Updated kdegraphics packages that resolve a security issue in kpdf are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kdegraphics packages contain applications for the K Desktop Environment including kpdf, a pdf file viewer.

A heap based buffer overflow bug was discovered in kpdf. An attacker could construct a carefully crafted PDF file that could cause kpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0301 to this issue.

Users of kpdf should upgrade to these updated packages, which contain a backported patch to resolve this issue.

Updated libpng packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libpng package contains a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.

A heap based buffer overflow bug was found in the way libpng strips alpha channels from a PNG image. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash or execute arbitrary code when the file is opened by a victim. The Common Vulnerabilities and Exposures project has assigned the name CVE-2006-0481 to this issue.

Please note that the vunerable libpng function is only used by TeTeX and XEmacs on Red Hat Enterprise Linux 4.

All users of libpng are advised to update to these updated packages which contain a backported patch that is not vulnerable to this issue.

An updated xpdf package that fixes a buffer overflow security issue is now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The xpdf package is an X Window System-based viewer for Portable Document Format (PDF) files.

A heap based buffer overflow bug was discovered in Xpdf. An attacker could construct a carefully crafted PDF file that could cause Xpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0301 to this issue.

Users of Xpdf should upgrade to this updated package, which contains a backported patch to resolve these issues.

Red Hat would like to thank Dirk Mueller for reporting this issue and providing a patch.

An updated firefox package that fixes several security bugs is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

Igor Bukanov discovered a bug in the way Firefox's JavaScript interpreter dereferences objects. If a user visits a malicious web page, Firefox could crash or execute arbitrary code as the user running Firefox. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0292 to this issue.

moz_bug_r_a4 discovered a bug in Firefox's XULDocument.persist() function. A malicious web page could inject arbitrary RDF data into a user's localstore.rdf file, which can cause Firefox to execute arbitrary JavaScript when a user runs Firefox. (CVE-2006-0296)

A denial of service bug was found in the way Firefox saves history information. If a user visits a web page with a very long title, it is possible Firefox will crash or take a very long time the next time it is run. (CVE-2005-4134)

This update also fixes a bug when using XSLT to transform documents.
Passing DOM Nodes as parameters to functions expecting an xsl:param could cause Firefox to throw an exception.

Users of Firefox are advised to upgrade to this updated package, which contains backported patches to correct these issues.

Updated gd packages that fix several buffer overflow flaws are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The gd package contains a graphics library used for the dynamic creation of images such as PNG and JPEG.

Several buffer overflow flaws were found in the way gd allocates memory. An attacker could create a carefully crafted image that could execute arbitrary code if opened by a victim using a program linked against the gd library. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2004-0941 to these issues.

Users of gd should upgrade to these updated packages, which contain a backported patch and is not vulnerable to these issues.

Updated kdelibs packages are now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

kdelibs contains libraries for the K Desktop Environment (KDE).

A heap overflow flaw was discovered affecting kjs, the JavaScript interpreter engine used by Konqueror and other parts of KDE. An attacker could create a malicious website containing carefully crafted JavaScript code that would trigger this flaw and possibly lead to arbitrary code execution. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0019 to this issue.

NOTE: this issue does not affect KDE in Red Hat Enterprise Linux 3 or 2.1.

Users of KDE should upgrade to these updated packages, which contain a backported patch from the KDE security team correcting this issue as well as two bug fixes.

An updated gpdf package that fixes several security issues is now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

gpdf is a GNOME based viewer for Portable Document Format (PDF) files.

Chris Evans discovered several flaws in the way gpdf processes PDF files. An attacker could construct a carefully crafted PDF file that could cause gpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project assigned the names CVE-2005-3624, CVE-2005-3625, CVE-2005-3626, and CVE-2005-3627 to these issues.

Users of gpdf should upgrade to this updated package, which contains a backported patch to resolve these issues.

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 4. This is the third regular update.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

This is the third regular kernel update to Red Hat Enterprise Linux 4.

New features introduced in this update include :

  - Open InfiniBand (OpenIB) support

  - Serial Attached SCSI support

  - NFS access control lists, asynchronous I/O

  - IA64 multi-core support and sgi updates

  - Large SMP CPU limits increased using the largesmp     kernel: Up to 512 CPUs in ia64, 128 in ppc64, and 64 in     AMD64 and Intel EM64T

  - Improved read-ahead performance

  - Common Internet File System (CIFS) update

  - Error Detection and Correction (EDAC) modules

  - Unisys support

There were several bug fixes in various parts of the kernel. The ongoing effort to resolve these problems has resulted in a marked improvement in the reliability and scalability of Red Hat Enterprise Linux 4.

The following security bug was fixed in this update :

  - dm-crypt did not clear a structure before freeing it,     which could allow local users to discover information     about cryptographic keys (CVE-2006-0095)

The following device drivers have been upgraded to new versions :

cciss: 2.6.8 to 2.6.8-rh1 ipmi_devintf: 33.4 to 33.11 ipmi_msghandler:
33.4 to 33.11 ipmi_poweroff: 33.4 to 33.11 ipmi_si: 33.4 to 33.11 ipmi_watchdog: 33.4 to 33.11 mptbase: 3.02.18 to 3.02.60.01rh e1000:
6.0.54-k2-NAPI to 6.1.16-k2-NAPI ixgb: 1.0.95-k2-NAPI to 1.0.100-k2-NAPI tg3: 3.27-rh to 3.43-rh aacraid: 1.1.2-lk2 to 1.1-5[2412] ahci: 1.01 to 1.2 ata_piix: 1.03 to 1.05 iscsi_sfnet:
4:0.1.11-1 to 4:0.1.11-2 libata: 1.11 to 1.20 qla2100: 8.01.00b5-rh2 to 8.01.02-d3 qla2200: 8.01.00b5-rh2 to 8.01.02-d3 qla2300:
8.01.00b5-rh2 to 8.01.02-d3 qla2322: 8.01.00b5-rh2 to 8.01.02-d3 qla2xxx: 8.01.00b5-rh2 to 8.01.02-d3 qla6312: 8.01.00b5-rh2 to 8.01.02-d3 sata_nv: 0.6 to 0.8 sata_promise: 1.01 to 1.03 sata_svw:
1.06 to 1.07 sata_sx4: 0.7 to 0.8 sata_vsc: 1.0 to 1.1 cifs: 1.20 to 1.34

Added drivers :

bnx2: 1.4.25 dell_rbu: 0.7 hangcheck-timer: 0.9.0 ib_mthca: 0.06 megaraid_sas: 00.00.02.00 qla2400: 8.01.02-d3 typhoon: 1.5.7

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

An updated spamassassin package that fixes a denial of service flaw is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email (SPAM) from incoming email.

