New Wireshark packages that fix various security vulnerabilities in Ethereal are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ethereal is a program for monitoring network traffic.

In May 2006, Ethereal changed its name to Wireshark. This update deprecates the Ethereal packages in Red Hat Enterprise Linux 2.1, 3, and 4 in favor of the supported Wireshark packages.

Several denial of service bugs were found in Ethereal's protocol dissectors. It was possible for Ethereal to crash or stop responding if it read a malformed packet off the network. (CVE-2006-3627, CVE-2006-3629, CVE-2006-3631)

Several buffer overflow bugs were found in Ethereal's ANSI MAP, NCP NMAS, and NDPStelnet dissectors. It was possible for Ethereal to crash or execute arbitrary code if it read a malformed packet off the network. (CVE-2006-3630, CVE-2006-3632)

Several format string bugs were found in Ethereal's Checkpoint FW-1, MQ, XML, and NTP dissectors. It was possible for Ethereal to crash or execute arbitrary code if it read a malformed packet off the network.
(CVE-2006-3628)

Users of Ethereal should upgrade to these updated packages containing Wireshark version 0.99.2, which is not vulnerable to these issues

Updated Apache httpd packages that correct security issues and resolve bugs are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache HTTP Server is a popular Web server available for free.

A bug was found in Apache where an invalid Expect header sent to the server was returned to the user in an unescaped error message. This could allow an attacker to perform a cross-site scripting attack if a victim was tricked into connecting to a site and sending a carefully crafted Expect header. (CVE-2006-3918)

While a web browser cannot be forced to send an arbitrary Expect header by a third-party attacker, it was recently discovered that certain versions of the Flash plugin can manipulate request headers.
If users running such versions can be persuaded to load a web page with a malicious Flash applet, a cross-site scripting attack against the server may be possible.

On Red Hat Enterprise Linux 3 and 4 systems, due to an unrelated issue in the handling of malformed Expect headers, the page produced by the cross-site scripting attack will only be returned after a timeout expires (2-5 minutes by default) if not first canceled by the user.

Users of httpd should update to these erratum packages, which contain a backported patch to correct these issues.

Updated krb5 packages are now available for Red Hat Enterprise Linux 4 to correct a privilege escalation security flaw.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Kerberos is a network authentication system which allows clients and servers to authenticate to each other through use of symmetric encryption and a trusted third party, the KDC.

A flaw was found where some bundled Kerberos-aware applications would fail to check the result of the setuid() call. On Linux 2.6 kernels, the setuid() call can fail if certain user limits are hit. A local attacker could manipulate their environment in such a way to get the applications to continue to run as root, potentially leading to an escalation of privileges. (CVE-2006-3083).

Users are advised to update to these erratum packages which contain a backported fix to correct this issue.

Updated GnuPG packages that fix a security issue is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

An integer overflow flaw was found in GnuPG. An attacker could create a carefully crafted message packet with a large length that could cause GnuPG to crash or possibly overwrite memory when opened.
(CVE-2006-3746)

All users of GnuPG are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

Updated SeaMonkey packages that fix several security bugs in the mozilla package are now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

The Mozilla Foundation has discontinued support for the Mozilla Suite.
This update deprecates the Mozilla Suite in Red Hat Enterprise Linux 4 in favor of the supported SeaMonkey Suite.

This update also resolves a number of outstanding Mozilla security issues :

Several flaws were found in the way SeaMonkey processed certain JavaScript actions. A malicious web page could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware.
(CVE-2006-2776, CVE-2006-2784, CVE-2006-2785, CVE-2006-2787, CVE-2006-3807, CVE-2006-3809, CVE-2006-3812)

Several denial of service flaws were found in the way SeaMonkey processed certain web content. A malicious web page could crash the browser or possibly execute arbitrary code as the user running SeaMonkey. (CVE-2006-2779, CVE-2006-2780, CVE-2006-3801, CVE-2006-3677, CVE-2006-3113, CVE-2006-3803, CVE-2006-3805, CVE-2006-3806, CVE-2006-3811)

Two flaws were found in the way SeaMonkey-mail displayed malformed inline vcard attachments. If a victim viewed an email message containing a carefully crafted vcard it was possible to execute arbitrary code as the user running Mozilla-mail. (CVE-2006-2781, CVE-2006-3804)

A cross-site scripting flaw was found in the way SeaMonkey processed Unicode Byte-Order-Mark (BOM) markers in UTF-8 web pages. A malicious web page could execute a script within the browser that a web input sanitizer could miss due to a malformed 'script' tag. (CVE-2006-2783)

Several flaws were found in the way SeaMonkey processed certain JavaScript actions. A malicious web page could conduct a cross-site scripting attack or steal sensitive information (such as cookies owned by other domains). (CVE-2006-3802, CVE-2006-3810)

A form file upload flaw was found in the way SeaMonkey handled JavaScript input object mutation. A malicious web page could upload an arbitrary local file at form submission time without user interaction.
(CVE-2006-2782)

A denial of service flaw was found in the way SeaMonkey called the crypto.signText() JavaScript function. A malicious web page could crash the browser if the victim had a client certificate loaded.
(CVE-2006-2778)

Two HTTP response smuggling flaws were found in the way SeaMonkey processed certain invalid HTTP response headers. A malicious website could return specially crafted HTTP response headers which may bypass HTTP proxy restrictions. (CVE-2006-2786)

A flaw was found in the way SeaMonkey processed Proxy AutoConfig scripts. A malicious Proxy AutoConfig server could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware.
(CVE-2006-3808)

A double free flaw was found in the way the nsIX509::getRawDER method was called. If a victim visited a carefully crafted web page, it was possible to execute arbitrary code as the user running Mozilla.
(CVE-2006-2788)

Users of Mozilla are advised to upgrade to this update, which contains SeaMonkey version 1.0.3 that corrects these issues.

Updated SeaMonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the way SeaMonkey processed certain JavaScript actions. A malicious web page could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware.
(CVE-2006-3807, CVE-2006-3809, CVE-2006-3812)

Several denial of service flaws were found in the way SeaMonkey processed certain web content. A malicious web page could crash the browser or possibly execute arbitrary code as the user running SeaMonkey. (CVE-2006-3801, CVE-2006-3677, CVE-2006-3113, CVE-2006-3803, CVE-2006-3805, CVE-2006-3806, CVE-2006-3811)

A buffer overflow flaw was found in the way SeaMonkey Messenger displayed malformed inline vcard attachments. If a victim viewed an email message containing a carefully crafted vcard, it was possible to execute arbitrary code as the user running SeaMonkey Messenger.
(CVE-2006-3804)

Several flaws were found in the way SeaMonkey processed certain JavaScript actions. A malicious web page could conduct a cross-site scripting attack or steal sensitive information (such as cookies owned by other domains). (CVE-2006-3802, CVE-2006-3810)

A flaw was found in the way SeaMonkey processed Proxy AutoConfig scripts. A malicious Proxy AutoConfig server could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware.
(CVE-2006-3808)

Users of SeaMonkey are advised to upgrade to this update, which contains SeaMonkey version 1.0.3 that corrects these issues.

