:Advisories, August 6, 2006
Advisories, August 6, 2006 0 Talkback[s]
Debian GNU/Linux
Debian Security Advisory DSA 1141-1 security@debian.org http://www.debian.org/security/ Martin Schulzehttp://www.debian.org/security/faq
Package : gnupg2
Evgeny Legerov discovered that overly large comments can crash gnupg,
the GNU privacy guard - a free PGP replacement, which is also present
in the development branch.
For the stable distribution (sarge) this problem has been fixed in
version 1.9.15-6sarge2.
For the unstable distribution (sid) this problem will be fixed soon.
We recommend that you upgrade your gnupg2 package.
Upgrade Instructions
wget url
will fetch the file for you
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given at the end of this advisory:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
Source archives:
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge2.dsc http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge2.diff.gz http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15.orig.tar.gz
Alpha architecture:
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge2_alpha.deb http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge2_alpha.deb http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge2_alpha.deb
AMD64 architecture:
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge2_amd64.deb http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge2_amd64.deb http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge2_amd64.deb
ARM architecture:
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge2_arm.deb http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge2_arm.deb http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge2_arm.deb
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge2_i386.deb http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge2_i386.deb http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge2_i386.deb
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge2_ia64.deb http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge2_ia64.deb http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge2_ia64.deb
HP Precision architecture:
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge2_hppa.deb http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge2_hppa.deb http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge2_hppa.deb
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge2_m68k.deb http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge2_m68k.deb http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge2_m68k.deb
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge2_mips.deb http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge2_mips.deb http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge2_mips.deb
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge2_mipsel.deb http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge2_mipsel.deb http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge2_mipsel.deb
PowerPC architecture:
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge2_powerpc.deb http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge2_powerpc.deb http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge2_powerpc.deb
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge2_s390.deb http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge2_s390.deb http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge2_s390.deb
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/g/gnupg2/gnupg-agent_1.9.15-6sarge2_sparc.deb http://security.debian.org/pool/updates/main/g/gnupg2/gnupg2_1.9.15-6sarge2_sparc.deb http://security.debian.org/pool/updates/main/g/gnupg2/gpgsm_1.9.15-6sarge2_sparc.deb
These files will probably be moved into the stable distribution on
its next update.
Debian Security Advisory DSA 1142-1 security@debian.org http://www.debian.org/security/ Martin Schulzehttp://www.debian.org/security/faq
Package : freeciv
Luigi Auriemma discovered missing boundary checks in freeciv, a clone
of the well known Civilisation game, which can be exploited by remote
attackers to cause a denial of service (crash) and possibly execute
arbitrary code.
For the stable distribution (sarge) these problems have been fixed in
version 2.0.1-1sarge2.
For the unstable distribution (sid) these problems will be fixed soon.
We recommend that you upgrade your freeciv package.
Upgrade Instructions
wget url
will fetch the file for you
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given at the end of this advisory:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
Source archives:
http://security.debian.org/pool/updates/main/f/freeciv/freeciv_2.0.1-1sarge2.dsc http://security.debian.org/pool/updates/main/f/freeciv/freeciv_2.0.1-1sarge2.diff.gz http://security.debian.org/pool/updates/main/f/freeciv/freeciv_2.0.1.orig.tar.gz
Architecture independent components:
http://security.debian.org/pool/updates/main/f/freeciv/freeciv-data_2.0.1-1sarge2_all.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-gtk_2.0.1-1sarge2_all.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-xaw3d_2.0.1-1sarge2_all.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv_2.0.1-1sarge2_all.deb
Alpha architecture:
http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-gtk_2.0.1-1sarge2_alpha.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-xaw3d_2.0.1-1sarge2_alpha.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-server_2.0.1-1sarge2_alpha.deb
AMD64 architecture:
http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-gtk_2.0.1-1sarge2_amd64.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-xaw3d_2.0.1-1sarge2_amd64.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-server_2.0.1-1sarge2_amd64.deb
ARM architecture:
http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-gtk_2.0.1-1sarge2_arm.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-xaw3d_2.0.1-1sarge2_arm.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-server_2.0.1-1sarge2_arm.deb
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-gtk_2.0.1-1sarge2_i386.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-xaw3d_2.0.1-1sarge2_i386.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-server_2.0.1-1sarge2_i386.deb
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-gtk_2.0.1-1sarge2_ia64.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-xaw3d_2.0.1-1sarge2_ia64.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-server_2.0.1-1sarge2_ia64.deb
HP Precision architecture:
http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-gtk_2.0.1-1sarge2_hppa.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-xaw3d_2.0.1-1sarge2_hppa.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-server_2.0.1-1sarge2_hppa.deb
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-gtk_2.0.1-1sarge2_m68k.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-xaw3d_2.0.1-1sarge2_m68k.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-server_2.0.1-1sarge2_m68k.deb
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-gtk_2.0.1-1sarge2_mips.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-xaw3d_2.0.1-1sarge2_mips.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-server_2.0.1-1sarge2_mips.deb
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-gtk_2.0.1-1sarge2_mipsel.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-xaw3d_2.0.1-1sarge2_mipsel.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-server_2.0.1-1sarge2_mipsel.deb
PowerPC architecture:
http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-gtk_2.0.1-1sarge2_powerpc.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-xaw3d_2.0.1-1sarge2_powerpc.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-server_2.0.1-1sarge2_powerpc.deb
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-gtk_2.0.1-1sarge2_s390.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-xaw3d_2.0.1-1sarge2_s390.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-server_2.0.1-1sarge2_s390.deb
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-gtk_2.0.1-1sarge2_sparc.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-client-xaw3d_2.0.1-1sarge2_sparc.deb http://security.debian.org/pool/updates/main/f/freeciv/freeciv-server_2.0.1-1sarge2_sparc.deb
These files will probably be moved into the stable distribution on
its next update.