A denial of service bug was found in SpamAssassin. An attacker could construct a message in such a way that would cause SpamAssassin to crash. If a number of these messages are sent, it could lead to a denial of service, potentially preventing the delivery or filtering of email. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2005-3351 to this issue.

The following issues have also been fixed in this update :

* service spamassassin restart sometimes fails * Content Boundary '--' throws off message parser * sa-learn: massive memory usage on large messages * High memory usage with many newlines * service spamassassin messages not translated * Numerous other bug fixes that improve spam filter accuracy and safety

Users of SpamAssassin should upgrade to this updated package containing version 3.0.5, which is not vulnerable to these issues.

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 4 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

  - a flaw in network IGMP processing that a allowed a     remote user on the local network to cause a denial of     service (disabling of multicast reports) if the system     is running multicast applications (CVE-2002-2185,     moderate)

  - a flaw which allowed a local user to write to firmware     on read-only opened /dev/cdrom devices (CVE-2004-1190,     moderate)

  - a flaw in gzip/zlib handling internal to the kernel that     may allow a local user to cause a denial of service     (crash) (CVE-2005-2458, low)

  - a flaw in procfs handling during unloading of modules     that allowed a local user to cause a denial of service     or potentially gain privileges (CVE-2005-2709, moderate)

  - a flaw in the SCSI procfs interface that allowed a local     user to cause a denial of service (crash)     (CVE-2005-2800, moderate)

  - a flaw in 32-bit-compat handling of the TIOCGDEV ioctl     that allowed a local user to cause a denial of service     (crash) (CVE-2005-3044, important)

  - a race condition when threads share memory mapping that     allowed local users to cause a denial of service     (deadlock) (CVE-2005-3106, important)

  - a flaw when trying to mount a non-hfsplus filesystem     using hfsplus that allowed local users to cause a denial     of service (crash) (CVE-2005-3109, moderate)

  - a minor info leak with the get_thread_area() syscall     that allowed a local user to view uninitialized kernel     stack data (CVE-2005-3276, low)

  - a flaw in mq_open system call that allowed a local user     to cause a denial of service (crash) (CVE-2005-3356,     important)

  - a flaw in set_mempolicy that allowed a local user on     some 64-bit architectures to cause a denial of service     (crash) (CVE-2005-3358, important)

  - a flaw in the auto-reap of child processes that allowed     a local user to cause a denial of service (crash)     (CVE-2005-3784, important)

  - a flaw in the IPv6 flowlabel code that allowed a local     user to cause a denial of service (crash)     (CVE-2005-3806, important)

  - a flaw in network ICMP processing that allowed a local     user to cause a denial of service (memory exhaustion)     (CVE-2005-3848, important)

  - a flaw in file lease time-out handling that allowed a     local user to cause a denial of service (log file     overflow) (CVE-2005-3857, moderate)

  - a flaw in network IPv6 xfrm handling that allowed a     local user to cause a denial of service (memory     exhaustion) (CVE-2005-3858, important)

  - a flaw in procfs handling that allowed a local user to     read kernel memory (CVE-2005-4605, important)

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

An updated squid package that fixes a security vulnerability as well as several issues is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects.

A denial of service flaw was found in the way squid processes certain NTLM authentication requests. It is possible for a remote attacker to crash the Squid server by sending a specially crafted NTLM authentication request. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2005-2917 to this issue.

The following issues have also been fixed in this update :

* An error introduced in squid-2.5.STABLE6-3.4E.12 can crash Squid when a user visits a site that has a bit longer DNS record.

* An error introduced in the old package prevented Squid from returning correct information about large file systems. The new package is compiled with the IDENT lookup support so that users who want to use it do not have to recompile it.

* Some authentication helpers needed SETUID rights but did not have them. If administrators wanted to use cache administrator, they had to change the SETUID bit manually. The updated package sets this bit so the new package can be updated without manual intervention from administrators.

* Squid could not handle a reply from an HTTP server when the reply began with the new-line character.

* An issue was discovered when a reply from an HTTP server was not HTTP 1.0 or 1.1 compliant.

* The updated package keeps user-defined error pages when the package is updated and it adds new ones.

All users of squid should upgrade to this updated package, which resolves these issues.

Updated openssh packages that fix bugs in sshd and add auditing of user logins are now available for Red Hat Enterprise Linux 4.

This update has been rated as having low security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This package includes the core files necessary for both the OpenSSH client and server.

An arbitrary command execution flaw was discovered in the way scp copies files locally. It is possible for a local attacker to create a file with a carefully crafted name that could execute arbitrary commands as the user running scp to copy files locally. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2006-0225 to this issue.

The following issue has also been fixed in this update :

* If the sshd service was stopped using the sshd init script while the main sshd daemon was not running, the init script would kill other sshd processes, such as the running sessions. For example, this could happen when the 'service sshd stop' command was issued twice.

Additionally, this update implements auditing of user logins through the system audit service.

All users of openssh should upgrade to these updated packages, which resolve these issues.

Updated Perl packages that fix security issues and bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Perl is a high-level programming language commonly used for system administration utilities and Web programming.

An integer overflow bug was found in Perl's format string processor.
It is possible for an attacker to cause perl to crash or execute arbitrary code if the attacker is able to process a malicious format string. This issue is only exploitable through a script which passes arbitrary untrusted strings to the format string processor. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-3962 to this issue.

Users of Perl are advised to upgrade to these updated packages, which contain backported patches to correct these issues as well as fixes for several bugs.

Updated curl packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and Dict servers, using any of the supported protocols.

Stefan Esser discovered an off-by-one bug in curl. It may be possible to execute arbitrary code on a user's machine if the user can be tricked into executing curl with a carefully crafted URL. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-4077 to this issue.

All users of curl are advised to upgrade to these updated packages, which contain a backported patch that resolves this issue.

Updated kdegraphics packages that resolve several security issues in kpdf are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kdegraphics packages contain applications for the K Desktop Environment including kpdf, a pdf file viewer.

Several flaws were discovered in kpdf. An attacker could construct a carefully crafted PDF file that could cause kpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project assigned the names CVE-2005-3191, CVE-2005-3192, and CVE-2005-3193 to these issues.

