Debian GNU/Linux
Debian Security Advisory DSA 1050-1 security@debian.org
http://www.debian.org/security/
Martin Schulze
May 2nd, 2006 http://www.debian.org/security/faq
Package : clamav
Vulnerability : buffer overflow
Problem type : remote
Debian-specific: no
CVE ID : CVE-2006-1989
BugTraq ID : 17754
Ulf Hürnhammar and an anonymous researcher from Germany
discovered a vulnerability in the protocol code of freshclam, a
command line utility responsible for downloading and installing
virus signature updates for ClamAV, the antivirus scanner for Unix.
This could lead to a denial of service or potentially the execution
of arbitrary code.
The old stable distribution (woody) does not contain clamav
packages.
For the stable distribution (sarge) this problem has been fixed
in version 0.84-2.sarge.9.
For the unstable distribution (sid) this problem has been fixed
in version 0.88.2-1.
We recommend that you upgrade your clamav packages.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
Source archives:
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.9.dsc
Size/MD5 checksum: 876
943e000ec0e1286a3dbdf29df42d2079
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.9.diff.gz
Size/MD5 checksum: 176085
5e83632aca0a41e5e9e666d7dc9bddb1
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84.orig.tar.gz
Size/MD5 checksum: 4006624
c43213da01d510faf117daa9a4d5326c
Architecture independent components:
http://security.debian.org/pool/updates/main/c/clamav/clamav-base_0.84-2.sarge.9_all.deb
Size/MD5 checksum: 154874
583075812746d50b00cf393f91cf6268
http://security.debian.org/pool/updates/main/c/clamav/clamav-docs_0.84-2.sarge.9_all.deb
Size/MD5 checksum: 690472
154f6c262b9525573acbc7d63c0fc58a
http://security.debian.org/pool/updates/main/c/clamav/clamav-testfiles_0.84-2.sarge.9_all.deb
Size/MD5 checksum: 123852
431264c393cbf721d11a4c17b465984c
Alpha architecture:
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.9_alpha.deb
Size/MD5 checksum: 74762
c0841b5ad9c30a0e1ab5bc852a5b4df5
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.9_alpha.deb
Size/MD5 checksum: 48832
ca0177b0ad40dab6ebd5e2482dccff0c
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.9_alpha.deb
Size/MD5 checksum: 2176472
9c55170dba238d910e2a76a9b9a0f90e
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.9_alpha.deb
Size/MD5 checksum: 42110
91038c466a5d7da73ec408edf1d79079
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.9_alpha.deb
Size/MD5 checksum: 255658
4018f5b3119dbe0a046bd3ef0eea7f5d
http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.9_alpha.deb
Size/MD5 checksum: 285526
dc76ca7e4f9334b55b8552e6de6144a7
AMD64 architecture:
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.9_amd64.deb
Size/MD5 checksum: 68840
f129489350c5dd3b700f10eae2e41e74
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.9_amd64.deb
Size/MD5 checksum: 44172
dfab3e90cb2948c876a66f34688a8e54
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.9_amd64.deb
Size/MD5 checksum: 2173250
bc5b91cd655eea9f62d9c997a4f33d0e
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.9_amd64.deb
Size/MD5 checksum: 40002
003163f47600d0992a6c6d445919e2a5
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.9_amd64.deb
Size/MD5 checksum: 176418
530c4ae72744122635ca79305d7624c8
http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.9_amd64.deb
Size/MD5 checksum: 259640
252a1582028a3a931d7535bcd6c08a93
ARM architecture:
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.9_arm.deb
Size/MD5 checksum: 63908
daadbd0ec8dd6bbbe0efb7dea8c7c862
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.9_arm.deb
Size/MD5 checksum: 39588
033e2e0cfcc9bff7560beb8a98c6d07b
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.9_arm.deb
Size/MD5 checksum: 2171286
19e45af806dc2d39dbf2facc99e71414
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.9_arm.deb
Size/MD5 checksum: 37304
8918504ae9fe175df5e403248df27184
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.9_arm.deb
Size/MD5 checksum: 174796
ecb5d13c843235495b25cfb422dcdd1e
http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.9_arm.deb
Size/MD5 checksum: 249614
68a25e96c65651a742a3cdea82b6e4dc
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.9_i386.deb
Size/MD5 checksum: 65208
499c59767ffef73b2e466d0ad355acd9
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.9_i386.deb
Size/MD5 checksum: 40312
5c1197cfd1d386259090acd018a09d1d
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.9_i386.deb
Size/MD5 checksum: 2171586
18efe0dffbe399b65f6109cf64fb4ebc
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.9_i386.deb
Size/MD5 checksum: 38026
e2ea6a0007d4cb3eb89a677ced6237d0
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.9_i386.deb
Size/MD5 checksum: 159514
07dc6d59c3ca44802a884ba57295f25c
http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.9_i386.deb
Size/MD5 checksum: 254212
8f0ac53bb73ab04cace56dacbd1f7385
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.9_ia64.deb
Size/MD5 checksum: 81806
2f5e60307573c83948b364aba0b902d7
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.9_ia64.deb
Size/MD5 checksum: 55248
b0836a06803e2817c62a2fb0e44bbdf2
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.9_ia64.deb
Size/MD5 checksum: 2180260
67d516ba4de63b2df9a2f22ea09977cc
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.9_ia64.deb
Size/MD5 checksum: 49196
eef0faa8458ad343723b2ad5ab20b85d
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.9_ia64.deb
Size/MD5 checksum: 252022
44ae4643b97df4c60fc9344e978ed301
http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.9_ia64.deb
Size/MD5 checksum: 317594
792d635c17661ff30a98002bcbf28c20
HP Precision architecture:
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.9_hppa.deb
Size/MD5 checksum: 68278
e6ae93d179cf42dff2e3e21f73b791d8