Updated libtiff packages that fix several security flaws are now available for Red Hat Enterprise Linux.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libtiff package contains a library of functions for manipulating TIFF (Tagged Image File Format) files.

Tavis Ormandy of Google discovered a number of flaws in libtiff during a security audit. An attacker could create a carefully crafted TIFF file in such a way that it was possible to cause an application linked with libtiff to crash or possibly execute arbitrary code.
(CVE-2006-3459, CVE-2006-3460, CVE-2006-3461, CVE-2006-3462, CVE-2006-3463, CVE-2006-3464, CVE-2006-3465)

All users are advised to upgrade to these updated packages, which contain backported fixes for these issues.

Updated thunderbird packages that fix several security bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Thunderbird is a standalone mail and newsgroup client.

The Mozilla Foundation has discontinued support for the Mozilla Thunderbird 1.0 branch. This update deprecates the Mozilla Thunderbird 1.0 branch in Red Hat Enterprise Linux 4 in favor of the supported Mozilla Thunderbird 1.5 branch.

This update also resolves a number of outstanding Thunderbird security issues :

Several flaws were found in the way Thunderbird processed certain JavaScript actions. A malicious mail message could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware.
(CVE-2006-2776, CVE-2006-2784, CVE-2006-2785, CVE-2006-2787, CVE-2006-3807, CVE-2006-3809)

Several denial of service flaws were found in the way Thunderbird processed certain mail messages. A malicious web page could crash the browser or possibly execute arbitrary code as the user running Thunderbird. (CVE-2006-2779, CVE-2006-2780, CVE-2006-3801, CVE-2006-3677, CVE-2006-3113, CVE-2006-3803, CVE-2006-3805, CVE-2006-3806, CVE-2006-3811)

Several flaws were found in the way Thunderbird processed certain JavaScript actions. A malicious mail message could conduct a cross-site scripting attack or steal sensitive information (such as cookies owned by other domains). (CVE-2006-3802, CVE-2006-3810)

A form file upload flaw was found in the way Thunderbird handled JavaScript input object mutation. A malicious mail message could upload an arbitrary local file at form submission time without user interaction. (CVE-2006-2782)

A denial of service flaw was found in the way Thunderbird called the crypto.signText() JavaScript function. A malicious mail message could crash the browser if the victim had a client certificate loaded.
(CVE-2006-2778)

A flaw was found in the way Thunderbird processed Proxy AutoConfig scripts. A malicious Proxy AutoConfig server could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install client malware.
(CVE-2006-3808)

Note: Please note that JavaScript support is disabled by default in Thunderbird. The above issues are not exploitable with JavaScript disabled.

Two flaws were found in the way Thunderbird displayed malformed inline vcard attachments. If a victim viewed an email message containing a carefully crafted vcard it was possible to execute arbitrary code as the user running Thunderbird. (CVE-2006-2781, CVE-2006-3804)

A cross site scripting flaw was found in the way Thunderbird processed Unicode Byte-order-Mark (BOM) markers in UTF-8 mail messages. A malicious web page could execute a script within the browser that a web input sanitizer could miss due to a malformed 'script' tag.
(CVE-2006-2783)

Two HTTP response smuggling flaws were found in the way Thunderbird processed certain invalid HTTP response headers. A malicious website could return specially crafted HTTP response headers which may bypass HTTP proxy restrictions. (CVE-2006-2786)

A double free flaw was found in the way the nsIX509::getRawDER method was called. If a victim visited a carefully crafted web page, it was possible to crash Thunderbird. (CVE-2006-2788)

Users of Thunderbird are advised to upgrade to this update, which contains Thunderbird version 1.5.0.5 that corrects these issues.

Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

The Mozilla Foundation has discontinued support for the Mozilla Firefox 1.0 branch. This update deprecates the Mozilla Firefox 1.0 branch in Red Hat Enterprise Linux 4 in favor of the supported Mozilla Firefox 1.5 branch.

This update also resolves a number of outstanding Firefox security issues :

Several flaws were found in the way Firefox processed certain JavaScript actions. A malicious web page could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware.
(CVE-2006-2776, CVE-2006-2784, CVE-2006-2785, CVE-2006-2787, CVE-2006-3807, CVE-2006-3809, CVE-2006-3812)

Several denial of service flaws were found in the way Firefox processed certain web content. A malicious web page could crash the browser or possibly execute arbitrary code as the user running Firefox. (CVE-2006-2779, CVE-2006-2780, CVE-2006-3801, CVE-2006-3677, CVE-2006-3113, CVE-2006-3803, CVE-2006-3805, CVE-2006-3806, CVE-2006-3811)

A cross-site scripting flaw was found in the way Firefox processed Unicode Byte-Order-Mark (BOM) markers in UTF-8 web pages. A malicious web page could execute a script within the browser that a web input sanitizer could miss due to a malformed 'script' tag. (CVE-2006-2783)

Several flaws were found in the way Firefox processed certain JavaScript actions. A malicious web page could conduct a cross-site scripting attack or steal sensitive information (such as cookies owned by other domains). (CVE-2006-3802, CVE-2006-3810)

A form file upload flaw was found in the way Firefox handled JavaScript input object mutation. A malicious web page could upload an arbitrary local file at form submission time without user interaction.
(CVE-2006-2782)

A denial of service flaw was found in the way Firefox called the crypto.signText() JavaScript function. A malicious web page could crash the browser if the victim had a client certificate loaded.
(CVE-2006-2778)

Two HTTP response smuggling flaws were found in the way Firefox processed certain invalid HTTP response headers. A malicious website could return specially crafted HTTP response headers which may bypass HTTP proxy restrictions. (CVE-2006-2786)

A flaw was found in the way Firefox processed Proxy AutoConfig scripts. A malicious Proxy AutoConfig server could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware.
(CVE-2006-3808)

A double free flaw was found in the way the nsIX509::getRawDER method was called. If a victim visited a carefully crafted web page, it was possible to execute arbitrary code as the user running Firefox.
(CVE-2006-2788)

Users of Firefox are advised to upgrade to this update, which contains Firefox version 1.5.0.5 that corrects these issues.

Updated ruby packages that fix security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ruby is an interpreted scripting language for object-oriented programming.

