Advisories, February 25, 2007

Mandriva Linux

Mandriva Linux Security Advisory MDKSA-2007:048
http://www.mandriva.com/security/

Package : php
Date : February 22, 2007
Affected: 2006.0, 2007.0, Corporate 3.0, Corporate 4.0, Multi
Network Firewall 2.0

Problem Description:

A number of vulnerabilities were discovered in PHP language.

Many buffer overflow flaws were discovered in the PHP session
extension, the str_replace() function, and the imap_mail_compose()
function. An attacker able to use a PHP application using any of
these functions could trigger these flaws and possibly execute
arbitrary code as the apache user (CVE-2007-0906).

A one-byte memory read will always occur prior to the beginning
of a buffer, which could be triggered, for example, by any use of
the header() function in a script (CVE-2007-0907).

The wddx extension, if used to import WDDX data from an
untrusted source, may allow a random portion of heap memory to be
exposed due to certain WDDX input packets (CVE-2007-0908).

The odbc_result_all() function, if used to display data from a
database,
and if the contents of the database are under the control of an
attacker, could lead to the execution of arbitrary code due to a
format string vulnerability (CVE-2007-0909).

Several flaws in the PHP could allow attackers to clobber
certain super-global variables via unspecified vectors
(CVE-2007-0910).

The zend_hash_init() function can be forced into an infinite
loop if unserializing untrusted data on a 64-bit platform,
resulting in the consumption of CPU resources until the script
timeout alarm aborts the execution of the script
(CVE-2007-0988).

Updated package have been patched to correct this issue.

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0906

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0907

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0908

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0909

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0910

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0988

Updated Packages:

Mandriva Linux 2006.0:
14a536e0c07f48b553986725223f54dc
2006.0/i586/libphp5_common5-5.0.4-9.19.20060mdk.i586.rpm
762bc7a2f5500dca2eb7effdb96b6cf0
2006.0/i586/php-cgi-5.0.4-9.19.20060mdk.i586.rpm
3055c27939b2b6451872b39654c7564f
2006.0/i586/php-cli-5.0.4-9.19.20060mdk.i586.rpm
042909d1305a2ceeab45fa11fa4ff434
2006.0/i586/php-devel-5.0.4-9.19.20060mdk.i586.rpm
0bcc6a996a381e6d8ee7c5271bbea166
2006.0/i586/php-fcgi-5.0.4-9.19.20060mdk.i586.rpm
69bc4325439a8ee9ba99ed28af7ed0e2
2006.0/i586/php-imap-5.0.4-2.5.20060mdk.i586.rpm
b9a273cc6b7b5e35efea231b27bbc2e5
2006.0/i586/php-odbc-5.0.4-1.1.20060mdk.i586.rpm
7b499c1b38392d556619692780ed41f4
2006.0/i586/php-session-5.0.4-1.1.20060mdk.i586.rpm
452f887b5fcfb2e568ec904b708f611c
2006.0/SRPMS/php-5.0.4-9.19.20060mdk.src.rpm
0ccd978c2b32e74087d237e334a46779
2006.0/SRPMS/php-imap-5.0.4-2.5.20060mdk.src.rpm
d7549d0a1c8dd9a8989bbf2519d923fa
2006.0/SRPMS/php-odbc-5.0.4-1.1.20060mdk.src.rpm
92abeadef4272b1e1dff61c956923d23
2006.0/SRPMS/php-session-5.0.4-1.1.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
9e66a63f9b6a4694e3b6440afc4e0bd5
2006.0/x86_64/lib64php5_common5-5.0.4-9.19.20060mdk.x86_64.rpm
a07a6011defb76f88eba66fc429221e3
2006.0/x86_64/php-cgi-5.0.4-9.19.20060mdk.x86_64.rpm
964d1e6c84a4a8b20fc5257435e64d6e
2006.0/x86_64/php-cli-5.0.4-9.19.20060mdk.x86_64.rpm
a0b074323affacd0c3b26302bb791d0a
2006.0/x86_64/php-devel-5.0.4-9.19.20060mdk.x86_64.rpm
74f357e2b7db2b3c1d7e179ab9341b10
2006.0/x86_64/php-fcgi-5.0.4-9.19.20060mdk.x86_64.rpm
6bad08844fe2a99bd12defc982e75e5f
2006.0/x86_64/php-imap-5.0.4-2.5.20060mdk.x86_64.rpm
183f14e7c52ad0b14692661afd478e3c
2006.0/x86_64/php-odbc-5.0.4-1.1.20060mdk.x86_64.rpm
f156370ad26f48adcc9fbdb17eb04db1
2006.0/x86_64/php-session-5.0.4-1.1.20060mdk.x86_64.rpm
452f887b5fcfb2e568ec904b708f611c
2006.0/SRPMS/php-5.0.4-9.19.20060mdk.src.rpm
0ccd978c2b32e74087d237e334a46779
2006.0/SRPMS/php-imap-5.0.4-2.5.20060mdk.src.rpm
d7549d0a1c8dd9a8989bbf2519d923fa
2006.0/SRPMS/php-odbc-5.0.4-1.1.20060mdk.src.rpm
92abeadef4272b1e1dff61c956923d23
2006.0/SRPMS/php-session-5.0.4-1.1.20060mdk.src.rpm