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.9_hppa.deb
Size/MD5 checksum: 43294
aca3a82514944bd64fe592f4c82fd3ee
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.9_hppa.deb
Size/MD5 checksum: 2173750
e75c6299f3bcebf2fde0152a97964fd5
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.9_hppa.deb
Size/MD5 checksum: 39444
1bcd721e1d64f1dd87d210e67dd03c8a
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.9_hppa.deb
Size/MD5 checksum: 202610
6de992b66d479fc91ab9c7f2ce241fe8
http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.9_hppa.deb
Size/MD5 checksum: 283332
b53830c42ec5c4b4cc2f75804ee33165
Motorola 680×0 architecture:
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.9_m68k.deb
Size/MD5 checksum: 62522
b64d3b425ff4a76e45a1ad3fda52ac93
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.9_m68k.deb
Size/MD5 checksum: 38206
14a9a4a27a4b09153cce7adf167e3832
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.9_m68k.deb
Size/MD5 checksum: 2170544
eda974d6e3d676f4eaffb82a73548b89
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.9_m68k.deb
Size/MD5 checksum: 35058
04b9394b533707237f58a402339cd84f
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.9_m68k.deb
Size/MD5 checksum: 146258
5ea523a7dbf19ff9d9d01b4ad8f31f39
http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.9_m68k.deb
Size/MD5 checksum: 250356
1954573109230d4898760c36a3c87ba4
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.9_mips.deb
Size/MD5 checksum: 67950
27a6b985d95bb70281ad7cd842770170
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.9_mips.deb
Size/MD5 checksum: 43798
c802171f2f84f4f14ef1a720ecbb8aa7
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.9_mips.deb
Size/MD5 checksum: 2173032
7aa9e633b0962f5ab86ee11fb7c3974a
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.9_mips.deb
Size/MD5 checksum: 37668
dec8e08fd9996962a93a1c3d752be4f0
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.9_mips.deb
Size/MD5 checksum: 195430
3e94e63724ef9c2dd11a59648f4b5c97
http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.9_mips.deb
Size/MD5 checksum: 257462
ef59f02caa5d95c70b85022ea788bfa3
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.9_mipsel.deb
Size/MD5 checksum: 67556
a8f18eb0565bba5c75370ff92ac78f38
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.9_mipsel.deb
Size/MD5 checksum: 43580
59d814309d704ff91e9e07d492cc7167
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.9_mipsel.deb
Size/MD5 checksum: 2172984
cb6babbbb93113c91190757557209803
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.9_mipsel.deb
Size/MD5 checksum: 37966
e87c71e23e8ccd7c1250c2338dafc9ea
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.9_mipsel.deb
Size/MD5 checksum: 191864
cdaf87930502971bfb89860cdef54ac1
http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.9_mipsel.deb
Size/MD5 checksum: 255070
50e2c374bd3bcb15ff980e1fb3251f7b
PowerPC architecture:
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.9_powerpc.deb
Size/MD5 checksum: 69284
4257688fc42e09118821e8958f0a6ee7
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.9_powerpc.deb
Size/MD5 checksum: 44694
f3ad6da5431802cc4d397bec741eca81
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.9_powerpc.deb
Size/MD5 checksum: 2173702
9b536d611b6ce4e48da03459c5071e84
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.9_powerpc.deb
Size/MD5 checksum: 38886
ff6033af2c67302deb234a7f120cf779
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.9_powerpc.deb
Size/MD5 checksum: 187680
227518152740d2518c5ec92105d85179
http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.9_powerpc.deb
Size/MD5 checksum: 264838
7f4c6eed60bdc21edd28b60fdfe4c710
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.9_s390.deb
Size/MD5 checksum: 67906
8c6217c5131838abbfd7ce298556c8b1
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.9_s390.deb
Size/MD5 checksum: 43564
d6af81d53141d8efddb3878d70a0e624
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.9_s390.deb
Size/MD5 checksum: 2172976
993af7eba4a41c2510f5280f37d7e048
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.9_s390.deb
Size/MD5 checksum: 38942
50b2b6c19597e479e1f398439018ce9c
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.9_s390.deb
Size/MD5 checksum: 182606
3821257f0925fe2be95a355d3d018d88
http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.9_s390.deb
Size/MD5 checksum: 269406
9fe3e9dd8e7564db863a452b2ff9ffae
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.9_sparc.deb
Size/MD5 checksum: 64424
df6e026c7266999f8747bc82706deb8f
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.9_sparc.deb
Size/MD5 checksum: 39456
a426823f333ab28e49b16934f19dc346
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.9_sparc.deb
Size/MD5 checksum: 2171178
ea328218eaa01a6ed32c2dcaff418844
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.9_sparc.deb
Size/MD5 checksum: 36844
c92fc7b0b4249d6dcd3058482a0936c3
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.9_sparc.deb
Size/MD5 checksum: 175782
45be5bb635f8fe1244045c429dae943f
http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.9_sparc.deb
Size/MD5 checksum: 264704
dfcbfa29904f0db5848da5de1885d1ea
These files will probably be moved into the stable distribution
on its next update.
For apt-get: deb http://security.debian.org/
stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security
dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>’ and http://packages.debian.org/<pkg>
Mandriva Linux
Mandriva Linux Security Advisory MDKSA-2006:081
http://www.mandriva.com/security/
Package : xorg-x11
Date : May 2, 2006
Affected: 10.2, 2006.0
Problem Description:
A problem was discovered in xorg-x11 where the X render
extension would mis-calculate the size of a buffer, leading to an
overflow that could possibly be exploited by clients of the X
server.
