.fc22 - rhbz#1189303 - [abrt] midori:WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV Initializestring in SQLiteStatement before using it webkitgtk3-2.4.9-3.fc23 -rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killedby SIGSEGV Initialize string in SQLiteStatement before using it
  (Oct 3)
 

firefox-41.0-6.fc21 - Rebuilt for old sqlite which is available in updatesfirefox-41.0-6.fc22 - Rebuilt for old sqlite which is available in updatesfirefox-41.0-6.fc23 - Rebuilt for old sqlite which is available in updates
  (Oct 3)
 

The 4.2.2 stable kernel update contains a number of important fixes across thetree. kernel-4.2.2-300.fc23 - Linux v4.2.2
  (Oct 3)
 

webkitgtk-2.4.9-2.fc21 - rhbz#1189303 - [abrt] midori:WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV Initializestring in SQLiteStatement before using it webkitgtk-2.4.9-2.fc22 -rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killedby SIGSEGV Initialize string in SQLiteStatement before using itwebkitgtk-2.4.9-3.fc23 - rhbz#1189303 - [abrt] midori:WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV Initializestring in SQLiteStatement before using it webkitgtk3-2.4.9-2.fc21 -rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killedby SIGSEGV Initialize string in SQLiteStatement before using itwebkitgtk3-2.4.9-2.fc22 - rhbz#1189303 - [abrt] midori:WebCore::SQLiteStatement::prepare(): midori killed by SIGSEGV Initializestring in SQLiteStatement before using it webkitgtk3-2.4.9-3.fc23 -rhbz#1189303 - [abrt] midori: WebCore::SQLiteStatement::prepare(): midori killedby SIGSEGV Initialize string in SQLiteStatement before using it
  (Oct 1)
 

This update fixes CVE-2015-5262 denial of service security vulnerability byrespectinc configured SO_TIMEOUT parameter during SSL handshake.
  (Oct 1)
 

This update resolves CVE-2015-0852.
  (Oct 1)
 

Security fix for use after free vulnerability
  (Oct 1)
 

golang-1.5.1-0.fc21 - update to go1.5.1 golang-1.5.1-0.fc22 - update togo1.5.1 golang-1.5.1-0.el6 - update to go1.5.1 golang-1.5.1-0.fc23 -update to go1.5.1 ---- update to go1.5; shared objects for x86_64; gdb fixes;full http smuggle fix; fixes for tests
  (Oct 1)
 

Security fix for use after free vulnerability
  (Oct 1)
 

golang-1.5.1-0.fc21 - update to go1.5.1 golang-1.5.1-0.fc22 - update togo1.5.1 golang-1.5.1-0.el6 - update to go1.5.1 golang-1.5.1-0.fc23 -update to go1.5.1 ---- bz1258166 remove srpm macros, for go-srpm-macros ----update to go1.5; shared objects for x86_64; gdb fixes; full http smuggle fix;fixes for tests ---- bz1258166 remove srpm macros, for go-srpm-macros
  (Oct 1)
 

This update fixes CVE-2015-5262 denial of service security vulnerability byrespectinc configured SO_TIMEOUT parameter during SSL handshake.
  (Oct 1)
 

This update resolves CVE-2015-0852.
  (Oct 1)
 

This update fixes CVE-2015-5262 denial of service security vulnerability byrespectinc configured SO_TIMEOUT parameter during SSL handshake.
  (Oct 1)
 

Update to 2.35 Fixes various security issues, seehttps://www.mozilla.org/en-US/security/known-vulnerabilities/seamonkey/ for moreinfo.
 
  Red Hat: 2015:1876-01: python-django: Moderate Advisory (Oct 8)
 

Updated python-django packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform 7.0. Red Hat Product Security has rated this update as having Moderate security [More...]
  Red Hat: 2015:1855-01: mod_proxy_fcgi: Low Advisory (Oct 2)
 

An updated mod_proxy_fcgi package that fixes one security issue is now available for Red Hat Ceph Storage 1.2 for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Low security [More...]
  Red Hat: 2015:1852-01: thunderbird: Important Advisory (Oct 1)
 

An updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security [More...]
 
  (Oct 1)
 

New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues. [More Info...]
  (Oct 1)
 

New seamonkey packages are available for Slackware 14.0, 14.1, and -current to fix security issues. [More Info...]
  (Oct 1)
 

New mozilla-thunderbird packages are available for Slackware 14.1 and -current to fix security issues. [More Info...]
 
  Ubuntu: 2766-1: Spice vulnerabilities (Oct 7)
 

Spice could be made to crash or run programs.
  Ubuntu: 2765-1: Linux kernel (Vivid HWE) vulnerability (Oct 5)
 

The system could be made to crash or run programs as an administrator.
  Ubuntu: 2761-1: Linux kernel vulnerability (Oct 5)
 

The system could be made to crash or run programs as an administrator.
  Ubuntu: 2763-1: Linux kernel (Trusty HWE) vulnerability (Oct 5)
 

The system could be made to crash or run programs as an administrator.
  Ubuntu: 2764-1: Linux kernel (Utopic HWE) vulnerability (Oct 5)
 

The system could be made to crash or run programs as an administrator.
  Ubuntu: 2762-1: Linux kernel vulnerability (Oct 5)
 

The system could be made to crash or run programs as an administrator.
  Ubuntu: 2754-1: Thunderbird vulnerabilities (Oct 5)
 

Several security issues were fixed in Thunderbird.
  Ubuntu: 2757-1: Oxide vulnerabilities (Oct 5)
 

Several security issues were fixed in Oxide.
  Ubuntu: 2743-4: Firefox regression (Oct 5)
 

USN-2743-1 introduced a regression in Firefox.