Mandriva Linux 2007.0:
cf3ef7426074a91964ef0086459cc889
2007.0/i586/libphp5_common5-5.1.6-1.6mdv2007.0.i586.rpm
8567efb3d4d7a41bcfeecd1c0a3c64e5
2007.0/i586/php-cgi-5.1.6-1.6mdv2007.0.i586.rpm
675213bf0e797a294776da1bbcbddc69
2007.0/i586/php-cli-5.1.6-1.6mdv2007.0.i586.rpm
115be2e3b5ca6b285dd359374ab4cf5c
2007.0/i586/php-devel-5.1.6-1.6mdv2007.0.i586.rpm
b3ca1cf50e10f01d57d9471baf5f330c
2007.0/i586/php-fcgi-5.1.6-1.6mdv2007.0.i586.rpm
40225dcc5e0e4293be737a5043436010
2007.0/i586/php-imap-5.1.6-1.1mdv2007.0.i586.rpm
ba41c7d542423eb42539dc6ab3e2ac9f
2007.0/i586/php-odbc-5.1.6-1.1mdv2007.0.i586.rpm
639ede4d200b60c4164f396d6e215b69
2007.0/i586/php-session-5.1.6-1.1mdv2007.0.i586.rpm
0b6a180bef35c9b1945f8c6bd81d7106
2007.0/SRPMS/php-5.1.6-1.6mdv2007.0.src.rpm
7d90955ba0926450ae4d3fe854744f36
2007.0/SRPMS/php-imap-5.1.6-1.1mdv2007.0.src.rpm
ed1c1f68a2ffc6d9fdaef4bf7ad7f9b3
2007.0/SRPMS/php-odbc-5.1.6-1.1mdv2007.0.src.rpm
2959ad88632828e143d5ac98fae79a7b
2007.0/SRPMS/php-session-5.1.6-1.1mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
0f3a963e7808ed8be25e7b17544c0c05
2007.0/x86_64/lib64php5_common5-5.1.6-1.6mdv2007.0.x86_64.rpm
b7bb612bfc0cb39bb5648dd0b7ea4d37
2007.0/x86_64/php-cgi-5.1.6-1.6mdv2007.0.x86_64.rpm
c4b459dc63debe260e8f06d4260e30fd
2007.0/x86_64/php-cli-5.1.6-1.6mdv2007.0.x86_64.rpm
18534448cbe23231900e3da51333dc67
2007.0/x86_64/php-devel-5.1.6-1.6mdv2007.0.x86_64.rpm
6bbd4f1f6c4e060de408183798a2f312
2007.0/x86_64/php-fcgi-5.1.6-1.6mdv2007.0.x86_64.rpm
b8c0a446c7fa433e0678e3e58effccab
2007.0/x86_64/php-imap-5.1.6-1.1mdv2007.0.x86_64.rpm
f49bb567345c6728baf879e943e15002
2007.0/x86_64/php-odbc-5.1.6-1.1mdv2007.0.x86_64.rpm
e60efa04d5b12f98a1c9800c8d3d4a21
2007.0/x86_64/php-session-5.1.6-1.1mdv2007.0.x86_64.rpm
0b6a180bef35c9b1945f8c6bd81d7106
2007.0/SRPMS/php-5.1.6-1.6mdv2007.0.src.rpm
7d90955ba0926450ae4d3fe854744f36
2007.0/SRPMS/php-imap-5.1.6-1.1mdv2007.0.src.rpm
ed1c1f68a2ffc6d9fdaef4bf7ad7f9b3
2007.0/SRPMS/php-odbc-5.1.6-1.1mdv2007.0.src.rpm
2959ad88632828e143d5ac98fae79a7b
2007.0/SRPMS/php-session-5.1.6-1.1mdv2007.0.src.rpm

Corporate 3.0:
b976e6b9cadf8cf26eb00611b5b47274
corporate/3.0/i586/libphp_common432-4.3.4-4.24.C30mdk.i586.rpm
21a6ed462d981442f42aa22f4b2dc09b
corporate/3.0/i586/php-cgi-4.3.4-4.24.C30mdk.i586.rpm
13515b3d016198d636d37abf967e5c20
corporate/3.0/i586/php-cli-4.3.4-4.24.C30mdk.i586.rpm
ba84264eeab995355deab7c9323aedd1
corporate/3.0/i586/php-imap-4.3.4-1.5.C30mdk.i586.rpm
128dc7b4d3b2e925b7a0b1d850d0895a
corporate/3.0/i586/php432-devel-4.3.4-4.24.C30mdk.i586.rpm
56f90fe0b8a96f6a6fe5bf0620cd4408
corporate/3.0/SRPMS/php-4.3.4-4.24.C30mdk.src.rpm
2ab806c5a8f696fdce5e4f1037e1404d
corporate/3.0/SRPMS/php-imap-4.3.4-1.5.C30mdk.src.rpm

Corporate 3.0/X86_64:
8ccfdbf8075179e44035bb97f3e75d7d
corporate/3.0/x86_64/lib64php_common432-4.3.4-4.24.C30mdk.x86_64.rpm

18b243d3ce9ea60777d66980280c37ba
corporate/3.0/x86_64/php-cgi-4.3.4-4.24.C30mdk.x86_64.rpm
404152b4a6a773895b7eff209f1fb1d5
corporate/3.0/x86_64/php-cli-4.3.4-4.24.C30mdk.x86_64.rpm
fdeb1accc67c123bace512c287a656c2
corporate/3.0/x86_64/php-imap-4.3.4-1.5.C30mdk.x86_64.rpm
14a01cc331d4ce489a8f9fdee3959c31
corporate/3.0/x86_64/php432-devel-4.3.4-4.24.C30mdk.x86_64.rpm
56f90fe0b8a96f6a6fe5bf0620cd4408
corporate/3.0/SRPMS/php-4.3.4-4.24.C30mdk.src.rpm
2ab806c5a8f696fdce5e4f1037e1404d
corporate/3.0/SRPMS/php-imap-4.3.4-1.5.C30mdk.src.rpm

Corporate 4.0:
c509fc3368d31c1dca47d065b28f2fea
corporate/4.0/i586/libphp4_common4-4.4.4-1.4.20060mlcs4.i586.rpm