The updated packages have been patched to correct this
issue.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1526
Updated Packages:
Mandriva Linux 10.2:
a2b8586e98837e2e1944c76fb57b9ab1
10.2/RPMS/libxorg-x11-6.8.2-7.3.102mdk.i586.rpm
c40829d9ea0cfb5837019be1226c10be
10.2/RPMS/libxorg-x11-devel-6.8.2-7.3.102mdk.i586.rpm
1037572baf36062f474fc18d8ef3c479
10.2/RPMS/libxorg-x11-static-devel-6.8.2-7.3.102mdk.i586.rpm
04becfb293020cc4ff315a2ee0ebf32e
10.2/RPMS/X11R6-contrib-6.8.2-7.3.102mdk.i586.rpm
83ecbd5538b58e2e7b4b7ab1a275f232
10.2/RPMS/xorg-x11-100dpi-fonts-6.8.2-7.3.102mdk.i586.rpm
9a7d14442752f3bd569d238305e6b4c5
10.2/RPMS/xorg-x11-6.8.2-7.3.102mdk.i586.rpm
f59d28b4ccb04597bcffaefd61beddab
10.2/RPMS/xorg-x11-75dpi-fonts-6.8.2-7.3.102mdk.i586.rpm
e45d5e613005a56c083693ec06a0f42f
10.2/RPMS/xorg-x11-cyrillic-fonts-6.8.2-7.3.102mdk.i586.rpm
32f4a41dfb1160a15f00c79f6844497d
10.2/RPMS/xorg-x11-doc-6.8.2-7.3.102mdk.i586.rpm
2081fc6014b96ed43e2c7f3eff340598
10.2/RPMS/xorg-x11-glide-module-6.8.2-7.3.102mdk.i586.rpm
683ccfd056709341173fcfaca26d6093
10.2/RPMS/xorg-x11-server-6.8.2-7.3.102mdk.i586.rpm
c43fdd380205248d49dd178239b330d8
10.2/RPMS/xorg-x11-xauth-6.8.2-7.3.102mdk.i586.rpm
dd775264950082d89cdc54dcff3cd665
10.2/RPMS/xorg-x11-Xdmx-6.8.2-7.3.102mdk.i586.rpm
950dfe1df58de30e7a8978679365cf84
10.2/RPMS/xorg-x11-xfs-6.8.2-7.3.102mdk.i586.rpm
ec3b5a7752b7a3ebf6512410582d9307
10.2/RPMS/xorg-x11-Xnest-6.8.2-7.3.102mdk.i586.rpm
36d85f3ec61acf906794f460964e81ef
10.2/RPMS/xorg-x11-Xprt-6.8.2-7.3.102mdk.i586.rpm
35d88a1d859606994dcf419b5368a4ab
10.2/RPMS/xorg-x11-Xvfb-6.8.2-7.3.102mdk.i586.rpm
9186fc96840016fc20e734fc7011db41
10.2/SRPMS/xorg-x11-6.8.2-7.3.102mdk.src.rpm
Mandriva Linux 10.2/X86_64:
a780d4e331064a187377d4640d6c3f17
x86_64/10.2/RPMS/lib64xorg-x11-6.8.2-7.3.102mdk.x86_64.rpm
4a39ecfa5c3689418752402c38fa4cbf
x86_64/10.2/RPMS/lib64xorg-x11-devel-6.8.2-7.3.102mdk.x86_64.rpm
7dc493ee280124d65485c371bde6d768
x86_64/10.2/RPMS/lib64xorg-x11-static-devel-6.8.2-7.3.102mdk.x86_64.rpm
a2b8586e98837e2e1944c76fb57b9ab1
x86_64/10.2/RPMS/libxorg-x11-6.8.2-7.3.102mdk.i586.rpm
c40829d9ea0cfb5837019be1226c10be
x86_64/10.2/RPMS/libxorg-x11-devel-6.8.2-7.3.102mdk.i586.rpm
1037572baf36062f474fc18d8ef3c479
x86_64/10.2/RPMS/libxorg-x11-static-devel-6.8.2-7.3.102mdk.i586.rpm
e6a02cb2c3c4d9d80d47a2bf897a5eaa
x86_64/10.2/RPMS/X11R6-contrib-6.8.2-7.3.102mdk.x86_64.rpm
a6b0f7a3f8fbc35be6b94d351d8d7504
x86_64/10.2/RPMS/xorg-x11-100dpi-fonts-6.8.2-7.3.102mdk.x86_64.rpm
ba547a06e55cdd70665e1f6fa16a9f21
x86_64/10.2/RPMS/xorg-x11-6.8.2-7.3.102mdk.x86_64.rpm
69025794bb59e71f19e13b2f84c9e002
x86_64/10.2/RPMS/xorg-x11-75dpi-fonts-6.8.2-7.3.102mdk.x86_64.rpm
6aa05b3fad46e506f6c0cc5a5d6b16bd
x86_64/10.2/RPMS/xorg-x11-cyrillic-fonts-6.8.2-7.3.102mdk.x86_64.rpm
47789a545c49c17eb831c01784b217ec
x86_64/10.2/RPMS/xorg-x11-doc-6.8.2-7.3.102mdk.x86_64.rpm
a2d447afd9360b7fc09450da3523b552
x86_64/10.2/RPMS/xorg-x11-server-6.8.2-7.3.102mdk.x86_64.rpm
c0661878d727b5c2f0cfe689748923e2
x86_64/10.2/RPMS/xorg-x11-xauth-6.8.2-7.3.102mdk.x86_64.rpm
7d0b9c84fb5b83909e1dc59e8b7ee5e2
x86_64/10.2/RPMS/xorg-x11-Xdmx-6.8.2-7.3.102mdk.x86_64.rpm
60f4063de8adafcf691ef0d4627dac95
x86_64/10.2/RPMS/xorg-x11-xfs-6.8.2-7.3.102mdk.x86_64.rpm
30612f88bb7a2a2c97a625006b8b7f8f
x86_64/10.2/RPMS/xorg-x11-Xnest-6.8.2-7.3.102mdk.x86_64.rpm
6a3a87b3cf7f7a319e3d4718e157a9e8
x86_64/10.2/RPMS/xorg-x11-Xprt-6.8.2-7.3.102mdk.x86_64.rpm
ee2d660c48449e901d51d24fa220919d
