:Security Digest: November 30, 2004
Security Digest: November 30, 2004 0 Talkback[s]
Gentoo Linux
http://security.gentoo.org/
Severity: Normal
The Java plug-in security in Sun and Blackdown Java environments can be
bypassed to access arbitrary packages, allowing untrusted Java applets
to perform unrestricted actions on the host system.
Sun and Blackdown both provide implementations of Java Development Kits
(JDK) and Java Runtime Environments (JRE). All these implementations
provide a Java plug-in that can be used to execute Java applets in a
restricted environment for web browsers.
Package Vulnerable Unaffected 1 dev-java/sun-jdk < 1.4.2.06 >= 1.4.2.06 2 dev-java/sun-jre-bin < 1.4.2.06 >= 1.4.2.06 3 dev-java/blackdown-jdk < 1.4.2.01 >= 1.4.2.01 4 dev-java/blackdown-jre < 1.4.2.01 >= 1.4.2.01
Package 1 [dev-java/sun-jdk] only applies to x86 and AMD64
users.
Package 2 [dev-java/sun-jre-bin] only applies to x86 and AMD64
users.
Package 3 [dev-java/blackdown-jdk] only applies to x86 and
AMD64 users.
Package 4 [dev-java/blackdown-jre] only applies to x86 and
AMD64 users. 4 affected packages; please see the notes above...
All Java plug-ins are subject to a vulnerability allowing unrestricted
Java package access.
A remote attacker could embed a malicious Java applet in a web page and
entice a victim to view it. This applet can then bypass security
restrictions and execute any command or access any file with the rights
of the user running the web browser.
As a workaround you could disable Java applets on your web browser.
All Sun JDK users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-java/sun-jdk-1.4.2.06"
All Sun JRE users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-java/sun-jre-bin-1.4.2.06"
All Blackdown JDK users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-java/blackdown-jdk-1.4.2.01"
All Blackdown JRE users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-java/blackdown-jre-1.4.2.01"
Note: You should unmerge all vulnerable versions to be fully protected.
[ 1 ] iDEFENSE Security Advisory 11.22.04
http://www.idefense.com/application/poi/display?id=158&type=vulnerabilities
[ 2 ] CAN-2004-1029
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1029
[ 3 ] Blackdown Security Advisory 2004-01
http://www.blackdown.org/java-linux/java2-status/security/Blackdown-SA-2004-01.txt
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200411-38.xml
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org .
Copyright 2004 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0
Debian GNU/Linux
Debian Security Advisory DSA 602-1 security@debian.org http://www.debian.org/security/ Martin Schulzehttp://www.debian.org/security/faq
Package : libgd2
More potential integer overflows have been found in the GD graphics
library which weren't covered by our security advisory DSA 591. They
could be exploited by a specially crafted graphic and could lead to
the execution of arbitrary code on the victim's machine.
For the stable distribution (woody) these problems have been fixed in
version 2.0.1-10woody2.
For the unstable distribution (sid) these problems will be fixed soon.
We recommend that you upgrade your libgd2 packages.
