Advisories, May 23, 2005

Fedora Core

Fedora Update Notification
FEDORA-2005-392
2005-05-23

Product : Fedora Core 3
Name : kernel
Version : 2.6.11
Release : 1.27_FC3
Summary : The Linux kernel (the core of the Linux operating
system)

Description :
The kernel package contains the Linux kernel (vmlinuz), the core of
any Linux operating system. The kernel handles the basic functions
of the operating system: memory allocation, process allocation,
device input and output, etc.

Tue May 17 2005 Dave Jones <davej@redhat.com>
- Remove the unused (and outdated) Xen patches from the FC3
  tree.
Mon May 16 2005 Dave Jones <davej@redhat.com>
- Rebase to 2.6.11.10, (fixing CAN-2005-1264)
Thu May 12 2005 Dave Jones <davej@redhat.com>
- Rebase to 2.6.11.9, (fixing CAN-2005-1263)
Tue May 10 2005 Dave Jones <davej@redhat.com>
- Fix two bugs in x86-64 page fault handler.
Mon May 9 2005 Dave Jones <davej@redhat.com>
- Rebase to 2.6.11.8
  Fixes CAN-2005-1368 (local DoS in key lookup). (#156680)
  Fixes CAN-2005-1369 (i2c alarms sysfs DoS). (#156683)
- Merge IDE fixes from 2.6.11-ac7
- Add Conflicts for older IPW firmwares.
- Fix conntrack leak with raw sockets.
Sun May 1 2005 Dave Jones <davej@redhat.com>
- Various firewire fixes backported from -mm. (#133798) (Thanks
  to Jody McIntyre for doing this)
Fri Apr 29 2005 Dave Jones <davej@redhat.com>
- fix oops in aacraid open when using adaptec tools.
  (#148761)
- Blacklist another brainless SCSI scanner. (#155457)
Thu Apr 21 2005 Dave Jones <davej@redhat.com>
- Fix up SCSI queue locking. (#155472)
Tue Apr 19 2005 Dave Jones <davej@redhat.com>
- SCSI tape security: require CAP_ADMIN for SG_IO etc.
  (#155355)
Mon Apr 18 2005 Dave Jones <davej@redhat.com>
- Retry more aggressively during USB device initialization
Thu Apr 14 2005 Dave Jones <davej@redhat.com>
- Build DRM modular. (#154769)
Fri Apr 8 2005 Dave Jones <davej@redhat.com>
- Disable Longhaul driver (again).

This update can be downloaded from:

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/

eb8eb148c1893fdebed808e57d1c7341
SRPMS/kernel-2.6.11-1.27_FC3.src.rpm
5680aee8a9fc7cafb99ec9e1bf107cb2
x86_64/kernel-2.6.11-1.27_FC3.x86_64.rpm
b888c53830bd94e7ccbcf7cf9a17b75b
x86_64/kernel-smp-2.6.11-1.27_FC3.x86_64.rpm
306bf40b4a80ca637f80886b42de3e33
x86_64/debug/kernel-debuginfo-2.6.11-1.27_FC3.x86_64.rpm
b8654be689d10962150468682139d42d
x86_64/kernel-doc-2.6.11-1.27_FC3.noarch.rpm
8485fa1f02c34f27b5a3e1411542428b
i386/kernel-2.6.11-1.27_FC3.i586.rpm
ed3ba65635f9b3e0a55bdb2324ec4336
i386/kernel-smp-2.6.11-1.27_FC3.i586.rpm
44e3ecec92f6619082fed9d580fc0784
i386/debug/kernel-debuginfo-2.6.11-1.27_FC3.i586.rpm
f1cad67f816aeeb95a0affc36a0e026f
i386/kernel-2.6.11-1.27_FC3.i686.rpm
70734d76439c49a0713a5f09e7f65c5f
i386/kernel-smp-2.6.11-1.27_FC3.i686.rpm
15bbcfe72ad670d86be8abdee254713e
i386/debug/kernel-debuginfo-2.6.11-1.27_FC3.i686.rpm
b8654be689d10962150468682139d42d
i386/kernel-doc-2.6.11-1.27_FC3.noarch.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the ‘up2date’ command.