x86_64/10.2/RPMS/xorg-x11-Xvfb-6.8.2-7.3.102mdk.x86_64.rpm
9186fc96840016fc20e734fc7011db41
x86_64/10.2/SRPMS/xorg-x11-6.8.2-7.3.102mdk.src.rpm
Mandriva Linux 2006.0:
1f422d4db438f8af71d37be16aa31dd8
2006.0/RPMS/libxorg-x11-6.9.0-5.5.20060mdk.i586.rpm
567fe8719887e0018da7c0c931b006be
2006.0/RPMS/libxorg-x11-devel-6.9.0-5.5.20060mdk.i586.rpm
bc6948084d15e2db685570435e6c578f
2006.0/RPMS/libxorg-x11-static-devel-6.9.0-5.5.20060mdk.i586.rpm
b0caee00bf81ead022e6ba43e936b3e4
2006.0/RPMS/X11R6-contrib-6.9.0-5.5.20060mdk.i586.rpm
bf84187d9c8c1359addc677d06f75bb0
2006.0/RPMS/xorg-x11-100dpi-fonts-6.9.0-5.5.20060mdk.i586.rpm
a8894744dec0a8141a525689911dc2ed
2006.0/RPMS/xorg-x11-6.9.0-5.5.20060mdk.i586.rpm
6ae694eb99ce727d4de310da9b52792e
2006.0/RPMS/xorg-x11-75dpi-fonts-6.9.0-5.5.20060mdk.i586.rpm
3972988a2e0575da6ed11f6f9941ef70
2006.0/RPMS/xorg-x11-cyrillic-fonts-6.9.0-5.5.20060mdk.i586.rpm
8c6bf7c477a4603425f4dda1b16e2dc8
2006.0/RPMS/xorg-x11-doc-6.9.0-5.5.20060mdk.i586.rpm
1ae0cd43a6e86cd2e2880c2efc3b2425
2006.0/RPMS/xorg-x11-glide-module-6.9.0-5.5.20060mdk.i586.rpm
f105a31d5bffc0bc9542309a6f74d3e7
2006.0/RPMS/xorg-x11-server-6.9.0-5.5.20060mdk.i586.rpm
7f74a7dc4beaa4805ef9ac2383c27e98
2006.0/RPMS/xorg-x11-xauth-6.9.0-5.5.20060mdk.i586.rpm
efc90de7405cef98c7eaea966beb4aae
2006.0/RPMS/xorg-x11-Xdmx-6.9.0-5.5.20060mdk.i586.rpm
ddee5ef185307f2791ea92696784c87a
2006.0/RPMS/xorg-x11-xfs-6.9.0-5.5.20060mdk.i586.rpm
0741c8b6834f7a48d955894b4d0b92e2
2006.0/RPMS/xorg-x11-Xnest-6.9.0-5.5.20060mdk.i586.rpm
6e6defaf5940866929820b52d6de7711
2006.0/RPMS/xorg-x11-Xprt-6.9.0-5.5.20060mdk.i586.rpm
ccc8c50d51b3e7a51aeeb6808b9ba155
2006.0/RPMS/xorg-x11-Xvfb-6.9.0-5.5.20060mdk.i586.rpm
5b61c9d922940a39907dc210b866d9b6
2006.0/SRPMS/xorg-x11-6.9.0-5.5.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
7af0c66f8ea216d5425754079a55160d
x86_64/2006.0/RPMS/lib64xorg-x11-6.9.0-5.5.20060mdk.x86_64.rpm
acbb8ca5144ff18f0771e2cca2a7285d
x86_64/2006.0/RPMS/lib64xorg-x11-devel-6.9.0-5.5.20060mdk.x86_64.rpm
9b66265d4e68509cfe6ab1a1c47da1a0
x86_64/2006.0/RPMS/lib64xorg-x11-static-devel-6.9.0-5.5.20060mdk.x86_64.rpm
1f422d4db438f8af71d37be16aa31dd8
x86_64/2006.0/RPMS/libxorg-x11-6.9.0-5.5.20060mdk.i586.rpm
567fe8719887e0018da7c0c931b006be
x86_64/2006.0/RPMS/libxorg-x11-devel-6.9.0-5.5.20060mdk.i586.rpm
bc6948084d15e2db685570435e6c578f
x86_64/2006.0/RPMS/libxorg-x11-static-devel-6.9.0-5.5.20060mdk.i586.rpm
6bae0bca551ee54302f7b02da07bf15f
x86_64/2006.0/RPMS/X11R6-contrib-6.9.0-5.5.20060mdk.x86_64.rpm
b2b420a89f9347ca74124f0abe57c522
x86_64/2006.0/RPMS/xorg-x11-100dpi-fonts-6.9.0-5.5.20060mdk.x86_64.rpm
f375d21d32bf2d07a94abbfedaac570c
x86_64/2006.0/RPMS/xorg-x11-6.9.0-5.5.20060mdk.x86_64.rpm
124ac772e205af0a172cfa8504cf3eb5
x86_64/2006.0/RPMS/xorg-x11-75dpi-fonts-6.9.0-5.5.20060mdk.x86_64.rpm
90a65f969a8857564f0f633613b52af3
x86_64/2006.0/RPMS/xorg-x11-cyrillic-fonts-6.9.0-5.5.20060mdk.x86_64.rpm
61b0387372dc4ed0426037949f02a5d8
x86_64/2006.0/RPMS/xorg-x11-doc-6.9.0-5.5.20060mdk.x86_64.rpm
803854e97100d7f256d9f0b0d701f71d
x86_64/2006.0/RPMS/xorg-x11-glide-module-6.9.0-5.5.20060mdk.x86_64.rpm
dc55e788b02ddb008b4e8da1c3fc1f21
x86_64/2006.0/RPMS/xorg-x11-server-6.9.0-5.5.20060mdk.x86_64.rpm
ad63a44856bb360fffff35774c738bfb
x86_64/2006.0/RPMS/xorg-x11-xauth-6.9.0-5.5.20060mdk.x86_64.rpm
d0961ffa49b85cbbfc297e321c1bccbb
x86_64/2006.0/RPMS/xorg-x11-Xdmx-6.9.0-5.5.20060mdk.x86_64.rpm
47ede4df893f6ee7ad53011d51f633fa
x86_64/2006.0/RPMS/xorg-x11-xfs-6.9.0-5.5.20060mdk.x86_64.rpm