A number of flaws were found in the safe-level restrictions in Ruby.
It was possible for an attacker to create a carefully crafted malicious script that can allow the bypass of certain safe-level restrictions. (CVE-2006-3694)

Users of Ruby should update to these erratum packages, which contain a backported patch and are not vulnerable to this issue.

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 3. This is the eighth regular update.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

This is the eighth regular kernel update to Red Hat Enterprise Linux 3.

New features introduced by this update include :

  - addition of the adp94xx and dcdbas device drivers -     diskdump support on megaraid_sas, qlogic, and swap     partitions - support for new hardware via driver and     SCSI white-list updates

There were many bug fixes in various parts of the kernel. The ongoing effort to resolve these problems has resulted in a marked improvement in the reliability and scalability of Red Hat Enterprise Linux 3.

There were numerous driver updates and security fixes (elaborated below). Other key areas affected by fixes in this update include the networking subsystem, the NFS and autofs4 file systems, the SCSI and USB subsystems, and architecture-specific handling affecting AMD Opteron and Intel EM64T processors.

The following device drivers have been added or upgraded to new versions :

adp94xx -------- 1.0.8 (new) bnx2 ----------- 1.4.38 cciss ---------- 2.4.60.RH1 dcdbas --------- 5.6.0-1 (new) e1000 ---------- 7.0.33-k2 emulex --------- 7.3.6 forcedeth ------ 0.30 ipmi ----------- 35.13 qlogic --------- 7.07.04b6 tg3 ------------ 3.52RH

The following security bugs were fixed in this update :

  - a flaw in the USB devio handling of device removal that     allowed a local user to cause a denial of service     (crash) (CVE-2005-3055, moderate)

  - a flaw in the exec() handling of multi-threaded tasks     using ptrace() that allowed a local user to cause a     denial of service (hang of a user process)     (CVE-2005-3107, low)

  - a difference in 'sysretq' operation of EM64T (as opposed     to Opteron) processors that allowed a local user to     cause a denial of service (crash) upon return from     certain system calls (CVE-2006-0741 and CVE-2006-0744,     important)

  - a flaw in unaligned accesses handling on Intel Itanium     processors that allowed a local user to cause a denial     of service (crash) (CVE-2006-0742, important)

  - an info leak on AMD-based x86 and x86_64 systems that     allowed a local user to retrieve the floating point     exception state of a process run by a different user     (CVE-2006-1056, important)

  - a flaw in IPv4 packet output handling that allowed a     remote user to bypass the zero IP ID countermeasure on     systems with a disabled firewall (CVE-2006-1242, low)

  - a minor info leak in socket option handling in the     network code (CVE-2006-1343, low)

  - a flaw in IPv4 netfilter handling for the unlikely use     of SNMP NAT processing that allowed a remote user to     cause a denial of service (crash) or potential memory     corruption (CVE-2006-2444, moderate)

Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

Updated openssh packages that fix bugs in sshd are now available for Red Hat Enterprise Linux 3.

This update has been rated as having low security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This package includes the core files necessary for both the OpenSSH client and server.

An arbitrary command execution flaw was discovered in the way scp copies files locally. It is possible for a local attacker to create a file with a carefully crafted name that could execute arbitrary commands as the user running scp to copy files locally.
(CVE-2006-0225)

The SSH daemon, when restricting host access by numeric IP addresses and with VerifyReverseMapping disabled, allows remote attackers to bypass 'from=' and 'user@host' address restrictions by connecting to a host from a system whose reverse DNS hostname contains the numeric IP address. (CVE-2003-0386)

The following issues have also been fixed in this update :

* If the sshd service was stopped using the sshd init script while the main sshd daemon was not running, the init script would kill other sshd processes, such as the running sessions. For example, this could happen when the 'service sshd stop' command was issued twice.

* When privilege separation was enabled, the last login message was printed only for the root user.

* The sshd daemon was sending messages to the system log from a signal handler when debug logging was enabled. This could cause a deadlock of the user's connection.

All users of openssh should upgrade to these updated packages, which resolve these issues.

Updated samba packages that fix a denial of service vulnerability are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Samba provides file and printer sharing services to SMB/CIFS clients.

A denial of service bug was found in the way the smbd daemon tracks active connections to shares. It was possible for a remote attacker to cause the smbd daemon to consume a large amount of system memory by sending carefully crafted smb requests. (CVE-2006-3403)

Users of Samba are advised to upgrade to these packages, which contain a backported patch to correct this issue.

Updated kdebase packages that resolve a security issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kdebase packages provide the core applications for KDE, the K Desktop Environment.

A flaw was found in KDE where the kdesktop_lock process sometimes failed to terminate properly. This issue could either block the user's ability to manually lock the desktop or prevent the screensaver to activate, both of which could have a security impact for users who rely on these functionalities. (CVE-2006-2933)

Please note that this issue only affected Red Hat Enterprise Linux 3.

All users of kdebase should upgrade to these updated packages, which contain a patch to resolve this issue.

Updated elfutils packages that address a minor security issue and various other issues are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The elfutils packages contain a number of utility programs and libraries related to the creation and maintenance of executable code.

The elfutils packages that originally shipped with Red Hat Enterprise Linux 3 were GPL-licensed versions which lacked some functionality.
Previous updates provided fully functional versions of elfutils only under the OSL license. This update provides a fully functional, GPL-licensed version of elfutils.

In the OSL-licensed elfutils versions provided in previous updates, some tools could sometimes crash when given corrupted input files.
(CVE-2005-1704)

Also, when the eu-strip tool was used to create separate debuginfo files from relocatable objects such as kernel modules (.ko), the resulting debuginfo files (.ko.debug) were sometimes corrupted. Both of these problems are fixed in the new version.

Users of elfutils should upgrade to these updated packages, which resolve these issues.

Updated gimp packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The GIMP (GNU Image Manipulation Program) is an image composition and editing program.

Henning Makholm discovered a buffer overflow bug in The GIMP XCF file loader. An attacker could create a carefully crafted image that could execute arbitrary code if opened by a victim. (CVE-2006-3404)

Please note that this issue did not affect the gimp packages in Red Hat Enterprise Linux 2.1, or 3.

Users of The GIMP should update to these erratum packages which contain a backported fix to correct this issue.

Updated libwmf packages that fix a security flaw are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Libwmf is a library for reading and converting Windows MetaFile vector graphics (WMF). Libwmf is used by packages such as The GIMP and ImageMagick.

An integer overflow flaw was discovered in libwmf. An attacker could create a carefully crafted WMF flaw that could execute arbitrary code if opened by a victim. (CVE-2006-3376).

Users of libwmf should update to these packages which contain a backported security patch to correct this issue.

