Updated PHP packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

The phpinfo() PHP function did not properly sanitize long strings. An attacker could use this to perform cross-site scripting attacks against sites that have publicly-available PHP scripts that call phpinfo(). (CVE-2006-0996)

The html_entity_decode() PHP function was found to not be binary safe.
An attacker could use this flaw to disclose a certain part of the memory. In order for this issue to be exploitable the target site would need to have a PHP script which called the 'html_entity_decode()' function with untrusted input from the user and displayed the result. (CVE-2006-1490)

The error handling output was found to not properly escape HTML output in certain cases. An attacker could use this flaw to perform cross-site scripting attacks against sites where both display_errors and html_errors are enabled. (CVE-2006-0208)

An input validation error was found in the 'mb_send_mail()' function.
An attacker could use this flaw to inject arbitrary headers in a mail sent via a script calling the 'mb_send_mail()' function where the 'To' parameter can be controlled by the attacker. (CVE-2005-3883)

A buffer overflow flaw was discovered in uw-imap, the University of Washington's IMAP Server. php-imap is compiled against the static c-client libraries from imap and therefore needed to be recompiled against the fixed version. This issue only affected Red Hat Enterprise Linux 3. (CVE-2005-2933).

Users of PHP should upgrade to these updated packages, which contain backported patches that resolve these issues.

Updated openmotif packages that fix a security issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenMotif provides libraries which implement the Motif industry standard graphical user interface.

A number of buffer overflow flaws were discovered in OpenMotif's libUil library. It is possible for an attacker to execute arbitrary code as a victim who has been tricked into executing a program linked against OpenMotif, which then loads a malicious User Interface Language (UIL) file. (CVE-2005-3964)

Users of OpenMotif are advised to upgrade to these erratum packages, which contain a backported security patch to correct this issue.

Updated freeradius packages that fix an authentication weakness are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

FreeRADIUS is a high-performance and highly configurable free RADIUS server designed to allow centralized authentication and authorization for a network.

A bug was found in the way FreeRADIUS authenticates users via the MSCHAP V2 protocol. It is possible for a remote attacker to authenticate as a victim by sending a malformed MSCHAP V2 login request to the FreeRADIUS server. (CVE-2006-1354)

Please note that FreeRADIUS installations not using the MSCHAP V2 protocol for authentication are not vulnerable to this issue.

A bug was also found in the way FreeRADIUS logs SQL errors from the sql_unixodbc module. It may be possible for an attacker to cause FreeRADIUS to crash or execute arbitrary code if they are able to manipulate the SQL database FreeRADIUS is connecting to.
(CVE-2005-4744)

Users of FreeRADIUS should update to these erratum packages, which contain backported patches and are not vulnerable to these issues.

Updated ipsec-tools packages that fix a bug in racoon are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The ipsec-tools package is used in conjunction with the IPsec functionality in the linux kernel and includes racoon, an IKEv1 keying daemon.

A denial of service flaw was found in the ipsec-tools racoon daemon.
If a victim's machine has racoon configured in a non-recommended insecure manner, it is possible for a remote attacker to crash the racoon daemon. (CVE-2005-3732)

Users of ipsec-tools should upgrade to these updated packages, which contain backported patches, and are not vulnerable to these issues.

Updated sendmail packages to fix a security issue are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Sendmail is a Mail Transport Agent (MTA) used to send mail between machines.

A flaw in the handling of asynchronous signals was discovered in Sendmail. A remote attacker may be able to exploit a race condition to execute arbitrary code as root. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0058 to this issue.

By default on Red Hat Enterprise Linux 3 and 4, Sendmail is configured to only accept connections from the local host. Therefore, only users who have configured Sendmail to listen to remote hosts would be able to be remotely exploited by this vulnerability.

Users of Sendmail are advised to upgrade to these erratum packages, which contain a backported patch from the Sendmail team to correct this issue.

An updated mailman package that fixes two security issues is now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Mailman is software to help manage email discussion lists.

A flaw in handling of UTF8 character encodings was found in Mailman.
An attacker could send a carefully crafted email message to a mailing list run by Mailman which would cause that particular mailing list to stop working. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-3573 to this issue.

A flaw in date handling was found in Mailman version 2.1.4 through 2.1.6. An attacker could send a carefully crafted email message to a mailing list run by Mailman which would cause the Mailman server to crash. (CVE-2005-4153).

Users of Mailman should upgrade to this updated package, which contains backported patches to correct these issues.

Updated mozilla packages that fix several security bugs are now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

Igor Bukanov discovered a bug in the way Mozilla's JavaScript interpreter dereferences objects. If a user visits a malicious web page, Mozilla could crash or execute arbitrary code as the user running Mozilla. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0292 to this issue.

moz_bug_r_a4 discovered a bug in Mozilla's XULDocument.persist() function. A malicious web page could inject arbitrary RDF data into a user's localstore.rdf file, which can cause Mozilla to execute arbitrary JavaScript when a user runs Mozilla. (CVE-2006-0296)

A denial of service bug was found in the way Mozilla saves history information. If a user visits a web page with a very long title, it is possible Mozilla will crash or take a very long time the next time it is run. (CVE-2005-4134)

Note that the Red Hat Enterprise Linux 3 packages also fix a bug when using XSLT to transform documents. Passing DOM Nodes as parameters to functions expecting an xsl:param could cause Mozilla to throw an exception.

Users of Mozilla are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Updated Python packages are now available to correct a security issue.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Python is an interpreted, interactive, object-oriented programming language.

An integer overflow flaw was found in Python's PCRE library that could be triggered by a maliciously crafted regular expression. On systems that accept arbitrary regular expressions from untrusted users, this could be exploited to execute arbitrary code with the privileges of the application using the library. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2491 to this issue.

