Advisories: October 27, 2005

Debian GNU/Linux

---

Debian Security Advisory DSA 874-1 security@debian.org
http://www.debian.org/security/
Martin Schulze
October 27th, 2005 http://www.debian.org/security/faq

---

Package : lynx
Vulnerability : buffer overflow
Problem type : remote
Debian-specific: no
CVE ID : CVE-2005-3120

Ulf Härnhammar discovered a buffer overflow in lynx, a
text-mode browser for the WWW that can be remotely exploited.
During the handling of Asian characters when connecting to an NNTP
server lynx can be tricked to write past the boundary of a buffer
which can lead to the execution of arbitrary code.

For the old stable distribution (woody) this problem has been
fixed in version 2.8.4.1b-3.3.

For the stable distribution (sarge) this problem has been fixed
in version 2.8.5-2sarge1.

For the unstable distribution (sid) this problem will be fixed
soon.

We recommend that you upgrade your lynx package.

Upgrade Instructions

---

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody

---

Source archives:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.4.1b-3.3.dsc

     Size/MD5 checksum: 579
117f4e3d95a601741dc672012719042c
    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.4.1b-3.3.diff.gz

     Size/MD5 checksum: 14448
5e5d819520415baa0d91f75f0ee4f0af
    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.4.1b.orig.tar.gz

     Size/MD5 checksum: 2557510
053a10f76b871e3944c11c7776da7f7a

Alpha architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.4.1b-3.3_alpha.deb

     Size/MD5 checksum: 1610266
c887b1d0598b99fe1e3f45fedaaf3321

ARM architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.4.1b-3.3_arm.deb

     Size/MD5 checksum: 1487698
fb290d8440ef3b2b59f10e270b1d7bb6

Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.4.1b-3.3_i386.deb

     Size/MD5 checksum: 1442878
31da62cb1f065acc2f65f2fd4481d530

Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.4.1b-3.3_ia64.deb

     Size/MD5 checksum: 1762578
e57e52ed11ea52b55d6a5ede09b466a8

HP Precision architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.4.1b-3.3_hppa.deb

     Size/MD5 checksum: 1555440
4beb62a33cc2c0f00a45e69bed8b5591

Motorola 680×0 architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.4.1b-3.3_m68k.deb

     Size/MD5 checksum: 1405626
7f8d46f3d143781364337b666a55fa42

Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.4.1b-3.3_mips.deb

     Size/MD5 checksum: 1507782
ae2ce1ddbe4855967d050a3e64e42e26

Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.4.1b-3.3_mipsel.deb

     Size/MD5 checksum: 1503970
08e80c500a4d57a4e47fc45dbf0ebfe3

PowerPC architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.4.1b-3.3_powerpc.deb

     Size/MD5 checksum: 1491262
2b58dece4ae0a8a98b31e2f8eba40d13

IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.4.1b-3.3_s390.deb

     Size/MD5 checksum: 1463360
1e5419b8db89374ea1c96f1219fe6e15

Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.4.1b-3.3_sparc.deb

     Size/MD5 checksum: 1492728
f4da20fe1ac83ee9adf37d49bb896c63

Debian GNU/Linux 3.1 alias sarge

---

Source archives:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.5-2sarge1.dsc

     Size/MD5 checksum: 614
e7d5a14aafd2e9775c3175e44e3f9964
    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.5-2sarge1.diff.gz

     Size/MD5 checksum: 14891
59cf146b8defbfa1b78df4306b951441
    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.5.orig.tar.gz

     Size/MD5 checksum: 2984352
5f516a10596bd52c677f9bfd9579bc28

Alpha architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.5-2sarge1_alpha.deb

     Size/MD5 checksum: 1994554
8a9eb6cd8ee34ad17aa06b912b588659

AMD64 architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.5-2sarge1_amd64.deb

     Size/MD5 checksum: 1881684
5afcd53828326a0cb056681047bd48e6

ARM architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.5-2sarge1_arm.deb

     Size/MD5 checksum: 1852912
de530d45ce98e68932ec4624abd67201

Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.5-2sarge1_i386.deb

     Size/MD5 checksum: 1852488
ba9125c2da9c21a8bcd173ff82948a28

Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.5-2sarge1_ia64.deb

     Size/MD5 checksum: 2128374
156c023772481f6e9f8629c44082c94d

HP Precision architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.5-2sarge1_hppa.deb

     Size/MD5 checksum: 1909574
24bbbc72ab025249a3adaa7717b316ff

Motorola 680×0 architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.5-2sarge1_m68k.deb

     Size/MD5 checksum: 1780590
449249ca3e257a33a5a9d7da16379076

Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.5-2sarge1_mips.deb

     Size/MD5 checksum: 1894006
f30b06596b5ed9d881e1f3ba767aca2a

Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.5-2sarge1_mipsel.deb

     Size/MD5 checksum: 1889486
0b650edf6ca51547aedd7c7754bbda99

PowerPC architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.5-2sarge1_powerpc.deb

     Size/MD5 checksum: 1878284
d90c1dc3fb2d5be179b827c32c14e222

IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.5-2sarge1_s390.deb

     Size/MD5 checksum: 1866758
60f30f0ebd7556799e565b4411a8d429

Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/l/lynx/lynx_2.8.5-2sarge1_sparc.deb

     Size/MD5 checksum: 1861536
85c12b7bd67f9800b49ab4b6b97a1dfd

These files will probably be moved into the stable distribution
on its next update.