An updated GnuPG package that fixes a security issue is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

An integer overflow flaw was found in GnuPG. An attacker could create a carefully crafted message packet with a large length that could cause GnuPG to crash or possibly overwrite memory when opened.
(CVE-2006-3082)

All users of GnuPG are advised to upgrade to this updated package, which contains a backported patch to correct this issue.

Updated freetype packages that fix several security flaws are now available for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

FreeType is a free, high-quality, and portable font engine.

Chris Evans discovered several integer underflow and overflow flaws in the FreeType font engine. If a user loads a carefully crafted font file with a program linked against FreeType, it could cause the application to crash or execute arbitrary code as the user. While it is uncommon for a user to explicitly load a font file, there are several application file formats which contain embedded fonts that are parsed by FreeType. (CVE-2006-0747, CVE-2006-1861, CVE-2006-3467)

A NULL pointer dereference flaw was found in the FreeType font engine.
An application linked against FreeType can crash upon loading a malformed font file. (CVE-2006-2661)

Users of FreeType should upgrade to these updated packages, which contain backported patches to correct these issues.

Updated mutt packages that fix a security issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Mutt is a text-mode mail user agent.

A buffer overflow flaw was found in the way Mutt processes an overly long namespace from a malicious imap server. In order to exploit this flaw a user would have to use Mutt to connect to a malicious IMAP server. (CVE-2006-3242)

Users of Mutt are advised to upgrade to these erratum packages, which contain a backported patch to correct this issue.

Updated kernel packages that fix a privilege escalation security issue in the Red Hat Enterprise Linux 4 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

During security research, Red Hat discovered a behavioral flaw in core dump handling. A local user could create a program that would cause a core file to be dumped into a directory they would not normally have permissions to write to. This could lead to a denial of service (disk consumption), or allow the local user to gain root privileges.
(CVE-2006-2451)

Prior to applying this update, users can remove the ability to escalate privileges using this flaw by configuring core files to dump to an absolute location. By default, core files are created in the working directory of the faulting application, but this can be overridden by specifying an absolute location for core files in /proc/sys/kernel/core_pattern. To avoid a potential denial of service, a separate partition for the core files should be used.

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

Updated PHP packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A directory traversal vulnerability was found in PHP. Local users could bypass open_basedir restrictions allowing remote attackers to create files in arbitrary directories via the tempnam() function.
(CVE-2006-1494)

The wordwrap() PHP function did not properly check for integer overflow in the handling of the 'break' parameter. An attacker who could control the string passed to the 'break' parameter could cause a heap overflow. (CVE-2006-1990)

A flaw was found in the zend_hash_del() PHP function. For PHP scripts that rely on the use of the unset() function, a remote attacker could force variable initialization to be bypassed. This would be a security issue particularly for installations that enable the 'register_globals' setting. 'register_globals' is disabled by default in Red Hat Enterprise Linux. (CVE-2006-3017)

Users of PHP should upgrade to these updated packages, which contain backported patches that resolve these issues.

Updated vixie-cron packages that fix a privilege escalation issue are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The vixie-cron package contains the Vixie version of cron. Cron is a standard UNIX daemon that runs specified programs at scheduled times.

A privilege escalation flaw was found in the way Vixie Cron runs programs; vixie-cron does not properly verify an attempt to set the current process user id succeeded. It was possible for a malicious local users who exhausted certain limits to execute arbitrary commands as root via cron. (CVE-2006-2607)

All users of vixie-cron should upgrade to these updated packages, which contain a backported patch to correct this issue.

Updated kdebase packages that correct a security flaw in kdm are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kdebase packages provide the core applications for KDE, the K Desktop Environment. These core packages include the KDE Display Manager (KDM).

Ludwig Nussel discovered a flaw in KDM. A malicious local KDM user could use a symlink attack to read an arbitrary file that they would not normally have permissions to read. (CVE-2006-2449)

Note: this issue does not affect the version of KDM as shipped with Red Hat Enterprise Linux 2.1 or 3.

All users of KDM should upgrade to these updated packages which contain a backported patch to correct this issue.

An updated squirrelmail package that fixes a local file disclosure flaw is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SquirrelMail is a standards-based webmail package written in PHP4.

A local file disclosure flaw was found in the way SquirrelMail loads plugins. In SquirrelMail 1.4.6 or earlier, if register_globals is on and magic_quotes_gpc is off, it became possible for an unauthenticated remote user to view the contents of arbitrary local files the web server has read-access to. This configuration is neither default nor safe, and configuring PHP with the register_globals set on is dangerous and not recommended. (CVE-2006-2842)

Users of SquirrelMail should upgrade to this erratum package, which contains a backported patch to correct this issue.

Updated mysql packages that fix multiple security flaws are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries.

A flaw was found in the way the MySQL mysql_real_escape() function escaped strings when operating in a multibyte character encoding. An attacker could provide an application a carefully crafted string containing invalidly-encoded characters which may be improperly escaped, leading to the injection of malicious SQL commands.
(CVE-2006-2753)

An information disclosure flaw was found in the way the MySQL server processed malformed usernames. An attacker could view a small portion of server memory by supplying an anonymous login username which was not null terminated. (CVE-2006-1516)

An information disclosure flaw was found in the way the MySQL server executed the COM_TABLE_DUMP command. An authenticated malicious user could send a specially crafted packet to the MySQL server which returned random unallocated memory. (CVE-2006-1517)

A log file obfuscation flaw was found in the way the mysql_real_query() function creates log file entries. An attacker with the the ability to call the mysql_real_query() function against a mysql server can obfuscate the entry the server will write to the log file. However, an attacker needed to have complete control over a server in order to attempt this attack. (CVE-2006-0903)

This update also fixes numerous non-security-related flaws, such as intermittent authentication failures.

All users of mysql are advised to upgrade to these updated packages containing MySQL version 4.1.20, which is not vulnerable to these issues.

Updated spamassassin packages that fix an arbitrary code execution flaw are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email (SPAM) from incoming email.

A flaw was found with the way the Spamassassin spamd daemon processes the virtual pop username passed to it. If a site is running spamd with both the --vpopmail and --paranoid flags, it is possible for a remote user with the ability to connect to the spamd daemon to execute arbitrary commands as the user running the spamd daemon.
(CVE-2006-2447)

Note: None of the IMAP or POP servers shipped with Red Hat Enterprise Linux 4 support vpopmail delivery. Running spamd with the --vpopmail and --paranoid flags is uncommon and not the default startup option as shipped with Red Hat Enterprise Linux 4.

Spamassassin, as shipped in Red Hat Enterprise Linux 4, performs RBL lookups against visi.com to help determine if an email is spam.
However, this DNS RBL has recently disappeared, resulting in mail filtering delays and timeouts.

Users of SpamAssassin should upgrade to these updated packages containing version 3.0.6 and backported patches, which are not vulnerable to these issues.

