Several vulnerabilities have been discovered in Squirrelmail, a
commonly used webmail system. The Common Vulnerabilities and
Exposures project identifies the following problems:
CVE-2006-0188
Martijn Brinkers and Ben Maurer found a flaw in webmail.php that
allows remote attackers to inject arbitrary web pages into the right
frame via a URL in the right_frame parameter.
CVE-2006-0195
Martijn Brinkers and Scott Hughes discovered an interpretation
conflict in the MagicHTML filter that allows remote attackers to
conduct cross-site scripting (XSS) attacks via style sheet
specifiers with invalid (1) "/*" and "*/" comments, or (2) slashes
inside the "url" keyword, which is processed by some web browsers
including Internet Explorer.
CVE-2006-0377
Vicente Aguilera of Internet Security Auditors, S.L. discovered a
CRLF injection vulnerability, which allows remote attackers to
inject arbitrary IMAP commands via newline characters in the mailbox
parameter of the sqimap_mailbox_select command, aka "IMAP
injection." There's no known way to exploit this yet.
For the old stable distribution (woody) these problems have been fixed in
version 1.2.6-5.
For the stable distribution (sarge) these problems have been fixed in
version 2:1.4.4-8.
For the unstable distribution (sid) these problems have been fixed in
version 2:1.4.6-1.
We recommend that you upgrade your squirrelmail package.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Updated XFree86 packages that fix security issues are now available.
XFree86 is an open source implementation of the X Window System. It
provides the basic low-level functionality that full-fledged graphical
user interfaces (GUIs) such as GNOME and KDE are designed upon.
2. Relevant releases/architectures:
Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
Fedora Core 1 - i386
3. Problem description:
An integer overflow flaw was found in libXpm, which is used by some
applications for loading of XPM images. An attacker could create a
malicious XPM file that would execute arbitrary code if opened by a
victim using an application linked to the vulnerable library. The Common
Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the
name CVE-2005-0605 to this issue.
Several integer overflow bugs were found in the way XFree86 parses
pixmap images. It is possible for a user to gain elevated privileges by
loading a specially crafted pixmap image. The Common Vulnerabilities and
Exposures project (cve.mitre.org/) has assigned the name CVE-2005-2495 to
this issue.
Users of XFree86 should upgrade to these updated packages, which contain
backported patches and are not vulnerable to these issues.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which
are not installed but included in the list will not be updated. Note
that you can also use wildcards (*.rpm) if your current directory only
contains the desired RPMs.
Please note that this update is also available via yum and apt. Many
people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system. This assumes that you
have yum or apt-get configured for obtaining Fedora Legacy content.
Please visit http://www.fedoralegacy.org/docs for directions on how to
configure yum and apt-get.
Updated X.org packages that fix a security issue are now available.
X.org is an open source implementation of the X Window System. It
provides the basic low-level functionality that full-fledged graphical
user interfaces (GUIs) such as GNOME and KDE are designed upon.
2. Relevant releases/architectures:
Fedora Core 2 - i386
3. Problem description:
Several integer overflow bugs were found in the way X.org parses
pixmap images. It is possible for a user to gain elevated privileges by
loading a specially crafted pixmap image. The Common Vulnerabilities and
Exposures project (cve.mitre.org/) has assigned the name CVE-2005-2495 to
this issue.
Users of X.org should upgrade to these updated packages, which contain a
backported patch and are not vulnerable to this issue.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which
are not installed but included in the list will not be updated. Note
that you can also use wildcards (*.rpm) if your current directory only
contains the desired RPMs.
Please note that this update is also available via yum and apt. Many
people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system. This assumes that you
have yum or apt-get configured for obtaining Fedora Legacy content.
Please visit http://www.fedoralegacy.org/docs for directions on how to
configure yum and apt-get.
Synopsis: Updated pcre packages fix a security issue
Advisory ID: FLSA:168516
Issue date: 2006-03-07
Product: Red Hat Linux, Fedora Core
Keywords: Bugfix
CVE Names: CVE-2005-2491
1. Topic:
Updated pcre packages are now available to correct a security issue.