Red Hat Linux

Red Hat Security Advisory

Synopsis: Important: firefox security update
Advisory ID: RHSA-2005:434-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-434.html

Issue date: 2005-05-23
Updated on: 2005-05-23
Product: Red Hat Enterprise Linux
CVE Names: CAN-2005-1476 CAN-2005-1477 CAN-2005-1531
CAN-2005-1532

1. Summary:

Updated firefox packages that fix various security bugs are now
available.

This update has been rated as having important security impact
by the Red Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 – i386, ia64, ppc, s390,
s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 – i386, x86_64
Red Hat Enterprise Linux ES version 4 – i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 – i386, ia64, x86_64

3. Problem description:

Mozilla Firefox is an open source Web browser.

Several bugs were found in the way Firefox executes javascript
code. Javascript executed from a web page should run with a
restricted access level, preventing dangerous actions. It is
possible that a malicious web page could execute javascript code
with elevated privileges, allowing access to protected data and
functions. The Common Vulnerabilities and Exposures project
(cve.mitre.org/) has assigned
the names CAN-2005-1476, CAN-2005-1477, CAN-2005-1531, and
CAN-2005-1532 to these issues.

Please note that the effects of CAN-2005-1477 are mitigated by
the default setup, which allows only the Mozilla Update site to
attempt installation of Firefox extensions. The Mozilla Update site
has been modified to prevent this attack from working. If other
URLs have been manually added to the whitelist, it may be possible
to execute this attack.

Users of Firefox are advised to upgrade to this updated package
which contains Firefox version 1.0.4 which is not vulnerable to
these issues.

4. Solution:

Before applying this update, make sure all previously released
errata relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat
Network, launch the Red Hat Update Agent with the following
command:

up2date

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.

5. RPMs required:

Red Hat Enterprise Linux AS version 4:

SRPMS:

ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/firefox-1.0.4-1.4.1.src.rpm
4f9b4bd723aba8d5293d00aac34c1b86
firefox-1.0.4-1.4.1.src.rpm

i386:
b68ad59036bb0b74fea8c5d53ea39438
firefox-1.0.4-1.4.1.i386.rpm

ia64:
bfa8af9ed21d9a3827f866b841a783cc
firefox-1.0.4-1.4.1.ia64.rpm

ppc:
71dbb17fce1828eb3f46114d05272fa8
firefox-1.0.4-1.4.1.ppc.rpm

s390:
534c7d82c927c24aae9f37acbcdcd4ea
firefox-1.0.4-1.4.1.s390.rpm

s390x:
dbdfe11ecc3482691f0674a83ccbb82e
firefox-1.0.4-1.4.1.s390x.rpm

x86_64:
33a6987f34b973610f9dab1a0efb59ed
firefox-1.0.4-1.4.1.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:

ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/firefox-1.0.4-1.4.1.src.rpm
4f9b4bd723aba8d5293d00aac34c1b86
firefox-1.0.4-1.4.1.src.rpm

i386:
b68ad59036bb0b74fea8c5d53ea39438
firefox-1.0.4-1.4.1.i386.rpm

x86_64:
33a6987f34b973610f9dab1a0efb59ed
firefox-1.0.4-1.4.1.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:

ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/firefox-1.0.4-1.4.1.src.rpm
4f9b4bd723aba8d5293d00aac34c1b86
firefox-1.0.4-1.4.1.src.rpm

i386:
b68ad59036bb0b74fea8c5d53ea39438
firefox-1.0.4-1.4.1.i386.rpm

ia64:
bfa8af9ed21d9a3827f866b841a783cc
firefox-1.0.4-1.4.1.ia64.rpm

x86_64:
33a6987f34b973610f9dab1a0efb59ed
firefox-1.0.4-1.4.1.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:

ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/firefox-1.0.4-1.4.1.src.rpm
4f9b4bd723aba8d5293d00aac34c1b86
firefox-1.0.4-1.4.1.src.rpm

i386:
b68ad59036bb0b74fea8c5d53ea39438
firefox-1.0.4-1.4.1.i386.rpm

ia64:
bfa8af9ed21d9a3827f866b841a783cc
firefox-1.0.4-1.4.1.ia64.rpm

x86_64:
33a6987f34b973610f9dab1a0efb59ed
firefox-1.0.4-1.4.1.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key
and details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