5d971c554acd6dccaaa6804c7b21c295
x86_64/2006.0/RPMS/xorg-x11-Xnest-6.9.0-5.5.20060mdk.x86_64.rpm
e63a6853f525479bd08489cf4bfef4a0
x86_64/2006.0/RPMS/xorg-x11-Xprt-6.9.0-5.5.20060mdk.x86_64.rpm
2f93fa75efd11814b9c4b40838e1ae6b
x86_64/2006.0/RPMS/xorg-x11-Xvfb-6.9.0-5.5.20060mdk.x86_64.rpm
5b61c9d922940a39907dc210b866d9b6
x86_64/2006.0/SRPMS/xorg-x11-6.9.0-5.5.20060mdk.src.rpm
To upgrade automatically use MandrivaUpdate or urpmi. The
verification of md5 checksums and GPG signatures is performed
automatically for you.
All packages are signed by Mandriva for security. You can obtain
the GPG public key of the Mandriva Security Team by executing:
gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
Mandriva Linux Security Advisory MDKSA-2006:082
http://www.mandriva.com/security/
Package : libtiff
Date : May 3, 2006
Affected: 10.2, 2006.0, Corporate 3.0, Multi Network Firewall
2.0
Problem Description:
Several bugs were discovered in libtiff that can lead to remote
Denial of Service attacks. These bugs can only be triggered by a
user using an application that uses libtiff to process malformed
TIFF images.
The updated packages have been patched to correct these
issues.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2024
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2025
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2026
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2120
Updated Packages:
Mandriva Linux 10.2:
08aa5454f03ea0daaf88792f1b28492d
10.2/RPMS/libtiff3-3.6.1-11.3.102mdk.i586.rpm
edca378c1e3a3af275353828c8ba5746
10.2/RPMS/libtiff3-devel-3.6.1-11.3.102mdk.i586.rpm
de9380639ecb80528e12cdfcc9b1f506
10.2/RPMS/libtiff3-static-devel-3.6.1-11.3.102mdk.i586.rpm
6f3f3f8a152efa131e1fb1801452fc2c
10.2/RPMS/libtiff-progs-3.6.1-11.3.102mdk.i586.rpm
c8add100f4b65e0a836f4b224f75fa38
10.2/SRPMS/libtiff-3.6.1-11.3.102mdk.src.rpm
Mandriva Linux 10.2/X86_64:
70df79d86316f9935d974d8e13a87b9b
x86_64/10.2/RPMS/lib64tiff3-3.6.1-11.3.102mdk.x86_64.rpm
7e514fbb60efb31fdb095a364dab688e
x86_64/10.2/RPMS/lib64tiff3-devel-3.6.1-11.3.102mdk.x86_64.rpm
42a6f0ab6296f393c56425650dcb8001
x86_64/10.2/RPMS/lib64tiff3-static-devel-3.6.1-11.3.102mdk.x86_64.rpm
08aa5454f03ea0daaf88792f1b28492d
x86_64/10.2/RPMS/libtiff3-3.6.1-11.3.102mdk.i586.rpm
edca378c1e3a3af275353828c8ba5746
x86_64/10.2/RPMS/libtiff3-devel-3.6.1-11.3.102mdk.i586.rpm
de9380639ecb80528e12cdfcc9b1f506
x86_64/10.2/RPMS/libtiff3-static-devel-3.6.1-11.3.102mdk.i586.rpm
cb843af331e738e4366d08c9aa10d254
x86_64/10.2/RPMS/libtiff-progs-3.6.1-11.3.102mdk.x86_64.rpm
c8add100f4b65e0a836f4b224f75fa38
x86_64/10.2/SRPMS/libtiff-3.6.1-11.3.102mdk.src.rpm
Mandriva Linux 2006.0:
b312c637a3f8eaadd3ffef2f16106c61
2006.0/RPMS/libtiff3-3.6.1-12.2.20060mdk.i586.rpm
0c78fe6412dd5d34e3be74f8e64bfcbe
2006.0/RPMS/libtiff3-devel-3.6.1-12.2.20060mdk.i586.rpm
7985656ea5af359dc92d27a8f683511c
2006.0/RPMS/libtiff3-static-devel-3.6.1-12.2.20060mdk.i586.rpm
6c9aad5364d6bbaafe838490c3de4149
2006.0/RPMS/libtiff-progs-3.6.1-12.2.20060mdk.i586.rpm
8ebe45e1b516c5422078bccdc540fb90
2006.0/SRPMS/libtiff-3.6.1-12.2.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
3741640beefd9ceb2741dd894c00c5e7
x86_64/2006.0/RPMS/lib64tiff3-3.6.1-12.2.20060mdk.x86_64.rpm
630cf4538bd6af1271128b0f842daf06
x86_64/2006.0/RPMS/lib64tiff3-devel-3.6.1-12.2.20060mdk.x86_64.rpm
cdbe7a7912cc50b3e956ed4788cdf340
x86_64/2006.0/RPMS/lib64tiff3-static-devel-3.6.1-12.2.20060mdk.x86_64.rpm