Users of Python should upgrade to these updated packages, which contain a backported patch that is not vulnerable to this issue.

An updated tar package that fixes a path traversal flaw is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The GNU tar program saves many files together in one archive and can restore individual files (or all of the files) from that archive.

In 2002, a path traversal flaw was found in the way GNU tar extracted archives. A malicious user could create a tar archive that could write to arbitrary files to which the user running GNU tar has write access (CVE-2002-0399). Red Hat included a backported security patch to correct this issue in Red Hat Enterprise Linux 3, and an erratum for Red Hat Enterprise Linux 2.1 users was issued.

During internal testing, we discovered that our backported security patch contained an incorrect optimization and therefore was not sufficient to completely correct this vulnerability. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2005-1918 to this issue.

Users of tar should upgrade to this updated package, which contains a replacement backported patch to correct this issue.

Updated ImageMagick packages that fix two security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ImageMagick(TM) is an image display and manipulation tool for the X Window System that can read and write multiple image formats.

A shell command injection flaw was found in ImageMagick's 'display' command. It is possible to execute arbitrary commands by tricking a user into running 'display' on a file with a specially crafted name.
The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2005-4601 to this issue.

A format string flaw was discovered in the way ImageMagick handles filenames. It may be possible to execute arbitrary commands by tricking a user into running a carefully crafted ImageMagick command.
(CVE-2006-0082)

Users of ImageMagick should upgrade to these updated packages, which contain backported patches and are not vulnerable to these issues.

Updated mod_auth_pgsql packages that fix format string security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The mod_auth_pgsql package is an httpd module that allows user authentication against information stored in a PostgreSQL database.

Several format string flaws were found in the way mod_auth_pgsql logs information. It may be possible for a remote attacker to execute arbitrary code as the 'apache' user if mod_auth_pgsql is used for user authentication. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-3656 to this issue.

Please note that this issue only affects servers which have mod_auth_pgsql installed and configured to perform user authentication against a PostgreSQL database.

All users of mod_auth_pgsql should upgrade to these updated packages, which contain a backported patch to resolve this issue.

This issue does not affect the mod_auth_pgsql package supplied with Red Hat Enterprise Linux 2.1.

Red Hat would like to thank iDefense for reporting this issue.

Updated CUPS packages that fix multiple security issues are now available for Red Hat Enterprise Linux.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

Chris Evans discovered several flaws in the way CUPS processes PDF files. An attacker could construct a carefully crafted PDF file that could cause CUPS to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project assigned the names CVE-2005-3624, CVE-2005-3625, CVE-2005-3626, and CVE-2005-3627 to these issues.

All users of CUPS should upgrade to these updated packages, which contain backported patches to resolve these issues.

Updated tetex packages that fix several integer overflows are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

TeTeX is an implementation of TeX. TeX takes a text file and a set of formatting commands as input and creates a typesetter-independent .dvi (DeVice Independent) file as output.

Several flaws were discovered in the teTeX PDF parsing library. An attacker could construct a carefully crafted PDF file that could cause teTeX to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project assigned the names CVE-2005-3191, CVE-2005-3192, CVE-2005-3193, CVE-2005-3624, CVE-2005-3625, CVE-2005-3626, CVE-2005-3627 and CVE-2005-3628 to these issues.

Users of teTeX should upgrade to these updated packages, which contain backported patches and are not vulnerable to these issues.

Updated Apache httpd packages that correct three security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache HTTP Server is a popular and freely-available Web server.

A memory leak in the worker MPM could allow remote attackers to cause a denial of service (memory consumption) via aborted connections, which prevents the memory for the transaction pool from being reused for other connections. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2970 to this issue. This vulnerability only affects users who are using the non-default worker MPM.

A flaw in mod_imap when using the Referer directive with image maps was discovered. With certain site configurations, a remote attacker could perform a cross-site scripting attack if a victim can be forced to visit a malicious URL using certain web browsers. (CVE-2005-3352)

A NULL pointer dereference flaw in mod_ssl was discovered affecting server configurations where an SSL virtual host is configured with access control and a custom 400 error document. A remote attacker could send a carefully crafted request to trigger this issue which would lead to a crash. This crash would only be a denial of service if using the non-default worker MPM. (CVE-2005-3357)

Users of httpd should update to these erratum packages which contain backported patches to correct these issues along with some additional bugs.

Updated Ethereal packages that fix various security vulnerabilities are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ethereal is a program for monitoring network traffic.

Two denial of service bugs were found in Ethereal's IRC and GTP protocol dissectors. Ethereal could crash or stop responding if it reads a malformed IRC or GTP packet off the network. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the names CVE-2005-3313 and CVE-2005-4585 to these issues.

A buffer overflow bug was found in Ethereal's OSPF protocol dissector.
Ethereal could crash or execute arbitrary code if it reads a malformed OSPF packet off the network. (CVE-2005-3651)

Users of ethereal should upgrade to these updated packages containing version 0.10.14, which is not vulnerable to these issues.

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 3. This is the seventh regular update.

This security advisory has been rated as having moderate security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

This is the seventh regular kernel update to Red Hat Enterprise Linux 3.

New features introduced by this update include :

  - addition of the bnx2, dell_rbu, and megaraid_sas device     drivers - support for multi-core, multi-threaded Intel     Itanium processors - upgrade of the SATA subsystem to     include ATAPI and SMART support - optional tuning via     the new numa_memory_allocator, arp_announce, and     printk_ratelimit sysctls

There were many bug fixes in various parts of the kernel. The ongoing effort to resolve these problems has resulted in a marked improvement in the reliability and scalability of Red Hat Enterprise Linux 3.