6. References:

http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox1.0.4

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1476

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1477

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1531

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1532

7. Contact:

The Red Hat security contact is <secalert@redhat.com>. More
contact details at https://www.redhat.com/security/team/contact/

Red Hat Security Advisory

Synopsis: Important: mozilla security update
Advisory ID: RHSA-2005:435-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-435.html

Issue date: 2005-05-23
Updated on: 2005-05-23
Product: Red Hat Enterprise Linux
CVE Names: CAN-2005-1476 CAN-2005-1477 CAN-2005-1531
CAN-2005-1532

1. Summary:

Updated mozilla packages that fix various security bugs are now
available.

This update has been rated as having important security impact
by the Red Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 –
i386, ia64
Red Hat Linux Advanced Workstation 2.1 – ia64
Red Hat Enterprise Linux ES version 2.1 – i386
Red Hat Enterprise Linux WS version 2.1 – i386
Red Hat Enterprise Linux AS version 3 – i386, ia64, ppc, s390,
s390x, x86_64
Red Hat Desktop version 3 – i386, x86_64
Red Hat Enterprise Linux ES version 3 – i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 – i386, ia64, x86_64
Red Hat Enterprise Linux AS version 4 – i386, ia64, ppc, s390,
s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 – i386, x86_64
Red Hat Enterprise Linux ES version 4 – i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 – i386, ia64, x86_64

3. Problem description:

Mozilla is an open source Web browser, advanced email and
newsgroup client, IRC chat client, and HTML editor.

Several bugs were found in the way Mozilla executes javascript
code. Javascript executed from a web page should run with a
restricted access level, preventing dangerous actions. It is
possible that a malicious web page could execute javascript code
with elevated privileges, allowing access to protected data and
functions. The Common Vulnerabilities and Exposures project
(cve.mitre.org/) has assigned
the names CAN-2005-1476, CAN-2005-1477, CAN-2005-1531, and
CAN-2005-1532 to these issues.

Users of Mozilla are advised to upgrade to this updated package,
which contains Mozilla version 1.7.8 to correct these issues.

4. Solution:

Before applying this update, make sure all previously released
errata relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat
Network, launch the Red Hat Update Agent with the following
command:

up2date

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.

5. RPMs required:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1:

SRPMS:

ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/galeon-1.2.14-1.2.5.src.rpm
4af4ef3c2227af8f776425c9d1bbc281
<“http://galeon-1.2.14-1.2.5.src.rpm”>galeon-1.2.14-1.2.5.src.rpm

ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/mozilla-1.7.8-1.1.2.1.src.rpm
8a34bfad0cf67f237dff6361157ae06e
<“http://mozilla-1.7.8-1.1.2.1.src.rpm”>mozilla-1.7.8-1.1.2.1.src.rpm

i386:
0d57746e65417719999e5829f5551ce8
<“http://galeon-1.2.14-1.2.5.i386.rpm”>galeon-1.2.14-1.2.5.i386.rpm

6b5e9c8e06ada5a63ce0fae0709bdf5e
<“http://mozilla-1.7.8-1.1.2.1.i386.rpm”>mozilla-1.7.8-1.1.2.1.i386.rpm

d489fab35d5b56b3d3ac195ca8f95722
<“http://mozilla-chat-1.7.8-1.1.2.1.i386.rpm”>mozilla-chat-1.7.8-1.1.2.1.i386.rpm

c700e7769c9f726d9fee71e2a92ead3f
<“http://mozilla-devel-1.7.8-1.1.2.1.i386.rpm”>mozilla-devel-1.7.8-1.1.2.1.i386.rpm

ad0afbfd7d41d05d60e47c4af636738f
<“http://mozilla-dom-inspector-1.7.8-1.1.2.1.i386.rpm”>mozilla-dom-inspector-1.7.8-1.1.2.1.i386.rpm

2e9a40b46f34782810704a8e961c92b2
<“http://mozilla-js-debugger-1.7.8-1.1.2.1.i386.rpm”>mozilla-js-debugger-1.7.8-1.1.2.1.i386.rpm