4901007b7f7d98585f926c76692e3c3e
corporate/4.0/i586/libphp5_common5-5.1.6-1.5.20060mlcs4.i586.rpm

e3ffeda22f59f1f947acfeba34a9d23f
corporate/4.0/i586/php-cgi-5.1.6-1.5.20060mlcs4.i586.rpm
aecf1f88ba7c6e964f8f96a90cbf10c2
corporate/4.0/i586/php-cli-5.1.6-1.5.20060mlcs4.i586.rpm
39268f16090d55a4c969734263036be4
corporate/4.0/i586/php-devel-5.1.6-1.5.20060mlcs4.i586.rpm
3db35d86b2943802a54cc3272662e91c
corporate/4.0/i586/php-fcgi-5.1.6-1.5.20060mlcs4.i586.rpm
a8e96cedb24e719f32c83d5e6bc02e3e
corporate/4.0/i586/php-imap-5.1.6-1.1.20060mlcs4.i586.rpm
169fef5a69d5d3c1b385d218ddaf68fd
corporate/4.0/i586/php-odbc-5.1.6-1.1.20060mlcs4.i586.rpm
d3191c857cee1b6ed1c9978d0eea5a8c
corporate/4.0/i586/php-session-5.1.6-1.1.20060mlcs4.i586.rpm
58777631a4cc9b7f064b3eb41b773b60
corporate/4.0/i586/php-wddx-5.1.6-1.1.20060mlcs4.i586.rpm
981f2fe117ddd4a025b095bd98f988b6
corporate/4.0/i586/php4-cgi-4.4.4-1.4.20060mlcs4.i586.rpm
d0845bd223c59cc23a487cc11822940c
corporate/4.0/i586/php4-cli-4.4.4-1.4.20060mlcs4.i586.rpm
ce46c6aa0f58d6b87392e0c7b471dc4b
corporate/4.0/i586/php4-devel-4.4.4-1.4.20060mlcs4.i586.rpm
cb618d8c7536749f010445b5f7c1ad5a
corporate/4.0/i586/php4-imap-4.4.4-0.1.20060mlcs4.i586.rpm
df7aa75f1bbdd6051f71d62692417b00
corporate/4.0/i586/php4-odbc-4.4.4-0.1.20060mlcs4.i586.rpm
a5743e7b00125f3fbfc9815e5bedacfe
corporate/4.0/i586/php4-wddx-4.4.4-0.1.20060mlcs4.i586.rpm
b912cf9745221ccf19f08c9e9e6e9724
corporate/4.0/SRPMS/php-5.1.6-1.5.20060mlcs4.src.rpm
12771ab58ff701a26a3dff54e3cb757a
corporate/4.0/SRPMS/php-imap-5.1.6-1.1.20060mlcs4.src.rpm
3ac73928485a9d003f9ab410da73f496
corporate/4.0/SRPMS/php-odbc-5.1.6-1.1.20060mlcs4.src.rpm
b6d3c63e004e44c8bef821d14e9dfb95
corporate/4.0/SRPMS/php-session-5.1.6-1.1.20060mlcs4.src.rpm
c30202c77c1a1a5a8694536733b7efb3
corporate/4.0/SRPMS/php-wddx-5.1.6-1.1.20060mlcs4.src.rpm
bc686b9f2bd178263c6e211c3781f0fb
corporate/4.0/SRPMS/php4-4.4.4-1.4.20060mlcs4.src.rpm
4ec41380503d039ba368e1b5a375042f
corporate/4.0/SRPMS/php4-imap-4.4.4-0.1.20060mlcs4.src.rpm
a151cddb0bb46bf5046091e9ee0683c1
corporate/4.0/SRPMS/php4-odbc-4.4.4-0.1.20060mlcs4.src.rpm
afa5569276637c92cfec4fca0b700434
corporate/4.0/SRPMS/php4-wddx-4.4.4-0.1.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
e2031a018eabe7291baa8f14e8aea201
corporate/4.0/x86_64/lib64php4_common4-4.4.4-1.4.20060mlcs4.x86_64.rpm

67e00f079636589757a192db88789be7
corporate/4.0/x86_64/lib64php5_common5-5.1.6-1.5.20060mlcs4.x86_64.rpm

9e8e832216178be8c5c6cf5a7b46011e
corporate/4.0/x86_64/php-cgi-5.1.6-1.5.20060mlcs4.x86_64.rpm
0628d22b004b2948ca17dcfadac43e50
corporate/4.0/x86_64/php-cli-5.1.6-1.5.20060mlcs4.x86_64.rpm
6e5eeeef138b0ae9c458bf3756e551c3
corporate/4.0/x86_64/php-devel-5.1.6-1.5.20060mlcs4.x86_64.rpm
9af58850637ffed2b37ccfa0c881fb1f
corporate/4.0/x86_64/php-fcgi-5.1.6-1.5.20060mlcs4.x86_64.rpm
fbacfda0078e058d0a9c55b0951d7b22
corporate/4.0/x86_64/php-imap-5.1.6-1.1.20060mlcs4.x86_64.rpm
4d4dfb1e89ff5debd4734b09e18282db
corporate/4.0/x86_64/php-odbc-5.1.6-1.1.20060mlcs4.x86_64.rpm
e6cc37b9941ca1c010a83ecfeb80f5ff
corporate/4.0/x86_64/php-session-5.1.6-1.1.20060mlcs4.x86_64.rpm