b312c637a3f8eaadd3ffef2f16106c61
x86_64/2006.0/RPMS/libtiff3-3.6.1-12.2.20060mdk.i586.rpm
0c78fe6412dd5d34e3be74f8e64bfcbe
x86_64/2006.0/RPMS/libtiff3-devel-3.6.1-12.2.20060mdk.i586.rpm
7985656ea5af359dc92d27a8f683511c
x86_64/2006.0/RPMS/libtiff3-static-devel-3.6.1-12.2.20060mdk.i586.rpm
c18a79a99fd471ced4b9915a3f9cd02e
x86_64/2006.0/RPMS/libtiff-progs-3.6.1-12.2.20060mdk.x86_64.rpm
8ebe45e1b516c5422078bccdc540fb90
x86_64/2006.0/SRPMS/libtiff-3.6.1-12.2.20060mdk.src.rpm
Corporate 3.0:
5b1cab786292da88043f192f544711d4
corporate/3.0/RPMS/libtiff3-3.5.7-11.9.C30mdk.i586.rpm
07778376fbe909b72f11c72408802fce
corporate/3.0/RPMS/libtiff3-devel-3.5.7-11.9.C30mdk.i586.rpm
2ce6f04f2ceb4e0c116b7f7a286b12e8
corporate/3.0/RPMS/libtiff3-static-devel-3.5.7-11.9.C30mdk.i586.rpm
d070d7982ab041207bb3cbed78cdfedf
corporate/3.0/RPMS/libtiff-progs-3.5.7-11.9.C30mdk.i586.rpm
b1d24c6cf07a8af24f162554bc891678
corporate/3.0/SRPMS/libtiff-3.5.7-11.9.C30mdk.src.rpm
Corporate 3.0/X86_64:
28e50e45ffbd233c2613455e5e128bae
x86_64/corporate/3.0/RPMS/lib64tiff3-3.5.7-11.9.C30mdk.x86_64.rpm
e43553c5fe9b72c12ba5538b4f5cae9a
x86_64/corporate/3.0/RPMS/lib64tiff3-devel-3.5.7-11.9.C30mdk.x86_64.rpm
160b42be0ce2429fd6d14fca71d193a2
x86_64/corporate/3.0/RPMS/lib64tiff3-static-devel-3.5.7-11.9.C30mdk.x86_64.rpm
5b1cab786292da88043f192f544711d4
x86_64/corporate/3.0/RPMS/libtiff3-3.5.7-11.9.C30mdk.i586.rpm
2e301111d4c1920dfb9a83324492bec7
x86_64/corporate/3.0/RPMS/libtiff-progs-3.5.7-11.9.C30mdk.x86_64.rpm
b1d24c6cf07a8af24f162554bc891678
x86_64/corporate/3.0/SRPMS/libtiff-3.5.7-11.9.C30mdk.src.rpm
Multi Network Firewall 2.0:
7f6bd8706a7b6ffc36649aad2f4e199d
mnf/2.0/RPMS/libtiff3-3.5.7-11.9.M20mdk.i586.rpm
320c31cfb0f44f1d3b43baf8f486e260
mnf/2.0/SRPMS/libtiff-3.5.7-11.9.M20mdk.src.rpm
To upgrade automatically use MandrivaUpdate or urpmi. The
verification of md5 checksums and GPG signatures is performed
automatically for you.
All packages are signed by Mandriva for security. You can obtain
the GPG public key of the Mandriva Security Team by executing:
gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
Red Hat Linux
Red Hat Security Advisory
Synopsis: Moderate: dia security update
Advisory ID: RHSA-2006:0280-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2006-0280.html
Issue date: 2006-05-03
Updated on: 2006-05-03
Product: Red Hat Enterprise Linux
CVE Names: CVE-2006-1550
1. Summary:
An updated Dia package that fixes several buffer overflow bugs
are now available.
This update has been rated as having moderate security impact by
the Red Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 –
i386, ia64
Red Hat Linux Advanced Workstation 2.1 – ia64
Red Hat Enterprise Linux ES version 2.1 – i386
Red Hat Enterprise Linux WS version 2.1 – i386
Red Hat Enterprise Linux AS version 4 – i386, ia64, ppc, s390,
s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 – i386, x86_64
Red Hat Enterprise Linux ES version 4 – i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 – i386, ia64, x86_64
3. Problem description:
The Dia drawing program is designed to draw various types of
diagrams.
infamous41md discovered three buffer overflow bugs in Dia’s xfig
file format importer. If an attacker is able to trick a Dia user
into opening a carefully crafted xfig file, it may be possible to
execute arbitrary code as the user running Dia. (CVE-2006-1550)
Users of Dia should update to these erratum packages, which
contain backported patches and are not vulnerable to these
issues.
