An updated lynx package that corrects a security flaw is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Lynx is a text-based Web browser.

Ulf Harnhammar discovered a stack overflow bug in Lynx when handling connections to NNTP (news) servers. An attacker could create a web page redirecting to a malicious news server which could execute arbitrary code as the user running lynx. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-3120 to this issue.

Users should update to this erratum package, which contains a backported patch to correct this issue.

A new xloadimage package that fixes bugs in handling malformed tiff and pbm/pnm/ppm images, and in handling metacharacters in file names is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The xloadimage utility displays images in an X Window System window, loads images into the root window, or writes images into a file.
Xloadimage supports many image types (including GIF, TIFF, JPEG, XPM, and XBM).

A flaw was discovered in xloadimage via which an attacker can construct a NIFF image with a very long embedded image title. This image can cause a buffer overflow. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-3178 to this issue.

All users of xloadimage should upgrade to this erratum package, which contains backported patches to correct these issues.

Updated OpenSSL packages that fix various security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenSSL is a toolkit that implements Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library.

OpenSSL contained a software work-around for a bug in SSL handling in Microsoft Internet Explorer version 3.0.2. This work-around is enabled in most servers that use OpenSSL to provide support for SSL and TLS.
Yutaka Oiwa discovered that this work-around could allow an attacker, acting as a 'man in the middle' to force an SSL connection to use SSL 2.0 rather than a stronger protocol such as SSL 3.0 or TLS 1.0. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2969 to this issue.

A bug was also fixed in the way OpenSSL creates DSA signatures. A cache timing attack was fixed in RHSA-2005-476 which caused OpenSSL to do private key calculations with a fixed time window. The DSA fix for this was not complete and the calculations are not always performed within a fixed-window. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0109 to this issue.

Users are advised to upgrade to these updated packages, which remove the MISE 3.0.2 work-around and contain patches to correct these issues.

Note: After installing this update, users are advised to either restart all services that use OpenSSL or restart their system.

Updated ruby packages that fix an arbitrary command execution issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

[Updated 25 Oct 2005] Errata has been updated to include missing packages for Red Hat Enterprise Linux 3.

Ruby is an interpreted scripting language for object-oriented programming.

A bug was found in the way ruby handles eval statements. It is possible for a malicious script to call eval in such a way that can allow the bypass of certain safe-level restrictions. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2337 to this issue.

Users of Ruby should update to these erratum packages, which contain a backported patch and are not vulnerable to this issue.

Updated mozilla packages that fix several security bugs are now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

A bug was found in the way Mozilla processes XBM image files. If a user views a specially crafted XBM file, it becomes possible to execute arbitrary code as the user running Mozilla. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2701 to this issue.

A bug was found in the way Mozilla processes certain Unicode sequences. It may be possible to execute arbitrary code as the user running Mozilla, if the user views a specially crafted Unicode sequence. (CVE-2005-2702)

A bug was found in the way Mozilla makes XMLHttp requests. It is possible that a malicious web page could leverage this flaw to exploit other proxy or server flaws from the victim's machine. It is also possible that this flaw could be leveraged to send XMLHttp requests to hosts other than the originator; the default behavior of the browser is to disallow this. (CVE-2005-2703)

A bug was found in the way Mozilla implemented its XBL interface. It may be possible for a malicious web page to create an XBL binding in a way that would allow arbitrary JavaScript execution with chrome permissions. Please note that in Mozilla 1.7.10 this issue is not directly exploitable and would need to leverage other unknown exploits. (CVE-2005-2704)

An integer overflow bug was found in Mozilla's JavaScript engine.
Under favorable conditions, it may be possible for a malicious web page to execute arbitrary code as the user running Mozilla.
(CVE-2005-2705)

A bug was found in the way Mozilla displays about: pages. It is possible for a malicious web page to open an about: page, such as about:mozilla, in such a way that it becomes possible to execute JavaScript with chrome privileges. (CVE-2005-2706)

A bug was found in the way Mozilla opens new windows. It is possible for a malicious website to construct a new window without any user interface components, such as the address bar and the status bar. This window could then be used to mislead the user for malicious purposes.
(CVE-2005-2707)

Users of Mozilla are advised to upgrade to this updated package that contains Mozilla version 1.7.12 and is not vulnerable to these issues.