---

---

Debian Security Advisory DSA 875-1 security@debian.org
http://www.debian.org/security/
Martin Schulze
October 27th, 2005 http://www.debian.org/security/faq

---

Package : openssl094
Vulnerability : cryptographic weakness
Problem type : remote
Debian-specific: no
CVE ID : CVE-2005-2969

Yutaka Oiwa discovered a vulnerability in the Open Secure Socket
Layer (OpenSSL) library that can allow an attacker to perform
active protocol-version rollback attacks that could lead to the use
of the weaker SSL 2.0 protocol even though both ends support SSL
3.0 or TLS 1.0.

The following matrix explains which version in which
distribution has this problem corrected.

We recommend that you upgrade your libssl packages.

Upgrade Instructions

---

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody

---

Source archives:

    http://security.debian.org/pool/updates/main/o/openssl094/openssl094_0.9.4-6.woody.4.dsc

     Size/MD5 checksum: 624
2989b7b16a146a2f9a6ca52887bb2c3f
    http://security.debian.org/pool/updates/main/o/openssl094/openssl094_0.9.4-6.woody.4.diff.gz

     Size/MD5 checksum: 47116
a4db6a4e53d8f8703da86774768cb21c
    http://security.debian.org/pool/updates/main/o/openssl094/openssl094_0.9.4.orig.tar.gz

     Size/MD5 checksum: 1570392
72544daea16d6c99d656b95f77b01b2d

Alpha architecture:

    http://security.debian.org/pool/updates/main/o/openssl094/libssl09_0.9.4-6.woody.4_alpha.deb

     Size/MD5 checksum: 445816
1eaa00c5cee084727d23a8169acdb705

Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/o/openssl094/libssl09_0.9.4-6.woody.4_i386.deb

     Size/MD5 checksum: 358626
2d3f09ec2222ac497180a01facea470c

PowerPC architecture:

    http://security.debian.org/pool/updates/main/o/openssl094/libssl09_0.9.4-6.woody.4_powerpc.deb

     Size/MD5 checksum: 378870
58d0d41fa2005b5d05f49c557023c466

These files will probably be moved into the stable distribution
on its next update.

---

---

Debian Security Advisory DSA 876-1 security@debian.org
http://www.debian.org/security/
Martin Schulze
October 27th, 2005 http://www.debian.org/security/faq

---

Package : lynx-ssl
Vulnerability : buffer overflow
Problem type : remote
Debian-specific: no
CVE ID : CVE-2005-3120

Ulf Härnhammar discovered a buffer overflow in lynx, a
text-mode browser for the WWW that can be remotely exploited.
During the handling of Asian characters when connecting to an NNTP
server lynx can be tricked to write past the boundary of a buffer
which can lead to the execution of arbitrary code.

For the old stable distribution (woody) this problem has been
fixed in version 2.8.4.1b-3.2.

For the stable distribution (sarge) this problem has been fixed
in version 2.8.5-2sarge1 of lynx.

For the unstable distribution (sid) this problem will be fixed
soon.

We recommend that you upgrade your lynx-ssl package.

Upgrade Instructions

---

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody

---

Source archives:

    http://security.debian.org/pool/updates/main/l/lynx-ssl/lynx-ssl_2.8.4.1b-3.2.dsc

     Size/MD5 checksum: 609
6256bc48e63d9120301c6bdae3316675
    http://security.debian.org/pool/updates/main/l/lynx-ssl/lynx-ssl_2.8.4.1b-3.2.diff.gz

     Size/MD5 checksum: 87627
69a835be9e783a6788fd3122ec4c51d4
    http://security.debian.org/pool/updates/main/l/lynx-ssl/lynx-ssl_2.8.4.1b.orig.tar.gz

     Size/MD5 checksum: 2557510
053a10f76b871e3944c11c7776da7f7a

Alpha architecture:

    http://security.debian.org/pool/updates/main/l/lynx-ssl/lynx-ssl_2.8.4.1b-3.2_alpha.deb

     Size/MD5 checksum: 1617392
d07cb6f46da183ab5c66860d90dd48c5

ARM architecture:

    http://security.debian.org/pool/updates/main/l/lynx-ssl/lynx-ssl_2.8.4.1b-3.2_arm.deb

     Size/MD5 checksum: 1491792
b20c7575d54e86838ddeff94622ce5ff

Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/l/lynx-ssl/lynx-ssl_2.8.4.1b-3.2_i386.deb

     Size/MD5 checksum: 1447102
0707d60cdc076a9078ecd198d9e185c5

Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/l/lynx-ssl/lynx-ssl_2.8.4.1b-3.2_ia64.deb

     Size/MD5 checksum: 1769060
9f621d66228be950732846918afb9b22

HP Precision architecture:

    http://security.debian.org/pool/updates/main/l/lynx-ssl/lynx-ssl_2.8.4.1b-3.2_hppa.deb

     Size/MD5 checksum: 1559592
c2c35718ba34d173fadefd3ba428695b

Motorola 680×0 architecture:

    http://security.debian.org/pool/updates/main/l/lynx-ssl/lynx-ssl_2.8.4.1b-3.2_m68k.deb

     Size/MD5 checksum: 1410534
86eff29224e043788f98a02f4af20402

Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/l/lynx-ssl/lynx-ssl_2.8.4.1b-3.2_mips.deb

     Size/MD5 checksum: 1511892
7fa8c96a81238e524e870dee74d07fa4

Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/l/lynx-ssl/lynx-ssl_2.8.4.1b-3.2_mipsel.deb

     Size/MD5 checksum: 1507808
5c7db52ed5910884679ec9ecc8606593

PowerPC architecture:

    http://security.debian.org/pool/updates/main/l/lynx-ssl/lynx-ssl_2.8.4.1b-3.2_powerpc.deb

     Size/MD5 checksum: 1497302
f82ae7bc6ee25639bd8c18ab6c644fb5

IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/l/lynx-ssl/lynx-ssl_2.8.4.1b-3.2_s390.deb

     Size/MD5 checksum: 1468622
72b310726d3baecfe26ba27ce9f9f46a

Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/l/lynx-ssl/lynx-ssl_2.8.4.1b-3.2_sparc.deb

     Size/MD5 checksum: 1497394
83d65399cb15b48bcd9024f01e3f9400

These files will probably be moved into the stable distribution
on its next update.

---

Fedora Core

---

Fedora Update Notification
FEDORA-2005-1031
2005-10-27

---

Product : Fedora Core 4
Name : pam
Version : 0.79
Release : 9.6
Summary : A security tool which provides authentication for
applications.

Description :
PAM (Pluggable Authentication Modules) is a system security tool
that allows system administrators to set authentication policy
without having to recompile programs that handle
authentication.

---

Update Information:

This update fixes a security bug in unix_chkpwd allowing brute
force attacks against passwords in /etc/shadow by a regular user
when SELinux is enabled.

---

• Wed Oct 26 2005 Tomas Mraz <tmraz@redhat.com> 0.79-9.6
  • fixed CAN-2005-2977 unix_chkpwd should skip user verification
    only if run as root (#168181)
  • link pam_loginuid to libaudit
  • remove spurious glib2 dependency
  • support no tty in pam_access (#170467)
  • support new kernel limits and unlimited limit value in
    pam_limits (#171546)

---

This update can be downloaded from:

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/4/

fb348c5be5d8f694cdbd927681150989 SRPMS/pam-0.79-9.6.src.rpm
4a06122544169a7549639fa52be91bcd ppc/pam-0.79-9.6.ppc.rpm
edf3fc81ac4dfddf44f25dd37142b23c ppc/pam-devel-0.79-9.6.ppc.rpm
873dca1bc06450ede87a40b9d0241398
ppc/debug/pam-debuginfo-0.79-9.6.ppc.rpm
054d2fe06507a3c45c7ef8bcf8a595ac ppc/pam-0.79-9.6.ppc64.rpm
c7a3db12973f5182739d6adae0b25555
ppc/pam-devel-0.79-9.6.ppc64.rpm
6774937168a148b9e63e54711c26c790 x86_64/pam-0.79-9.6.x86_64.rpm
649b875ec7894c2fd855abb9a6547ef0
x86_64/pam-devel-0.79-9.6.x86_64.rpm
a70f55b7f8ce114052362e167984fdb0
x86_64/debug/pam-debuginfo-0.79-9.6.x86_64.rpm
6674a4ea75709a1e5c7f905e617db12b x86_64/pam-0.79-9.6.i386.rpm
f535f175a757f0d7b1dc66b1538fcd1c
x86_64/pam-devel-0.79-9.6.i386.rpm
6674a4ea75709a1e5c7f905e617db12b i386/pam-0.79-9.6.i386.rpm
f535f175a757f0d7b1dc66b1538fcd1c
i386/pam-devel-0.79-9.6.i386.rpm
d4ec56ab2def5974a103495169442c4c
i386/debug/pam-debuginfo-0.79-9.6.i386.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the ‘up2date’ command.

---

---

Fedora Update Notification
FEDORA-2005-1032
2005-10-27

---

Product : Fedora Core 3
Name : gdb
Version : 6.1post
Release : 1.20040607.43.0.1
Summary : A GNU source-level debugger for C, C++ and other
languages.

Description :
GDB, the GNU debugger, allows you to debug programs written in C,
C++, and other languages, by executing them in a controlled fashion
and printing their data.

---

Update Information:

This is an fc3 update for gdb regarding security issues:

CAN-2005-1704 Integer Overflow in gdb

This problem is that gdb’s internal copy of bfd does not protect
against heap-based overflow.

CAN-2005-1705 gdb arbitrary command execution

This problem allows unprotected .gdbinit files to execute
arbitrary commands during gdb startup.

