|
|
| Top White Papers
Current Newswire:
Fedora Core Advisories: kdebase, kdelibs, lhaSep 08, 2004, 18:14 (0 Talkback[s])Fedora Update Notification FEDORA-2004-292 2004-09-08 Product : Fedora Core 1 Description : Update Information: Andrew Tuitt reported that versions of KDE up to and including 3.2.3 create temporary directories with predictable names. A local attacker could prevent KDE applications from functioning correctly, or overwrite files owned by other users by creating malicious symlinks. The Common Vulnerabilities and Exposures project has assigned the name CAN-2004-0689 to this issue. WESTPOINT internet reconnaissance services has discovered that the KDE web browser Konqueror allows websites to set cookies for certain country specific secondary top level domains. An attacker within one of the affected domains could construct a cookie which would be sent to all other websites within the domain leading to a session fixation attack. This issue does not affect popular domains such as .co.uk, .co.in, or .com. The Common Vulnerabilities and Exposures project has assigned the name CAN-2004-0721 to this issue. A frame injection spoofing vulnerability has been discovered in the Konqueror web browser. This issue could allow a malicious website to show arbitrary content in a named frame of a different browser window. The Common Vulnerabilities and Exposures project has assigned the name CAN-2004-0746 to this issue. All users of KDE are advised to upgrade to these packages, which contain backported patches from the KDE team for these issues.
This update can be downloaded from: http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/ 3004c6dd30bc64d3631acd3d2219814d
SRPMS/kdebase-3.1.4-7.src.rpm This update can also be installed with the Update Agent; you can launch the Update Agent with the 'up2date' command. Fedora Update Notification FEDORA-2004-291 2004-09-08 Product : Fedora Core 2 Description : Update Information: Andrew Tuitt reported that versions of KDE up to and including 3.2.3 create temporary directories with predictable names. A local attacker could prevent KDE applications from functioning correctly, or overwrite files owned by other users by creating malicious symlinks. The Common Vulnerabilities and Exposures project has assigned the name CAN-2004-0689 to this issue. WESTPOINT internet reconnaissance services has discovered that the KDE web browser Konqueror allows websites to set cookies for certain country specific secondary top level domains. An attacker within one of the affected domains could construct a cookie which would be sent to all other websites within the domain leading to a session fixation attack. This issue does not affect popular domains such as .co.uk, .co.in, or .com. The Common Vulnerabilities and Exposures project has assigned the name CAN-2004-0721 to this issue. A frame injection spoofing vulnerability has been discovered in the Konqueror web browser. This issue could allow a malicious website to show arbitrary content in a named frame of a different browser window. The Common Vulnerabilities and Exposures project has assigned the name CAN-2004-0746 to this issue. All users of KDE are advised to upgrade to these packages, which contain backported patches from the KDE team for these issues.
This update can be downloaded from: http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/ 1f58d8b1b9a5598e249f9cca9dfd989d
SRPMS/kdelibs-3.2.2-8.FC2.src.rpm This update can also be installed with the Update Agent; you can launch the Update Agent with the 'up2date' command. Fedora Update Notification FEDORA-2004-290 2004-09-08 Product : Fedora Core 1 Description : Update Information: Andrew Tuitt reported that versions of KDE up to and including 3.2.3 create temporary directories with predictable names. A local attacker could prevent KDE applications from functioning correctly, or overwrite files owned by other users by creating malicious symlinks. The Common Vulnerabilities and Exposures project has assigned the name CAN-2004-0689 to this issue. WESTPOINT internet reconnaissance services has discovered that the KDE web browser Konqueror allows websites to set cookies for certain country specific secondary top level domains. An attacker within one of the affected domains could construct a cookie which would be sent to all other websites within the domain leading to a session fixation attack. This issue does not affect popular domains such as .co.uk, .co.in, or .com. The Common Vulnerabilities and Exposures project has assigned the name CAN-2004-0721 to this issue. A frame injection spoofing vulnerability has been discovered in the Konqueror web browser. This issue could allow a malicious website to show arbitrary content in a named frame of a different browser window. The Common Vulnerabilities and Exposures project has assigned the name CAN-2004-0746 to this issue. All users of KDE are advised to upgrade to these erratum packages, which contain backported patches from the KDE team for these issues.