bd9fce2e55b5445324c605eb739a811c
corporate/4.0/x86_64/php-wddx-5.1.6-1.1.20060mlcs4.x86_64.rpm
6795c92d078f0a9a67abcc44fde3b6ee
corporate/4.0/x86_64/php4-cgi-4.4.4-1.4.20060mlcs4.x86_64.rpm
d6112d336c1d5bc101cc5a624177b38e
corporate/4.0/x86_64/php4-cli-4.4.4-1.4.20060mlcs4.x86_64.rpm
b5c7bd35a04a63839c9a43de0392ee29
corporate/4.0/x86_64/php4-devel-4.4.4-1.4.20060mlcs4.x86_64.rpm
94ae86a2e5b36059eba7f7385df0f79c
corporate/4.0/x86_64/php4-imap-4.4.4-0.1.20060mlcs4.x86_64.rpm
17166588d6b6052e85f395e15fa6a942
corporate/4.0/x86_64/php4-odbc-4.4.4-0.1.20060mlcs4.x86_64.rpm
de8d50be6e2bd6f6cdba304f003bcc24
corporate/4.0/x86_64/php4-wddx-4.4.4-0.1.20060mlcs4.x86_64.rpm
b912cf9745221ccf19f08c9e9e6e9724
corporate/4.0/SRPMS/php-5.1.6-1.5.20060mlcs4.src.rpm
12771ab58ff701a26a3dff54e3cb757a
corporate/4.0/SRPMS/php-imap-5.1.6-1.1.20060mlcs4.src.rpm
3ac73928485a9d003f9ab410da73f496
corporate/4.0/SRPMS/php-odbc-5.1.6-1.1.20060mlcs4.src.rpm
b6d3c63e004e44c8bef821d14e9dfb95
corporate/4.0/SRPMS/php-session-5.1.6-1.1.20060mlcs4.src.rpm
c30202c77c1a1a5a8694536733b7efb3
corporate/4.0/SRPMS/php-wddx-5.1.6-1.1.20060mlcs4.src.rpm
bc686b9f2bd178263c6e211c3781f0fb
corporate/4.0/SRPMS/php4-4.4.4-1.4.20060mlcs4.src.rpm
4ec41380503d039ba368e1b5a375042f
corporate/4.0/SRPMS/php4-imap-4.4.4-0.1.20060mlcs4.src.rpm
a151cddb0bb46bf5046091e9ee0683c1
corporate/4.0/SRPMS/php4-odbc-4.4.4-0.1.20060mlcs4.src.rpm
afa5569276637c92cfec4fca0b700434
corporate/4.0/SRPMS/php4-wddx-4.4.4-0.1.20060mlcs4.src.rpm

Multi Network Firewall 2.0:
f67045828bb37de94a16410dd106c839
mnf/2.0/i586/libphp_common432-4.3.4-4.24.M20mdk.i586.rpm
6d6c9770470709db6c849baf1b79ed7c
mnf/2.0/i586/php-cgi-4.3.4-4.24.M20mdk.i586.rpm
f5f3a45ffa8c90a53f541dd575dcfde0
mnf/2.0/i586/php-cli-4.3.4-4.24.M20mdk.i586.rpm
7d8a49eb836d1f7b09afbb67dae77ef4
mnf/2.0/i586/php432-devel-4.3.4-4.24.M20mdk.i586.rpm
9ef4f5c1fd355320945faf7bb3904975
mnf/2.0/SRPMS/php-4.3.4-4.24.M20mdk.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The
verification of md5 checksums and GPG signatures is performed
automatically for you.

All packages are signed by Mandriva for security. You can obtain
the GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>

Mandriva Linux Security Advisory MDKSA-2007:049
http://www.mandriva.com/security/

Package : spamassassin
Date : February 23, 2007
Affected: 2007.0, Corporate 4.0

Problem Description:

A bug in the way that SpamAssassin processes HTML emails
containing URIs was discovered in versions 3.1.x. A carefully
crafted mail message could make SpamAssassin consume significant
amounts of CPU resources that could delay or prevent the delivery
of mail if a number of these messages were sent at once.

SpamAssassin has been upgraded to version 3.1.8 to correct this
problem, and other upstream bugs. In addition, an invalid path
setting in local.cf for the auto_whitelist_path has been fixed for
Mandriva 2007.0.

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0451

http://qa.mandriva.com/show_bug.cgi?id=27424

Updated Packages:

Mandriva Linux 2007.0:
d650293a8726a25c4fd3fac01058f758
2007.0/i586/perl-Mail-SpamAssassin-3.1.8-0.1mdv2007.0.i586.rpm
721c1aeebf3bf0eda9e82f165cebcd7b
2007.0/i586/spamassassin-3.1.8-0.1mdv2007.0.i586.rpm
bb191e955876ae1cd3a39a694f5c6259
2007.0/i586/spamassassin-spamc-3.1.8-0.1mdv2007.0.i586.rpm
845c7c94d98f06bdcc2949ea2cf3272b
2007.0/i586/spamassassin-spamd-3.1.8-0.1mdv2007.0.i586.rpm
730d7cb8c61a3c40149ffdabb3a2a039
2007.0/i586/spamassassin-tools-3.1.8-0.1mdv2007.0.i586.rpm
ad0a0132bf2cea709038ae72af5ad72b
2007.0/SRPMS/spamassassin-3.1.8-0.1mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
74e606f97f5d341eaaa7f1fae29af965
2007.0/x86_64/perl-Mail-SpamAssassin-3.1.8-0.1mdv2007.0.x86_64.rpm

b75394411af4c61a6e273ae0bfdd0cdb
2007.0/x86_64/spamassassin-3.1.8-0.1mdv2007.0.x86_64.rpm
841dbbe7e13527bbed478c4ee1673824
2007.0/x86_64/spamassassin-spamc-3.1.8-0.1mdv2007.0.x86_64.rpm
b0033170128717b308172d1be62d2fea
2007.0/x86_64/spamassassin-spamd-3.1.8-0.1mdv2007.0.x86_64.rpm
8cda04c353a295fe889b0373dd70c657
2007.0/x86_64/spamassassin-tools-3.1.8-0.1mdv2007.0.x86_64.rpm
ad0a0132bf2cea709038ae72af5ad72b
2007.0/SRPMS/spamassassin-3.1.8-0.1mdv2007.0.src.rpm