There were numerous driver updates and security fixes (elaborated below). Other key areas affected by fixes in this update include the networking subsystem, the VM subsystem, NPTL handling, autofs4, the USB subsystem, CPU enumeration, and 32-bit-exec-mode handling on 64-bit architectures.

The following device drivers have been upgraded to new versions :

aacraid -------- 1.1.5-2412 bnx2 ----------- 1.4.30 (new) dell_rbu
------- 2.1 (new) e1000 ---------- 6.1.16-k3 emulex --------- 7.3.3 fusion --------- 2.06.16.02 ipmi ----------- 35.11 megaraid2 ------ v2.10.10.1 megaraid_sas --- 00.00.02.00 (new) tg3 ------------ 3.43RH

The following security bugs were fixed in this update :

  - a flaw in gzip/zlib handling internal to the kernel that     allowed a local user to cause a denial of service     (crash) (CVE-2005-2458,low)

  - a flaw in ext3 EA/ACL handling of attribute sharing that     allowed a local user to gain privileges (CVE-2005-2801,     moderate)

  - a minor info leak with the get_thread_area() syscall     that allowed a local user to view uninitialized kernel     stack data (CVE-2005-3276, low)

Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

  - a flaw in network IGMP processing that a allowed a     remote user on the local network to cause a denial of     service (disabling of multicast reports) if the system     is running multicast applications (CVE-2002-2185,     moderate)

  - a flaw in remap_page_range() with O_DIRECT writes that     allowed a local user to cause a denial of service     (crash) (CVE-2004-1057, important)

  - a flaw in exec() handling on some 64-bit architectures     that allowed a local user to cause a denial of service     (crash) (CVE-2005-2708, important)

  - a flaw in procfs handling during unloading of modules     that allowed a local user to cause a denial of service     or potentially gain privileges (CVE-2005-2709, moderate)

  - a flaw in IPv6 network UDP port hash table lookups that     allowed a local user to cause a denial of service (hang)     (CVE-2005-2973, important)

  - a flaw in 32-bit-compat handling of the TIOCGDEV ioctl     that allowed a local user to cause a denial of service     (crash) (CVE-2005-3044, important)

  - a network buffer info leak using the orinoco driver that     allowed a remote user to possibly view uninitialized     data (CVE-2005-3180, important)

  - a flaw in IPv4 network TCP and UDP netfilter handling     that allowed a local user to cause a denial of service     (crash) (CVE-2005-3275, important)

  - a flaw in the IPv6 flowlabel code that allowed a local     user to cause a denial of service (crash)     (CVE-2005-3806, important)

  - a flaw in network ICMP processing that allowed a local     user to cause a denial of service (memory exhaustion)     (CVE-2005-3848, important)

  - a flaw in file lease time-out handling that allowed a     local user to cause a denial of service (log file     overflow) (CVE-2005-3857, moderate)

  - a flaw in network IPv6 xfrm handling that allowed a     local user to cause a denial of service (memory     exhaustion) (CVE-2005-3858, important)

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.

An updated vixie-cron package that fixes a bug and security issue is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The vixie-cron package contains the Vixie version of cron. Cron is a standard UNIX daemon that runs specified programs at scheduled times.

A bug was found in the way vixie-cron installs new crontab files. It is possible for a local attacker to execute the crontab command in such a way that they can view the contents of another user's crontab file. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-1038 to this issue.

This update also fixes an issue where cron jobs could start before their scheduled time.

All users of vixie-cron should upgrade to this updated package, which contains backported patches and is not vulnerable to these issues.

Updated squid packages that fix a security vulnerability as well as several bugs are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Squid is a high-performance proxy caching server for Web clients, supporting FTP, gopher, and HTTP data objects.

A denial of service flaw was found in the way squid processes certain NTLM authentication requests. A remote attacker could send a specially crafted NTLM authentication request which would cause the Squid server to crash. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2917 to this issue.

Several bugs have also been addressed in this update :

* An error introduced in 2.5.STABLE3-6.3E.14 where Squid can crash if a user visits a site which has a long DNS record.

* Some authentication helpers were missing needed setuid rights.

* Squid couldn't handle a reply from a HTTP server when the reply began with the new-line character or wasn't HTTP/1.0 or HTTP/1.1 compliant.

* User-defined error pages were not kept when the squid package was upgraded.

All users of squid should upgrade to these updated packages, which contain backported patches to resolve these issues.

Updated initscripts packages that fix a privilege escalation issue and several bugs are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The initscripts package contains the basic system scripts used to boot your Red Hat system, change runlevels, and shut the system down cleanly. Initscripts also contains the scripts that activate and deactivate most network interfaces.

A bug was found in the way initscripts handled various environment variables when the /sbin/service command is run. It is possible for a local user with permissions to execute /sbin/service via sudo to execute arbitrary commands as the 'root' user. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-3629 to this issue.

The following issues have also been fixed in this update :

* extraneous characters were logged on bootup.

* fsck would be attempted on filesystems marked with _netdev in rc.sysinit before they were available.

Additionally, support for multi-core Itanium processors has been added to redhat-support-check.

All users of initscripts should upgrade to these updated packages, which contain backported patches to resolve these issues.

Updated Perl packages that fix security issues and bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Perl is a high-level programming language commonly used for system administration utilities and Web programming.

An integer overflow bug was found in Perl's format string processor.
It is possible for an attacker to cause perl to crash or execute arbitrary code if the attacker is able to process a malicious format string. This issue is only exploitable through a script wich passes arbitrary untrusted strings to the format string processor. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-3962 to this issue.