4. Solution:
Before applying this update, make sure all previously released
errata relevant to your system have been applied.
This update is available via Red Hat Network. To use Red Hat
Network, launch the Red Hat Update Agent with the following
command:
up2date
This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.
5. Bug IDs fixed (http://bugzilla.redhat.com/):
187401 – CVE-2006-1550 Dia multiple buffer overflows
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/dia-0.88.1-3.3.src.rpm
a2bcfd1db5b67912d03cc8377d0efa4e dia-0.88.1-3.3.src.rpm
i386:
3a1e3f98594ec1039dbcc4055d2d6426 dia-0.88.1-3.3.i386.rpm
ia64:
f0fc2b254fcabcf6aa4e8e0ea94f02f9 dia-0.88.1-3.3.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/dia-0.88.1-3.3.src.rpm
a2bcfd1db5b67912d03cc8377d0efa4e dia-0.88.1-3.3.src.rpm
ia64:
f0fc2b254fcabcf6aa4e8e0ea94f02f9 dia-0.88.1-3.3.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/dia-0.88.1-3.3.src.rpm
a2bcfd1db5b67912d03cc8377d0efa4e dia-0.88.1-3.3.src.rpm
i386:
3a1e3f98594ec1039dbcc4055d2d6426 dia-0.88.1-3.3.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/dia-0.88.1-3.3.src.rpm
a2bcfd1db5b67912d03cc8377d0efa4e dia-0.88.1-3.3.src.rpm
i386:
3a1e3f98594ec1039dbcc4055d2d6426 dia-0.88.1-3.3.i386.rpm
Red Hat Enterprise Linux AS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/dia-0.94-5.4.src.rpm
97d5aaa13d19483c21cbc329dc00001b dia-0.94-5.4.src.rpm
i386:
6ee8860a0ba1fb695198f9562f422473 dia-0.94-5.4.i386.rpm
04f3ac7cb40626b4836dfd4a45135276
dia-debuginfo-0.94-5.4.i386.rpm
ia64:
03205912eecd5ae3f2d65f91769593a3 dia-0.94-5.4.ia64.rpm
e572ed6ba3b0d936cc38c0de14ebae88
dia-debuginfo-0.94-5.4.ia64.rpm
ppc:
af35c1218f2bede5aa806b8a335b2715 dia-0.94-5.4.ppc.rpm
e93f1a08b58a636e8e55a538776d2d52
dia-debuginfo-0.94-5.4.ppc.rpm
s390:
c59cce80c5e6b5a3f0564abe61098156 dia-0.94-5.4.s390.rpm
03159e17a741914c405d88ae6b5dea43
dia-debuginfo-0.94-5.4.s390.rpm
s390x:
25656c7e6ab95af3f159bd25f8002627 dia-0.94-5.4.s390x.rpm
82df44848401aa6fcb162b3a874aff55
dia-debuginfo-0.94-5.4.s390x.rpm
x86_64:
3fac8491faa94d85be7b13e9d16ad1fb dia-0.94-5.4.x86_64.rpm
3e41ac343a6fcb2c589863020ecbe139
dia-debuginfo-0.94-5.4.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/dia-0.94-5.4.src.rpm
97d5aaa13d19483c21cbc329dc00001b dia-0.94-5.4.src.rpm
i386:
6ee8860a0ba1fb695198f9562f422473 dia-0.94-5.4.i386.rpm
04f3ac7cb40626b4836dfd4a45135276
dia-debuginfo-0.94-5.4.i386.rpm
x86_64:
3fac8491faa94d85be7b13e9d16ad1fb dia-0.94-5.4.x86_64.rpm
3e41ac343a6fcb2c589863020ecbe139
dia-debuginfo-0.94-5.4.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/dia-0.94-5.4.src.rpm
97d5aaa13d19483c21cbc329dc00001b dia-0.94-5.4.src.rpm
i386:
6ee8860a0ba1fb695198f9562f422473 dia-0.94-5.4.i386.rpm
04f3ac7cb40626b4836dfd4a45135276
dia-debuginfo-0.94-5.4.i386.rpm
ia64:
03205912eecd5ae3f2d65f91769593a3 dia-0.94-5.4.ia64.rpm
e572ed6ba3b0d936cc38c0de14ebae88
dia-debuginfo-0.94-5.4.ia64.rpm
x86_64:
3fac8491faa94d85be7b13e9d16ad1fb dia-0.94-5.4.x86_64.rpm
3e41ac343a6fcb2c589863020ecbe139
dia-debuginfo-0.94-5.4.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/dia-0.94-5.4.src.rpm
97d5aaa13d19483c21cbc329dc00001b dia-0.94-5.4.src.rpm
i386:
6ee8860a0ba1fb695198f9562f422473 dia-0.94-5.4.i386.rpm
04f3ac7cb40626b4836dfd4a45135276
dia-debuginfo-0.94-5.4.i386.rpm
ia64:
03205912eecd5ae3f2d65f91769593a3 dia-0.94-5.4.ia64.rpm
e572ed6ba3b0d936cc38c0de14ebae88
dia-debuginfo-0.94-5.4.ia64.rpm
x86_64:
3fac8491faa94d85be7b13e9d16ad1fb dia-0.94-5.4.x86_64.rpm
3e41ac343a6fcb2c589863020ecbe139
dia-debuginfo-0.94-5.4.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key
and details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1550
http://www.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More
contact details at https://www.redhat.com/security/team/contact/
Copyright 2006 Red Hat, Inc.