Fixes for both problems are found in:

gdb-6.1post-1.20040607.43.0.1

---

• Tue Oct 4 2005 Jeff Johnston <jjohnstn@redhat.com>
  1.200400607.43.0.1
  • Security errata to handle untrusted .gdbinit and bfd integer
    overflow.
  • Bugzilla 158683 and bugzilla 158686

---

This update can be downloaded from:

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/

b8b1221e0bee3f36f56d97a5a14f967e
SRPMS/gdb-6.1post-1.20040607.43.0.1.src.rpm
5888949940a560c9ba95df6e06d844c1
x86_64/gdb-6.1post-1.20040607.43.0.1.x86_64.rpm
503a943143b7d0493f138db9d3884829
x86_64/debug/gdb-debuginfo-6.1post-1.20040607.43.0.1.x86_64.rpm
1c0c3d31110fef65ebde55bc1c77bde1
i386/gdb-6.1post-1.20040607.43.0.1.i386.rpm
36c25e23d587ebf23099e4bf300e8ae2
i386/debug/gdb-debuginfo-6.1post-1.20040607.43.0.1.i386.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the ‘up2date’ command.

---

---

Fedora Update Notification
FEDORA-2005-1033
2005-10-27

---

Product : Fedora Core 4
Name : gdb
Version : 6.3.0.0
Release : 1.84
Summary : A GNU source-level debugger for C, C++, Java and other
languages.

Description :
GDB, the GNU debugger, allows you to debug programs written in C,
C++, Java, and other languages, by executing them in a controlled
fashion and printing their data.

---

Update Information:

This is an fc4 update for gdb that includes security issues:

CAN-2005-1704 Integer Overflow in gdb

This problem is that gdb’s internal copy of bfd does not protect
against heap-based overflow.

CAN-2005-1705 gdb arbitrary command execution

This problem allows unprotected .gdbinit files to execute
arbitrary commands during gdb startup.

Fixes for both problems are found in:

gdb-6.3.0.0-1.84

This release also contains some additional fixes from the last
update.

---

• Tue Oct 18 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.84
  • Bump up release number.
• Tue Oct 18 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.82
  • Modify attach patch to add missing fclose.
  • Bugzilla 166712
• Tue Oct 11 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.81
  • Bump up release number.
• Tue Oct 11 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.78
  • Support gdb attaching to a stopped process.
• Thu Sep 29 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.77
  • Bump up release number.
• Thu Sep 29 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.74
  • Fix up DSO read logic when process is attached.
• Mon Sep 26 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.73
  • Bump up release number.
• Mon Sep 26 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.70
  • Fix frame pointer calculation for ia64 sigtramp frame.
• Thu Sep 22 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.69
  • Bump up release number.
• Thu Sep 22 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.66
  • Remove extraneous xfree.
• Wed Sep 7 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.65
  • Bump up release number.
• Wed Sep 7 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.62
  • Readd readnever option
• Wed Jul 27 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.61
  • Bump up release number.
• Tue Jul 26 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.57
  • Bump up release number.
• Tue Jul 26 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.54
  • Add testcase to verify printing of inherited members
  • Bugzilla 146835
• Mon Jul 25 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.53
  • Bump up release number.
• Mon Jul 25 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.50
  • Fix bug with info frame and cursor address on ia64.
  • Add testcase to verify pseudo-registers calculated for ia64
    sigtramp.
  • Bugzilla 160339
• Fri Jul 22 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.49
  • Bump up release number.
• Fri Jul 22 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.46
  • Fix attaching to 32-bit processes on 64-bit systems.
  • Bugzilla 160254
• Thu Jul 14 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.45
  • Bump up release number.
• Thu Jul 14 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.42
  • Add work-around to make ia64 gcore work faster.
  • Bugzilla 147436
• Thu Jul 14 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.41
  • Bump up release number.
• Mon Jul 11 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.38
  • Fix backtracing across sigaltstack for ia64
  • Bugzilla 151741
• Fri Jul 8 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.37
  • Bump up release number.
• Fri Jul 8 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.35
  • Build pseudo-registers properly for sigtramp frame.
  • Bugzilla 160339
• Fri Jul 8 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.34
  • Bump up release number.
• Thu Jul 7 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.31
  • Modify security errata to include additional bfd robustness
    updates
  • Bugzilla 158680
• Fri Jun 10 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.30
  • Bump up release number.
• Fri Jun 10 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.28
  • Security errata for bfd and .gdbinit file usage
  • Bugzilla 158680
• Wed May 18 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.24
  • Bump up release number.
• Wed May 18 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.23
  • Bump up release number.
• Wed May 18 2005 Jeff Johnston <jjohnstn@redhat.com>
  6.3.0.0-1.22
  • Specify SA_RESTART for linux-nat.c handlers and use my_waitpid
    which handles EINTR.

---

This update can be downloaded from:

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/4/

13dc7a0519af07517322966a31755c14
SRPMS/gdb-6.3.0.0-1.84.src.rpm
105ad05894d1a6473ac22bf923e59f63 ppc/gdb-6.3.0.0-1.84.ppc.rpm
983c714df523fe92774bc77a99660c47
ppc/debug/gdb-debuginfo-6.3.0.0-1.84.ppc.rpm
b46209774e0b189c93bd45565dbd57a2
x86_64/gdb-6.3.0.0-1.84.x86_64.rpm
ea77f6d39f6e994be2f81335f0925de8
x86_64/debug/gdb-debuginfo-6.3.0.0-1.84.x86_64.rpm
5456f46ec1b03267210b9f045612a9b8 i386/gdb-6.3.0.0-1.84.i386.rpm
fc72f8be341eaf9142aa768de9ad06e1
i386/debug/gdb-debuginfo-6.3.0.0-1.84.i386.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the ‘up2date’ command.

---

Mandriva Linux

---

Mandriva Linux Security Advisory MDKSA-2005:200
http://www.mandriva.com/security/

---

Package : apache-mod_auth_shadow
Date : October 27, 2005
Affected: 10.1, 10.2, 2006.0

---

Problem Description:

The mod_auth_shadow module 1.0 through 1.5 and 2.0 for Apache
with AuthShadow enabled uses shadow authentication for all
locations that use the require group directive, even when other
authentication mechanisms are specified, which might allow remote
authenticated users to bypass security restrictions.

This update requires an explicit “AuthShadow on” statement if
website authentication should be checked against /etc/shadow.

The updated packages have been patched to address this
issue.

---

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2963

---

Updated Packages:

Mandriva Linux 10.1:
528cdab76158def18a53ce798f06efbf
10.1/RPMS/apache2-mod_auth_shadow-2.0.50_2.0-3.2.101mdk.i586.rpm

670e7f53e4d7ec420cc0ce529a11a423
10.1/SRPMS/apache2-mod_auth_shadow-2.0.50_2.0-3.2.101mdk.src.rpm

Mandriva Linux 10.1/X86_64:
43f45a988397a72e7a00485055f00ca1
x86_64/10.1/RPMS/apache2-mod_auth_shadow-2.0.50_2.0-3.2.101mdk.x86_64.rpm

670e7f53e4d7ec420cc0ce529a11a423
x86_64/10.1/SRPMS/apache2-mod_auth_shadow-2.0.50_2.0-3.2.101mdk.src.rpm

Mandriva Linux 10.2:
aa10a068cf7bc453cd8935b48afed141
10.2/RPMS/apache2-mod_auth_shadow-2.0.53_2.0-6.2.102mdk.i586.rpm

c7d15fcb80581c1169366d6ae56f9a1c
10.2/SRPMS/apache2-mod_auth_shadow-2.0.53_2.0-6.2.102mdk.src.rpm

Mandriva Linux 10.2/X86_64:
caa1cb7195baf33a5ea8e07f31a84825
x86_64/10.2/RPMS/apache2-mod_auth_shadow-2.0.53_2.0-6.2.102mdk.x86_64.rpm

c7d15fcb80581c1169366d6ae56f9a1c
x86_64/10.2/SRPMS/apache2-mod_auth_shadow-2.0.53_2.0-6.2.102mdk.src.rpm

Mandriva Linux 2006.0:
e720a14ca9e445ae9aca32a8bd077f59
2006.0/RPMS/apache-mod_auth_shadow-2.0.54_2.0-4.1.20060mdk.i586.rpm

29be94c1a29d1c1400d84781fe25fd2d
2006.0/SRPMS/apache-mod_auth_shadow-2.0.54_2.0-4.1.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
19778e61e14975aa3f749068d985cf34
x86_64/2006.0/RPMS/apache-mod_auth_shadow-2.0.54_2.0-4.1.20060mdk.x86_64.rpm

29be94c1a29d1c1400d84781fe25fd2d
x86_64/2006.0/SRPMS/apache-mod_auth_shadow-2.0.54_2.0-4.1.20060mdk.src.rpm

---

To upgrade automatically use MandrivaUpdate or urpmi. The
verification of md5 checksums and GPG signatures is performed
automatically for you.

All packages are signed by Mandriva for security. You can obtain
the GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

---

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>

---

Mandriva Linux Security Advisory MDKSA-2005:201
http://www.mandriva.com/security/

---

Package : sudo
Date : October 27, 2005
Affected: 10.1, 10.2, 2006.0, Corporate 2.1, Corporate 3.0, Multi
Network Firewall 2.0

---

Problem Description:

Tavis Ormandy discovered that sudo does not perform sufficient
environment cleaning; in particular the SHELLOPTS and PS4 variables
are still passed to the program running as an alternate user which
can result in the execution of arbitrary commands as the alternate
user when a bash script is executed.

The updated packages have been patched to correct this
problem.

---

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2959

---

Updated Packages:

Corporate Server 2.1:
f7a973c064788876a3927e23698165e7
corporate/2.1/RPMS/sudo-1.6.6-2.3.C21mdk.i586.rpm
9d41a3e0d779287d5d6defe3effeadb6
corporate/2.1/SRPMS/sudo-1.6.6-2.3.C21mdk.src.rpm

Corporate Server 2.1/X86_64:
11dee7cd0ef65739fbcb74eb4435abb7
x86_64/corporate/2.1/RPMS/sudo-1.6.6-2.3.C21mdk.x86_64.rpm
9d41a3e0d779287d5d6defe3effeadb6
x86_64/corporate/2.1/SRPMS/sudo-1.6.6-2.3.C21mdk.src.rpm

Mandriva Linux 10.1:
3ac90a3cd189ea0326d927370fdb250e
10.1/RPMS/sudo-1.6.8p1-1.3.101mdk.i586.rpm
d0f1e39453c3efa42829959452b10f85
10.1/SRPMS/sudo-1.6.8p1-1.3.101mdk.src.rpm