Updated Dia packages that fix several buffer overflow bugs are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Dia drawing program is designed to draw various types of diagrams.

Several format string flaws were found in the way dia displays certain messages. If an attacker is able to trick a Dia user into opening a carefully crafted file, it may be possible to execute arbitrary code as the user running Dia. (CVE-2006-2453, CVE-2006-2480)

Users of Dia should update to these erratum packages, which contain backported patches and are not vulnerable to these issues.

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 4 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

* a flaw in the IPv6 implementation that allowed a local user to cause a denial of service (infinite loop and crash) (CVE-2005-2973, important)

* a flaw in the bridge implementation that allowed a remote user to cause forwarding of spoofed packets via poisoning of the forwarding table with already dropped frames (CVE-2005-3272, moderate)

* a flaw in the atm module that allowed a local user to cause a denial of service (panic) via certain socket calls (CVE-2005-3359, important)

* a flaw in the NFS client implementation that allowed a local user to cause a denial of service (panic) via O_DIRECT writes (CVE-2006-0555, important)

* a difference in 'sysretq' operation of EM64T (as opposed to Opteron) processors that allowed a local user to cause a denial of service (crash) upon return from certain system calls (CVE-2006-0741 and CVE-2006-0744, important)

* a flaw in the keyring implementation that allowed a local user to cause a denial of service (OOPS) (CVE-2006-1522, important)

* a flaw in IP routing implementation that allowed a local user to cause a denial of service (panic) via a request for a route for a multicast IP (CVE-2006-1525, important)

* a flaw in the SCTP-netfilter implementation that allowed a remote user to cause a denial of service (infinite loop) (CVE-2006-1527, important)

* a flaw in the sg driver that allowed a local user to cause a denial of service (crash) via a dio transfer to memory mapped (mmap) IO space (CVE-2006-1528, important)

* a flaw in the threading implementation that allowed a local user to cause a denial of service (panic) (CVE-2006-1855, important)

* two missing LSM hooks that allowed a local user to bypass the LSM by using readv() or writev() (CVE-2006-1856, moderate)

* a flaw in the virtual memory implementation that allowed local user to cause a denial of service (panic) by using the lsof command (CVE-2006-1862, important)

* a directory traversal vulnerability in smbfs that allowed a local user to escape chroot restrictions for an SMB-mounted filesystem via '..\\' sequences (CVE-2006-1864, moderate)

* a flaw in the ECNE chunk handling of SCTP that allowed a remote user to cause a denial of service (panic) (CVE-2006-2271, moderate)

* a flaw in the handling of COOKIE_ECHO and HEARTBEAT control chunks of SCTP that allowed a remote user to cause a denial of service (panic) (CVE-2006-2272, moderate)

* a flaw in the handling of DATA fragments of SCTP that allowed a remote user to cause a denial of service (infinite recursion and crash) (CVE-2006-2274, moderate)

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

Updated X.org packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

X.org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces such as GNOME and KDE are designed upon.

A buffer overflow flaw in the X.org server RENDER extension was discovered. A malicious authorized client could exploit this issue to cause a denial of service (crash) or potentially execute arbitrary code with root privileges on the X.org server. (CVE-2006-1526)

Users of X.org should upgrade to these updated packages, which contain a backported patch and is not vulnerable to this issue.

This issue does not affect Red Hat Enterprise Linux 2.1 or 3.

Updated ruby packages that fix a denial of service issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ruby is an interpreted scripting language for object-oriented programming.

A bug was found in the way Ruby creates its xmlrpc and http servers.
The servers use a non blocking socket, which enables a remote user to cause a denial of service condition if they are able to transmit a large volume of information from the network server. (CVE-2006-1931)

Users of Ruby should update to these erratum packages, which contain a backported patch and are not vulnerable to this issue.

Updated thunderbird packages that fix various bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

[Updated 24 Apr 2006] The erratum text has been updated to include the details of additional issues that were fixed by these erratum packages but which were not public at the time of release. No changes have been made to the packages.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several bugs were found in the way Thunderbird processes malformed JavaScript. A malicious HTML mail message could modify the content of a different open HTML mail message, possibly stealing sensitive information or conducting a cross-site scripting attack. Please note that JavaScript support is disabled by default in Thunderbird.
(CVE-2006-1731, CVE-2006-1732, CVE-2006-1741)

Several bugs were found in the way Thunderbird processes certain JavaScript actions. A malicious HTML mail message could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware. Please note that JavaScript support is disabled by default in Thunderbird. (CVE-2006-0292, CVE-2006-0296, CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734, CVE-2006-1735, CVE-2006-1742)

Several bugs were found in the way Thunderbird processes malformed HTML mail messages. A carefully crafted malicious HTML mail message could cause the execution of arbitrary code as the user running Thunderbird. (CVE-2006-0748, CVE-2006-0749, CVE-2006-1724, CVE-2006-1730, CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790)

A bug was found in the way Thunderbird processes certain inline content in HTML mail messages. It may be possible for a remote attacker to send a carefully crafted mail message to the victim, which will fetch remote content, even if Thunderbird is configured not to fetch remote content. (CVE-2006-1045)

A bug was found in the way Thunderbird executes in-line mail forwarding. If a user can be tricked into forwarding a maliciously crafted mail message as in-line content, it is possible for the message to execute JavaScript with the permissions of 'chrome'.
(CVE-2006-0884)

Users of Thunderbird are advised to upgrade to these updated packages containing Thunderbird version 1.0.8, which is not vulnerable to these issues.

Updated firefox packages that fix several security bugs are now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

[Updated 24 Apr 2006] The erratum text has been updated to include CVE-2006-0748, an issue fixed by these erratum packages but which was not public at the time of release. No changes have been made to the packages.

Mozilla Firefox is an open source Web browser.

Several bugs were found in the way Firefox processes malformed JavaScript. A malicious web page could modify the content of a different open web page, possibly stealing sensitive information or conducting a cross-site scripting attack. (CVE-2006-1731, CVE-2006-1732, CVE-2006-1741)

Several bugs were found in the way Firefox processes certain JavaScript actions. A malicious web page could execute arbitrary JavaScript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware.
(CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734, CVE-2006-1735, CVE-2006-1742)

Several bugs were found in the way Firefox processes malformed web pages. A carefully crafted malicious web page could cause the execution of arbitrary code as the user running Firefox.
(CVE-2006-0748, CVE-2006-0749, CVE-2006-1724, CVE-2006-1730, CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790)

A bug was found in the way Firefox displays the secure site icon. If a browser is configured to display the non-default secure site modal warning dialog, it may be possible to trick a user into believing they are viewing a secure site. (CVE-2006-1740)

A bug was found in the way Firefox allows JavaScript mutation events on 'input' form elements. A malicious web page could be created in such a way that when a user submits a form, an arbitrary file could be uploaded to the attacker. (CVE-2006-1729)

Users of Firefox are advised to upgrade to these updated packages containing Firefox version 1.0.8 which corrects these issues.