PCRE is a Perl-compatible regular expression library.
2. Relevant releases/architectures:
Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
Fedora Core 1 - i386
Fedora Core 2 - i386
3. Problem description:
An integer overflow flaw was found in PCRE, triggered by a maliciously
crafted regular expression. On systems that accept arbitrary regular
expressions from untrusted users, this could be exploited to execute
arbitrary code with the privileges of the application using the library.
The Common Vulnerabilities and Exposures project assigned the name
CVE-2005-2491 to this issue.
Users should update to these erratum packages that contain a backported
patch to correct this issue.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which
are not installed but included in the list will not be updated. Note
that you can also use wildcards (*.rpm) if your current directory only
contains the desired RPMs.
Please note that this update is also available via yum and apt. Many
people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system. This assumes that you
have yum or apt-get configured for obtaining Fedora Legacy content.
Please visit http://www.fedoralegacy.org/docs for directions on how to
configure yum and apt-get.
A flaw was discovered in gpdf. An attacker could construct a carefully
crafted PDF file that would cause gpdf to consume all available disk
space in /tmp when opened. The Common Vulnerabilities and Exposures
project assigned the name CVE-2005-2097 to this issue.
Several flaws were discovered in gpdf. An attacker could construct a
carefully crafted PDF file that could cause gpdf to crash or possibly
execute arbitrary code when opened. The Common Vulnerabilities and
Exposures project assigned the names CVE-2005-3191, CVE-2005-3192,
CVE-2005-3193, CVE-2005-3624, CVE-2005-3625, CVE-2005-3626,
CVE-2005-3627 and CVE-2005-3628 to these issues.
Users of gpdf should upgrade to this updated package, which contains
backported patches to resolve these issues.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which
are not installed but included in the list will not be updated. Note
that you can also use wildcards (*.rpm) if your current directory only
contains the desired RPMs.
Please note that this update is also available via yum and apt. Many
people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system. This assumes that you
have yum or apt-get configured for obtaining Fedora Legacy content.
Please visit http://www.fedoralegacy.org/docs for directions on how to
configure yum and apt-get.
Package : kdegraphics
Date : March 8, 2006
Affected: 2006.0, Corporate 3.0
Problem Description:
Marcelo Ricardo Leitner discovered the official published kpdf
patches for several previous xpdf vulnerabilities were lacking some
hunks published by upstream xpdf. As a result, kpdf is still
vulnerable to certain carefully crafted pdf files.
Although previous updates captured most of these changes, this new
update picks up some of the missing patches.
The updated packages have been patched to correct these problems.
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
Red Hat Linux
Red Hat Security Advisory
Synopsis: Updated kernel packages available for Red Hat Enterprise Linux 4 Update 3
Advisory ID: RHSA-2006:0132-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2006-0132.html
Issue date: 2006-03-07
Updated on: 2006-03-07
Product: Red Hat Enterprise Linux
CVE Names: CVE-2006-0095
1. Summary:
Updated kernel packages are now available as part of ongoing support
and maintenance of Red Hat Enterprise Linux version 4. This is the
third regular update.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 4 - i386, ia64, noarch, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, noarch, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, noarch, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, noarch, x86_64
3. Problem description:
The Linux kernel handles the basic functions of the operating system.
This is the third regular kernel update to Red Hat Enterprise Linux 4.
New features introduced in this update include:
Open InfiniBand (OpenIB) support
Serial Attached SCSI support
NFS access control lists, asynchronous I/O
IA64 multi-core support and sgi updates
Large SMP CPU limits increased using the largesmp kernel: Up to 512 CPUs
in ia64, 128 in ppc64, and 64 in AMD64 and Intel EM64T
Improved read-ahead performance
Common Internet File System (CIFS) update
Device mapper mirroring
Error Detection and Correction (EDAC) modules
Unisys support
There were several bug fixes in various parts of the kernel. The ongoing
effort to resolve these problems has resulted in a marked improvement
in the reliability and scalability of Red Hat Enterprise Linux 4.
