GENTOO LINUX SECURITY ANNOUNCEMENT 200311-06
| GLSA: | 200311-06 |
| package: | dev-php/phpsysinfo |
| summary: | phpSysInfo directory traversal |
| severity: | normal |
| Gentoo bug: | 26782 |
| date: | 2003-11-22 |
| CVE: | CAN-2003-0536 |
| exploit: | local |
| affected: | <=2.1 |
| fixed: | >=2.1-r1 |
DESCRIPTION:
phpSysInfo contains two vulnerabilities which could allow local
files to be read or arbitrary PHP code to be executed, under the
privileges of the web server process.
SOLUTION:
It is recommended that all Gentoo Linux users who are running
dev-php/phpsysinfo upgrade to the fixed version:
emerge sync
emerge ‘>=dev-php/phpsysinfo-2.1-r1’
emerge clean
GENTOO LINUX SECURITY ANNOUNCEMENT 200311-07
| GLSA: | 200311-07 |
| package: | net-libs/libnids |
| summary: | Libnids remote code execution |
| severity: | normal |
| Gentoo bug: | 32724 |
| date: | 2003-11-22 |
| CVE: | CAN-2003-0850 |
| exploit: | remote |
| affected: | <=1.17 |
| fixed: | >=1.18 |
DESCRIPTION:
There is a bug in the part of libnids code responsible for TCP
reassembly. The flaw probably allows remote code execution.
SOLUTION:
It is recommended that all Gentoo Linux users who are running
net-libs/libnids update their systems as follows:
emerge sync
emerge ‘>=net-libs/libnids-1.18’
emerge clean
GENTOO LINUX SECURITY ANNOUNCEMENT 200311-04
| GLSA: | 200311-04 |
| package: | net-analyzer/ethereal |
| summary: | Security problems in Ethereal 0.9.15 |
| severity: | normal |
| Gentoo bug: | 32691 |
| date: | 2003-11-22 |
| CVE: | none |
| exploit: | remote |
| affected: | <0.9.16 |
| fixed: | >=0.9.16 |
DESCRIPTION:
Quote from <http://www.ethereal.com/appnotes/enpa-sa-00011.html>;:
Potential security issues have been discovered in the following
protocol dissectors:
Impact:
It may be possible to make Ethereal crash or run arbitrary code
by injecting a purposefully malformed packet onto the wire, or by
convincing someone to read a malformed packet trace file.
Resolution:
Upgrade to 0.9.16.
If you are running a version prior to 0.9.16 and you
cannot upgrade, you can disable the GTP, ISAKMP, MEGACO, and SOCKS
protocol dissectors by selecting Edit->Protocols… and
deselecting them from the list.
SOLUTION:
It is recommended that all Gentoo Linux users who are running
net-analyzer/ethereal 0.9.x upgrade:
emerge sync
emerge ‘>=net-analyzer/ethereal-0.9.16’
emerge clean
GENTOO LINUX SECURITY ANNOUNCEMENT 200311-05
| GLSA: | 200311-05 |
| package: | sys-libs/glibc |
| summary: | Glibc getgrouplist buffer overrun vulnerability |
| severity: | normal |
| Gentoo bug: | 33383 |
| date: | 2003-11-22 |
| CVE: | CAN-2003-0689 |
| affected: | <=2.2.4 |
| fixed: | >=2.2.5 |
DESCRIPTION:
A bug in the getgrouplist function can cause a buffer overflow
if the size of the group list is too small to hold all the user’s
groups. This overflow can cause segmentation faults in user
applications. This vulnerability exists only when an administrator
has placed a user in a number of groups larger than that expected
by an application.
SOLUTION:
It is recommended that all Gentoo Linux users update their
systems as follows:
emerge sync
emerge ‘>=sys-libs/glibc-2.2.5’
emerge clean
Web Webster has more than 20 years of writing and editorial experience in the tech sector. He’s written and edited news, demand generation, user-focused, and thought leadership content for business software solutions, consumer tech, and Linux Today, he edits and writes for a portfolio of tech industry news and analysis websites including webopedia.com, and DatabaseJournal.com.
LinuxToday is a trusted, contributor-driven news resource supporting all types of Linux users. Our thriving international community engages with us through social media and frequent content contributions aimed at solving problems ranging from personal computing to enterprise-level IT operations. LinuxToday serves as a home for a community that struggles to find comparable information elsewhere on the web.
Property of TechnologyAdvice. © 2025 TechnologyAdvice. All Rights Reserved
Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.