Red Hat Security Advisory
Synopsis: Moderate: squirrelmail security update
Advisory ID: RHSA-2006:0283-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2006-0283.html
Issue date: 2006-05-03
Updated on: 2006-05-03
Product: Red Hat Enterprise Linux
CVE Names: CVE-2006-0188 CVE-2006-0195 CVE-2006-0377
1. Summary:
An updated squirrelmail package that fixes three security and
many other bug issues is now available. This update contains bug
fixes of upstream squirrelmail 1.4.6 with some additional
improvements to international language support.
This update has been rated as having moderate security impact by
the Red Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 3 – noarch
Red Hat Desktop version 3 – noarch
Red Hat Enterprise Linux ES version 3 – noarch
Red Hat Enterprise Linux WS version 3 – noarch
Red Hat Enterprise Linux AS version 4 – noarch
Red Hat Enterprise Linux Desktop version 4 – noarch
Red Hat Enterprise Linux ES version 4 – noarch
Red Hat Enterprise Linux WS version 4 – noarch
3. Problem description:
SquirrelMail is a standards-based webmail package written in
PHP4.
A bug was found in the way SquirrelMail presents the right frame
to the user. If a user can be tricked into opening a carefully
crafted URL, it is possible to present the user with arbitrary HTML
data. (CVE-2006-0188)
A bug was found in the way SquirrelMail filters incoming HTML
email. It is possible to cause a victim’s web browser to request
remote content by opening a HTML email while running a web browser
that processes certain types of invalid style sheets. Only Internet
Explorer is known to process such malformed style sheets.
(CVE-2006-0195)
A bug was found in the way SquirrelMail processes a request to
select an IMAP mailbox. If a user can be tricked into opening a
carefully crafted URL, it is possible to execute arbitrary IMAP
commands as the user viewing their mail with SquirrelMail.
(CVE-2006-0377)
Users of SquirrelMail are advised to upgrade to this updated
package, which contains SquirrelMail version 1.4.6 and is not
vulnerable to these issues.
4. Solution:
Before applying this update, make sure all previously released
errata relevant to your system have been applied.
This update is available via Red Hat Network. To use Red Hat
Network, launch the Red Hat Update Agent with the following
command:
up2date
This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.
5. Bug IDs fixed (http://bugzilla.redhat.com/):
182579 – CVE-2006-0188 Possible XSS through right_frame
parameter in webmail.php
182581 – CVE-2006-0195 Possible XSS in MagicHTML (IE only)
182584 – CVE-2006-0377 IMAP injection in sqimap_mailbox_select
mailbox parameter
6. RPMs required:
Red Hat Enterprise Linux AS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/squirrelmail-1.4.6-5.el3.src.rpm
1fe10ab0c6fc8f80035d1cf309047f90
squirrelmail-1.4.6-5.el3.src.rpm
noarch:
248e27d4444f0325d0147d4182d578b6
squirrelmail-1.4.6-5.el3.noarch.rpm
Red Hat Desktop version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/squirrelmail-1.4.6-5.el3.src.rpm
1fe10ab0c6fc8f80035d1cf309047f90
squirrelmail-1.4.6-5.el3.src.rpm
noarch:
248e27d4444f0325d0147d4182d578b6
squirrelmail-1.4.6-5.el3.noarch.rpm
Red Hat Enterprise Linux ES version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/squirrelmail-1.4.6-5.el3.src.rpm
1fe10ab0c6fc8f80035d1cf309047f90
squirrelmail-1.4.6-5.el3.src.rpm
noarch:
248e27d4444f0325d0147d4182d578b6
squirrelmail-1.4.6-5.el3.noarch.rpm
Red Hat Enterprise Linux WS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/squirrelmail-1.4.6-5.el3.src.rpm
1fe10ab0c6fc8f80035d1cf309047f90
squirrelmail-1.4.6-5.el3.src.rpm
noarch:
248e27d4444f0325d0147d4182d578b6
squirrelmail-1.4.6-5.el3.noarch.rpm
Red Hat Enterprise Linux AS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/squirrelmail-1.4.6-5.el4.src.rpm
c8163c92c42c98ce77fae36cf84e1f52
squirrelmail-1.4.6-5.el4.src.rpm
noarch:
8552e96fa6ebb15ae9e033115b8f0fc3
squirrelmail-1.4.6-5.el4.noarch.rpm
Red Hat Enterprise Linux Desktop version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/squirrelmail-1.4.6-5.el4.src.rpm
c8163c92c42c98ce77fae36cf84e1f52
squirrelmail-1.4.6-5.el4.src.rpm
noarch:
8552e96fa6ebb15ae9e033115b8f0fc3
squirrelmail-1.4.6-5.el4.noarch.rpm
Red Hat Enterprise Linux ES version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/squirrelmail-1.4.6-5.el4.src.rpm
c8163c92c42c98ce77fae36cf84e1f52
squirrelmail-1.4.6-5.el4.src.rpm
noarch:
8552e96fa6ebb15ae9e033115b8f0fc3
squirrelmail-1.4.6-5.el4.noarch.rpm
Red Hat Enterprise Linux WS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/squirrelmail-1.4.6-5.el4.src.rpm
c8163c92c42c98ce77fae36cf84e1f52
squirrelmail-1.4.6-5.el4.src.rpm
noarch:
8552e96fa6ebb15ae9e033115b8f0fc3
squirrelmail-1.4.6-5.el4.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key
and details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References: