pcre-devel-4.5-3.2.RHEL4.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2491
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2005 Red Hat, Inc.
Slackware Linux
[slackware-security] kcheckpass in kdebase (SSA:2005-251-01)
New kdebase packages are available for Slackware 10.0, 10.1, and -current to
fix a security issue with the kcheckpass program. Earlier versions of
Slackware are not affected. A flaw in the way the program creates lockfiles
could allow a local attacker to gain root privileges.
For more details about the issue, see:
http://www.kde.org/info/security/advisory-20050905-1.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2494
Here are the details from the Slackware 10.1 ChangeLog:
+--------------------------+
patches/packages/kdebase-3.3.2-i486-2.tgz: Patched a security bug in
kcheckpass that could allow a local user to gain root privileges.
For more information, see:
http://www.kde.org/info/security/advisory-20050905-1.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2494
(* Security fix *)
+--------------------------+
Updated package for Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/kdebase-3.2.3-i486-3.tgz
Updated package for Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/kdebase-3.3.2-i486-2.tgz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/kde/kdebase-3.4.2-i486-2.tgz
Slackware 10.0 package:
89cbad3536bbfba273b2ae77a097ce89 kdebase-3.2.3-i486-3.tgz
Slackware 10.1 package:
6d2d8c96dc1f5b209b5eb35425ae7952 kdebase-3.3.2-i486-2.tgz
Slackware -current package:
8b7066a01eb25a8b846d2ac9a5de85e2 kdebase-3.4.2-i486-2.tgz
Upgrade the package as root:
# upgradepkg kdebase-3.3.2-i486-2.tgz
+-----+
[slackware-security] mod_ssl (SSA:2005-251-02)
New mod_ssl packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1,
and -current to fix a security issue. If "SSLVerifyClient optional" was
configured in the global section of the config file, it could improperly
override "SSLVerifyClient require" in a per-location section.
More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2700
Here are the details from the Slackware 10.1 ChangeLog:
+--------------------------+
patches/packages/mod_ssl-2.8.24_1.3.33-i486-1.tgz: Upgraded to
mod_ssl-2.8.24-1.3.33. From the CHANGES file:
Fix a security issue (CAN-2005-2700) where "SSLVerifyClient require" was
not enforced in per-location context if "SSLVerifyClient optional" was
configured in the global virtual host configuration.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2700
(* Security fix *)
+--------------------------+
Updated package for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/mod_ssl-2.8.24_1.3.33-i386-1.tgz
Updated package for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/mod_ssl-2.8.24_1.3.33-i386-1.tgz
Updated package for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/mod_ssl-2.8.24_1.3.33-i486-1.tgz
Updated package for Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/mod_ssl-2.8.24_1.3.33-i486-1.tgz
Updated package for Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/mod_ssl-2.8.24_1.3.33-i486-1.tgz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/mod_ssl-2.8.24_1.3.33-i486-1.tgz
Slackware 8.1 package:
469f8428c07cd2e737e5937ec15d5493 mod_ssl-2.8.24_1.3.33-i386-1.tgz
Slackware 9.0 package:
3aec2d3362e320655801d3c96b6e0a65 mod_ssl-2.8.24_1.3.33-i386-1.tgz
Slackware 9.1 package:
d6e3e52c94a07720804f11a8b6ae637f mod_ssl-2.8.24_1.3.33-i486-1.tgz
Slackware 10.0 package:
cc304adec35e4fe0aa998dfb4033c480 mod_ssl-2.8.24_1.3.33-i486-1.tgz
Slackware 10.1 package:
4c2da461e7fec6fac6a392b18ca67717 mod_ssl-2.8.24_1.3.33-i486-1.tgz
Slackware -current package:
588e2f479a46fcb149b964d4fc747a78 mod_ssl-2.8.24_1.3.33-i486-1.tgz
First, stop apache:
# apachectl stop
The upgrade will should save the important config files for mod_ssl,
nevertheless it's a good idea to backup any keys/certificates you wish
to save for mod_ssl (in /etc/apache/ssl.*), then upgrade mod_ssl:
# upgradepkg mod_ssl-2.8.24_1.3.33-i486-1.tgz
If necessary, restore any mod_ssl config files.
Finally, restart apache:
# apachectl startssl
+-----+
[slackware-security] php5 in Slackware 10.1 (SSA:2005-251-04)
A new php5 package is available for Slackware 10.1 in /testing to fix
security issues. PHP has been relinked with the shared PCRE library
to fix an overflow issue with PHP's builtin PRCE code, and
PEAR::XMLRPC has been upgraded to version 1.4.0 which eliminates the
eval() function. The eval() function is believed to be insecure as
implemented, and would be difficult to secure.
Note that this new package now requires that the PCRE package be
installed, so be sure to get the new package from the patches/packages/
directory if you don't already have it.
More details about these issues may be found in the Common
Vulnerabilities and Exposures (CVE) database:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2491
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2498
Here are the details from the Slackware 10.1 ChangeLog:
+--------------------------+
testing/packages/php-5.0.5/php-5.0.5-i486-1.tgz: Upgraded to
php-5.0.5, which fixes security issues with XML-RPC and PCRE.
This new package now links with the system's shared PCRE library,
so be sure you have the new PCRE package from patches/packages/
installed.
Ordinarily packages in /testing are not considered supported, but
several people have written to say that they are using php5 from
/testing in a production environment and would like to see an
updated package, so here it is. The package in /testing was
replaced in /testing rather than putting it under /patches to
avoid any problems with automatic upgrade tools replacing php-4
packages with this one.
For more information on the security issues fixed, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2491
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2498
(* Security fix *)
+--------------------------+
Updated package for Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/testing/packages/php-5.0.5/php-5.0.5-i486-1.tgz
Slackware 10.1 package:
8926968bdfa8bd2103048bd2c21ad07c php-5.0.5-i486-1.tgz
First, stop apache:
# apachectl stop
Next, upgrade to the new PHP package:
# upgradepkg php-5.0.5-i486-1.tgz
Finally, restart apache:
# apachectl start (or: apachectl startssl)
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