Corporate 4.0:
1cacb51bf040c259c069fa608e0e2c49
corporate/4.0/i586/perl-Mail-SpamAssassin-3.1.8-0.1.20060mlcs4.i586.rpm

f05942822badb56e42aa93f0b5717a58
corporate/4.0/i586/spamassassin-3.1.8-0.1.20060mlcs4.i586.rpm
8a70c211b6b9f900aeadcb701a82de08
corporate/4.0/i586/spamassassin-spamc-3.1.8-0.1.20060mlcs4.i586.rpm

cf64b92a8f7bf9e10f82e6ae5ff83d94
corporate/4.0/i586/spamassassin-spamd-3.1.8-0.1.20060mlcs4.i586.rpm

f58b265feb70a6129bb747e52d9b968e
corporate/4.0/i586/spamassassin-tools-3.1.8-0.1.20060mlcs4.i586.rpm

663e6ce1d90085aea5840934b742641b
corporate/4.0/SRPMS/spamassassin-3.1.8-0.1.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
69f4a1ef34a46eaf071d157dab7a19a1
corporate/4.0/x86_64/perl-Mail-SpamAssassin-3.1.8-0.1.20060mlcs4.x86_64.rpm

f18bd5698dfc5342984b6f2d0d15606f
corporate/4.0/x86_64/spamassassin-3.1.8-0.1.20060mlcs4.x86_64.rpm

87b7259668e39af9187acd29cd59a872
corporate/4.0/x86_64/spamassassin-spamc-3.1.8-0.1.20060mlcs4.x86_64.rpm

533fee6c7f174f9964584864d6da08e7
corporate/4.0/x86_64/spamassassin-spamd-3.1.8-0.1.20060mlcs4.x86_64.rpm

7a0df8727eb4f3024325995b920b47a7
corporate/4.0/x86_64/spamassassin-tools-3.1.8-0.1.20060mlcs4.x86_64.rpm

663e6ce1d90085aea5840934b742641b
corporate/4.0/SRPMS/spamassassin-3.1.8-0.1.20060mlcs4.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The
verification of md5 checksums and GPG signatures is performed
automatically for you.

All packages are signed by Mandriva for security. You can obtain
the GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>

Red Hat Linux

Red Hat Security Advisory

Synopsis: Critical: seamonkey security update
Advisory ID: RHSA-2007:0077-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0077.html

Issue date: 2007-02-23
Updated on: 2007-02-23
Product: Red Hat Enterprise Linux
CVE Names: CVE-2006-6077 CVE-2007-0008 CVE-2007-0009 CVE-2007-0775
CVE-2007-0777 CVE-2007-0778 CVE-2007-0779 CVE-2007-0780
CVE-2007-0800 CVE-2007-0981 CVE-2007-0995 CVE-2007-0996

1. Summary:

Updated seamonkey packages that fix several security bugs are
now available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having critical security impact by
the Red Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 –
i386, ia64
Red Hat Linux Advanced Workstation 2.1 – ia64
Red Hat Enterprise Linux ES version 2.1 – i386
Red Hat Enterprise Linux WS version 2.1 – i386
Red Hat Enterprise Linux AS version 3 – i386, ia64, ppc, s390,
s390x, x86_64
Red Hat Desktop version 3 – i386, x86_64
Red Hat Enterprise Linux ES version 3 – i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 – i386, ia64, x86_64
Red Hat Enterprise Linux AS version 4 – i386, ia64, ppc, s390,
s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 – i386, x86_64
Red Hat Enterprise Linux ES version 4 – i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 – i386, ia64, x86_64

3. Problem description:

SeaMonkey is an open source Web browser, advanced email and
newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the way SeaMonkey processed certain
malformed JavaScript code. A malicious web page could execute
JavaScript code in such a way that may result in SeaMonkey crashing
or executing arbitrary code as the user running SeaMonkey.
(CVE-2007-0775, CVE-2007-0777)

Several cross-site scripting (XSS) flaws were found in the way
SeaMonkey processed certain malformed web pages. A malicious web
page could display misleading information which may result in a
user unknowingly divulging sensitive information such as a
password. (CVE-2006-6077, CVE-2007-0995, CVE-2007-0996)

A flaw was found in the way SeaMonkey cached web pages on the
local disk. A malicious web page may be able to inject arbitrary
HTML into a browsing session if the user reloads a targeted site.
(CVE-2007-0778)

A flaw was found in the way SeaMonkey displayed certain web
content. A malicious web page could generate content which could
overlay user interface elements such as the hostname and security
indicators, tricking a user into thinking they are visiting a
different site. (CVE-2007-0779)

Two flaws were found in the way SeaMonkey displayed blocked
popup windows. If a user can be convinced to open a blocked popup,
it is possible to read arbitrary local files, or conduct an XSS
attack against the user. (CVE-2007-0780, CVE-2007-0800)

Two buffer overflow flaws were found in the Network Security
Services (NSS) code for processing the SSLv2 protocol. Connecting
to a malicious secure web server could cause the execution of
arbitrary code as the user running SeaMonkey. (CVE-2007-0008,
CVE-2007-0009)

A flaw was found in the way SeaMonkey handled the
“location.hostname” value during certain browser domain checks.
This flaw could allow a malicious web site to set domain cookies
for an arbitrary site, or possibly perform an XSS attack.
(CVE-2007-0981)

Users of SeaMonkey are advised to upgrade to these erratum
packages, which contain SeaMonkey version 1.0.8 that corrects these
issues.

4. Solution:

Before applying this update, make sure all previously released
errata relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat
Network, launch the Red Hat Update Agent with the following
command:

up2date

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

204589 – mozilla-config points to the wrong places
229805 – CVE-2007-0775 Multiple Seamonkey flaws (CVE-2007-0777,
CVE-2007-0995, CVE-2007-0996, CVE-2006-6077, CVE-2007-0778,
CVE-2007-0779, CVE-2007-0780, CVE-2007-0800, CVE-2007-0008,
CVE-2007-0009, CVE-2007-0981)

6. RPMs required:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1:

SRPMS:

ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/seamonkey-1.0.8-0.1.el2.src.rpm

39d880aad29e3f51e07a9b4d6f25e2cc
seamonkey-1.0.8-0.1.el2.src.rpm

i386:
da3d22f28c19c89aacb6482877d68dce
seamonkey-1.0.8-0.1.el2.i386.rpm
264a5f3969f815ace28b027070885dea
seamonkey-chat-1.0.8-0.1.el2.i386.rpm
4f18e11647ba4325ff18dcaf43b67a44
seamonkey-devel-1.0.8-0.1.el2.i386.rpm
0580a43a7ff40844e8131a2665f9dcef
seamonkey-dom-inspector-1.0.8-0.1.el2.i386.rpm
4b3e456989e24c13da26b53b313c5a39
seamonkey-js-debugger-1.0.8-0.1.el2.i386.rpm
7798bae69f31dc0eca56471f5b407a04
seamonkey-mail-1.0.8-0.1.el2.i386.rpm
885cb4726a8b07511014d50151a15ee6
seamonkey-nspr-1.0.8-0.1.el2.i386.rpm
2db1b5b2f1135fee3fea6883b83bf170
seamonkey-nspr-devel-1.0.8-0.1.el2.i386.rpm
1eabd4f304e7e70654fbcc117c8d83c7
seamonkey-nss-1.0.8-0.1.el2.i386.rpm
73a3586dc107e87867d301de7b05582b
seamonkey-nss-devel-1.0.8-0.1.el2.i386.rpm

ia64:
e749cd761e0644ebfce03d24751f3df6
seamonkey-1.0.8-0.1.el2.ia64.rpm
74c8c47184dd8878e7a4a3f050766481
seamonkey-chat-1.0.8-0.1.el2.ia64.rpm
93678fecbb9b4e043718af2bf5d15056
seamonkey-devel-1.0.8-0.1.el2.ia64.rpm
3a2071697d0a07f8d6549ec8d74162ee
seamonkey-dom-inspector-1.0.8-0.1.el2.ia64.rpm
e0856fbb982d7e12bb30d102fb21752e
seamonkey-js-debugger-1.0.8-0.1.el2.ia64.rpm
40158f0905485ac02542c77e0a824611
seamonkey-mail-1.0.8-0.1.el2.ia64.rpm
8ea66a98269b061be72d240f02285c6f
seamonkey-nspr-1.0.8-0.1.el2.ia64.rpm
cfe078264e88c7df80630542b2cf9130
seamonkey-nspr-devel-1.0.8-0.1.el2.ia64.rpm
e942fd31657a736f0b0ef4d348b10101
seamonkey-nss-1.0.8-0.1.el2.ia64.rpm
d117b39a0a7a19ee5bd367e5998705b8
seamonkey-nss-devel-1.0.8-0.1.el2.ia64.rpm

Red Hat Linux Advanced Workstation 2.1:

SRPMS:

ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/seamonkey-1.0.8-0.1.el2.src.rpm

39d880aad29e3f51e07a9b4d6f25e2cc
seamonkey-1.0.8-0.1.el2.src.rpm

Red Hat Enterprise Linux ES version 2.1:

SRPMS:

ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/seamonkey-1.0.8-0.1.el2.src.rpm

39d880aad29e3f51e07a9b4d6f25e2cc
seamonkey-1.0.8-0.1.el2.src.rpm

Red Hat Enterprise Linux WS version 2.1:

SRPMS:

ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/seamonkey-1.0.8-0.1.el2.src.rpm

39d880aad29e3f51e07a9b4d6f25e2cc
seamonkey-1.0.8-0.1.el2.src.rpm

Red Hat Enterprise Linux AS version 3:

SRPMS:

ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/seamonkey-1.0.8-0.1.el3.src.rpm

d9c0432dac707bef181baa7bd7783621
seamonkey-1.0.8-0.1.el3.src.rpm

ia64:
3cee7adae6f8a6cc4656fb4ac050d2eb
seamonkey-1.0.8-0.1.el3.ia64.rpm
5e22c5b9c11316d7de7316a8e73a89eb
seamonkey-chat-1.0.8-0.1.el3.ia64.rpm
2e01227642c02d6e5f82217af32e94e6
seamonkey-debuginfo-1.0.8-0.1.el3.i386.rpm
de2a81cb447b0e9478731b7e46de04f5
seamonkey-debuginfo-1.0.8-0.1.el3.ia64.rpm
1262efad6404a89696775b6594df015d
seamonkey-devel-1.0.8-0.1.el3.ia64.rpm
28490a881b2657cf1f3152fb80ae18df
seamonkey-dom-inspector-1.0.8-0.1.el3.ia64.rpm
53efd630d8d664f57959255615a558f9
seamonkey-js-debugger-1.0.8-0.1.el3.ia64.rpm
95f27c1956cc94bf6374444afad14fad
seamonkey-mail-1.0.8-0.1.el3.ia64.rpm
c9389de45d3d0f751e902ea4003d56ed
seamonkey-nspr-1.0.8-0.1.el3.i386.rpm
7d5e7fc6de15902287df2cd4859d410a
seamonkey-nspr-1.0.8-0.1.el3.ia64.rpm
50fae7d63a57bec9621e965e13fdb361
seamonkey-nspr-devel-1.0.8-0.1.el3.ia64.rpm
2615bc36969370b66fd80025409e60ff
seamonkey-nss-1.0.8-0.1.el3.i386.rpm
d9038c88088661ab945f2025d78939e5
seamonkey-nss-1.0.8-0.1.el3.ia64.rpm
82ecdbab3635936529aa7c64ef2ad0ac
seamonkey-nss-devel-1.0.8-0.1.el3.ia64.rpm