Mandriva Linux 10.1/X86_64:
e4522d2cc1241b549143cdfd384b1e84
x86_64/10.1/RPMS/sudo-1.6.8p1-1.3.101mdk.x86_64.rpm
d0f1e39453c3efa42829959452b10f85
x86_64/10.1/SRPMS/sudo-1.6.8p1-1.3.101mdk.src.rpm

Corporate 3.0:
7f961e981298b0e17db2206b0c173c94
corporate/3.0/RPMS/sudo-1.6.7-0.p5.2.3.C30mdk.i586.rpm
541ec48ae7f199c9e02209552541c93a
corporate/3.0/SRPMS/sudo-1.6.7-0.p5.2.3.C30mdk.src.rpm

Corporate 3.0/X86_64:
0baca1e5dd528d9a0746812c3f70b6aa
x86_64/corporate/3.0/RPMS/sudo-1.6.7-0.p5.2.3.C30mdk.x86_64.rpm
541ec48ae7f199c9e02209552541c93a
x86_64/corporate/3.0/SRPMS/sudo-1.6.7-0.p5.2.3.C30mdk.src.rpm

Multi Network Firewall 2.0:
73f5119120b2f173d2a5b529bc4b94b1
mnf/2.0/RPMS/sudo-1.6.7-0.p5.2.3.M20mdk.i586.rpm
6711bd6886115f5e5ec429eb739af719
mnf/2.0/SRPMS/sudo-1.6.7-0.p5.2.3.M20mdk.src.rpm

Mandriva Linux 10.2:
d1145addcb3d305aa1149baaad74bee4
10.2/RPMS/sudo-1.6.8p1-2.2.102mdk.i586.rpm
7cfd46cb455cc00b091849726d4763f5
10.2/SRPMS/sudo-1.6.8p1-2.2.102mdk.src.rpm

Mandriva Linux 10.2/X86_64:
9d59bab72f413dd21013add16252a48a
x86_64/10.2/RPMS/sudo-1.6.8p1-2.2.102mdk.x86_64.rpm
7cfd46cb455cc00b091849726d4763f5
x86_64/10.2/SRPMS/sudo-1.6.8p1-2.2.102mdk.src.rpm

Mandriva Linux 2006.0:
bf2035af2ac556c3bcb013e80c4fbbd9
2006.0/RPMS/sudo-1.6.8p8-2.1.20060mdk.i586.rpm
4c708ebf20c38db338e909e6e461888f
2006.0/SRPMS/sudo-1.6.8p8-2.1.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
569e58db33c0a58b0548e3ea699e86fa
x86_64/2006.0/RPMS/sudo-1.6.8p8-2.1.20060mdk.x86_64.rpm
4c708ebf20c38db338e909e6e461888f
x86_64/2006.0/SRPMS/sudo-1.6.8p8-2.1.20060mdk.src.rpm

---

To upgrade automatically use MandrivaUpdate or urpmi. The
verification of md5 checksums and GPG signatures is performed
automatically for you.

All packages are signed by Mandriva for security. You can obtain
the GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

---

Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10
Mandriva Security Team <security*mandriva.com>

Red Hat Linux

---

Red Hat Security Advisory

Synopsis: Important: kernel security update
Advisory ID: RHSA-2005:808-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-808.html

Issue date: 2005-10-27
Updated on: 2005-10-27
Product: Red Hat Enterprise Linux
Obsoletes: RHSA-2005:514
CVE Names: CVE-2005-3053 CVE-2005-3108 CVE-2005-3110 CVE-2005-3119
CVE-2005-3180 CVE-2005-3181

---

1. Summary:

Updated kernel packages that fix several security issues and a
page attribute mapping bug are now available for Red Hat Enterprise
Linux 4.

This update has been rated as having important security impact
by the Red Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 – i386, ia64, noarch, ppc,
s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 – i386, noarch,
x86_64
Red Hat Enterprise Linux ES version 4 – i386, ia64, noarch,
x86_64
Red Hat Enterprise Linux WS version 4 – i386, ia64, noarch,
x86_64

3. Problem description:

The Linux kernel handles the basic functions of the operating
system.

An issue was discovered that affects how page attributes are
changed by the kernel. Video drivers, which sometimes map kernel
pages with a different caching policy than write-back, are now
expected to function correctly. This change affects the x86, AMD64,
and Intel EM64T architectures.

In addition the following security bugs were fixed:

The set_mempolicy system call did not check for negative numbers
in the policy field. An unprivileged local user could use this flaw
to cause a denial of service (system panic). (CVE-2005-3053)

A flaw in ioremap handling on AMD 64 and Intel EM64T systems. An
unprivileged local user could use this flaw to cause a denial of
service or minor information leak. (CVE-2005-3108)

A race condition in the ebtables netfilter module. On a SMP
system that is operating under a heavy load this flaw may allow
remote attackers to cause a denial of service (crash).
(CVE-2005-3110)

A memory leak was found in key handling. An unprivileged local
user could use this flaw to cause a denial of service.
(CVE-2005-3119)

A flaw in the Orinoco wireless driver. On systems running the
vulnerable drive, a remote attacker could send carefully crafted
packets which would divulge the contents of uninitialized kernel
memory. (CVE-2005-3180)

A memory leak was found in the audit system. An unprivileged
local user could use this flaw to cause a denial of service.
(CVE-2005-3181)

All Red Hat Enterprise Linux 4 users are advised to upgrade
their kernels to the packages associated with their machine
architectures and configurations as listed in this erratum.