The following security bug was fixed in this update:
- dm-crypt did not clear a structure before freeing it, which could allow
local users to discover information about cryptographic keys (CVE-2006-0095)
The following device drivers have been upgraded to new versions:
cciss: 2.6.8 to 2.6.8-rh1
ipmi_devintf: 33.4 to 33.11
ipmi_msghandler: 33.4 to 33.11
ipmi_poweroff: 33.4 to 33.11
ipmi_si: 33.4 to 33.11
ipmi_watchdog: 33.4 to 33.11
mptbase: 3.02.18 to 3.02.60.01rh
e1000: 6.0.54-k2-NAPI to 6.1.16-k2-NAPI
ixgb: 1.0.95-k2-NAPI to 1.0.100-k2-NAPI
tg3: 3.27-rh to 3.43-rh
aacraid: 1.1.2-lk2 to 1.1-5[2412]
ahci: 1.01 to 1.2
ata_piix: 1.03 to 1.05
iscsi_sfnet: 4:0.1.11-1 to 4:0.1.11-2
libata: 1.11 to 1.20
qla2100: 8.01.00b5-rh2 to 8.01.02-d3
qla2200: 8.01.00b5-rh2 to 8.01.02-d3
qla2300: 8.01.00b5-rh2 to 8.01.02-d3
qla2322: 8.01.00b5-rh2 to 8.01.02-d3
qla2xxx: 8.01.00b5-rh2 to 8.01.02-d3
qla6312: 8.01.00b5-rh2 to 8.01.02-d3
sata_nv: 0.6 to 0.8
sata_promise: 1.01 to 1.03
sata_svw: 1.06 to 1.07
sata_sx4: 0.7 to 0.8
sata_vsc: 1.0 to 1.1
cifs: 1.20 to 1.34
All Red Hat Enterprise Linux 4 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
108616 - RHEL4 (IPF): Support for Additional function in Intel's Monticeto processor (HW)
108827 - RHEL4: Infiniband support
131889 - RHEL4 U2: SATA ATAPI support (including ESB2)
139949 - sym driver creates voluminous /var/log/messages entries
141699 - FEAT: RHEL 4 U3: ia64 needs hint@pause in spinloop
141851 - spin loops on both ia32 and ia32e need cpu_relax
144477 - bonding mode=6 + dhcp doesn't work correctly
144703 - ia32 apps that are not large file aware can access files >= 4GB
145061 - SMART support in SATA driver (P1)
149294 - qlogic fabric rediscovery functionality missing
150893 - On few Nocona based platforms, acpi-cpufreq driver assumes the wrong CPU freq at boot time
151549 - RHEL 4 Kernel does not provide ACL support over NFS
152036 - Amanda hangs on backup in case of ip_conntrack_amanda is used (RHEL4)
153971 - large usb flash drive require reboot to mount more than once
154387 - umount fails on nfs server side when nfs client does heavy io
155017 - Unisys' x86_64 ES7000 loses legacy devices during boot when using latest ES7000 platform code
156437 - Writing large file to 1TB ext3 volume sometimes very slow
156602 - SCTP memory consumption, additional fixes
156785 - Missing SHUTDOWN notification with SCTP stream socket
157241 - [RHEL4-U3] PCI Hotplug - Slot powered off after enabling
157586 - ES7000 systems won't boot with large configuration
159869 - Diskdump fails through ipr driver
160308 - USB Key stops working after upgrade to U1
160844 - dangling POSIX locks after close
161101 - Assertion failure in journal_commit_transaction() at fs/jbd/commit.c:790: "jh->b_next_transaction == ((void *)0)"
161362 - Oracle Hangs with directio and aio using NFS
161597 - sysfs_remove_dir() de-references NULL pointer
161617 - RHEL4 Panics at smp_apic_timer_interrupt
161846 - Problem with b44: SIOCSIFFLAGS: Cannot allocate memory
162094 - read() with count > 0xffffffff panics kernel at fs/direct-io.c:886
162731 - [RHEL4] 'getpriority/setpriority' broken with PRIO_USER, who=0
162732 - io_cancel doesn't work properly
162759 - System occasionally experienced system hangs.