Users of kpdf should upgrade to these updated packages, which contain a backported patch to resolve these issues.

An updated gpdf package that fixes several security issues is now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The gpdf package is a GNOME based viewer for Portable Document Format (PDF) files.

Several flaws were discovered in gpdf. An attacker could construct a carefully crafted PDF file that could cause gpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project assigned the names CVE-2005-3191, CVE-2005-3192, and CVE-2005-3193 to these issues.

Users of gpdf should upgrade to this updated package, which contains a backported patch to resolve these issues.

Updated udev packages that fix a security issue are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The udev package contains an implementation of devfs in userspace using sysfs and /sbin/hotplug.

Richard Cunningham discovered a flaw in the way udev sets permissions on various files in /dev/input. It may be possible for an authenticated attacker to gather sensitive data entered by a user at the console, such as passwords. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-3631 to this issue.

All users of udev should upgrade to these updated packages, which contain a backported patch and are not vulnerable to this issue.

Updated libc-client packages that fix a buffer overflow issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

C-client is a common API for accessing mailboxes.

A buffer overflow flaw was discovered in the way C-client parses user-supplied mailboxes. If an authenticated user requests a specially crafted mailbox name, it may be possible to execute arbitrary code on a server that uses C-client to access mailboxes. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2933 to this issue.

All users of libc-client should upgrade to these updated packages, which contain a backported patch that resolves this issue.

Updated lm_sensors packages that fix an insecure file issue are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The lm_sensors package includes a collection of modules for general SMBus access and hardware monitoring. This package requires special support which is not in standard version 2.2 kernels.

A bug was found in the way the pwmconfig tool creates temporary files.
It is possible that a local attacker could leverage this flaw to overwrite arbitrary files located on the system. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2672 to this issue.

Users of lm_sensors are advised to upgrade to these updated packages, which contain a backported patch that resolves this issue.

Updated kernel packages that fix several security issues and a page attribute mapping bug are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

An issue was discovered that affects how page attributes are changed by the kernel. Video drivers, which sometimes map kernel pages with a different caching policy than write-back, are now expected to function correctly. This change affects the x86, AMD64, and Intel EM64T architectures.

In addition the following security bugs were fixed :

The set_mempolicy system call did not check for negative numbers in the policy field. An unprivileged local user could use this flaw to cause a denial of service (system panic). (CVE-2005-3053)

A flaw in ioremap handling on AMD 64 and Intel EM64T systems. An unprivileged local user could use this flaw to cause a denial of service or minor information leak. (CVE-2005-3108)

A race condition in the ebtables netfilter module. On a SMP system that is operating under a heavy load this flaw may allow remote attackers to cause a denial of service (crash). (CVE-2005-3110)

A memory leak was found in key handling. An unprivileged local user could use this flaw to cause a denial of service. (CVE-2005-3119)

A flaw in the Orinoco wireless driver. On systems running the vulnerable drive, a remote attacker could send carefully crafted packets which would divulge the contents of uninitialized kernel memory. (CVE-2005-3180)

A memory leak was found in the audit system. An unprivileged local user could use this flaw to cause a denial of service. (CVE-2005-3181)

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

An updated pam package that fixes a security weakness is now available for Red Hat Enterprise Linux 4.

This update has been rated as having low security impact by the Red Hat Security Response Team.

PAM (Pluggable Authentication Modules) is a system security tool that allows system administrators to set an authentication policy without having to recompile programs that handle authentication.

A bug was found in the way PAM's unix_chkpwd helper program validates user passwords when SELinux is enabled. Under normal circumstances, it is not possible for a local non-root user to verify the password of another local user with the unix_chkpwd command. A patch applied that adds SELinux functionality makes it possible for a local user to use brute-force password guessing techniques against other local user accounts. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2977 to this issue.

All users of pam should upgrade to this updated package, which contains backported patches to correct these issues.

Updated netpbm packages that fix a security issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The netpbm package contains a library of functions that support programs for handling various graphics file formats, including .pbm (portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable pixmaps) and others.

A bug was found in the way netpbm converts Portable Anymap (PNM) files into Portable Network Graphics (PNG). The usage of uninitialised variables in the pnmtopng code allows an attacker to change stack contents when converting to PNG files with pnmtopng using the '-trans' option. This may allow an attacker to execute arbitrary code. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2978 to this issue.

All users of netpbm should upgrade to the updated packages, which contain a backported patch to resolve this issue.

An updated thunderbird package that fixes various bugs is now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Mozilla Thunderbird is a standalone mail and newsgroup client.

A bug was found in the way Thunderbird processes certain international domain names. An attacker could create a specially crafted HTML mail, which when viewed by the victim would cause Thunderbird to crash or possibly execute arbitrary code. Thunderbird as shipped with Red Hat Enterprise Linux 4 must have international domain names enabled by the user in order to be vulnerable to this issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2871 to this issue.

A bug was found in the way Thunderbird processes certain Unicode sequences. It may be possible to execute arbitrary code as the user running Thunderbird if the user views a specially crafted HTML mail containing Unicode sequences. (CVE-2005-2702)

A bug was found in the way Thunderbird makes XMLHttp requests. It is possible that a malicious HTML mail could leverage this flaw to exploit other proxy or server flaws from the victim's machine. It is also possible that this flaw could be leveraged to send XMLHttp requests to hosts other than the originator; the default behavior of Thunderbird is to disallow such actions. (CVE-2005-2703)

A bug was found in the way Thunderbird implemented its XBL interface.
It may be possible for a malicious HTML mail to create an XBL binding in such a way that would allow arbitrary JavaScript execution with chrome permissions. Please note that in Thunderbird 1.0.6 this issue is not directly exploitable and will need to leverage other unknown exploits. (CVE-2005-2704)

An integer overflow bug was found in Thunderbird's JavaScript engine.
Under favorable conditions, it may be possible for a malicious mail message to execute arbitrary code as the user running Thunderbird.
Please note that JavaScript support is disabled by default in Thunderbird. (CVE-2005-2705)

A bug was found in the way Thunderbird displays about: pages. It is possible for a malicious HTML mail to open an about: page, such as about:mozilla, in such a way that it becomes possible to execute JavaScript with chrome privileges. (CVE-2005-2706)

A bug was found in the way Thunderbird opens new windows. It is possible for a malicious HTML mail to construct a new window without any user interface components, such as the address bar and the status bar. This window could then be used to mislead the user for malicious purposes. (CVE-2005-2707)

A bug was found in the way Thunderbird processes URLs passed to it on the command line. If a user passes a malformed URL to Thunderbird, such as clicking on a link in an instant messaging program, it is possible to execute arbitrary commands as the user running Thunderbird. (CVE-2005-2968)

Users of Thunderbird are advised to upgrade to this updated package, which contains Thunderbird version 1.0.7 and is not vulnerable to these issues.

