:Advisories, November 7, 2006
Advisories, November 7, 2006 0 Talkback[s]
Gentoo Linux
http://security.gentoo.org/
Severity: High
The NVIDIA binary graphics driver is vulnerable to a local privilege
escalation through an X session.
The NVIDIA binary graphics driver from NVIDIA Corporation provides the
kernel module and the GL modules for graphic acceleration on the NVIDIA
based graphic cards.
1 x11-drivers/nvidia-drivers < 1.0.8776 >= 1.0.8776
< 1.0-8762
Rapid7 reported a boundary error in the NVIDIA binary graphics driver
that leads to a buffer overflow in the accelerated rendering
functionality.
An X client could trigger the buffer overflow with a maliciously
crafted series of glyphs. A remote attacker could also entice a user to
open a specially crafted web page, document or X client that will
trigger the buffer overflow. This could result in the execution of
arbitrary code with root privileges or at least in the crash of the X
server.
Disable the accelerated rendering functionality in the Device section
of xorg.conf :
Option "RenderAccel" "false"
NVIDIA binary graphics driver users should upgrade to the latest
version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-drivers/nvidia-drivers-1.0.8776"
[ 1 ] CVE-2006-5379
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5379
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200611-03.xml
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org .
Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Mandriva Linux
Mandriva Linux Security Advisory MDKSA-2006:198http://www.mandriva.com/security/
Package : imlib2
Problem Description:
M Joonas Pihlaja discovered several vulnerabilities in the Imlib2
graphics library.
The load() function of several of the Imlib2 image loaders does not
check the width and height of an image before allocating memory. As a
result, a carefully crafted image file can trigger a segfault when an
application using Imlib2 attempts to view the image. (CVE-2006-4806)
The tga loader fails to bounds check input data to make sure the input
data doesn't load outside the memory mapped region. (CVE-2006-4807)
The RLE decoding loops of the load() function in the tga loader does
not check that the count byte of an RLE packet doesn't cause a heap
overflow of the pixel buffer. (CVE-2006-4808)
The load() function of the pnm loader writes arbitrary length user data
into a fixed size stack allocated buffer buf[] without bounds checking.
(CVE-2006-4809) Updated packages have been patched to correct these
issues.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4806 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4807 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4808 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4809
Updated Packages:
Mandriva Linux 2006.0:
Mandriva Linux 2006.0/X86_64:
Mandriva Linux 2007.0:
Mandriva Linux 2007.0/X86_64:
Corporate 3.0:
Corporate 3.0/X86_64:
Corporate 4.0:
Corporate 4.0/X86_64:
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID
Mandriva Linux Security Advisory MDKSA-2006:199http://www.mandriva.com/security/
Package : libx11
Problem Description:
The Xinput module (modules/im/ximcp/imLcIm.c) in X.Org libX11 1.0.2 and
1.0.3 opens a file for reading twice using the same file descriptor,
which causes a file descriptor leak that allows local users to read
files specified by the XCOMPOSEFILE environment variable via the
duplicate file descriptor.
Updated packages have been patched to correct this issue.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5397
Updated Packages:
Mandriva Linux 2007.0:
Mandriva Linux 2007.0/X86_64:
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID
Mandriva Linux Security Advisory MDKSA-2006:200http://www.mandriva.com/security/
Package : rpm
Problem Description:
A heap-based buffer overflow was discovered in librpm when the LANG or
LC_ALL environment variable is set to ru_RU.UTF-8 (and possibly other
locales), which could allow for user-assisted attackers to execute
arbitrary code via crafted RPM packages.
Updated packages have been patched to correct this issue.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5466 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=212833
Updated Packages:
Mandriva Linux 2006.0:
Mandriva Linux 2006.0/X86_64:
Mandriva Linux 2007.0:
Mandriva Linux 2007.0/X86_64:
Corporate 3.0:
Corporate 3.0/X86_64:
Corporate 4.0:
Corporate 4.0/X86_64:
Multi Network Firewall Unsaved Document 12.0:
9e79dfbf56472d3c8dc0ab385484845b mnf/2.0/i586/popt-1.8.2-7.1.M20mdk.i586.rpm
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID
Ubuntu
https://launchpad.net/bugs/70278
A security issue affects the following Ubuntu releases:
Ubuntu 5.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 5.10:
Ubuntu 6.06 LTS:
Ubuntu 6.10:
In general, a standard system upgrade is sufficient to effect the
necessary changes.
Details follow:
USN-376-1 provided an update to imlib2 to fix several security
vulnerabilities. Unfortunately the update broke JPG file handling in
certain situations. This update corrects this problem. We apologize
for the inconvenience.
Updated packages for Ubuntu 5.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/imlib2_1.2.0-2.2ubuntu2.2.diff.gz http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/imlib2_1.2.0-2.2ubuntu2.2.dsc http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/imlib2_1.2.0.orig.tar.gz
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2.0-2.2ubuntu2.2_amd64.deb http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.0-2.2ubuntu2.2_amd64.deb
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2.0-2.2ubuntu2.2_i386.deb http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.0-2.2ubuntu2.2_i386.deb
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2.0-2.2ubuntu2.2_powerpc.deb http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.0-2.2ubuntu2.2_powerpc.deb
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2.0-2.2ubuntu2.2_sparc.deb http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.0-2.2ubuntu2.2_sparc.deb
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/imlib2_1.2.1-2ubuntu0.2.diff.gz http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/imlib2_1.2.1-2ubuntu0.2.dsc http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/imlib2_1.2.1.orig.tar.gz
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2.1-2ubuntu0.2_amd64.deb http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.1-2ubuntu0.2_amd64.deb
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2.1-2ubuntu0.2_i386.deb http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.1-2ubuntu0.2_i386.deb
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2.1-2ubuntu0.2_powerpc.deb http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.1-2ubuntu0.2_powerpc.deb
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2.1-2ubuntu0.2_sparc.deb http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.1-2ubuntu0.2_sparc.deb
Updated packages for Ubuntu 6.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/imlib2_1.2.1-2ubuntu1.2.diff.gz http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/imlib2_1.2.1-2ubuntu1.2.dsc http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/imlib2_1.2.1.orig.tar.gz
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2.1-2ubuntu1.2_amd64.deb http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.1-2ubuntu1.2_amd64.deb
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2.1-2ubuntu1.2_i386.deb http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.1-2ubuntu1.2_i386.deb
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2.1-2ubuntu1.2_powerpc.deb http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.1-2ubuntu1.2_powerpc.deb
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2.1-2ubuntu1.2_sparc.deb http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.1-2ubuntu1.2_sparc.deb