An updated squirrelmail package that fixes three security and many other bug issues is now available. This update contains bug fixes of upstream squirrelmail 1.4.6 with some additional improvements to international language support.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SquirrelMail is a standards-based webmail package written in PHP4.

A bug was found in the way SquirrelMail presents the right frame to the user. If a user can be tricked into opening a carefully crafted URL, it is possible to present the user with arbitrary HTML data.
(CVE-2006-0188)

A bug was found in the way SquirrelMail filters incoming HTML email.
It is possible to cause a victim's web browser to request remote content by opening a HTML email while running a web browser that processes certain types of invalid style sheets. Only Internet Explorer is known to process such malformed style sheets.
(CVE-2006-0195)

A bug was found in the way SquirrelMail processes a request to select an IMAP mailbox. If a user can be tricked into opening a carefully crafted URL, it is possible to execute arbitrary IMAP commands as the user viewing their mail with SquirrelMail. (CVE-2006-0377)

Users of SquirrelMail are advised to upgrade to this updated package, which contains SquirrelMail version 1.4.6 and is not vulnerable to these issues.

An updated Dia package that fixes several buffer overflow bugs are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Dia drawing program is designed to draw various types of diagrams.

infamous41md discovered three buffer overflow bugs in Dia's xfig file format importer. If an attacker is able to trick a Dia user into opening a carefully crafted xfig file, it may be possible to execute arbitrary code as the user running Dia. (CVE-2006-1550)

Users of Dia should update to these erratum packages, which contain backported patches and are not vulnerable to these issues.

An updated GnuPG package that fixes signature verification flaws as well as minor bugs is now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

Tavis Ormandy discovered a bug in the way GnuPG verifies cryptographically signed data with detached signatures. It is possible for an attacker to construct a cryptographically signed message which could appear to come from a third party. When a victim processes a GnuPG message with a malformed detached signature, GnuPG ignores the malformed signature, processes and outputs the signed data, and exits with status 0, just as it would if the signature had been valid. In this case, GnuPG's exit status would not indicate that no signature verification had taken place. This issue would primarily be of concern when processing GnuPG results via an automated script. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0455 to this issue.

Tavis Ormandy also discovered a bug in the way GnuPG verifies cryptographically signed data with inline signatures. It is possible for an attacker to inject unsigned data into a signed message in such a way that when a victim processes the message to recover the data, the unsigned data is output along with the signed data, gaining the appearance of having been signed. This issue is mitigated in the GnuPG shipped with Red Hat Enterprise Linux as the --ignore-crc-error option must be passed to the gpg executable for this attack to be successful.
The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0049 to this issue.

Please note that neither of these issues affect the way RPM or up2date verify RPM package files, nor is RPM vulnerable to either of these issues.

All users of GnuPG are advised to upgrade to this updated package, which contains backported patches to correct these issues.

Updated kdegraphics packages that fully resolve a security issue in kpdf are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kdegraphics packages contain applications for the K Desktop Environment including kpdf, a PDF file viewer.

Marcelo Ricardo Leitner discovered that a kpdf security fix, CVE-2005-3627, was incomplete. Red Hat issued kdegraphics packages with this incomplete fix in RHSA-2005:868. An attacker could construct a carefully crafted PDF file that could cause kpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0746 to this issue.

Users of kpdf should upgrade to these updated packages, which contain a backported patch to resolve this issue.

An updated tar package that fixes a buffer overflow bug is now available for Red Hat Enterprise Linux 4.

This update has been rated as having Moderate security impact by the Red Hat Security Response Team.

The GNU tar program saves many files together in one archive and can restore individual files (or all of the files) from that archive.

Jim Meyering discovered a buffer overflow bug in the way GNU tar extracts malformed archives. By tricking a user into extracting a malicious tar archive, it is possible to execute arbitrary code as the user running tar. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2006-0300 to this issue.

Users of tar should upgrade to this updated package, which contains a backported patch to correct this issue.

Updated gnutls packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The GNU TLS Library provides support for cryptographic algorithms and protocols such as TLS. GNU TLS includes Libtasn1, a library developed for ASN.1 structures management that includes DER encoding and decoding.

Several flaws were found in the way libtasn1 decodes DER. An attacker could create a carefully crafted invalid X.509 certificate in such a way that could trigger this flaw if parsed by an application that uses GNU TLS. This could lead to a denial of service (application crash).
It is not certain if this issue could be escalated to allow arbitrary code execution. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0645 to this issue.

In Red Hat Enterprise Linux 4, the GNU TLS library is only used by the Evolution client when connecting to an Exchange server or when publishing calendar information to a WebDAV server.

Users are advised to upgrade to these updated packages, which contain a backported patch from the GNU TLS maintainers to correct this issue.

Updated kdegraphics packages that resolve a security issue in kpdf are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The kdegraphics packages contain applications for the K Desktop Environment including kpdf, a pdf file viewer.

A heap based buffer overflow bug was discovered in kpdf. An attacker could construct a carefully crafted PDF file that could cause kpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0301 to this issue.

Users of kpdf should upgrade to these updated packages, which contain a backported patch to resolve this issue.

Updated libpng packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The libpng package contains a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files.

A heap based buffer overflow bug was found in the way libpng strips alpha channels from a PNG image. An attacker could create a carefully crafted PNG image file in such a way that it could cause an application linked with libpng to crash or execute arbitrary code when the file is opened by a victim. The Common Vulnerabilities and Exposures project has assigned the name CVE-2006-0481 to this issue.

Please note that the vunerable libpng function is only used by TeTeX and XEmacs on Red Hat Enterprise Linux 4.

All users of libpng are advised to update to these updated packages which contain a backported patch that is not vulnerable to this issue.

An updated xpdf package that fixes a buffer overflow security issue is now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The xpdf package is an X Window System-based viewer for Portable Document Format (PDF) files.

A heap based buffer overflow bug was discovered in Xpdf. An attacker could construct a carefully crafted PDF file that could cause Xpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0301 to this issue.

Users of Xpdf should upgrade to this updated package, which contains a backported patch to resolve these issues.

Red Hat would like to thank Dirk Mueller for reporting this issue and providing a patch.