Updated util-linux and mount packages that fix two security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function.

The mount package contains the mount, umount, swapon and swapoff programs.

A bug was found in the way the umount command is executed by normal users. It may be possible for a user to gain elevated privileges if the user is able to execute the 'umount -r' command on a mounted file system. The file system will be re-mounted only with the 'readonly' flag set, clearing flags such as 'nosuid' and 'noexec'. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2876 to this issue.

This update also fixes a hardlink bug in the script command for Red Hat Enterprise Linux 2.1. If a local user places a hardlinked file named 'typescript' in a directory they have write access to, the file will be overwritten if the user running script has write permissions to the destination file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2001-1494 to this issue.

All users of util-linux and mount should upgrade to these updated packages, which contain backported patches to correct these issues.

Updated wget package that fixes several security issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

GNU Wget is a file retrieval utility that can use either the HTTP or FTP protocols.

A bug was found in the way wget writes files to the local disk. If a malicious local user has write access to the directory wget is saving a file into, it is possible to overwrite files that the user running wget has write access to. (CVE-2004-2014)

A bug was found in the way wget filters redirection URLs. It is possible for a malicious Web server to overwrite files the user running wget has write access to. Note: in order for this attack to succeed the local DNS would need to resolve '..' to an IP address, which is an unlikely situation. (CVE-2004-1487)

A bug was found in the way wget displays HTTP response codes. It is possible that a malicious web server could inject a specially crafted terminal escape sequence capable of misleading the user running wget.
(CVE-2004-1488)

Users should upgrade to this updated package, which contains a version of wget that is not vulnerable to these issues.

An updated mozilla package that fixes a security bug is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

A bug was found in the way Mozilla processes certain international domain names. An attacker could create a specially crafted HTML file, which when viewed by the victim would cause Mozilla to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2871 to this issue.

Users of Mozilla are advised to upgrade to this updated package that contains a backported patch and is not vulnerable to this issue.

An updated Squid package that fixes security issues is now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Squid is a full-featured Web proxy cache.

A bug was found in the way Squid displays error messages. A remote attacker could submit a request containing an invalid hostname which would result in Squid displaying a previously used error message. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-2479 to this issue.

Two denial of service bugs were found in the way Squid handles malformed requests. A remote attacker could submit a specially crafted request to Squid that would cause the server to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-2794 and CVE-2005-2796 to these issues.

Please note that CVE-2005-2796 does not affect Red Hat Enterprise Linux 2.1

Users of Squid should upgrade to this updated package that contains backported patches, and is not vulnerable to these issues.

Updated pcre packages are now available to correct a security issue.

This update has been rated as having moderate security impact by the Red Hat Security Response Team

PCRE is a Perl-compatible regular expression library.

An integer overflow flaw was found in PCRE, triggered by a maliciously crafted regular expression. On systems that accept arbitrary regular expressions from untrusted users, this could be exploited to execute arbitrary code with the privileges of the application using the library. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2491 to this issue.

The security impact of this issue varies depending on the way that applications make use of PCRE. For example, the Apache web server uses the system PCRE library in order to parse regular expressions, but this flaw would only allow a user who already has the ability to write .htaccess files to gain 'apache' privileges. For applications supplied with Red Hat Enterprise Linux, a maximum security impact of moderate has been assigned.

Users should update to these erratum packages that contain a backported patch to correct this issue.

An updated cvs package that fixes a security bug is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

CVS (Concurrent Version System) is a version control system.

An insecure temporary file usage was found in the cvsbug program. It is possible that a local user could leverage this issue to execute arbitrary instructions as the user running cvsbug. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2693 to this issue.

All users of cvs should upgrade to this updated package, which includes a patch to correct this issue.

Updated openldap and nss_ldap packages that correct a potential password disclosure issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenLDAP is an open source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools.

The nss_ldap module is an extension for use with GNU libc which allows applications to, without internal modification, consult a directory service using LDAP to supplement information that would be read from local files such as /etc/passwd, /etc/group, and /etc/shadow.

A bug was found in the way OpenLDAP, nss_ldap, and pam_ldap refer LDAP servers. If a client connection is referred to a different server, it is possible that the referred connection will not be encrypted even if the client has 'ssl start_tls' in its ldap.conf file. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2069 to this issue.