Debian Security Advisory DSA 1143-1 security@debian.org http://www.debian.org/security/ Martin Schulzehttp://www.debian.org/security/faq
Package : dhcp
Justin Winschief and Andrew Steets discovered a bug in dhcp, the DHCP
server for automatic IP address assignment, which causes the server to
unexpectedly exit.
For the stable distribution (sarge) this problem has been fixed in
version 2.0pl5-19.1sarge2.
For the unstable distribution (sid) this problem will be fixed soon.
We recommend that you upgrade your dhcp package.
Upgrade Instructions
wget url
will fetch the file for you
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given at the end of this advisory:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
Source archives:
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sarge2.dsc http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sarge2.diff.gz http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5.orig.tar.gz
Alpha architecture:
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sarge2_alpha.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-19.1sarge2_alpha.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-19.1sarge2_alpha.deb
AMD64 architecture:
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sarge2_amd64.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-19.1sarge2_amd64.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-19.1sarge2_amd64.deb
ARM architecture:
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sarge2_arm.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-19.1sarge2_arm.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-19.1sarge2_arm.deb
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sarge2_i386.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-19.1sarge2_i386.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-19.1sarge2_i386.deb
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sarge2_ia64.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-19.1sarge2_ia64.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-19.1sarge2_ia64.deb
HP Precision architecture:
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sarge2_hppa.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-19.1sarge2_hppa.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-19.1sarge2_hppa.deb
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sarge2_m68k.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-19.1sarge2_m68k.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-19.1sarge2_m68k.deb
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sarge2_mips.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-19.1sarge2_mips.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-19.1sarge2_mips.deb
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sarge2_mipsel.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-19.1sarge2_mipsel.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-19.1sarge2_mipsel.deb
PowerPC architecture:
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sarge2_powerpc.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-19.1sarge2_powerpc.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-19.1sarge2_powerpc.deb
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sarge2_s390.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-19.1sarge2_s390.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-19.1sarge2_s390.deb
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/d/dhcp/dhcp_2.0pl5-19.1sarge2_sparc.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-client_2.0pl5-19.1sarge2_sparc.deb http://security.debian.org/pool/updates/main/d/dhcp/dhcp-relay_2.0pl5-19.1sarge2_sparc.deb
These files will probably be moved into the stable distribution on
its next update.
http://security.debian.org/ stable/updates mainftp://security.debian.org/debian-security dists/stable/updates/maindebian-security-announce@lists.debian.org http://packages.debian.org/<pkg>
Gentoo Linux
http://security.gentoo.org/
Severity: High
VNC servers created with LibVNCServer accept insecure protocol types,
even when the server does not offer it, resulting in unauthorized
access to the server.
LibVNCServer is a GPL'ed library for creating VNC servers.
LibVNCServer fails to properly validate protocol types effectively
letting users decide what protocol to use, such as "Type 1 - None".
LibVNCServer will accept this security type, even if it is not offered
by the server.
An attacker could use this vulnerability to gain unauthorized access
with the privileges of the user running the VNC server.
There is no known workaround at this time.
All LibVNCServer users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/libvncserver-0.8.2"
[ 1 ] CVE-2006-2450
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2450
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200608-05.xml
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org .
Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
http://security.gentoo.org/
Severity: Normal
Courier MTA has fixed a DoS issue related to usernames containing a "="
character.
Courier MTA is an integrated mail and groupware server based on open
protocols.
Courier MTA has fixed a security issue relating to usernames containing
the "=" character, causing high CPU utilization.
An attacker could exploit this vulnerability by sending a specially
crafted email to a mail gateway running a vulnerable version of Courier
MTA.
There is no known workaround at this time.
All Courier MTA users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=mail-mta/courier-0.53.2"
[ 1 ] CVE-2006-2659
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2659
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200608-06.xml
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org .
Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
http://security.gentoo.org/
Severity: Normal
libTIFF contains several vulnerabilities that could result in arbitrary
code execution.
libTIFF provides support for reading and manipulating TIFF images.
Tavis Ormandy of the Google Security Team discovered several heap and
stack buffer overflows and other flaws in libTIFF. The affected parts
include the TIFFFetchShortPair(), TIFFScanLineSize() and
EstimateStripByteCounts() functions, and the PixarLog and NeXT RLE
decoders.
A remote attacker could entice a user to open a specially crafted TIFF
file, resulting in the possible execution of arbitrary code.
There is no known workaround at this time.
All libTIFF users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/tiff-3.8.2-r2"
[ 1 ] CVE-2006-3459
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3459
[ 2 ] CVE-2006-3460
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3460
[ 3 ] CVE-2006-3461
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3461
[ 4 ] CVE-2006-3462
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3462
[ 5 ] CVE-2006-3463
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3463
[ 6 ] CVE-2006-3464
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3464
[ 7 ] CVE-2006-3465
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3465
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200608-07.xml
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org .
Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
http://security.gentoo.org/
Severity: High
GnuPG is vulnerable to an integer overflow that could lead to the
execution of arbitrary code.
The GNU Privacy Guard, GnuPG, is a free replacement for the PGP suite
of cryptographic software.
Evgeny Legerov discovered a vulnerability in GnuPG that when certain
packets are handled an integer overflow may occur.
By sending a specially crafted email to a user running an affected
version of GnuPG, a remote attacker could possibly execute arbitrary
code with the permissions of the user running GnuPG.
There is no known workaround at this time.
All GnuPG users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-crypt/gnupg-1.4.5"
[ 1 ] CVE-2006-3746
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3746
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200608-08.xml
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org .
Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Slackware Linux
[slackware-security] php (SSA:2006-217-01)
New php packages are available for Slackware 10.2 and -current to
fix security and other issues.
More details about these issues may be found on the PHP website:
http://www.php.net
Here are the details from the Slackware 10.2 ChangeLog:http://www.php.net
Updated package for Slackware 10.2:ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/php-4.4.3-i486-1_slack10.2.tgz
Updated package for Slackware -current:ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/php-4.4.3-i486-1.tgz
Slackware 10.2 package:
Slackware -current package:
Upgrade the package as root:
+-----+
Slackware Linux Security Teamhttp://slackware.com/gpg-key security@slackware.com
Trustix Secure Linux
Package names: apache, gnupg, libtiff
gnupgRFC2440 ).
libtiff
Problem description:
SECURITY Fix: A vulnerability has been reported in Apache HTTP Server,
which potentially can be exploited by malicious people to compromise
a vulnerable system. The vulnerability is caused by a off-by-one error
in mod_rewrite within the ldap scheme handling and can be exploited
to cause a one-byte buffer overflow.
The Common Vulnerabilities and Exposures project has assigned the
name CVE-2006-3747 to this issue.
gnupg < TSL 3.0 > < TSL 2.2 > < TSEL 2 >
SECURITY Fix: Evgeny Legerov has reported a vulnerability in GnuPG,
caused due to an input validation error in parse_packet.c when
handling certain message packets. This can be exploited to cause
GnuPG to consume large amounts of memory or crash via an overly
long comment length in a message packet. This can further be
exploited to cause an integer overflow, which leads to possible
memory corruption and crashes GnuPG.
The Common Vulnerabilities and Exposures project (cve.mitre.org /) has
assigned the name CVE-2006-3746 to this issue.
libtiff < TSL 3.0 > < TSL 2.2 > < TSEL 2 >
SECURITY Fix: Tavis Ormandy, Google Security Team has reported some
vulnerabilities in libTIFF, which can be exploited by malicious people
to cause a DoS or potentially compromise a vulnerable system. The
vulnerabilities are caused due to various heap and integer overflows
when processing TIFF images and can be exploited via a specially
crafted TIFF image.
The Common Vulnerabilities and Exposures project (cve.mitre.org /) has
assigned the names CVE-2006-3459, CVE-2006-3460, CVE-2006-3461,
CVE-2006-3462, CVE-2006-3463, CVE-2006-3464 and CVE-2006-3465
these issues.
Action:
Location:http://http.trustix.org/pub/trustix/updates/ >
<URI:ftp://ftp.trustix.org/pub/trustix/updates/ >
About Trustix Secure Linux:
Automatic updates:
Questions?http://www.trustix.org/support/ >
Verification:http://www.trustix.org/TSL-SIGN-KEY >
The advisory itself is available from the errata pages athttp://www.trustix.org/errata/trustix-2.2/ > andhttp://www.trustix.org/errata/trustix-3.0/ >http://www.trustix.org/errata/2006/0044/ >
MD5sums of the packages:
c25e4d8ff23456ee2107506b1d317bc6 2.2/rpms/apache-2.0.55-5tr.i586.rpm
Trustix Security Team