Paul Szabo discovered a bug in the way Perl's File::Path::rmtree module removed directory trees. If a local user has write permissions to a subdirectory within the tree being removed by File::Path::rmtree, it is possible for them to create setuid binary files. (CVE-2005-0448)

Solar Designer discovered several temporary file bugs in various Perl modules. A local attacker could overwrite or create files as the user running a Perl script that uses a vulnerable module. (CVE-2004-0976)

Users of Perl are advised to upgrade to these updated packages, which contain backported patches to correct these issues as well as fixes for several bugs.

Updated CUPS packages that fix multiple security issues are now available for Red Hat Enterprise Linux.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

Several flaws were discovered in the way CUPS processes PDF files. An attacker could construct a carefully crafted PDF file that could cause CUPS to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project assigned the names CVE-2005-3191, CVE-2005-3192, and CVE-2005-3193 to these issues.

All users of CUPS should upgrade to these updated packages, which contain backported patches to resolve these issues.

An updated imap package that fixes a buffer overflow issue is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The imap package provides server daemons for both the IMAP (Internet Message Access Protocol) and POP (Post Office Protocol) mail access protocols.

A buffer overflow flaw was discovered in the way the c-client library parses user-supplied mailboxes. If an authenticated user requests a specially crafted mailbox name, it may be possible to execute arbitrary code on a server that uses the library. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2933 to this issue.

All users of imap should upgrade to these updated packages, which contain a backported patch and are not vulnerable to this issue.

Updated netpbm packages that fix two security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The netpbm package contains a library of functions that support programs for handling various graphics file formats.

A stack based buffer overflow bug was found in the way netpbm converts Portable Anymap (PNM) files into Portable Network Graphics (PNG). A specially crafted PNM file could allow an attacker to execute arbitrary code by attempting to convert a PNM file to a PNG file when using pnmtopng with the '-text' option. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-3632 to this issue.

An 'off by one' bug was found in the way netpbm converts Portable Anymap (PNM) files into Portable Network Graphics (PNG). If a victim attempts to convert a specially crafted 256 color PNM file to a PNG file, then it can cause the pnmtopng utility to crash. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-3662 to this issue.

All users of netpbm should upgrade to these updated packages, which contain backported patches that resolve these issues.

An updated xpdf package that fixes several security issues is now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

[Updated 20 Dec 2005] The initial fix for these issues was incomplete.
The packages have been updated with a more complete fix.

The xpdf package is an X Window System-based viewer for Portable Document Format (PDF) files.

Several flaws were discovered in Xpdf. An attacker could construct a carefully crafted PDF file that could cause Xpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project assigned the names CVE-2005-3191, CVE-2005-3192, and CVE-2005-3193 to these issues.

Users of Xpdf should upgrade to this updated package, which contains a backported patch to resolve these issues.

Red Hat would like to thank Derek B. Noonburg for reporting this issue and providing a patch.

An updated lynx package that corrects a security flaw is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Lynx is a text-based Web browser.

An arbitrary command execute bug was found in the lynx 'lynxcgi:' URI handler. An attacker could create a web page redirecting to a malicious URL which could execute arbitrary code as the user running lynx. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2929 to this issue.

Users should update to this erratum package, which contains a backported patch to correct this issue.

Updated PHP packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A flaw was found in the way PHP registers global variables during a file upload request. A remote attacker could submit a carefully crafted multipart/form-data POST request that would overwrite the $GLOBALS array, altering expected script behavior, and possibly leading to the execution of arbitrary PHP commands. Please note that this vulnerability only affects installations which have register_globals enabled in the PHP configuration file, which is not a default or recommended option. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-3390 to this issue.

A flaw was found in the PHP parse_str() function. If a PHP script passes only one argument to the parse_str() function, and the script can be forced to abort execution during operation (for example due to the memory_limit setting), the register_globals may be enabled even if it is disabled in the PHP configuration file. This vulnerability only affects installations that have PHP scripts using the parse_str function in this way. (CVE-2005-3389)

A Cross-Site Scripting flaw was found in the phpinfo() function. If a victim can be tricked into following a malicious URL to a site with a page displaying the phpinfo() output, it may be possible to inject JavaScript or HTML content into the displayed page or steal data such as cookies. This vulnerability only affects installations which allow users to view the output of the phpinfo() function. As the phpinfo() function outputs a large amount of information about the current state of PHP, it should only be used during debugging or if protected by authentication. (CVE-2005-3388)

A denial of service flaw was found in the way PHP processes EXIF image data. It is possible for an attacker to cause PHP to crash by supplying carefully crafted EXIF image data. (CVE-2005-3353)

Users of PHP should upgrade to these updated packages, which contain backported patches that resolve these issues.

Updated OpenSSL096b compatibility packages that fix a remote denial of service vulnerability are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The OpenSSL toolkit implements Secure Sockets Layer (SSL v2/v3), Transport Layer Security (TLS v1) protocols, and serves as a full-strength general purpose cryptography library. OpenSSL 0.9.6b libraries are provided for Red Hat Enterprise Linux 3 and 4 to allow compatibility with legacy applications.

Testing performed by the OpenSSL group using the Codenomicon TLS Test Tool uncovered a NULL pointer assignment in the do_change_cipher_spec() function. A remote attacker could perform a carefully crafted SSL/TLS handshake against a server that uses the OpenSSL library in such a way as to cause OpenSSL to crash. Depending on the server this could lead to a denial of service. (CVE-2004-0079)

This issue was reported as not affecting OpenSSL versions prior to 0.9.6c, and testing with the Codenomicon Test Tool showed that OpenSSL 0.9.6b as shipped as a compatibility library with Red Hat Enterprise Linux 3 and 4 did not crash. However, an alternative reproducer has been written which shows that this issue does affect versions of OpenSSL prior to 0.9.6c.

Note that Red Hat does not ship any applications with Red Hat Enterprise Linux 3 or 4 that use these compatibility libraries.

Users of the OpenSSL096b compatibility package are advised to upgrade to these updated packages, which contain a patch provided by the OpenSSL group that protect against this issue.

Updated libungif packages that fix two security issues are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libungif package contains a shared library of functions for loading and saving GIF format image files.

Several bugs in the way libungif decodes GIF images were discovered.
An attacker could create a carefully crafted GIF image file in such a way that it could cause an application linked with libungif to crash or execute arbitrary code when the file is opened by a victim. The Common Vulnerabilities and Exposures project has assigned the names CVE-2005-2974 and CVE-2005-3350 to these issues.

All users of libungif are advised to upgrade to these updated packages, which contain backported patches that resolve these issues.

Updated wget packages that fix a security issue are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

GNU Wget is a file retrieval utility that can use either the HTTP or FTP protocols.

A stack based buffer overflow bug was found in the wget implementation of NTLM authentication. An attacker could execute arbitrary code on a user's machine if the user can be tricked into connecting to a malicious web server using NTLM authentication. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-3185 to this issue.

All users of wget are advised to upgrade to these updated packages, which contain a backported patch that resolves this issue.

Updated gtk2 packages that fix two security issues are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The gtk2 package contains the GIMP ToolKit (GTK+), a library for creating graphical user interfaces for the X Window System.

A bug was found in the way gtk2 processes XPM images. An attacker could create a carefully crafted XPM file in such a way that it could cause an application linked with gtk2 to execute arbitrary code when the file was opened by a victim. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-3186 to this issue.

Ludwig Nussel discovered an infinite-loop denial of service bug in the way gtk2 processes XPM images. An attacker could create a carefully crafted XPM file in such a way that it could cause an application linked with gtk2 to stop responding when the file was opened by a victim. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2975 to this issue.

Users of gtk2 are advised to upgrade to these updated packages, which contain backported patches and are not vulnerable to these issues.

Updated gdk-pixbuf packages that fix several security issues are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The gdk-pixbuf package contains an image loading library used with the GNOME GUI desktop environment.

A bug was found in the way gdk-pixbuf processes XPM images. An attacker could create a carefully crafted XPM file in such a way that it could cause an application linked with gdk-pixbuf to execute arbitrary code when the file was opened by a victim. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-3186 to this issue.

Ludwig Nussel discovered an integer overflow bug in the way gdk-pixbuf processes XPM images. An attacker could create a carefully crafted XPM file in such a way that it could cause an application linked with gdk-pixbuf to execute arbitrary code or crash when the file was opened by a victim. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2976 to this issue.

Ludwig Nussel also discovered an infinite-loop denial of service bug in the way gdk-pixbuf processes XPM images. An attacker could create a carefully crafted XPM file in such a way that it could cause an application linked with gdk-pixbuf to stop responding when the file was opened by a victim. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2975 to this issue.

Users of gdk-pixbuf are advised to upgrade to these updated packages, which contain backported patches and are not vulnerable to these issues.

Updated Ethereal packages that fix various security vulnerabilities are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The ethereal package is a program for monitoring network traffic.

A number of security flaws have been discovered in Ethereal. On a system where Ethereal is running, a remote attacker could send malicious packets to trigger these flaws and cause Ethereal to crash or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project has assigned the names CVE-2005-3241, CVE-2005-3242, CVE-2005-3243, CVE-2005-3244, CVE-2005-3245, CVE-2005-3246, CVE-2005-3247, CVE-2005-3248, CVE-2005-3249, and CVE-2005-3184 to these issues.

Users of ethereal should upgrade to these updated packages, which contain version 0.10.13 and are not vulnerable to these issues.

Updated curl packages that fix a security issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and Dict servers, using any of the supported protocols.

A stack based buffer overflow bug was found in cURL's NTLM authentication module. It is possible to execute arbitrary code on a user's machine if the user can be tricked into connecting to a malicious web server using NTLM authentication. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-3185 to this issue.

All users of curl are advised to upgrade to these updated packages, which contain a backported patch that resolve this issue.

An updated lynx package that corrects a security flaw is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Lynx is a text-based Web browser.

Ulf Harnhammar discovered a stack overflow bug in Lynx when handling connections to NNTP (news) servers. An attacker could create a web page redirecting to a malicious news server which could execute arbitrary code as the user running lynx. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-3120 to this issue.

Users should update to this erratum package, which contains a backported patch to correct this issue.

A new xloadimage package that fixes bugs in handling malformed tiff and pbm/pnm/ppm images, and in handling metacharacters in file names is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The xloadimage utility displays images in an X Window System window, loads images into the root window, or writes images into a file.
Xloadimage supports many image types (including GIF, TIFF, JPEG, XPM, and XBM).

A flaw was discovered in xloadimage via which an attacker can construct a NIFF image with a very long embedded image title. This image can cause a buffer overflow. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-3178 to this issue.

All users of xloadimage should upgrade to this erratum package, which contains backported patches to correct these issues.

Updated OpenSSL packages that fix various security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenSSL is a toolkit that implements Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library.

OpenSSL contained a software work-around for a bug in SSL handling in Microsoft Internet Explorer version 3.0.2. This work-around is enabled in most servers that use OpenSSL to provide support for SSL and TLS.
Yutaka Oiwa discovered that this work-around could allow an attacker, acting as a 'man in the middle' to force an SSL connection to use SSL 2.0 rather than a stronger protocol such as SSL 3.0 or TLS 1.0. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2969 to this issue.

A bug was also fixed in the way OpenSSL creates DSA signatures. A cache timing attack was fixed in RHSA-2005-476 which caused OpenSSL to do private key calculations with a fixed time window. The DSA fix for this was not complete and the calculations are not always performed within a fixed-window. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0109 to this issue.

Users are advised to upgrade to these updated packages, which remove the MISE 3.0.2 work-around and contain patches to correct these issues.

Note: After installing this update, users are advised to either restart all services that use OpenSSL or restart their system.

Updated ruby packages that fix an arbitrary command execution issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

[Updated 25 Oct 2005] Errata has been updated to include missing packages for Red Hat Enterprise Linux 3.

Ruby is an interpreted scripting language for object-oriented programming.

A bug was found in the way ruby handles eval statements. It is possible for a malicious script to call eval in such a way that can allow the bypass of certain safe-level restrictions. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2337 to this issue.

Users of Ruby should update to these erratum packages, which contain a backported patch and are not vulnerable to this issue.

Updated mozilla packages that fix several security bugs are now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

A bug was found in the way Mozilla processes XBM image files. If a user views a specially crafted XBM file, it becomes possible to execute arbitrary code as the user running Mozilla. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2701 to this issue.

A bug was found in the way Mozilla processes certain Unicode sequences. It may be possible to execute arbitrary code as the user running Mozilla, if the user views a specially crafted Unicode sequence. (CVE-2005-2702)

A bug was found in the way Mozilla makes XMLHttp requests. It is possible that a malicious web page could leverage this flaw to exploit other proxy or server flaws from the victim's machine. It is also possible that this flaw could be leveraged to send XMLHttp requests to hosts other than the originator; the default behavior of the browser is to disallow this. (CVE-2005-2703)

A bug was found in the way Mozilla implemented its XBL interface. It may be possible for a malicious web page to create an XBL binding in a way that would allow arbitrary JavaScript execution with chrome permissions. Please note that in Mozilla 1.7.10 this issue is not directly exploitable and would need to leverage other unknown exploits. (CVE-2005-2704)

An integer overflow bug was found in Mozilla's JavaScript engine.
Under favorable conditions, it may be possible for a malicious web page to execute arbitrary code as the user running Mozilla.
(CVE-2005-2705)

A bug was found in the way Mozilla displays about: pages. It is possible for a malicious web page to open an about: page, such as about:mozilla, in such a way that it becomes possible to execute JavaScript with chrome privileges. (CVE-2005-2706)

A bug was found in the way Mozilla opens new windows. It is possible for a malicious website to construct a new window without any user interface components, such as the address bar and the status bar. This window could then be used to mislead the user for malicious purposes.
(CVE-2005-2707)

Users of Mozilla are advised to upgrade to this updated package that contains Mozilla version 1.7.12 and is not vulnerable to these issues.

Updated util-linux and mount packages that fix two security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function.

The mount package contains the mount, umount, swapon and swapoff programs.

A bug was found in the way the umount command is executed by normal users. It may be possible for a user to gain elevated privileges if the user is able to execute the 'umount -r' command on a mounted file system. The file system will be re-mounted only with the 'readonly' flag set, clearing flags such as 'nosuid' and 'noexec'. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2876 to this issue.

This update also fixes a hardlink bug in the script command for Red Hat Enterprise Linux 2.1. If a local user places a hardlinked file named 'typescript' in a directory they have write access to, the file will be overwritten if the user running script has write permissions to the destination file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2001-1494 to this issue.

All users of util-linux and mount should upgrade to these updated packages, which contain backported patches to correct these issues.

Updated wget package that fixes several security issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

GNU Wget is a file retrieval utility that can use either the HTTP or FTP protocols.

A bug was found in the way wget writes files to the local disk. If a malicious local user has write access to the directory wget is saving a file into, it is possible to overwrite files that the user running wget has write access to. (CVE-2004-2014)

A bug was found in the way wget filters redirection URLs. It is possible for a malicious Web server to overwrite files the user running wget has write access to. Note: in order for this attack to succeed the local DNS would need to resolve '..' to an IP address, which is an unlikely situation. (CVE-2004-1487)

A bug was found in the way wget displays HTTP response codes. It is possible that a malicious web server could inject a specially crafted terminal escape sequence capable of misleading the user running wget.
(CVE-2004-1488)

Users should upgrade to this updated package, which contains a version of wget that is not vulnerable to these issues.

An updated mozilla package that fixes a security bug is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

A bug was found in the way Mozilla processes certain international domain names. An attacker could create a specially crafted HTML file, which when viewed by the victim would cause Mozilla to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2871 to this issue.

Users of Mozilla are advised to upgrade to this updated package that contains a backported patch and is not vulnerable to this issue.

An updated Squid package that fixes security issues is now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Squid is a full-featured Web proxy cache.

A bug was found in the way Squid displays error messages. A remote attacker could submit a request containing an invalid hostname which would result in Squid displaying a previously used error message. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-2479 to this issue.

Two denial of service bugs were found in the way Squid handles malformed requests. A remote attacker could submit a specially crafted request to Squid that would cause the server to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-2794 and CVE-2005-2796 to these issues.

Please note that CVE-2005-2796 does not affect Red Hat Enterprise Linux 2.1

Users of Squid should upgrade to this updated package that contains backported patches, and is not vulnerable to these issues.

Updated pcre packages are now available to correct a security issue.

This update has been rated as having moderate security impact by the Red Hat Security Response Team

PCRE is a Perl-compatible regular expression library.

An integer overflow flaw was found in PCRE, triggered by a maliciously crafted regular expression. On systems that accept arbitrary regular expressions from untrusted users, this could be exploited to execute arbitrary code with the privileges of the application using the library. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2491 to this issue.