A bug was also found in the way certain OpenLDAP authentication schemes store hashed passwords. A remote attacker could re-use a hashed password to gain access to unauthorized resources. The Common Vulnerabilities and Exposures project has assigned the name CVE-2004-0823 to this issue.

All users of OpenLDAP and nss_ldap are advised to upgrade to these updated packages, which contain backported fixes that resolve these issues.

Updated CUPS packages that fix a security issue are now available for Red Hat Enterprise Linux.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

When processing a PDF file, bounds checking was not correctly performed on some fields. This could cause the pdftops filter (running as user 'lp') to crash. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2097 to this issue.

All users of CUPS should upgrade to these erratum packages, which contain a patch to correct this issue.

Updated Ethereal packages that fix various security vulnerabilities are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The ethereal package is a program for monitoring network traffic.

A number of security flaws have been discovered in Ethereal. On a system where Ethereal is running, a remote attacker could send malicious packets to trigger these flaws and cause Ethereal to crash or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-2360, CVE-2005-2361, CVE-2005-2362, CVE-2005-2363, CVE-2005-2364, CVE-2005-2365, CVE-2005-2366, and CVE-2005-2367 to these issues.

Users of ethereal should upgrade to these updated packages, which contain version 0.10.12 which is not vulnerable to these issues.

Note: To reduce the risk of future vulnerabilities in Ethereal, the ethereal and tethereal programs in this update have been compiled as Position Independent Executables (PIE) for Red Hat Enterprise Linux 3 and 4. In addition FORTIFY_SOURCE has been enabled for Red Hat Enterprise Linux 4 packages to provide compile time and runtime buffer checks.

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 3. This is the sixth regular update.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

This is the sixth regular kernel update to Red Hat Enterprise Linux 3.

New features introduced by this update include :

  - diskdump support on HP Smart Array devices -     netconsole/netdump support over bonded interfaces - new     chipset and device support via PCI table updates -     support for new 'oom-kill' and 'kscand_work_percent'     sysctls - support for dual core processors and ACPI     Power Management timers on AMD64 and Intel EM64T systems

There were many bug fixes in various parts of the kernel. The ongoing effort to resolve these problems has resulted in a marked improvement in the reliability and scalability of Red Hat Enterprise Linux 3.

There were numerous driver updates and security fixes (elaborated below). Other key areas affected by fixes in this update include kswapd, inode handling, the SATA subsystem, diskdump handling, ptrace() syscall support, and signal handling.

The following device drivers have been upgraded to new versions :

3w-9xxx ---- 2.24.03.008RH cciss ------ 2.4.58.RH1 e100 ------- 3.4.8-k2 e1000 ------ 6.0.54-k2 emulex ----- 7.3.2 fusion ----- 2.06.16i.01 iscsi ------ 3.6.2.1 ipmi ------- 35.4 lpfcdfc ---- 1.2.1 qlogic ----- 7.05.00-RH1 tg3 -------- 3.27RH

The following security bugs were fixed in this update :

  - a flaw in syscall argument checking on Itanium systems     that allowed a local user to cause a denial of service     (crash) (CVE-2005-0136)

  - a flaw in stack expansion that allowed a local user of     mlockall() to cause a denial of service (memory     exhaustion) (CVE-2005-0179)

  - a small memory leak in network packet defragmenting that     allowed a remote user to cause a denial of service     (memory exhaustion) on systems using netfilter     (CVE-2005-0210)

  - flaws in ptrace() syscall handling on AMD64 and Intel     EM64T systems that allowed a local user to cause a     denial of service (crash) (CVE-2005-0756, CVE-2005-1762,     CVE-2005-2553)

  - flaws in ISO-9660 file system handling that allowed the     mounting of an invalid image on a CD-ROM to cause a     denial of service (crash) or potentially execute     arbitrary code (CVE-2005-0815)

  - a flaw in ptrace() syscall handling on Itanium systems     that allowed a local user to cause a denial of service     (crash) (CVE-2005-1761)

  - a flaw in the alternate stack switching on AMD64 and     Intel EM64T systems that allowed a local user to cause a     denial of service (crash) (CVE-2005-1767)

  - race conditions in the ia32-compat support for exec()     syscalls on AMD64, Intel EM64T, and Itanium systems that     could allow a local user to cause a denial of service     (crash) (CVE-2005-1768)