Upgrade Instructions
wget url
will fetch the file for you
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
Source archives:
http://security.debian.org/pool/updates/main/libg/libgd2/libgd2_2.0.1-10woody2.dsc http://security.debian.org/pool/updates/main/libg/libgd2/libgd2_2.0.1-10woody2.diff.gz http://security.debian.org/pool/updates/main/libg/libgd2/libgd2_2.0.1.orig.tar.gz
Alpha architecture:
http://security.debian.org/pool/updates/main/libg/libgd2/libgd-tools_2.0.1-10woody2_alpha.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2_2.0.1-10woody2_alpha.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-dev_2.0.1-10woody2_alpha.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-noxpm_2.0.1-10woody2_alpha.deb
ARM architecture:
http://security.debian.org/pool/updates/main/libg/libgd2/libgd-tools_2.0.1-10woody2_arm.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2_2.0.1-10woody2_arm.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-dev_2.0.1-10woody2_arm.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-noxpm_2.0.1-10woody2_arm.deb
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/libg/libgd2/libgd-tools_2.0.1-10woody2_i386.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2_2.0.1-10woody2_i386.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-dev_2.0.1-10woody2_i386.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-noxpm_2.0.1-10woody2_i386.deb
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/libg/libgd2/libgd-tools_2.0.1-10woody2_ia64.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2_2.0.1-10woody2_ia64.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-dev_2.0.1-10woody2_ia64.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-noxpm_2.0.1-10woody2_ia64.deb
HP Precision architecture:
http://security.debian.org/pool/updates/main/libg/libgd2/libgd-tools_2.0.1-10woody2_hppa.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2_2.0.1-10woody2_hppa.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-dev_2.0.1-10woody2_hppa.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-noxpm_2.0.1-10woody2_hppa.deb
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/libg/libgd2/libgd-tools_2.0.1-10woody2_m68k.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2_2.0.1-10woody2_m68k.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-dev_2.0.1-10woody2_m68k.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-noxpm_2.0.1-10woody2_m68k.deb
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/libg/libgd2/libgd-tools_2.0.1-10woody2_mips.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2_2.0.1-10woody2_mips.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-dev_2.0.1-10woody2_mips.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-noxpm_2.0.1-10woody2_mips.deb
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/libg/libgd2/libgd-tools_2.0.1-10woody2_mipsel.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2_2.0.1-10woody2_mipsel.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-dev_2.0.1-10woody2_mipsel.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-noxpm_2.0.1-10woody2_mipsel.deb
PowerPC architecture:
http://security.debian.org/pool/updates/main/libg/libgd2/libgd-tools_2.0.1-10woody2_powerpc.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2_2.0.1-10woody2_powerpc.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-dev_2.0.1-10woody2_powerpc.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-noxpm_2.0.1-10woody2_powerpc.deb
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/libg/libgd2/libgd-tools_2.0.1-10woody2_s390.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2_2.0.1-10woody2_s390.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-dev_2.0.1-10woody2_s390.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-noxpm_2.0.1-10woody2_s390.deb
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/libg/libgd2/libgd-tools_2.0.1-10woody2_sparc.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2_2.0.1-10woody2_sparc.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-dev_2.0.1-10woody2_sparc.deb http://security.debian.org/pool/updates/main/libg/libgd2/libgd2-noxpm_2.0.1-10woody2_sparc.deb
These files will probably be moved into the stable distribution on
its next update.
http://security.debian.org/ stable/updates mainftp://security.debian.org/debian-security dists/stable/updates/maindebian-security-announce@lists.debian.org http://packages.debian.org/<pkg>
Debian Security Advisory DSA 601-1 security@debian.org http://www.debian.org/security/ Martin Schulzehttp://www.debian.org/security/faq
Package : libgd1
More potential integer overflows have been found in the GD graphics
library which weren't covered by our security advisory DSA 589. They
could be exploited by a specially crafted graphic and could lead to
the execution of arbitrary code on the victim's machine.
For the stable distribution (woody) these problems have been fixed in
version 1.8.4-17.woody4.
For the unstable distribution (sid) these problems will be fixed soon.
We recommend that you upgrade your libgd1 packages.
Upgrade Instructions
wget url
will fetch the file for you
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
Source archives:
http://security.debian.org/pool/updates/main/libg/libgd/libgd_1.8.4-17.woody4.dsc http://security.debian.org/pool/updates/main/libg/libgd/libgd_1.8.4-17.woody4.diff.gz http://security.debian.org/pool/updates/main/libg/libgd/libgd_1.8.4.orig.tar.gz
Alpha architecture:
http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_alpha.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_alpha.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_alpha.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_alpha.deb
ARM architecture:
http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_arm.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_arm.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_arm.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_arm.deb
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_i386.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_i386.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_i386.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_i386.deb
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_ia64.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_ia64.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_ia64.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_ia64.deb
HP Precision architecture:
http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_hppa.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_hppa.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_hppa.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_hppa.deb
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_m68k.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_m68k.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_m68k.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_m68k.deb
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_mips.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_mips.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_mips.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_mips.deb
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_mipsel.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_mipsel.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_mipsel.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_mipsel.deb
PowerPC architecture:
http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_powerpc.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_powerpc.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_powerpc.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_powerpc.deb
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_s390.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_s390.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_s390.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_s390.deb
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/libg/libgd/libgd-dev_1.8.4-17.woody4_sparc.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd-noxpm-dev_1.8.4-17.woody4_sparc.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1_1.8.4-17.woody4_sparc.deb http://security.debian.org/pool/updates/main/libg/libgd/libgd1-noxpm_1.8.4-17.woody4_sparc.deb
These files will probably be moved into the stable distribution on
its next update.