The security impact of this issue varies depending on the way that applications make use of PCRE. For example, the Apache web server uses the system PCRE library in order to parse regular expressions, but this flaw would only allow a user who already has the ability to write .htaccess files to gain 'apache' privileges. For applications supplied with Red Hat Enterprise Linux, a maximum security impact of moderate has been assigned.

Users should update to these erratum packages that contain a backported patch to correct this issue.

An updated cvs package that fixes a security bug is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

CVS (Concurrent Version System) is a version control system.

An insecure temporary file usage was found in the cvsbug program. It is possible that a local user could leverage this issue to execute arbitrary instructions as the user running cvsbug. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2693 to this issue.

All users of cvs should upgrade to this updated package, which includes a patch to correct this issue.

Updated openldap and nss_ldap packages that correct a potential password disclosure issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenLDAP is an open source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools.

The nss_ldap module is an extension for use with GNU libc which allows applications to, without internal modification, consult a directory service using LDAP to supplement information that would be read from local files such as /etc/passwd, /etc/group, and /etc/shadow.

A bug was found in the way OpenLDAP, nss_ldap, and pam_ldap refer LDAP servers. If a client connection is referred to a different server, it is possible that the referred connection will not be encrypted even if the client has 'ssl start_tls' in its ldap.conf file. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2069 to this issue.

A bug was also found in the way certain OpenLDAP authentication schemes store hashed passwords. A remote attacker could re-use a hashed password to gain access to unauthorized resources. The Common Vulnerabilities and Exposures project has assigned the name CVE-2004-0823 to this issue.

All users of OpenLDAP and nss_ldap are advised to upgrade to these updated packages, which contain backported fixes that resolve these issues.

Updated CUPS packages that fix a security issue are now available for Red Hat Enterprise Linux.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

When processing a PDF file, bounds checking was not correctly performed on some fields. This could cause the pdftops filter (running as user 'lp') to crash. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2097 to this issue.

All users of CUPS should upgrade to these erratum packages, which contain a patch to correct this issue.

Updated Ethereal packages that fix various security vulnerabilities are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The ethereal package is a program for monitoring network traffic.

A number of security flaws have been discovered in Ethereal. On a system where Ethereal is running, a remote attacker could send malicious packets to trigger these flaws and cause Ethereal to crash or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-2360, CVE-2005-2361, CVE-2005-2362, CVE-2005-2363, CVE-2005-2364, CVE-2005-2365, CVE-2005-2366, and CVE-2005-2367 to these issues.

Users of ethereal should upgrade to these updated packages, which contain version 0.10.12 which is not vulnerable to these issues.

Note: To reduce the risk of future vulnerabilities in Ethereal, the ethereal and tethereal programs in this update have been compiled as Position Independent Executables (PIE) for Red Hat Enterprise Linux 3 and 4. In addition FORTIFY_SOURCE has been enabled for Red Hat Enterprise Linux 4 packages to provide compile time and runtime buffer checks.

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 3. This is the sixth regular update.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

This is the sixth regular kernel update to Red Hat Enterprise Linux 3.

New features introduced by this update include :

  - diskdump support on HP Smart Array devices -     netconsole/netdump support over bonded interfaces - new     chipset and device support via PCI table updates -     support for new 'oom-kill' and 'kscand_work_percent'     sysctls - support for dual core processors and ACPI     Power Management timers on AMD64 and Intel EM64T systems

There were many bug fixes in various parts of the kernel. The ongoing effort to resolve these problems has resulted in a marked improvement in the reliability and scalability of Red Hat Enterprise Linux 3.

There were numerous driver updates and security fixes (elaborated below). Other key areas affected by fixes in this update include kswapd, inode handling, the SATA subsystem, diskdump handling, ptrace() syscall support, and signal handling.

The following device drivers have been upgraded to new versions :

3w-9xxx ---- 2.24.03.008RH cciss ------ 2.4.58.RH1 e100 ------- 3.4.8-k2 e1000 ------ 6.0.54-k2 emulex ----- 7.3.2 fusion ----- 2.06.16i.01 iscsi ------ 3.6.2.1 ipmi ------- 35.4 lpfcdfc ---- 1.2.1 qlogic ----- 7.05.00-RH1 tg3 -------- 3.27RH

The following security bugs were fixed in this update :

  - a flaw in syscall argument checking on Itanium systems     that allowed a local user to cause a denial of service     (crash) (CVE-2005-0136)

  - a flaw in stack expansion that allowed a local user of     mlockall() to cause a denial of service (memory     exhaustion) (CVE-2005-0179)

  - a small memory leak in network packet defragmenting that     allowed a remote user to cause a denial of service     (memory exhaustion) on systems using netfilter     (CVE-2005-0210)

  - flaws in ptrace() syscall handling on AMD64 and Intel     EM64T systems that allowed a local user to cause a     denial of service (crash) (CVE-2005-0756, CVE-2005-1762,     CVE-2005-2553)

  - flaws in ISO-9660 file system handling that allowed the     mounting of an invalid image on a CD-ROM to cause a     denial of service (crash) or potentially execute     arbitrary code (CVE-2005-0815)

  - a flaw in ptrace() syscall handling on Itanium systems     that allowed a local user to cause a denial of service     (crash) (CVE-2005-1761)

  - a flaw in the alternate stack switching on AMD64 and     Intel EM64T systems that allowed a local user to cause a     denial of service (crash) (CVE-2005-1767)

  - race conditions in the ia32-compat support for exec()     syscalls on AMD64, Intel EM64T, and Itanium systems that     could allow a local user to cause a denial of service     (crash) (CVE-2005-1768)

  - flaws in IPSEC network handling that allowed a local     user to cause a denial of service or potentially gain     privileges (CVE-2005-2456, CVE-2005-2555)

  - a flaw in sendmsg() syscall handling on 64-bit systems     that allowed a local user to cause a denial of service     or potentially gain privileges (CVE-2005-2490)

  - flaws in unsupported modules that allowed     denial-of-service attacks (crashes) or local privilege     escalations on systems using the drm, coda, or moxa     modules (CVE-2004-1056, CVE-2005-0124, CVE-2005-0504)

  - potential leaks of kernel data from jfs and ext2 file     system handling (CVE-2004-0181, CVE-2005-0400)

Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

An updated binutils package that fixes several bugs and minor security issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Binutils is a collection of utilities used for the creation of executable code. A number of bugs were found in various binutils tools.

Several integer overflow bugs were found in binutils. If a user is tricked into processing a specially crafted executable with utilities such as readelf, size, strings, objdump, or nm, it may allow the execution of arbitrary code as the user running the utility. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1704 to this issue.

Additionally, the following bugs have been fixed :

-- correct alignment of .tbss section if the requested alignment of .tbss is bigger than requested alignment of .tdata section -- by default issue an error if IA-64 hint@pause instruction is put into the B slot, add assembler command line switch to override this behaviour

All users of binutils should upgrade to this updated package, which contains backported patches to resolve these issues.

ID	Name	Severity
21897	CentOS 3 / 4 : php (CESA-2006:0276)	high
21896	CentOS 3 / 4 : openmotif (CESA-2006:0272)	high
21895	CentOS 3 / 4 : freeradius (CESA-2006:0271)	high
21894	CentOS 3 / 4 : ipsec-tools (CESA-2006:0267)	critical
21893	CentOS 3 / 4 : sendmail (CESA-2006:0264)	high
21892	CentOS 3 / 4 : mailman (CESA-2006:0204)	high
21891	CentOS 3 / 4 : mozilla (CESA-2006:0199)	high
21890	CentOS 3 / 4 : python (CESA-2006:0197)	high
21889	CentOS 3 : tar (CESA-2006:0195)	low
21888	CentOS 3 / 4 : ImageMagick (CESA-2006:0178)	high
21887	CentOS 3 / 4 : mod_auth_pgsql (CESA-2006:0164)	critical
21886	CentOS 3 / 4 : cups (CESA-2006:0163)	critical
21885	CentOS 3 / 4 : tetex (CESA-2006:0160)	critical
21884	CentOS 3 / 4 : httpd (CESA-2006:0159)	medium
21883	CentOS 3 / 4 : ethereal (CESA-2006:0156)	high
21882	CentOS 3 : kernel (CESA-2006:0144)	medium
21881	CentOS 3 : kernel (CESA-2006:0140)	high
21880	CentOS 3 : vixie-cron (CESA-2006:0117)	low
21879	CentOS 3 : squid (CESA-2006:0045)	medium
21878	CentOS 3 : initscripts (CESA-2006:0015)	high
21877	CentOS 3 : perl (CESA-2005:881)	medium
21876	CentOS 3 / 4 : cups (CESA-2005:878)	high
21875	CentOS 3 : imap (CESA-2005:850)	high
21874	CentOS 3 : netpbm (CESA-2005:843)	medium
21873	CentOS 3 / 4 : xpdf (CESA-2005:840)	critical
21872	CentOS 3 / 4 : lynx (CESA-2005:839)	high
21871	CentOS 3 / 4 : php (CESA-2005:831)	high
21870	CentOS 3 / 4 : openssl096b (CESA-2005:830)	medium
21869	CentOS 3 / 4 : libungif (CESA-2005:828)	high
21868	CentOS 3 / 4 : wget (CESA-2005:812)	high
21867	CentOS 3 / 4 : gtk2 (CESA-2005:811)	high
21866	CentOS 3 / 4 : gdk-pixbuf (CESA-2005:810)	high
21865	CentOS 3 / 4 : ethereal (CESA-2005:809)	critical
21864	CentOS 3 / 4 : curl (CESA-2005:807)	high
21863	CentOS 3 / 4 : lynx (CESA-2005:803)	high
21862	CentOS 3 / 4 : xloadimage (CESA-2005:802)	medium
21861	CentOS 3 / 4 : openssl (CESA-2005:800)	medium
21860	CentOS 3 / 4 : ruby (CESA-2005:799)	high
21859	CentOS 3 / 4 : Mozilla (CESA-2005:789)	high
21858	CentOS 3 / 4 : util-linux / mount (CESA-2005:782)	high
21857	CentOS 3 / 4 : wget (CESA-2005:771)	medium
21856	CentOS 3 / 4 : mozilla (CESA-2005:769)	high
21855	CentOS 3 / 4 : squid (CESA-2005:766)	medium
21854	CentOS 3 / 4 : pcre (CESA-2005:761)	high
21853	CentOS 3 / 4 : cvs (CESA-2005:756)	medium
21852	CentOS 3 : openldap / nss_ldap (CESA-2005:751)	high
21851	CentOS 3 / 4 : cups (CESA-2005:706)	low
21850	CentOS 3 / 4 : ethereal (CESA-2005:687)	high
21849	CentOS 3 : kernel (CESA-2005:663)	medium
21848	CentOS 3 : binutils (CESA-2005:659)	medium

Detections

Analytics

CentOS Local Security Checks Family for Nessus

high

high

high

critical

high

high

high

high

low

high

critical

critical

critical

medium

high

medium

high

low

medium

high

medium

high

high

medium

critical

high

high

medium

high

high

high

high

critical

high

high

medium

medium

high

high

high

medium

high

medium

high

medium

high

low

high

medium

medium