An updated firefox package that fixes several security bugs is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

Igor Bukanov discovered a bug in the way Firefox's JavaScript interpreter dereferences objects. If a user visits a malicious web page, Firefox could crash or execute arbitrary code as the user running Firefox. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0292 to this issue.

moz_bug_r_a4 discovered a bug in Firefox's XULDocument.persist() function. A malicious web page could inject arbitrary RDF data into a user's localstore.rdf file, which can cause Firefox to execute arbitrary JavaScript when a user runs Firefox. (CVE-2006-0296)

A denial of service bug was found in the way Firefox saves history information. If a user visits a web page with a very long title, it is possible Firefox will crash or take a very long time the next time it is run. (CVE-2005-4134)

This update also fixes a bug when using XSLT to transform documents.
Passing DOM Nodes as parameters to functions expecting an xsl:param could cause Firefox to throw an exception.

Users of Firefox are advised to upgrade to this updated package, which contains backported patches to correct these issues.

Updated gd packages that fix several buffer overflow flaws are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The gd package contains a graphics library used for the dynamic creation of images such as PNG and JPEG.

Several buffer overflow flaws were found in the way gd allocates memory. An attacker could create a carefully crafted image that could execute arbitrary code if opened by a victim using a program linked against the gd library. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2004-0941 to these issues.

Users of gd should upgrade to these updated packages, which contain a backported patch and is not vulnerable to these issues.

Updated kdelibs packages are now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

kdelibs contains libraries for the K Desktop Environment (KDE).

A heap overflow flaw was discovered affecting kjs, the JavaScript interpreter engine used by Konqueror and other parts of KDE. An attacker could create a malicious website containing carefully crafted JavaScript code that would trigger this flaw and possibly lead to arbitrary code execution. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0019 to this issue.

NOTE: this issue does not affect KDE in Red Hat Enterprise Linux 3 or 2.1.

Users of KDE should upgrade to these updated packages, which contain a backported patch from the KDE security team correcting this issue as well as two bug fixes.

An updated gpdf package that fixes several security issues is now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

gpdf is a GNOME based viewer for Portable Document Format (PDF) files.

Chris Evans discovered several flaws in the way gpdf processes PDF files. An attacker could construct a carefully crafted PDF file that could cause gpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project assigned the names CVE-2005-3624, CVE-2005-3625, CVE-2005-3626, and CVE-2005-3627 to these issues.

Users of gpdf should upgrade to this updated package, which contains a backported patch to resolve these issues.

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 4. This is the third regular update.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

This is the third regular kernel update to Red Hat Enterprise Linux 4.

New features introduced in this update include :

  - Open InfiniBand (OpenIB) support

  - Serial Attached SCSI support

  - NFS access control lists, asynchronous I/O

  - IA64 multi-core support and sgi updates

  - Large SMP CPU limits increased using the largesmp     kernel: Up to 512 CPUs in ia64, 128 in ppc64, and 64 in     AMD64 and Intel EM64T

  - Improved read-ahead performance

  - Common Internet File System (CIFS) update

  - Error Detection and Correction (EDAC) modules

  - Unisys support

There were several bug fixes in various parts of the kernel. The ongoing effort to resolve these problems has resulted in a marked improvement in the reliability and scalability of Red Hat Enterprise Linux 4.

The following security bug was fixed in this update :

  - dm-crypt did not clear a structure before freeing it,     which could allow local users to discover information     about cryptographic keys (CVE-2006-0095)

The following device drivers have been upgraded to new versions :

cciss: 2.6.8 to 2.6.8-rh1 ipmi_devintf: 33.4 to 33.11 ipmi_msghandler:
33.4 to 33.11 ipmi_poweroff: 33.4 to 33.11 ipmi_si: 33.4 to 33.11 ipmi_watchdog: 33.4 to 33.11 mptbase: 3.02.18 to 3.02.60.01rh e1000:
6.0.54-k2-NAPI to 6.1.16-k2-NAPI ixgb: 1.0.95-k2-NAPI to 1.0.100-k2-NAPI tg3: 3.27-rh to 3.43-rh aacraid: 1.1.2-lk2 to 1.1-5[2412] ahci: 1.01 to 1.2 ata_piix: 1.03 to 1.05 iscsi_sfnet:
4:0.1.11-1 to 4:0.1.11-2 libata: 1.11 to 1.20 qla2100: 8.01.00b5-rh2 to 8.01.02-d3 qla2200: 8.01.00b5-rh2 to 8.01.02-d3 qla2300:
8.01.00b5-rh2 to 8.01.02-d3 qla2322: 8.01.00b5-rh2 to 8.01.02-d3 qla2xxx: 8.01.00b5-rh2 to 8.01.02-d3 qla6312: 8.01.00b5-rh2 to 8.01.02-d3 sata_nv: 0.6 to 0.8 sata_promise: 1.01 to 1.03 sata_svw:
1.06 to 1.07 sata_sx4: 0.7 to 0.8 sata_vsc: 1.0 to 1.1 cifs: 1.20 to 1.34

Added drivers :

bnx2: 1.4.25 dell_rbu: 0.7 hangcheck-timer: 0.9.0 ib_mthca: 0.06 megaraid_sas: 00.00.02.00 qla2400: 8.01.02-d3 typhoon: 1.5.7

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

An updated spamassassin package that fixes a denial of service flaw is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email (SPAM) from incoming email.

A denial of service bug was found in SpamAssassin. An attacker could construct a message in such a way that would cause SpamAssassin to crash. If a number of these messages are sent, it could lead to a denial of service, potentially preventing the delivery or filtering of email. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2005-3351 to this issue.

The following issues have also been fixed in this update :

* service spamassassin restart sometimes fails * Content Boundary '--' throws off message parser * sa-learn: massive memory usage on large messages * High memory usage with many newlines * service spamassassin messages not translated * Numerous other bug fixes that improve spam filter accuracy and safety

Users of SpamAssassin should upgrade to this updated package containing version 3.0.5, which is not vulnerable to these issues.

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 4 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

  - a flaw in network IGMP processing that a allowed a     remote user on the local network to cause a denial of     service (disabling of multicast reports) if the system     is running multicast applications (CVE-2002-2185,     moderate)

  - a flaw which allowed a local user to write to firmware     on read-only opened /dev/cdrom devices (CVE-2004-1190,     moderate)

  - a flaw in gzip/zlib handling internal to the kernel that     may allow a local user to cause a denial of service     (crash) (CVE-2005-2458, low)

  - a flaw in procfs handling during unloading of modules     that allowed a local user to cause a denial of service     or potentially gain privileges (CVE-2005-2709, moderate)

  - a flaw in the SCSI procfs interface that allowed a local     user to cause a denial of service (crash)     (CVE-2005-2800, moderate)

  - a flaw in 32-bit-compat handling of the TIOCGDEV ioctl     that allowed a local user to cause a denial of service     (crash) (CVE-2005-3044, important)

  - a race condition when threads share memory mapping that     allowed local users to cause a denial of service     (deadlock) (CVE-2005-3106, important)