http://security.debian.org/ stable/updates mainftp://security.debian.org/debian-security dists/stable/updates/maindebian-security-announce@lists.debian.org http://packages.debian.org/<pkg>
Mandrakelinux
Mandrakelinux Security Update Advisory
Package name: libxpm4
Problem Description:
The previous libxpm4 update had a linking error that resulted in a missing
s_popen symbol error running applications dependant on the library. In
addition, the file path checking in the security updates prevented some
applications, like gimp-2.0 from being able to save xpm format images.
Updated packages are patched to correct all these issues.
Updated Packages:
Mandrakelinux 10.0:
Mandrakelinux 10.0/AMD64:
Mandrakelinux 10.1:
Mandrakelinux 10.1/X86_64:
Corporate Server 2.1:
Corporate Server 2.1/x86_64:
Mandrakelinux 9.2:
Mandrakelinux 9.2/AMD64:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandrakesoft for security. You can obtain
the GPG public key of the Mandrakelinux Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandrakelinux at:
http://www.mandrakesoft.com/security/advisories
If you want to report vulnerabilities, please contact
security_linux-mandrake.com
Type Bits/KeyID Date User ID
Fedora Core Linux
Product : Fedora Core 3
Description :
Fri Nov 19 2004 Warren Togami <wtogami@redhat.com> 1.4.3a-6.FC3
Fri Nov 19 2004 Warren Togami <wtogami@redhat.com> 1.4.3a-7
CAN-2004-1036 Cross Site Scripting in encoded text
#112769 updated splash screens
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/
f3214fb13b71f13ac46fe6c440c09ad4 SRPMS/squirrelmail-1.4.3a-6.FC3.src.rpm
This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.
Product : Fedora Core 2
Description :
Fri Nov 19 2004 Warren Togami <wtogami@redhat.com> 1.4.3a-6.FC2
Fri Nov 19 2004 Warren Togami <wtogami@redhat.com> 1.4.3a-7
CAN-2004-1036 Cross Site Scripting in encoded text
#112769 updated splash screens
Thu Oct 14 2004 Warren Togami <wtogami@redhat.com> 1.4.3a-5
Wed Oct 13 2004 Warren Togami <wtogami@redhat.com> 1.4.3a-4
Tue Aug 31 2004 Warren Togami <wtogami@redhat.com> 1.4.3-2
#125638 config_local.php and default_pref in /etc/squirrelmail/
to match upstream RPM. This should allow smoother drop-in
replacements and upgrades.
other spec cleanup.
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/
ef1c31c817be7a19cb217f17c79fda8c SRPMS/squirrelmail-1.4.3a-6.FC2.src.rpm
This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.
Netwosix
Linux Netwosix Security Announcement Italyhttp://www.netwosix.org> ; by Vincenzo Ciaglia
Together with the new release of "Linux Netwosix 1.2 Jinko"
(http://www.netwosix.org/announce.html ), NEPOTE (NEtwosix POrting Tool
Environment) has been updated with fixed packages. All the users are invited
to update their version to the latest one to avoid some security problems for
their own systems and upgrade every packages.
You can download the latest version of Nepote from one of the official mirror
at http://download.netwosix.org/ (directory /nepote) and follow the
instructions in the file "ports.readme".
Cheers,http://www.netwosix.org >