162814 - Assertion failure in log_do_checkpoint
163150 - request backport of fc transport class HBA port_id for dm-multipath
163738 - Kernel PANIC - not syncing: fatal exception
163741 - qetharp 'Operation not supported' on non-layer2 guestlan
164298 - PANIC at rpc_wake_up_status
164547 - Bug in IPv6 address adding error path
165018 - Bonding driver fails to switch to backup link
165092 - Bugs in kernel key managment syscall interface
165154 - Bad order for release_region in error exit from i810_probe
165741 - acct does not have Large File Support
165744 - 2.6: /sbin/service iptables stop hangs on modprobe -r ipt_state
165959 - NFS/RPC - timestamp conversion is wrong
166454 - rpmbuild --rebuild glibc-2.3.4-2.12.src.rpm hangs (same problem with glibc-2.3.4-2.9.src.rpm)
166524 - Erratic behaviour when system fd limit reached
166544 - 2.6.9-16.ELsmp null pointer dereference in __bounce_end_io_read on x86_64
166589 - mount/umount can cause the block device reads to fail
166880 - [RHEL4 U1] OOPS removing ahci driver
167115 - [RHEL4 U1] Bonding driver does not switch to backup interface upon active interface failure under heavy UDP traffic
167192 - NFSv3 locking misses important kernel patches
167211 - RHEL4 Panic in __wake_up_common (networking)
167630 - Multicast domain membership doesn't follow bonding failover
167634 - RHEL4 __copy_user breaks on unaligned src
167645 - RHEL4 U2 performance regression running enterprise workload
167730 - FEAT RHEL4 U3: 10GigE Neterion Driver Update (S2io)
167731 - [RHEL4] hangcheck-timer not compiled in RHEL4 on IA64
167907 - SCTP association restart problem, possible backport
168090 - ipmi_poweroff driver update for Dell <8G servers
168262 - [RHEL4 U1][diskdump] Diskdump from OS_INIT fails.
168431 - autofs removes leading path components of /net mounts on timeout
168483 - FEAT: [RHEL4 U3] kernel dm: Statistic information about dm devices (*)
168775 - wait() and waitpid() return inconsistencies under high load
168824 - [FEAT:][RHEL 4 U3]LVM2 Snapshot support of root
169042 - [Texas Instruments] nfs bindresvport: Address already in use
169149 - oops in gss_pipe_release()
169184 - ls hangs on krb5 mountd when user has not kinit-ed
169197 - NFS client oops when debugging is on
170146 - CRM648268: kernel reporting init process cutime as very large negative value
170423 - Cache invalidation bug in nfs v3
170487 - Bad: kernel panic on boot (kernel-2.6.9-22.EL)
170546 - kernel_lock() problem through NFS mount
170656 - iSCSI connection recovery uses session address instead of portal address
170864 - device-mapper mirroring backwards compatibility issue
170887 - Neterion(S2io) adapter not functional after running offline diagnostics
170985 - RHEL 4 Update 2 Incompatibility with VMware ESX 2.5.2
171060 - Marvell Yukon 88E8050 ethernet interface not supported
171112 - Kernel oops killing process with open files on a NFS3 krb5 mount after /var/lib/nfs/rpc_pipefs has been unmounted
171141 - FEAT RHEL4 U3 [diskdump]: kernel - support compressing dump data
171220 - USB: khubd deadlock on error path
171705 - Kernel key management facility improvements
171715 - nfsd: clear signals before exiting the nfsd() thread
171765 - linux-2.6.13-key-reiserfs.patch is incomplete
171950 - Can't reboot on IBM xSeries 236.