s390x:
a63a68b9e1aa82aff5b8502c12b7f7a6
seamonkey-1.0.8-0.1.el3.s390x.rpm
7c9154b6edc0392fd9f9f15c592942e3
seamonkey-chat-1.0.8-0.1.el3.s390x.rpm
371c1a7ae6f93c86b97d4602fb868a03
seamonkey-debuginfo-1.0.8-0.1.el3.s390x.rpm
29c18a69b52c39f2ce8a4ed644816965
seamonkey-devel-1.0.8-0.1.el3.s390x.rpm
60586f71134b064688edee64d4c9de4c
seamonkey-dom-inspector-1.0.8-0.1.el3.s390x.rpm
09ceb8e9dd21f38d5bcefd1599ad5c11
seamonkey-js-debugger-1.0.8-0.1.el3.s390x.rpm
44ed6b5030e669bb52a435e4f81e6ff4
seamonkey-mail-1.0.8-0.1.el3.s390x.rpm
e32ef6a80ad82c696ef8fee3ad98682a
seamonkey-nspr-1.0.8-0.1.el3.s390.rpm
1d5f7cb65369bdfd5386100dd3e72fd9
seamonkey-nspr-1.0.8-0.1.el3.s390x.rpm
76fecddfea37238f1e5f10c9ac2641d6
seamonkey-nspr-devel-1.0.8-0.1.el3.s390x.rpm
d43d345c16ebd5b802dc55ea490e5b79
seamonkey-nss-1.0.8-0.1.el3.s390.rpm
92c91b0d7058834ce14a95005f76993d
seamonkey-nss-1.0.8-0.1.el3.s390x.rpm
b375727f68ec92b287b55f37e1a13b12
seamonkey-nss-devel-1.0.8-0.1.el3.s390x.rpm

x86_64:
2a6e1bd4bebb86c3ec9e5ac7654d5a1e
seamonkey-1.0.8-0.1.el3.i386.rpm
58d678dafb0f2e97967de754e5111cac
seamonkey-1.0.8-0.1.el3.x86_64.rpm
77885a5baee9afdddf9ed6f3612b2a4c
seamonkey-chat-1.0.8-0.1.el3.x86_64.rpm
2e01227642c02d6e5f82217af32e94e6
seamonkey-debuginfo-1.0.8-0.1.el3.i386.rpm
639ece1f7226b8e7b25fadd209dc4f33
seamonkey-debuginfo-1.0.8-0.1.el3.x86_64.rpm
c9048de5da8fa83a0f1e7d6b4fbb0ead
seamonkey-devel-1.0.8-0.1.el3.x86_64.rpm
7ee075fa9702c36a514de4d575b9ae8e
seamonkey-dom-inspector-1.0.8-0.1.el3.x86_64.rpm
7c10397261a53697820fb2574490f390
seamonkey-js-debugger-1.0.8-0.1.el3.x86_64.rpm
9d89e65394eef9ca9874567a09f23ba5
seamonkey-mail-1.0.8-0.1.el3.x86_64.rpm
c9389de45d3d0f751e902ea4003d56ed
seamonkey-nspr-1.0.8-0.1.el3.i386.rpm
b71f32d60d8a6492c39868d6677ff15a
seamonkey-nspr-1.0.8-0.1.el3.x86_64.rpm
4dbc63a76557c64d919d83735fe72de4
seamonkey-nspr-devel-1.0.8-0.1.el3.x86_64.rpm
2615bc36969370b66fd80025409e60ff
seamonkey-nss-1.0.8-0.1.el3.i386.rpm
e0f3e5ef4a474dcedb51db957ee00f40
seamonkey-nss-1.0.8-0.1.el3.x86_64.rpm
e25a251ac1a056ee2e8c077e77317232
seamonkey-nss-devel-1.0.8-0.1.el3.x86_64.rpm

Red Hat Desktop version 3:

SRPMS:

ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/seamonkey-1.0.8-0.1.el3.src.rpm

d9c0432dac707bef181baa7bd7783621
seamonkey-1.0.8-0.1.el3.src.rpm

Red Hat Enterprise Linux ES version 3:

SRPMS:

ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/seamonkey-1.0.8-0.1.el3.src.rpm

d9c0432dac707bef181baa7bd7783621
seamonkey-1.0.8-0.1.el3.src.rpm

Red Hat Enterprise Linux WS version 3:

SRPMS:

ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/seamonkey-1.0.8-0.1.el3.src.rpm

d9c0432dac707bef181baa7bd7783621
seamonkey-1.0.8-0.1.el3.src.rpm

Red Hat Enterprise Linux AS version 4:

SRPMS:

ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/devhelp-0.10-0.7.el4.src.rpm

a7f99203ff09b10414224ee195b86984
devhelp-0.10-0.7.el4.src.rpm
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/seamonkey-1.0.8-0.1.el4.src.rpm

3b5379b498327acaca9a3667d5b2d167
seamonkey-1.0.8-0.1.el4.src.rpm

i386:
da5cbb74822b4ecf6bcb6ef1c4d4bf31
devhelp-0.10-0.7.el4.i386.rpm
fc612902ccc2b60c1d063124ee432c19
devhelp-debuginfo-0.10-0.7.el4.i386.rpm
7a6b87e57b497aa1869e2ed2c2ea19dd
devhelp-devel-0.10-0.7.el4.i386.rpm
e621eb35b3e4299af003bd15d9f41f58
seamonkey-1.0.8-0.1.el4.i386.rpm
5eba76356fa0720b47f5a2c7ae80b147
seamonkey-chat-1.0.8-0.1.el4.i386.rpm
bed8c2cd6767db3fb2beb244f6f4d9d8
seamonkey-debuginfo-1.0.8-0.1.el4.i386.rpm
3176df8ed772f3c82bdcea5b51772e7f
seamonkey-devel-1.0.8-0.1.el4.i386.rpm
9e7e4a1557a88ad7ce1830741f8bae68
seamonkey-dom-inspector-1.0.8-0.1.el4.i386.rpm
9bcabc447dae113d5a9b93ec06817438
seamonkey-js-debugger-1.0.8-0.1.el4.i386.rpm
cf922931516e8907041d5410015b4131
seamonkey-mail-1.0.8-0.1.el4.i386.rpm
adce235489a2b56887dbf8c752467b37
seamonkey-nspr-1.0.8-0.1.el4.i386.rpm
f7d0c66ed0c14578a4e3a50560c892ae
seamonkey-nspr-devel-1.0.8-0.1.el4.i386.rpm
fc93912e0ac211c37c0f0d8828b801d3
seamonkey-nss-1.0.8-0.1.el4.i386.rpm
a44467cd4d67ffd4024f4112b94504a0
seamonkey-nss-devel-1.0.8-0.1.el4.i386.rpm