This update can be downloaded from: http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/ 008938cbdcd2153b84d2dda1cbcbf887
SRPMS/kdelibs-3.1.4-7.src.rpm This update can also be installed with the Update Agent; you can launch the Update Agent with the 'up2date' command. Fedora Update Notification FEDORA-2004-294 2004-09-08 Product : Fedora Core 1 archives. Install the lha package if you need to extract DOS files from LHA archives. Update Information: Lukasz Wojtow discovered a stack-based buffer overflow in all versions of lha up to and including version 1.14. A carefully created archive could allow an attacker to execute arbitrary code when a victim extracts or tests the archive. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CAN-2004-0769 to this issue. Buffer overflows were discovered in the command line processing of all versions of lha up to and including version 1.14. If a malicious user can trick a victim into passing a specially crafted command line to the lha command, it is possible that arbitrary code could be executed. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the names CAN-2004-0771 and CAN-2004-0694 to these issues. Thomas Biege discovered a shell meta character command execution vulnerability in all versions of lha up to and including 1.14. An attacker could create a directory with shell meta characters in its name which could lead to arbitrary command execution. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CAN-2004-0745 to this issue. Users of lha should update to this updated package
This update can be downloaded from: http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/ 4c8e03b8489c398e6f01c9c26e76a956
SRPMS/lha-1.14i-12.2.src.rpm This update can also be installed with the Update Agent; you can launch the Update Agent with the 'up2date' command. Fedora Update Notification FEDORA-2004-293 2004-09-08 Product : Fedora Core 2 Description : Update Information: Andrew Tuitt reported that versions of KDE up to and including 3.2.3 create temporary directories with predictable names. A local attacker could prevent KDE applications from functioning correctly, or overwrite files owned by other users by creating malicious symlinks. The Common Vulnerabilities and Exposures project has assigned the name CAN-2004-0689 to this issue. WESTPOINT internet reconnaissance services has discovered that the KDE web browser Konqueror allows websites to set cookies for certain country specific secondary top level domains. An attacker within one of the affected domains could construct a cookie which would be sent to all other websites within the domain leading to a session fixation attack. This issue does not affect popular domains such as .co.uk, .co.in, or .com. The Common Vulnerabilities and Exposures project has assigned the name CAN-2004-0721 to this issue. A frame injection spoofing vulnerability has been discovered in the Konqueror web browser. This issue could allow a malicious website to show arbitrary content in a named frame of a different browser window. The Common Vulnerabilities and Exposures project has assigned the name CAN-2004-0746 to this issue. All users of KDE are advised to upgrade to these packages, which contain backported patches from the KDE team for these issues.
This update can be downloaded from: http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/ 80f87d426b760776fc7fc03653ad30a6
SRPMS/kdebase-3.2.2-6.FC2.src.rpm This update can also be installed with the Update Agent; you can launch the Update Agent with the 'up2date' command. Fedora Update Notification FEDORA-2004-295 2004-09-08 Product : Fedora Core 2 archives. Install the lha package if you need to extract DOS files from LHA archives. Update Information: Lukasz Wojtow discovered a stack-based buffer overflow in all versions of lha up to and including version 1.14. A carefully created archive could allow an attacker to execute arbitrary code when a victim extracts or tests the archive. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CAN-2004-0769 to this issue. Buffer overflows were discovered in the command line processing of all versions of lha up to and including version 1.14. If a malicious user can trick a victim into passing a specially crafted command line to the lha command, it is possible that arbitrary code could be executed. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the names CAN-2004-0771 and CAN-2004-0694 to these issues. Thomas Biege discovered a shell meta character command execution vulnerability in all versions of lha up to and including 1.14. An attacker could create a directory with shell meta characters in its name which could lead to arbitrary command execution. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CAN-2004-0745 to this issue. Users of lha should update to this updated package
This update can be downloaded from: http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/ bccb95c64b01e506961bdacb3323031b
SRPMS/lha-1.14i-14.1.src.rpm This update can also be installed with the Update Agent; you can launch the Update Agent with the 'up2date' command.
0 Talkback[s]
(click to add your comment)
|