171985 - rhel4 u2 - Null pointer dereference in alc880_auto_fill_dac_nids
171989 - rhel4 modules loading signing issue
172081 - rename(2) onto an empty directory fails on NFS file systems
172214 - Large LUNS can't be seen with Hitachi Open-L SAN
172393 - No analog audio with the "Intel Corporation Enterprise Southbridge High Definition Audio (rev 08)"
172487 - Difficulty with some iSCSI targets in iscsi_sfnet
172595 - netpoll can dereference a null pointer, causing a system crash
172598 - [RHEL4] tuxstat SIGSEGV
172839 - NMI watchdog panic during cache_alloc_refill with corrupt size-128 slabcache
172892 - kernel dm: dm-ioctl memory leak on attempt to load non-existing mapping
172920 - Lock at "Initializing hardware... storage network" caused by ULi HD Audio controller enabled.
172986 - autofs doesn't remount if nfs server is unreachable at expire time
173155 - kernel dm: DM_LIST_VERSIONS_CMD ioctl reponse truncated
173156 - kernel dm: Notify userspace when a device is renamed.
173157 - kernel dm-log: big endian 64-bit corruption
173158 - kernel dm-log: Make mirror log arch-independent
173159 - kernel dm: move bdget outside lockfs
173161 - kernel dm: Make lock_fs optional.
173163 - kernel dm snapshot: Separate out metadata reading.
173164 - kernel dm snapshot: Load metadata on table creation not resumption.
173166 - kernel dm snapshot: Reduce PF_MEMALLOC usage
173174 - kernel dm multipath: Fix do_end_io locking.
173194 - race condition when expiring ghosted autofs mounts
173206 - kernel dm snapshot: bio_list_merge fix
173304 - Fix for SystemTap bugzilla #1345 - return probe on do_execve
173354 - unable to create sgi_sn/ptc_statistics" printed to the console
173486 - Further key management facility improvements
173493 - Permit key management to request already running process to instantiate a key
173912 - GFS deadlock - gfs_write (do_write_direct) and gfs_setattr (do_truncate)
173981 - kernel bug at mm/prio_tree.c
174427 - SCSI errors with latest qlogic driver
174760 - Provide support for more than 8 logical processors
174895 - System became unresponsive to local commands.
175123 - Diskdump overwrite by SATA update
175132 - Audit fails to record syscall failures when asked to via auditctl
175415 - [audit][PATCH] New user space message types
175680 - broken U3 modsyms
175687 - autofs doesn't attempt to remount failed mount points
175728 - Kernel panic. Server hangs and is totally unresponsive until a power cycle brings it back online.
175812 - setxattr() to a file on NFS returns EIO
175988 - hang-check timer needs to be build on S390/S390x
176825 - broken memsets in s390 drivers.
177031 - device-mapper mirror log: avoid overrun while syncing
177136 - CVE-2006-0095 dm-crypt key leak
177445 - Please consider upping NR_CPUS to 16 for x86_64
177492 - Early panic in "io_apic_get_unique_id" on 4CPU, dual-core HT enabled EM64T System
177522 - Kernel panic while running NFS ACL test
177527 - Add aic94xx and sas code into RHEL4 U3
177561 - Largesmp kernel does not see all logical CPUs on IBM x460
177620 - kernel device-mapper snapshot: barriers are not supported
177634 - AIM7 File Server Performance -15% relative to U2
177719 - BIOS bug shows the wrong number of CPUs
178839 - CPU's being incorrectly numbered
178975 - /proc/cpuinfo shows wrong value
179057 - SCSI LLDD's oops on rmmod if devices scan w/ PQ=3
179751 - lvremove panic in dm_mod:kcopyd_client_destroy while attempting to remove a snapshot
180353 - NPTL: under xterm -e process receives SIGHUP when child thread exits
180405 - kabi violation in multi-core detection patch
181574 - device-mapper mirror removal stuck on kcopyd_client_destroy (pvmove hangs)
181884 - RHEL4 U3 "noht" boot parameter sometimes disables dual core support as well as ht support