An updated firefox package that fixes several security bugs is now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

A bug was found in the way Firefox processes XBM image files. If a user views a specially crafted XBM file, it becomes possible to execute arbitrary code as the user running Firefox. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2701 to this issue.

A bug was found in the way Firefox processes certain Unicode sequences. It may be possible to execute arbitrary code as the user running Firefox if the user views a specially crafted Unicode sequence. (CVE-2005-2702)

A bug was found in the way Firefox makes XMLHttp requests. It is possible that a malicious web page could leverage this flaw to exploit other proxy or server flaws from the victim's machine. It is also possible that this flaw could be leveraged to send XMLHttp requests to hosts other than the originator; the default behavior of the browser is to disallow this. (CVE-2005-2703)

A bug was found in the way Firefox implemented its XBL interface. It may be possible for a malicious web page to create an XBL binding in such a way that would allow arbitrary JavaScript execution with chrome permissions. Please note that in Firefox 1.0.6 this issue is not directly exploitable and will need to leverage other unknown exploits.
(CVE-2005-2704)

An integer overflow bug was found in Firefox's JavaScript engine.
Under favorable conditions, it may be possible for a malicious web page to execute arbitrary code as the user running Firefox.
(CVE-2005-2705)

A bug was found in the way Firefox displays about: pages. It is possible for a malicious web page to open an about: page, such as about:mozilla, in such a way that it becomes possible to execute JavaScript with chrome privileges. (CVE-2005-2706)

A bug was found in the way Firefox opens new windows. It is possible for a malicious website to construct a new window without any user interface components, such as the address bar and the status bar. This window could then be used to mislead the user for malicious purposes.
(CVE-2005-2707)

A bug was found in the way Firefox processes URLs passed to it on the command line. If a user passes a malformed URL to Firefox, such as clicking on a link in an instant messaging program, it is possible to execute arbitrary commands as the user running Firefox.
(CVE-2005-2968)

Users of Firefox are advised to upgrade to this updated package that contains Firefox version 1.0.7 and is not vulnerable to these issues.

An updated firefox package that fixes as security bug is now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

A bug was found in the way Firefox processes certain international domain names. An attacker could create a specially crafted HTML file, which when viewed by the victim would cause Firefox to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2871 to this issue.

Users of Firefox are advised to upgrade to this updated package that contains a backported patch and is not vulnerable to this issue.

Updated openldap and nss_ldap packages that correct a potential password disclosure issue and possible authentication vulnerability are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenLDAP is an open source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools.

The nss_ldap module is an extension for use with GNU libc which allows applications to, without internal modification, consult a directory service using LDAP to supplement information that would be read from local files such as /etc/passwd, /etc/group, and /etc/shadow.

A bug was found in the way OpenLDAP, nss_ldap, and pam_ldap refer LDAP servers. If a client connection is referred to a different server, it is possible that the referred connection will not be encrypted even if the client has 'ssl start_tls' in its ldap.conf file. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2069 to this issue.

A bug was found in the way the pam_ldap module processed certain failure messages. If the server includes supplemental data in an authentication failure result message, but the data does not include any specific error code, the pam_ldap module would proceed as if the authentication request had succeeded, and authentication would succeed. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2641 to this issue.

Additionally the following issues are corrected in this erratum.

  - The OpenLDAP upgrading documentation has been updated.

  - Fix a database deadlock locking issue.

  - A fix where slaptest segfaults on exit after successful     check.

  - The library libslapd_db-4.2.so is now located in an     architecture-dependent directory.

  - The LDAP client no longer enters an infinite loop when     the server returns a reference to itself.

  - The pam_ldap module adds the ability to check user     passwords using a directory server to PAM-aware     applications.

  - The directory server can now include supplemental     information regarding the state of the user's account if     a client indicates that it supports such a feature.

All users of OpenLDAP and nss_ldap are advised to upgrade to these updated packages, which contain backported fixes that resolve these issues.

Updated PHP packages that fix a security issue are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A bug was discovered in the PEAR XML-RPC Server package included in PHP. If a PHP script is used which implements an XML-RPC Server using the PEAR XML-RPC package, then it is possible for a remote attacker to construct an XML-RPC request which can cause PHP to execute arbitrary PHP commands as the 'apache' user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2498 to this issue.

When using the default SELinux 'targeted' policy on Red Hat Enterprise Linux 4, the impact of this issue is reduced since the scripts executed by PHP are constrained within the httpd_sys_script_t security context.

Users of PHP should upgrade to these updated packages, which contain backported fixes for these issues.

Updated vim packages that fix a security issue are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

VIM (VIsual editor iMproved) is a version of the vi editor.

A bug was found in the way VIM processes modelines. If a user with modelines enabled opens a text file with a carefully crafted modeline, arbitrary commands may be executed as the user running VIM. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2368 to this issue.

Users of VIM are advised to upgrade to these updated packages, which resolve this issue.

Updated netpbm packages that fix a security issue are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The netpbm package contains a library of functions that support programs for handling various graphics file formats, including .pbm (portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable pixmaps) and others.

A bug was found in the way netpbm converts PostScript files into PBM, PGM or PPM files. An attacker could create a carefully crafted PostScript file in such a way that it could execute arbitrary commands when the file is processed by a victim using pstopnm. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2471 to this issue.

All users of netpbm should upgrade to the updated packages, which contain a backported patch to resolve this issue.

An updated gpdf package that fixes a security issue is now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The gpdf package is an GNOME based viewer for Portable Document Format (PDF) files.

Marcus Meissner reported a flaw in gpdf. An attacker could construct a carefully crafted PDF file that would cause gpdf to consume all available disk space in /tmp when opened. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2097 to this issue.

Note that this issue does not affect the version of gpdf in Red Hat Enterprise Linux 3 or 2.1.

Users of gpdf should upgrade to this updated package, which contains a backported patch to resolve this issue.

Updated kdegraphics packages that resolve a security issue in kpdf are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kdegraphics packages contain applications for the K Desktop Environment including kpdf, a pdf file viewer.