ia64:
d6e4836af1f9fc37d73a981e25def5d6
seamonkey-1.0.8-0.1.el4.ia64.rpm
f704d0e34baebf5d171985fd7563b3a7
seamonkey-chat-1.0.8-0.1.el4.ia64.rpm
bed8c2cd6767db3fb2beb244f6f4d9d8
seamonkey-debuginfo-1.0.8-0.1.el4.i386.rpm
1b4beec7d1b8c233218d2caf94d0de12
seamonkey-debuginfo-1.0.8-0.1.el4.ia64.rpm
abc2b9d6de06ac157d6e061b359581d2
seamonkey-devel-1.0.8-0.1.el4.ia64.rpm
c8f0755c9bf719c2f4cd4f30610a90de
seamonkey-dom-inspector-1.0.8-0.1.el4.ia64.rpm
5826c8a4a9c808851857037af3e86f6d
seamonkey-js-debugger-1.0.8-0.1.el4.ia64.rpm
f2f19aa6b12849fd4bd4be7cca5bf3db
seamonkey-mail-1.0.8-0.1.el4.ia64.rpm
adce235489a2b56887dbf8c752467b37
seamonkey-nspr-1.0.8-0.1.el4.i386.rpm
ce460822031d3e127de6a4dff937243f
seamonkey-nspr-1.0.8-0.1.el4.ia64.rpm
cb228a1fefb73023dff832281f04da7f
seamonkey-nspr-devel-1.0.8-0.1.el4.ia64.rpm
fc93912e0ac211c37c0f0d8828b801d3
seamonkey-nss-1.0.8-0.1.el4.i386.rpm
28c95fd78764092dd85d7cdec15810c1
seamonkey-nss-1.0.8-0.1.el4.ia64.rpm
84a9888a9b11cd5d69e822d1882a1684
seamonkey-nss-devel-1.0.8-0.1.el4.ia64.rpm

ppc:
976ee42a5ebc31f22f9acaea03d85488
devhelp-0.10-0.7.el4.ppc.rpm
9ed66c497003d8db2d8a06cb6f338f7e
devhelp-debuginfo-0.10-0.7.el4.ppc.rpm
d8ec3f049fc6c54e4a2e97766608023c
devhelp-devel-0.10-0.7.el4.ppc.rpm
070c0d15ad58a28c7e9398fee2034b2f
seamonkey-1.0.8-0.1.el4.ppc.rpm
103f8683dd691fc6577eef35d1d382df
seamonkey-chat-1.0.8-0.1.el4.ppc.rpm
e0f4b6a4c5cfac949fd637841d88878d
seamonkey-debuginfo-1.0.8-0.1.el4.ppc.rpm
c0fc5b7374d1e5fe865cf895370203ba
seamonkey-devel-1.0.8-0.1.el4.ppc.rpm
1dbe916ae2bce866eb1c92a792037200
seamonkey-dom-inspector-1.0.8-0.1.el4.ppc.rpm
49c0fc00d4f9d2d4552f2ff4adca1a29
seamonkey-js-debugger-1.0.8-0.1.el4.ppc.rpm
8a2eb63b5a2c0728e96c923ca0aca763
seamonkey-mail-1.0.8-0.1.el4.ppc.rpm
a9c059263e592c93829117d9b0cfae6a
seamonkey-nspr-1.0.8-0.1.el4.ppc.rpm
a60a08fb7b1a0419b1481843fc00661d
seamonkey-nspr-devel-1.0.8-0.1.el4.ppc.rpm
2ef4d3f59b3af191d20c2dfeefcd7337
seamonkey-nss-1.0.8-0.1.el4.ppc.rpm
af9f46d44d0e22aa02d4865508cacc07
seamonkey-nss-devel-1.0.8-0.1.el4.ppc.rpm

s390x:
d1404cfd22dde0619d0ea0ea00a9ccd1
seamonkey-1.0.8-0.1.el4.s390x.rpm
9859f3e1f0f70a14eb9ee231a020524a
seamonkey-chat-1.0.8-0.1.el4.s390x.rpm
cd635043ee43391143f949a41c6fde86
seamonkey-debuginfo-1.0.8-0.1.el4.s390.rpm
1c547a8fde9a8b98197083bc04c22c6b
seamonkey-debuginfo-1.0.8-0.1.el4.s390x.rpm
a4f520e25b9ab7c916c93dad69e1fc64
seamonkey-devel-1.0.8-0.1.el4.s390x.rpm
dd99dff3cd8203d93c394c01e1b6a8aa
seamonkey-dom-inspector-1.0.8-0.1.el4.s390x.rpm
d22104b0c78404ab3a7c61e74afc5760
seamonkey-js-debugger-1.0.8-0.1.el4.s390x.rpm
3d30ea603f769a0a09873742b755b9f1
seamonkey-mail-1.0.8-0.1.el4.s390x.rpm
834d2f56576fa72dcc64e1831a323743 seamonkey-nspr-1.0.

Advisories, February 25, 2007

Mandriva Linux

Red Hat Linux

Get the Free Newsletter!

Must Read

How to Install and Use Nessus Vulnerability Scanner on Ubuntu 24.04

Best Free and Open Source Visual Automation Tools

PipeWire 1.4.1 Brings Bug Fixes and Stability Improvements

8 Tiny Utilities to Make Your Linux Experience Even Better

DXVK 2.6 Adds NVIDIA Reflex Support, Improvements for Many Games

Our Brands