172f647e7eb962ee1659afa9c60c4791
<“http://mozilla-mail-1.7.8-1.1.2.1.i386.rpm”>mozilla-mail-1.7.8-1.1.2.1.i386.rpm

0fb9e6b246e579b41c41644ebacc8d32
<“http://mozilla-nspr-1.7.8-1.1.2.1.i386.rpm”>mozilla-nspr-1.7.8-1.1.2.1.i386.rpm

6ed8d6aba58e45a3458524562117e62d
<“http://mozilla-nspr-devel-1.7.8-1.1.2.1.i386.rpm”>mozilla-nspr-devel-1.7.8-1.1.2.1.i386.rpm

46d3552771e8425c08b878b8eceb61df
<“http://mozilla-nss-1.7.8-1.1.2.1.i386.rpm”>mozilla-nss-1.7.8-1.1.2.1.i386.rpm

66930f01ee46e52b8d91ac42c59c50e6
<“http://mozilla-nss-devel-1.7.8-1.1.2.1.i386.rpm”>mozilla-nss-devel-1.7.8-1.1.2.1.i386.rpm

ia64:
61864d5181a383178f1d04a45a934bcf
<“http://galeon-1.2.14-1.2.5.ia64.rpm”>galeon-1.2.14-1.2.5.ia64.rpm

200b07850adcbd520797ef5df5303d05
<“http://mozilla-1.7.8-1.1.2.1.ia64.rpm”>mozilla-1.7.8-1.1.2.1.ia64.rpm

b43bcd118155d74a52f23ec119a5608d
<“http://mozilla-chat-1.7.8-1.1.2.1.ia64.rpm”>mozilla-chat-1.7.8-1.1.2.1.ia64.rpm

03464e784fdb548b406f79f82d05041d
<“http://mozilla-devel-1.7.8-1.1.2.1.ia64.rpm”>mozilla-devel-1.7.8-1.1.2.1.ia64.rpm

9db5e619a99bd1bffc58240c493f9f3d
<“http://mozilla-dom-inspector-1.7.8-1.1.2.1.ia64.rpm”>mozilla-dom-inspector-1.7.8-1.1.2.1.ia64.rpm

edb91fd591647b55c671bfd5ac4f32b9
<“http://mozilla-js-debugger-1.7.8-1.1.2.1.ia64.rpm”>mozilla-js-debugger-1.7.8-1.1.2.1.ia64.rpm

9114877d323cf0c40ca88853b68019f0
<“http://mozilla-mail-1.7.8-1.1.2.1.ia64.rpm”>mozilla-mail-1.7.8-1.1.2.1.ia64.rpm

bc433f7c6ad1ac40d0ee6cbbc4145834
<“http://mozilla-nspr-1.7.8-1.1.2.1.ia64.rpm”>mozilla-nspr-1.7.8-1.1.2.1.ia64.rpm

0b72848a620aff45e07a357c329ca278
<“http://mozilla-nspr-devel-1.7.8-1.1.2.1.ia64.rpm”>mozilla-nspr-devel-1.7.8-1.1.2.1.ia64.rpm

0a60c2f6e40b8417f94930e1448ee70f
<“http://mozilla-nss-1.7.8-1.1.2.1.ia64.rpm”>mozilla-nss-1.7.8-1.1.2.1.ia64.rpm

e54f185c50c77d66aa4a2c1c8502856a
<“http://mozilla-nss-devel-1.7.8-1.1.2.1.ia64.rpm”>mozilla-nss-devel-1.7.8-1.1.2.1.ia64.rpm

Red Hat Linux Advanced Workstation 2.1:

SRPMS:

ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/galeon-1.2.14-1.2.5.src.rpm
4af4ef3c2227af8f776425c9d1bbc281
<“http://galeon-1.2.14-1.2.5.src.rpm”>galeon-1.2.14-1.2.5.src.rpm

ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/mozilla-1.7.8-1.1.2.1.src.rpm
8a34bfad0cf67f237dff6361157ae06e
<“http://mozilla-1.7.8-1.1.2.1.src.rpm”>mozilla-1.7.8-1.1.2.1.src.rpm