A flaw was discovered in kpdf. An attacker could construct a carefully crafted PDF file that would cause kpdf to consume all available disk space in /tmp when opened. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2097 to this issue.

Note this issue does not affect Red Hat Enterprise Linux 3 or 2.1.

Users of kpdf should upgrade to these updated packages, which contains a backported patch to resolve this issue.

An updated xpdf package that fixes a security issue is now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The xpdf package is an X Window System-based viewer for Portable Document Format (PDF) files.

A flaw was discovered in Xpdf in that an attacker could construct a carefully crafted PDF file that would cause Xpdf to consume all available disk space in /tmp when opened. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2097 to this issue.

Note this issue does not affect the version of Xpdf in Red Hat Enterprise Linux 3 or 2.1.

Users of xpdf should upgrade to this updated package, which contains a backported patch to resolve this issue.

Updated kdenetwork packages to correct a security flaw in Kopete are now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The kdenetwork package contains networking applications for the K Desktop Environment. Kopete is a KDE instant messenger which supports a number of protocols including ICQ, MSN, Yahoo, Jabber, and Gadu-Gadu.

Multiple integer overflow flaws were found in the way Kopete processes Gadu-Gadu messages. A remote attacker could send a specially crafted Gadu-Gadu message which would cause Kopete to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-1852 to this issue.

In order to be affected by this issue, a user would need to have registered with Gadu-Gadu and be signed in to the Gadu-Gadu server in order to receive a malicious message. In addition, Red Hat believes that the Exec-shield technology (enabled by default in Red Hat Enterprise Linux 4) would block attempts to remotely exploit this vulnerability.

Note that this issue does not affect Red Hat Enterprise Linux 2.1 or 3.

Users of Kopete should update to these packages which contain a patch to correct this issue.

Updated kdelibs packages are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

kdelibs contains libraries for the K Desktop Environment.

A flaw was discovered affecting Kate, the KDE advanced text editor, and Kwrite. Depending on system settings, it may be possible for a local user to read the backup files created by Kate or Kwrite. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-1920 to this issue.

Please note this issue does not affect Red Hat Enterprise Linux 3 or 2.1.

Users of Kate or Kwrite should update to these errata packages which contains a backported patch from the KDE security team correcting this issue.

Updated thunderbird package that fixes various bugs is now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Mozilla Thunderbird is a standalone mail and newsgroup client.

A bug was found in the way Thunderbird handled anonymous functions during regular expression string replacement. It is possible for a malicious HTML mail to capture a random block of client memory. The Common Vulnerabilities and Exposures project has assigned this bug the name CVE-2005-0989.

A bug was found in the way Thunderbird validated several XPInstall related JavaScript objects. A malicious HTML mail could pass other objects to the XPInstall objects, resulting in the JavaScript interpreter jumping to arbitrary locations in memory. (CVE-2005-1159)

A bug was found in the way the Thunderbird privileged UI code handled DOM nodes from the content window. An HTML message could install malicious JavaScript code or steal data when a user performs commonplace actions such as clicking a link or opening the context menu. (CVE-2005-1160)

A bug was found in the way Thunderbird executed JavaScript code.
JavaScript executed from HTML mail should run with a restricted access level, preventing dangerous actions. It is possible that a malicious HTML mail could execute JavaScript code with elevated privileges, allowing access to protected data and functions. (CVE-2005-1532)

A bug was found in the way Thunderbird executed JavaScript in XBL controls. It is possible for a malicious HTML mail to leverage this vulnerability to execute other JavaScript based attacks even when JavaScript is disabled. (CVE-2005-2261)

A bug was found in the way Thunderbird handled certain JavaScript functions. It is possible for a malicious HTML mail to crash the client by executing malformed JavaScript code. (CVE-2005-2265)

A bug was found in the way Thunderbird handled child frames. It is possible for a malicious framed HTML mail to steal sensitive information from its parent frame. (CVE-2005-2266)

A bug was found in the way Thunderbird handled DOM node names. It is possible for a malicious HTML mail to overwrite a DOM node name, allowing certain privileged chrome actions to execute the malicious JavaScript. (CVE-2005-2269)

A bug was found in the way Thunderbird cloned base objects. It is possible for HTML content to navigate up the prototype chain to gain access to privileged chrome objects. (CVE-2005-2270)

Users of Thunderbird are advised to upgrade to this updated package that contains Thunderbird version 1.0.6 and is not vulnerable to these issues.

An updated sysreport package that fixes an insecure temporary file flaw is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Sysreport is a utility that gathers information about a system's hardware and configuration. The information can then be used for diagnostic purposes and debugging.

Bill Stearns discovered a bug in the way sysreport creates temporary files. It is possible that a local attacker could obtain sensitive information about the system when sysreport is run. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2104 to this issue.

Users of sysreport should update to this erratum package, which contains a patch that resolves this issue.

An updated squirrelmail package that fixes two security issues is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

[Updated 04 Aug 2005] The previous SquirrelMail package released with this errata contained a bug which rendered the addressbook unusable.
The erratum has been updated with a package which corrects this issue.

SquirrelMail is a standards-based webmail package written in PHP4.

A bug was found in the way SquirrelMail handled the $_POST variable.
If a user is tricked into visiting a malicious URL, the user's SquirrelMail preferences could be read or modified. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2095 to this issue.

Several cross-site scripting bugs were discovered in SquirrelMail. An attacker could inject arbitrary JavaScript or HTML content into SquirrelMail pages by tricking a user into visiting a carefully crafted URL, or by sending them a carefully constructed HTML email message. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-1769 to this issue.

All users of SquirrelMail should upgrade to this updated package, which contains backported patches that resolve these issues.

An updated firefox package that fixes various security bugs is now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

A bug was found in the way Firefox handled synthetic events. It is possible that Web content could generate events such as keystrokes or mouse clicks that could be used to steal data or execute malicious JavaScript code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2260 to this issue.