  - a flaw when trying to mount a non-hfsplus filesystem     using hfsplus that allowed local users to cause a denial     of service (crash) (CVE-2005-3109, moderate)

  - a minor info leak with the get_thread_area() syscall     that allowed a local user to view uninitialized kernel     stack data (CVE-2005-3276, low)

  - a flaw in mq_open system call that allowed a local user     to cause a denial of service (crash) (CVE-2005-3356,     important)

  - a flaw in set_mempolicy that allowed a local user on     some 64-bit architectures to cause a denial of service     (crash) (CVE-2005-3358, important)

  - a flaw in the auto-reap of child processes that allowed     a local user to cause a denial of service (crash)     (CVE-2005-3784, important)

  - a flaw in the IPv6 flowlabel code that allowed a local     user to cause a denial of service (crash)     (CVE-2005-3806, important)

  - a flaw in network ICMP processing that allowed a local     user to cause a denial of service (memory exhaustion)     (CVE-2005-3848, important)

  - a flaw in file lease time-out handling that allowed a     local user to cause a denial of service (log file     overflow) (CVE-2005-3857, moderate)

  - a flaw in network IPv6 xfrm handling that allowed a     local user to cause a denial of service (memory     exhaustion) (CVE-2005-3858, important)

  - a flaw in procfs handling that allowed a local user to     read kernel memory (CVE-2005-4605, important)

All Red Hat Enterprise Linux 4 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

An updated squid package that fixes a security vulnerability as well as several issues is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects.

A denial of service flaw was found in the way squid processes certain NTLM authentication requests. It is possible for a remote attacker to crash the Squid server by sending a specially crafted NTLM authentication request. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2005-2917 to this issue.

The following issues have also been fixed in this update :

* An error introduced in squid-2.5.STABLE6-3.4E.12 can crash Squid when a user visits a site that has a bit longer DNS record.

* An error introduced in the old package prevented Squid from returning correct information about large file systems. The new package is compiled with the IDENT lookup support so that users who want to use it do not have to recompile it.

* Some authentication helpers needed SETUID rights but did not have them. If administrators wanted to use cache administrator, they had to change the SETUID bit manually. The updated package sets this bit so the new package can be updated without manual intervention from administrators.

* Squid could not handle a reply from an HTTP server when the reply began with the new-line character.

* An issue was discovered when a reply from an HTTP server was not HTTP 1.0 or 1.1 compliant.

* The updated package keeps user-defined error pages when the package is updated and it adds new ones.

All users of squid should upgrade to this updated package, which resolves these issues.

ID	Name	Severity
22238	CentOS 3 / 4 : wireshark (CESA-2006:0602)	critical
22207	CentOS 3 / 4 : httpd (CESA-2006:0619)	medium
22197	CentOS 4 : krb5 (CESA-2006:0612)	high
22164	CentOS 3 / 4 : gnupg (CESA-2006:0615)	medium
22163	CentOS 4 : seamonkey (CESA-2006:0609)	high
22162	CentOS 3 : seamonkey (CESA-2006:0608)	high
22161	CentOS 3 / 4 : libtiff (CESA-2006:0603)	high
22138	CentOS 4 : thunderbird (CESA-2006:0611)	high
22137	CentOS 4 : Firefox (CESA-2006:0610)	high
22136	CentOS 3 / 4 : ruby (CESA-2006:0604)	medium
22135	CentOS 3 : kernel (CESA-2006:0437)	high
22134	CentOS 3 : openssh (CESA-2006:0298)	high
22104	CentOS 3 / 4 : samba (CESA-2006:0591)	medium
22103	CentOS 3 : kdebase (CESA-2006:0576)	medium
22082	CentOS 3 : elfutils (CESA-2006:0368)	medium
22067	CentOS 4 : gimp (CESA-2006:0598)	medium
22066	CentOS 4 : libwmf (CESA-2006:0597)	high
22065	CentOS 3 / 4 : gnupg (CESA-2006:0571)	medium
22064	CentOS 3 / 4 : freetype (CESA-2006:0500)	high
22039	CentOS 3 / 4 : mutt (CESA-2006:0577)	high
22038	CentOS 4 : kernel (CESA-2006:0574)	medium
22037	CentOS 3 / 4 : php (CESA-2006:0568)	high
22036	CentOS 4 : vixie-cron (CESA-2006:0539)	high
22002	CentOS 4 : kdebase (CESA-2006:0548)	medium
22001	CentOS 3 / 4 : squirrelmail (CESA-2006:0547)	high
22000	CentOS 4 : mysql (CESA-2006:0544)	high
21999	CentOS 4 : spamassassin (CESA-2006:0543)	medium
21998	CentOS 4 : dia (CESA-2006:0541)	high
21997	CentOS 4 : kernel (CESA-2006:0493)	high
21996	CentOS 4 : xorg-x11 (CESA-2006:0451)	low
21995	CentOS 4 : ruby (CESA-2006:0427)	medium
21994	CentOS 4 : thunderbird (CESA-2006:0330)	critical
21993	CentOS 4 : firefox (CESA-2006:0328)	critical
21992	CentOS 3 / 4 : squirrelmail (CESA-2006:0283)	medium
21991	CentOS 4 : dia (CESA-2006:0280)	high
21990	CentOS 3 / 4 : gnu / gnupg (CESA-2006:0266)	medium
21989	CentOS 4 : kdegraphics (CESA-2006:0262)	high
21988	CentOS 4 : tar (CESA-2006:0232)	medium
21987	CentOS 4 : gnutls (CESA-2006:0207)	high
21986	CentOS 4 : kdegraphics (CESA-2006:0206)	high
21985	CentOS 4 : libpng (CESA-2006:0205)	medium
21984	CentOS 4 : xpdf (CESA-2006:0201)	high
21983	CentOS 4 : firefox (CESA-2006:0200)	high
21982	CentOS 4 : gd (CESA-2006:0194)	critical
21981	CentOS 4 : kdelibs (CESA-2006:0184)	high
21980	CentOS 4 : gpdf (CESA-2006:0177)	critical
21979	CentOS 4 : kernel (CESA-2006:0132)	low
21978	CentOS 4 : spamassassin (CESA-2006:0129)	medium
21977	CentOS 4 : kernel (CESA-2006:0101)	high
21976	CentOS 4 : squid (CESA-2006:0052)	medium

Detections

Analytics

CentOS Local Security Checks Family for Nessus

critical

medium

high

medium

high

high

high

high

high

medium

high

high

medium

medium

medium

medium

high

medium

high

high

medium

high

high

medium

high

high

medium

high

high

low

medium

critical

critical

medium

high

medium

high

medium

high

high

medium

high

high

critical

high

critical

low

medium

high

medium