4. Solution:

Before applying this update, make sure that all
previously-released errata relevant to your system have been
applied. Use Red Hat Network to download and update your packages.
To launch the Red Hat Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to
the following Web page for the System Administration or
Customization guide specific to your system:

    http://www.redhat.com/docs/manuals/enterprise/

5. Bug IDs fixed (http://bugzilla.redhat.com/):

160135 – kernel panic in ioremap with four 1GB DIMMs
(2.6.9-11.ELsmp)
168217 – CAN-2005-3108 [RHEL 4] ioremap_nocache causes panic, only
on one motherboard, not on upstream 2.6.12.5 or later at least
168936 – System instability when using the NVIDIA driver (i.e bad
caching on address)
168993 – CAN-2005-3053 RHEL 4 sys_set_mempolicy allows invalid
policy leading to panic
170264 – CAN-2005-3108 ioremap x86_64 DoS
170268 – CAN-2005-3110 ebtables race
170274 – CAN-2005-3119 config_keys memleak
170277 – CAN-2005-3180 orinoco driver information leakage
170283 – CAN-2005-3181 names_cache memory leak
170563 – kernel crash in HP Compaq dc7100 CMT(DX438AV)
171154 – RHEL4 [NETFILTER]: Fix deadlock in ip4_queue.

6. RPMs required:

Red Hat Enterprise Linux AS version 4:

SRPMS:

ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/kernel-2.6.9-22.0.1.EL.src.rpm

a5556584e16702cb85ca37a64d9cdf52 kernel-2.6.9-22.0.1.EL.src.rpm

i386:
7b6290bc039c15259d579a06c395896c
kernel-2.6.9-22.0.1.EL.i686.rpm
432daa8fe4a9da2b970cb78500da7d4c
kernel-devel-2.6.9-22.0.1.EL.i686.rpm
b6478d292099a0278e7f4294d8324b64
kernel-hugemem-2.6.9-22.0.1.EL.i686.rpm
50eee5abb14da6bbf8dd0cf41726d631
kernel-hugemem-devel-2.6.9-22.0.1.EL.i686.rpm
532741540a653577ca248bf9ba84ac54
kernel-smp-2.6.9-22.0.1.EL.i686.rpm
36f7781eee1091e70f2c3d60090c3e9c
kernel-smp-devel-2.6.9-22.0.1.EL.i686.rpm

ia64:
5a51ab10cffc50cb078bd13fc8a5414a
kernel-2.6.9-22.0.1.EL.ia64.rpm
c31e6f11fedeecda7d22ffc1d4844fc3
kernel-devel-2.6.9-22.0.1.EL.ia64.rpm

noarch:
fad9b931780bd1ac8939de42f45ff97b
kernel-doc-2.6.9-22.0.1.EL.noarch.rpm

ppc:
b42d460c270ebcef5b7060326bbc5605
kernel-2.6.9-22.0.1.EL.ppc64.rpm
09f2f62975e14f2c3548216ac213b81b
kernel-2.6.9-22.0.1.EL.ppc64iseries.rpm
057920195917f3e207c89528ddcd671e
kernel-devel-2.6.9-22.0.1.EL.ppc64.rpm
ed97b76d4d5c4030e8534fa2490b1dd5
kernel-devel-2.6.9-22.0.1.EL.ppc64iseries.rpm

s390:
1683e74a2788aaacd97c37e377531053
kernel-2.6.9-22.0.1.EL.s390.rpm
87032a8964416a5528d6ada8c73bd516
kernel-devel-2.6.9-22.0.1.EL.s390.rpm

s390x:
073b6e7e7ab0c75f6f7eee3ab9e5c978
kernel-2.6.9-22.0.1.EL.s390x.rpm
7aa4a6814166a3d21dc368a63f7a3a29
kernel-devel-2.6.9-22.0.1.EL.s390x.rpm

x86_64:
1df1f4b6332f734de942ee24ac392dab
kernel-2.6.9-22.0.1.EL.x86_64.rpm
c6b5364f055aced104b6261a3f02347f
kernel-devel-2.6.9-22.0.1.EL.x86_64.rpm
9d2820794ce05766fd31a6ed490db23f
kernel-smp-2.6.9-22.0.1.EL.x86_64.rpm
7459acc9a4ece3527fbb1b032d3f3163
kernel-smp-devel-2.6.9-22.0.1.EL.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:

ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/kernel-2.6.9-22.0.1.EL.src.rpm

a5556584e16702cb85ca37a64d9cdf52
kernel-2.6.9-22.0.1.EL.src.rpm

i386:
7b6290bc039c15259d579a06c395896c
kernel-2.6.9-22.0.1.EL.i686.rpm
432daa8fe4a9da2b970cb78500da7d4c
kernel-devel-2.6.9-22.0.1.EL.i686.rpm
b6478d292099a0278e7f4294d8324b64
kernel-hugemem-2.6.9-22.0.1.EL.i686.rpm
50eee5abb14da6bbf8dd0cf41726d631
kernel-hugemem-devel-2.6.9-22.0.1.EL.i686.rpm
532741540a653577ca248bf9ba84ac54
kernel-smp-2.6.9-22.0.1.EL.i686.rpm
36f7781eee1091e70f2c3d60090c3e9c
kernel-smp-devel-2.6.9-22.0.1.EL.i686.rpm

noarch:
fad9b931780bd1ac8939de42f45ff97b
kernel-doc-2.6.9-22.0.1.EL.noarch.rpm

x86_64:
1df1f4b6332f734de942ee24ac392dab
kernel-2.6.9-22.0.1.EL.x86_64.rpm
c6b5364f055aced104b6261a3f02347f
kernel-devel-2.6.9-22.0.1.EL.x86_64.rpm
9d2820794ce05766fd31a6ed490db23f
kernel-smp-2.6.9-22.0.1.EL.x86_64.rpm
7459acc9a4ece3527fbb1b032d3f3163
kernel-smp-devel-2.6.9-22.0.1.EL.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:

ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/kernel-2.6.9-22.0.1.EL.src.rpm

a5556584e16702cb85ca37a64d9cdf52
kernel-2.6.9-22.0.1.EL.src.rpm

i386:
7b6290bc039c15259d579a06c395896c
kernel-2.6.9-22.0.1.EL.i686.rpm
432daa8fe4a9da2b970cb78500da7d4c
kernel-devel-2.6.9-22.0.1.EL.i686.rpm
b6478d292099a0278e7f4294d8324b64
kernel-hugemem-2.6.9-22.0.1.EL.i686.rpm
50eee5abb14da6bbf8dd0cf41726d631
kernel-hugemem-devel-2.6.9-22.0.1.EL.i686.rpm
532741540a653577ca248bf9ba84ac54
kernel-smp-2.6.9-22.0.1.EL.i686.rpm
36f7781eee1091e70f2c3d60090c3e9c
kernel-smp-devel-2.6.9-22.0.1.EL.i686.rpm

ia64:
5a51ab10cffc50cb078bd13fc8a5414a
kernel-2.6.9-22.0.1.EL.ia64.rpm
c31e6f11fedeecda7d22ffc1d4844fc3
kernel-devel-2.6.9-22.0.1.EL.ia64.rpm

noarch:
fad9b931780bd1ac8939de42f45ff97b
kernel-doc-2.6.9-22.0.1.EL.noarch.rpm

x86_64:
1df1f4b6332f734de942ee24ac392dab
kernel-2.6.9-22.0.1.EL.x86_64.rpm
c6b5364f055aced104b6261a3f02347f
kernel-devel-2.6.9-22.0.1.EL.x86_64.rpm
9d2820794ce05766fd31a6ed490db23f
kernel-smp-2.6.9-22.0.1.EL.x86_64.rpm
7459acc9a4ece3527fbb1b032d3f3163
kernel-smp-devel-2.6.9-22.0.1.EL.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:

ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/kernel-2.6.9-22.0.1.EL.src.rpm

a5556584e16702cb85ca37a64d9cdf52
kernel-2.6.9-22.0.1.EL.src.rpm

i386:
7b6290bc039c15259d579a06c395896c
kernel-2.6.9-22.0.1.EL.i686.rpm
432daa8fe4a9da2b970cb78500da7d4c
kernel-devel-2.6.9-22.0.1.EL.i686.rpm
b6478d292099a0278e7f4294d8324b64
kernel-hugemem-2.6.9-22.0.1.EL.i686.rpm
50eee5abb14da6bbf8dd0cf41726d631
kernel-hugemem-devel-2.6.9-22.0.1.EL.i686.rpm
532741540a653577ca248bf9ba84ac54
kernel-smp-2.6.9-22.0.1.EL.i686.rpm
36f7781eee1091e70f2c3d60090c3e9c
kernel-smp-devel-2.6.9-22.0.1.EL.i686.rpm

ia64:
5a51ab10cffc50cb078bd13fc8a5414a
kernel-2.6.9-22.0.1.EL.ia64.rpm
c31e6f11fedeecda7d22ffc1d4844fc3
kernel-devel-2.6.9-22.0.1.EL.ia64.rpm

noarch:
fad9b931780bd1ac8939de42f45ff97b
kernel-doc-2.6.9-22.0.1.EL.noarch.rpm

x86_64:
1df1f4b6332f734de942ee24ac392dab
kernel-2.6.9-22.0.1.EL.x86_64.rpm
c6b5364f055aced104b6261a3f02347f
kernel-devel-2.6.9-22.0.1.EL.x86_64.rpm
9d2820794ce05766fd31a6ed490db23f
kernel-smp-2.6.9-22.0.1.EL.x86_64.rpm
7459acc9a4ece3527fbb1b032d3f3163
kernel-smp-devel-2.6.9-22.0.1.EL.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key
and details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3053

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3108

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3110

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3119

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3180

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3181

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More
contact details at https://www.redhat.com/security/team/contact/

Copyright 2005 Red Hat, Inc.