ruby-tcltk-1.8.1-7.EL4.3.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1931
http://www.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2006 Red Hat, Inc.
Slackware Linux
[slackware-security] Apache httpd (SSA:2006-129-01)
New Apache packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1,
10.2, and -current to fix security issues.
More details about the issues may be found in the Common
Vulnerabilities and Exposures (CVE) database:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3352
In addition, new mod_ssl packages for Apache 1.3.35 are available for
all of these versions of Slackware, and new versions of PHP are
available for Slackware -current. These additional packages do not
fix security issues, but may be required on your system depending on
your Apache setup.
One more note about this round of updates: the packages have been given
build versions that indicate which version of Slackware they are meant
to patch, such as -1_slack8.1, or -1_slack9.0, etc. This should help to
avoid some of the issues with automatic upgrade tools by providing a
unique package name when the same fix is deployed across multiple
Slackware versions. Only patches applied to -current will have the
simple build number, such as -1.
Here are the details from the Slackware 10.2 ChangeLog:
+--------------------------+
patches/packages/apache-1.3.35-i486-1_slack10.2.tgz:
Upgraded to apache-1.3.35.
From the official announcement:
Of particular note is that 1.3.35 addresses and fixes 1 potential
security issue: CVE-2005-3352 (cve.mitre.org/)
mod_imap: Escape untrusted referer header before outputting in HTML
to avoid potential cross-site scripting. Change also made to
ap_escape_html so we escape quotes. Reported by JPCERT
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3352
(* Security fix *)
patches/packages/mod_ssl-2.8.26_1.3.35-i486-1_slack10.2.tgz:
Upgraded to mod_ssl-2.8.26-1.3.35.
This is an updated version designed for Apache 1.3.35.
+--------------------------+
Updated package for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/apache-1.3.35-i386-1_slack8.1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/mod_ssl-2.8.26_1.3.35-i386-1_slack8.1.tgz
Updated package for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/apache-1.3.35-i386-1_slack9.0.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/mod_ssl-2.8.26_1.3.35-i386-1_slack9.0.tgz
Updated package for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/apache-1.3.35-i486-1_slack9.1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/mod_ssl-2.8.26_1.3.35-i486-1_slack9.1.tgz
Updated package for Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/apache-1.3.35-i486-1_slack10.0.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/mod_ssl-2.8.26_1.3.35-i486-1_slack10.0.tgz
Updated package for Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/apache-1.3.35-i486-1_slack10.1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/mod_ssl-2.8.26_1.3.35-i486-1_slack10.1.tgz
Updated package for Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/apache-1.3.35-i486-1_slack10.2.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/mod_ssl-2.8.26_1.3.35-i486-1_slack10.2.tgz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/apache-1.3.35-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/mod_ssl-2.8.26_1.3.35-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/php-4.4.2-i486-4.tgz
Slackware 8.1 packages:
208bbe94a46f8d05e15f1ccdb38f9a91 apache-1.3.35-i386-1_slack8.1.tgz
9172a6d347df033d024a7ba786c47bfe mod_ssl-2.8.26_1.3.35-i386-1_slack8.1.tgz
Slackware 9.0 packages:
0482ca192a7b94c254421c717634e628 apache-1.3.35-i386-1_slack9.0.tgz
913763c2e12d6d2a101ce4a539f060f3 mod_ssl-2.8.26_1.3.35-i386-1_slack9.0.tgz
Slackware 9.1 packages:
d96044932ab33623425c328862a3750f apache-1.3.35-i486-1_slack9.1.tgz
ae58ab559c60a475330514dca689d735 mod_ssl-2.8.26_1.3.35-i486-1_slack9.1.tgz
Slackware 10.0 packages:
2beb7c88f4f28adbe61e13d79889a27e apache-1.3.35-i486-1_slack10.0.tgz
403f1297bcc9cff0df3f9afcb16d69b6 mod_ssl-2.8.26_1.3.35-i486-1_slack10.0.tgz
Slackware 10.1 packages:
4a0b68ddf002a300e536e584c3eb2923 apache-1.3.35-i486-1_slack10.1.tgz
f24d6776f221cc61f2b0b98cd1fc1ae9 mod_ssl-2.8.26_1.3.35-i486-1_slack10.1.tgz