A bug was found in the way Firefox executed JavaScript in XBL controls. It is possible for a malicious webpage to leverage this vulnerability to execute other JavaScript based attacks even when JavaScript is disabled. (CVE-2005-2261)

A bug was found in the way Firefox set an image as the desktop wallpaper. If a user chooses the 'Set As Wallpaper...' context menu item on a specially crafted image, it is possible for an attacker to execute arbitrary code on a victim's machine. (CVE-2005-2262)

A bug was found in the way Firefox installed its extensions. If a user can be tricked into visiting a malicious webpage, it may be possible to obtain sensitive information such as cookies or passwords.
(CVE-2005-2263)

A bug was found in the way Firefox handled the _search target. It is possible for a malicious website to inject JavaScript into an already open webpage. (CVE-2005-2264)

A bug was found in the way Firefox handled certain JavaScript functions. It is possible for a malicious web page to crash the browser by executing malformed JavaScript code. (CVE-2005-2265)

A bug was found in the way Firefox handled multiple frame domains. It is possible for a frame as part of a malicious website to inject content into a frame that belongs to another domain. This issue was previously fixed as CVE-2004-0718 but was accidentally disabled.
(CVE-2005-1937)

A bug was found in the way Firefox handled child frames. It is possible for a malicious framed page to steal sensitive information from its parent page. (CVE-2005-2266)

A bug was found in the way Firefox opened URLs from media players. If a media player opens a URL that is JavaScript, JavaScript is executed with access to the currently open webpage. (CVE-2005-2267)

A design flaw was found in the way Firefox displayed alerts and prompts. Alerts and prompts were given the generic title [JavaScript Application] which prevented a user from knowing which site created them. (CVE-2005-2268)

A bug was found in the way Firefox handled DOM node names. It is possible for a malicious site to overwrite a DOM node name, allowing certain privileged chrome actions to execute the malicious JavaScript.
(CVE-2005-2269)

A bug was found in the way Firefox cloned base objects. It is possible for Web content to navigate up the prototype chain to gain access to privileged chrome objects. (CVE-2005-2270)

Users of Firefox are advised to upgrade to this updated package that contains Firefox version 1.0.6 and is not vulnerable to these issues.

Updated zlib packages that fix a buffer overflow are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Zlib is a general-purpose lossless data compression library that is used by many different programs.

A previous zlib update, RHSA-2005:569 (CVE-2005-2096) fixed a flaw in zlib that could allow a carefully crafted compressed stream to crash an application. While the original patch corrected the reported overflow, Markus Oberhumer discovered additional ways a stream could trigger an overflow. An attacker could create a carefully crafted compressed stream that would cause an application to crash if the stream is opened by a user. As an example, an attacker could create a malicious PNG image file that would cause a Web browser or mail viewer to crash if the image is viewed. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2005-1849 to this issue.

Note that the versions of zlib shipped with Red Hat Enterprise Linux 2.1 and 3 are not vulnerable to this issue.

All users should update to these errata packages that contain a patch from Mark Adler that corrects this issue.

Updated Zlib packages that fix a buffer overflow are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Zlib is a general-purpose lossless data compression library which is used by many different programs.

Tavis Ormandy discovered a buffer overflow affecting Zlib version 1.2 and above. An attacker could create a carefully crafted compressed stream that would cause an application to crash if the stream is opened by a user. As an example, an attacker could create a malicious PNG image file which would cause a web browser or mail viewer to crash if the image is viewed. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2096 to this issue.

Please note that the versions of Zlib as shipped with Red Hat Enterprise Linux 2.1 and 3 are not vulnerable to this issue.

All users should update to these erratum packages which contain a patch from Mark Adler which corrects this issue.

Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Kerberos is a networked authentication system that uses a trusted third party (a KDC) to authenticate clients and servers to each other.

A double-free flaw was found in the krb5_recvauth() routine which may be triggered by a remote unauthenticated attacker. Red Hat Enterprise Linux 4 contains checks within glibc that detect double-free flaws.
Therefore, on Red Hat Enterprise Linux 4 successful exploitation of this issue can only lead to a denial of service (KDC crash). The Common Vulnerabilities and Exposures project assigned the name CVE-2005-1689 to this issue.

Daniel Wachdorf discovered a single byte heap overflow in the krb5_unparse_name() function, part of krb5-libs. Sucessful exploitation of this flaw would lead to a denial of service (crash).
To trigger this flaw an attacker would need to have control of a kerberos realm that shares a cross-realm key with the target, making exploitation of this flaw unlikely. (CVE-2005-1175).

Daniel Wachdorf also discovered that in error conditions that may occur in response to correctly-formatted client requests, the Kerberos 5 KDC may attempt to free uninitialized memory. This could allow a remote attacker to cause a denial of service (KDC crash) (CVE-2005-1174).

Gael Delalleau discovered an information disclosure issue in the way some telnet clients handle messages from a server. An attacker could construct a malicious telnet server that collects information from the environment of any victim who connects to it using the Kerberos-aware telnet client (CVE-2005-0488).

The rcp protocol allows a server to instruct a client to write to arbitrary files outside of the current directory. This could potentially cause a security issue if a user uses the Kerberos-aware rcp to copy files from a malicious server (CVE-2004-0175).

All users of krb5 should update to these erratum packages, which contain backported patches to correct these issues. Red Hat would like to thank the MIT Kerberos Development Team for their responsible disclosure of these issues.

Updated ruby packages that fix an arbitrary command execution issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ruby is an interpreted scripting language for object-oriented programming.

A bug was found in the way Ruby launched an XMLRPC server. If an XMLRPC server is launched in a certain way, it becomes possible for a remote attacker to execute arbitrary commands within the XMLRPC server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1992 to this issue.

Users of Ruby should update to these erratum packages, which contain a backported patch and are not vulnerable to this issue.

An updated HelixPlayer package that fixes a buffer overflow issue is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

HelixPlayer is a media player.

A buffer overflow bug was found in the way HelixPlayer processes SMIL files. An attacker could create a specially crafted SMIL file, which when combined with a malicious web server, could execute arbitrary code when opened by a user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1766 to this issue.

All users of HelixPlayer are advised to upgrade to this updated package, which contains HelixPlayer version 10.0.5 and is not vulnerable to this issue.

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 4. This is the second regular update.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

This is the second regular kernel update to Red Hat Enterprise Linux 4.

New features introduced in this update include: - Audit support - systemtap - kprobes, relayfs - Keyring support - iSCSI Initiator - iscsi_sfnet 4:0.1.11-1 - Device mapper multipath support - Intel dual core support - esb2 chipset support - Increased exec-shield coverage - Dirty page tracking for HA systems - Diskdump -- allow partial diskdumps and directing to swap

There were several bug fixes in various parts of the kernel. The ongoing effort to resolve these problems has resulted in a marked improvement in the reliability and scalability of Red Hat Enterprise Linux 4.

The following security bugs were fixed in this update, detailed below with corresponding CAN names available from the Common Vulnerabilities and Exposures project (cve.mitre.org) :

  - flaws in ptrace() syscall handling on 64-bit systems     that allowed a local user to cause a denial of service     (crash) (CVE-2005-0756, CVE-2005-1761, CVE-2005-1762,     CVE-2005-1763)

  - flaws in IPSEC network handling that allowed a local     user to cause a denial of service or potentially gain     privileges (CVE-2005-2456, CVE-2005-2555)

  - a flaw in sendmsg() syscall handling on 64-bit systems     that allowed a local user to cause a denial of service     or potentially gain privileges (CVE-2005-2490)

  - a flaw in sendmsg() syscall handling that allowed a     local user to cause a denial of service by altering     hardware state (CVE-2005-2492)

  - a flaw that prevented the topdown allocator from     allocating mmap areas all the way down to address zero     (CVE-2005-1265)

  - flaws dealing with keyrings that could cause a local     denial of service (CVE-2005-2098, CVE-2005-2099)

  - a flaw in the 4GB split patch that could allow a local     denial of service (CVE-2005-2100)

  - a xattr sharing bug in the ext2 and ext3 file systems     that could cause default ACLs to disappear     (CVE-2005-2801)

  - a flaw in the ipt_recent module on 64-bit architectures     which could allow a remote denial of service     (CVE-2005-2872)

The following device drivers have been upgraded to new versions :

qla2100 --------- 8.00.00b21-k to 8.01.00b5-rh2 qla2200 --------- 8.00.00b21-k to 8.01.00b5-rh2 qla2300 --------- 8.00.00b21-k to 8.01.00b5-rh2 qla2322 --------- 8.00.00b21-k to 8.01.00b5-rh2 qla2xxx
--------- 8.00.00b21-k to 8.01.00b5-rh2 qla6312 --------- 8.00.00b21-k to 8.01.00b5-rh2 megaraid_mbox --- 2.20.4.5 to 2.20.4.6 megaraid_mm
----- 2.20.2.5 to 2.20.2.6 lpfc ------------ 0:8.0.16.6_x2 to 0:8.0.16.17 cciss ----------- 2.6.4 to 2.6.6 ipw2100 --------- 1.0.3 to 1.1.0 tg3 ------------- 3.22-rh to 3.27-rh e100 ------------ 3.3.6-k2-NAPI to 3.4.8-k2-NAPI e1000 ----------- 5.6.10.1-k2-NAPI to 6.0.54-k2-NAPI 3c59x ----------- LK1.1.19 mptbase --------- 3.01.16 to 3.02.18 ixgb ------------ 1.0.66 to 1.0.95-k2-NAPI libata ---------- 1.10 to 1.11 sata_via -------- 1.0 to 1.1 sata_ahci ------- 1.00 to 1.01 sata_qstor ------ 0.04 sata_sil -------- 0.8 to 0.9 sata_svw
-------- 1.05 to 1.06 s390: crypto ---- 1.31 to 1.57 s390: zfcp ------ s390: CTC-MPC --- s390: dasd ------- s390: cio ------- s390: qeth
------

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

Updated tcpdump packages that fix a security issue are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Tcpdump is a command line tool for monitoring network traffic.

A denial of service bug was found in tcpdump during the processing of certain network packets. It is possible for an attacker to inject a carefully crafted packet onto the network, crashing a running tcpdump session. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1267 to this issue.

Users of tcpdump are advised to upgrade to these erratum packages, which contain backported security patches and are not vulnerable to these issues.

An updated sysreport package that fixes an information disclosure flaw is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team

Sysreport is a utility that gathers information about a system's hardware and configuration. The information can then be used for diagnostic purposes and debugging.

When run by the root user, sysreport includes the contents of the /etc/sysconfig/rhn/up2date configuration file. If up2date has been configured to connect to a proxy server that requires an authentication password, that password is included in plain text in the system report. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-1760 to this issue.

Users of sysreport should update to this erratum package, which contains a patch that removes any proxy authentication passwords.

An updated spamassassin package that fixes a denial of service bug when parsing malformed messages is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email (SPAM) from incoming email.

A denial of service bug has been found in SpamAssassin. An attacker could construct a message in such a way that would cause SpamAssassin to consume CPU resources. If a number of these messages were sent it could lead to a denial of service, potentially preventing the delivery or filtering of email. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1266 to this issue.

SpamAssassin version 3.0.4 additionally solves a number of bugs including: - #156390 Spamassassin consumes too much memory during learning - #155423 URI blacklist spam bypass - #147464 Users may now disable subject rewriting - Smarter default Bayes scores - Numerous other bug fixes that improve spam filter accuracy and safety

For full details, please refer to the change details of 3.0.2, 3.0.3, and 3.0.4 in SpamAssassin's online documentation at the following address: http://wiki.apache.org/spamassassin/NextRelease

Users of SpamAssassin should update to this updated package, containing version 3.0.4 which is not vulnerable to this issue and resolves these bugs.

Updated firefox packages that fix various security bugs are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

Several bugs were found in the way Firefox executes JavaScript code.
JavaScript executed from a web page should run with a restricted access level, preventing dangerous actions. It is possible that a malicious web page could execute JavaScript code with elevated privileges, allowing access to protected data and functions. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-1476, CVE-2005-1477, CVE-2005-1531, and CVE-2005-1532 to these issues.

Please note that the effects of CVE-2005-1477 are mitigated by the default setup, which allows only the Mozilla Update site to attempt installation of Firefox extensions. The Mozilla Update site has been modified to prevent this attack from working. If other URLs have been manually added to the whitelist, it may be possible to execute this attack.

Users of Firefox are advised to upgrade to this updated package which contains Firefox version 1.0.4 which is not vulnerable to these issues.

Updated GnuTLS packages that fix a remote denial of service vulnerability are available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The GnuTLS library implements Secure Sockets Layer (SSL v3) and Transport Layer Security (TLS v1) protocols.

A denial of service bug was found in the GnuTLS library versions prior to 1.0.25. A remote attacker could perform a carefully crafted TLS handshake against a service that uses the GnuTLS library causing the service to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1431 to this issue.

All users of GnuTLS are advised to upgrade to these updated packages and to restart any services which use GnuTLS.

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 4. This is the first regular update.