Slackware 10.2 packages:
bbaed7e942e5f1c7380b3def44d54d74 apache-1.3.35-i486-1_slack10.2.tgz
e70a300f5c4333ae1d31e8d852b89dc3 mod_ssl-2.8.26_1.3.35-i486-1_slack10.2.tgz
Slackware -current packages:
b662f564f048ace17eaafc7e50bed7b2 apache-1.3.35-i486-1.tgz
c7d403fc891e210d1f1a71c559939cd5 mod_ssl-2.8.26_1.3.35-i486-1.tgz
fb78ce30aece8d8718ed722be319dd2b php-4.4.2-i486-4.tgz
First, stop apache:
# apachectl stop
Then, upgrade the apache package:
# upgradepkg apache-1.3.35-i486-1_slack10.2.tgz
If you use mod_ssl, you'll also need to upgrade that package. The
upgrade should save the important config files for mod_ssl,
nevertheless it's a good idea to backup any keys/certificates you wish
to save for mod_ssl (in /etc/apache/ssl.*), then upgrade mod_ssl:
# upgradepkg mod_ssl-2.8.26_1.3.35-i486-1_slack10.2.tgz
If necessary, restore any mod_ssl config files.
If you are using PHP on Slackware -current, upgrade the PHP package.
Finally, restart apache:
# apachectl start
Or, if you use mod_ssl:
# apachectl startssl
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
[slackware-security] mysql (SSA:2006-129-02)
New mysql packages are available for Slackware 10.2 and -current to
fix security issues. The MySQL package shipped with Slackware 10.2
may possibly leak sensitive information found in uninitialized
memory to authenticated users. The MySQL package previously in
Slackware -current also suffered from these flaws, but an additional
overflow could allow arbitrary code execution.
Since the vulnerabilities require a valid login and/or access to the
database server, the risk is moderate. Slackware does not provide
network access to a MySQL database by default.
More details about the issues may be found in the Common
Vulnerabilities and Exposures (CVE) database.
Issues that affect both Slackware 10.2 and -current:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1516
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1517
An issue affecting only Slackware -current:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1518
Here are the details from the Slackware 10.2 ChangeLog:
+--------------------------+
patches/packages/mysql-4.1.19-i486-1.tgz:
Upgraded to mysql-4.1.19.
This fixes some minor security issues with possible information leakage.
Note that the information leakage bugs require that the attacker have
access to an account on the database. Also note that by default,
Slackware's rc.mysqld script does not allow access to the database
through the outside network (it uses the --skip-networking option).
If you've enabled network access to MySQL, it is a good idea to filter
the port (3306) to prevent access from unauthorized machines.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1516
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1517
(* Security fix *)
+--------------------------+
Here are the details from the Slackware -current ChangeLog:
+--------------------------+
ap/mysql-5.0.21-i486-1.tgz: Upgraded to mysql-5.0.21.
This fixes some security issues, including possible information leakage, and
execution of arbitrary code. Note that the information leakage bugs require
that the attacker have access to an account on the database. Also note that
by default, Slackware's rc.mysqld script does not allow access to the
database through the outside network (it uses the --skip-networking option).
If you've enabled network access to MySQL, it is a good idea to filter the
port (3306) to prevent access from unauthorized machines.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1516
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1517
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1518
(* Security fix *)
+--------------------------+
Updated package for Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/mysql-4.1.19-i486-1.tgz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/mysql-5.0.21-i486-1.tgz
Slackware 10.2 package:
c229e19d782404da119be46355a170d2 mysql-4.1.19-i486-1.tgz
Slackware -current package:
51008b23954c0d82c2670290476d0249 mysql-5.0.21-i486-1.tgz
Upgrade the package as root:
# upgradepkg mysql-4.1.19-i486-1.tgz
Then, restart the database server:
# sh /etc/rc.d/rc.mysqld restart
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