[Updated 9 August 2005] The advisory text has been updated to show that this update also contained fixes for the security issues named CVE-2005-0209 and CVE-2005-0937. No changes have been made to the packages associated with this advisory.

The Linux kernel handles the basic functions of the operating system.

This is the first regular kernel update to Red Hat Enterprise Linux 4.

A flaw affecting the auditing code was discovered. On Itanium architectures a local user could use this flaw to cause a denial of service (crash). This issue is rated as having important security impact (CVE-2005-0136).

A flaw was discovered in the servicing of a raw device ioctl. A local user who has access to raw devices could use this flaw to write to kernel memory and cause a denial of service or potentially gain privileges. This issue is rated as having moderate security impact (CVE-2005-1264).

A flaw in fragment forwarding was discovered that affected the netfilter subsystem for certain network interface cards. A remote attacker could send a set of bad fragments and cause a denial of service (system crash). Acenic and SunGEM network interfaces were the only adapters affected, which are in widespread use. (CVE-2005-0209)

A flaw in the futex functions was discovered affecting the Linux 2.6 kernel. A local user could use this flaw to cause a denial of service (system crash). (CVE-2005-0937)

New features introduced by this update include: - Fixed TCP BIC congestion handling. - Diskdump support for more controllers (megaraid, SATA) - Device mapper multipath support - AMD64 dual core support. - Intel ICH7 hardware support.

There were many bug fixes in various parts of the kernel. The ongoing effort to resolve these problems has resulted in a marked improvement in the reliability and scalability of Red Hat Enterprise Linux 4.

The following device drivers have been upgraded to new versions:
ata_piix -------- 1.03 bonding --------- 2.6.1 e1000 ----------- 5.6.10.1-k2-NAPI e100 ------------ 3.3.6-k2-NAPI ibmveth --------- 1.03 libata ---------- 1.02 to 1.10 lpfc ------------ 0:8.0.16 to 0:8.0.16.6_x2 megaraid_mbox --- 2.20.4.0 to 2.20.4.5 megaraid_mm ----- 2.20.2.0-rh1 to 2.20.2.5 sata_nv --------- 0.03 to 0.6 sata_promise
---- 1.00 to 1.01 sata_sil -------- 0.8 sata_sis -------- 0.5 sata_svw
-------- 1.05 sata_sx4 -------- 0.7 sata_via -------- 1.0 sata_vsc
-------- 1.0 tg3 ------------- 3.22-rh ipw2100 --------- 1.0.3 ipw2200
--------- 1.0.0

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

ID	Name	Severity
21986	CentOS 4 : kdegraphics (CESA-2006:0206)	high
21985	CentOS 4 : libpng (CESA-2006:0205)	medium
21984	CentOS 4 : xpdf (CESA-2006:0201)	high
21983	CentOS 4 : firefox (CESA-2006:0200)	high
21982	CentOS 4 : gd (CESA-2006:0194)	critical
21981	CentOS 4 : kdelibs (CESA-2006:0184)	high
21980	CentOS 4 : gpdf (CESA-2006:0177)	critical
21979	CentOS 4 : kernel (CESA-2006:0132)	low
21978	CentOS 4 : spamassassin (CESA-2006:0129)	medium
21977	CentOS 4 : kernel (CESA-2006:0101)	high
21976	CentOS 4 : squid (CESA-2006:0052)	medium
21975	CentOS 4 : openssh (CESA-2006:0044)	medium
21974	CentOS 4 : perl (CESA-2005:880)	medium
21973	CentOS 4 : curl (CESA-2005:875)	medium
21972	CentOS 4 : kdegraphics (CESA-2005:868)	critical
21971	CentOS 4 : gpdf (CESA-2005:867)	high
21970	CentOS 4 : udev (CESA-2005:864)	medium
21969	CentOS 4 : libc-client (CESA-2005:848)	high
21968	CentOS 4 : lm_sensors (CESA-2005:825)	low
21967	CentOS 4 : kernel (CESA-2005:808)	medium
21966	CentOS 4 : pam (CESA-2005:805)	low
21965	CentOS 4 : netpbm (CESA-2005:793)	high
21964	CentOS 4 : thunderbird (CESA-2005:791)	high
21963	CentOS 4 : firefox (CESA-2005:785)	high
21962	CentOS 4 : firefox (CESA-2005:768)	high
21961	CentOS 4 : openldap / nss_ldap (CESA-2005:767)	high
21960	CentOS 3 / 4 : php (CESA-2005:748)	medium
21959	CentOS 3 / 4 : vim (CESA-2005:745)	high
21958	CentOS 3 / 4 : netpbm (CESA-2005:743)	high
21957	CentOS 4 : gpdf (CESA-2005:708)	low
21956	CentOS 4 : kdegraphics (CESA-2005:671)	low
21955	CentOS 4 : xpdf (CESA-2005:670)	low
21954	CentOS 4 : kdenetwork (CESA-2005:639)	high
21953	CentOS 4 : kdelibs (CESA-2005:612)	medium
21952	CentOS 4 : thunderbird (CESA-2005:601)	high
21951	CentOS 3 / 4 : sysreport (CESA-2005:598)	low
21950	CentOS 3 / 4 : SquirrelMail (CESA-2005:595)	medium
21949	CentOS 4 : firefox (CESA-2005:586)	high
21948	CentOS 4 : zlib (CESA-2005:584)	medium
21947	CentOS 4 : zlib (CESA-2005:569)	high
21946	CentOS 4 : krb5 (CESA-2005:567)	high
21945	CentOS 4 : ruby (CESA-2005:543)	high
21944	CentOS 4 : HelixPlayer (CESA-2005:517)	medium
21943	CentOS 4 : kernel (CESA-2005:514)	high
21942	CentOS 4 : tcpdump (CESA-2005:505)	medium
21941	CentOS 3 / 4 : sysreport (CESA-2005:502)	high
21940	CentOS 4 : spamassassin (CESA-2005:498)	medium
21939	CentOS 4 : firefox (CESA-2005:434)	high
21938	CentOS 4 : gnutls (CESA-2005:430)	medium
21937	CentOS 4 : kernel (CESA-2005:420)	high

Detections

Analytics

CentOS Local Security Checks Family for Nessus

high

medium

high

high

critical

high

critical

low

medium

high

medium

medium

medium

medium

critical

high

medium

high

low

medium

low

high

high

high

high

high

medium

high

high

low

low

low

high

medium

high

low

medium

high

medium

high

high

high

medium

high

medium

high

medium

high

medium

high