  - flaws in IPSEC network handling that allowed a local     user to cause a denial of service or potentially gain     privileges (CVE-2005-2456, CVE-2005-2555)

  - a flaw in sendmsg() syscall handling on 64-bit systems     that allowed a local user to cause a denial of service     or potentially gain privileges (CVE-2005-2490)

  - flaws in unsupported modules that allowed     denial-of-service attacks (crashes) or local privilege     escalations on systems using the drm, coda, or moxa     modules (CVE-2004-1056, CVE-2005-0124, CVE-2005-0504)

  - potential leaks of kernel data from jfs and ext2 file     system handling (CVE-2004-0181, CVE-2005-0400)

Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

An updated binutils package that fixes several bugs and minor security issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Binutils is a collection of utilities used for the creation of executable code. A number of bugs were found in various binutils tools.

Several integer overflow bugs were found in binutils. If a user is tricked into processing a specially crafted executable with utilities such as readelf, size, strings, objdump, or nm, it may allow the execution of arbitrary code as the user running the utility. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1704 to this issue.

Additionally, the following bugs have been fixed :

-- correct alignment of .tbss section if the requested alignment of .tbss is bigger than requested alignment of .tdata section -- by default issue an error if IA-64 hint@pause instruction is put into the B slot, add assembler command line switch to override this behaviour

All users of binutils should upgrade to this updated package, which contains backported patches to resolve these issues.

Updated fetchmail packages that fix a security flaw are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Fetchmail is a remote mail retrieval and forwarding utility.

A buffer overflow was discovered in fetchmail's POP3 client. A malicious server could cause send a carefully crafted message UID and cause fetchmail to crash or potentially execute arbitrary code as the user running fetchmail. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2335 to this issue.

Users of fetchmail should update to this erratum package which contains a backported patch to correct this issue.

An updated gaim package that fixes multiple security issues is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Gaim is an Internet Messaging client.

A heap based buffer overflow issue was discovered in the way Gaim processes away messages. A remote attacker could send a specially crafted away message to a Gaim user logged into AIM or ICQ that could result in arbitrary code execution. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2103 to this issue.

Daniel Atallah discovered a denial of service issue in Gaim. A remote attacker could attempt to upload a file with a specially crafted name to a user logged into AIM or ICQ, causing Gaim to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2102 to this issue.

A denial of service bug was found in Gaim's Gadu Gadu protocol handler. A remote attacker could send a specially crafted message to a Gaim user logged into Gadu Gadu, causing Gaim to crash. Please note that this issue only affects PPC and IBM S/390 systems running Gaim.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2370 to this issue.

Users of gaim are advised to upgrade to this updated package, which contains backported patches and is not vulnerable to these issues.

Updated Apache httpd packages that correct two security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Apache HTTP Server is a popular and freely-available Web server.

A flaw was discovered in mod_ssl's handling of the 'SSLVerifyClient' directive. This flaw occurs if a virtual host is configured using 'SSLVerifyClient optional' and a directive 'SSLVerifyClient required' is set for a specific location. For servers configured in this fashion, an attacker may be able to access resources that should otherwise be protected, by not supplying a client certificate when connecting. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2700 to this issue.

A flaw was discovered in Apache httpd where the byterange filter would buffer certain responses into memory. If a server has a dynamic resource such as a CGI script or PHP script that generates a large amount of data, an attacker could send carefully crafted requests in order to consume resources, potentially leading to a Denial of Service. (CVE-2005-2728)

Users of Apache httpd should update to these errata packages that contain backported patches to correct these issues.

Updated mozilla packages that fix various security issues are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

A bug was found in the way Mozilla handled synthetic events. It is possible that Web content could generate events such as keystrokes or mouse clicks that could be used to steal data or execute malicious JavaScript code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2260 to this issue.

A bug was found in the way Mozilla executed JavaScript in XBL controls. It is possible for a malicious webpage to leverage this vulnerability to execute other JavaScript based attacks even when JavaScript is disabled. (CVE-2005-2261)

A bug was found in the way Mozilla installed its extensions. If a user can be tricked into visiting a malicious webpage, it may be possible to obtain sensitive information such as cookies or passwords.
(CVE-2005-2263)

A bug was found in the way Mozilla handled certain JavaScript functions. It is possible for a malicious webpage to crash the browser by executing malformed JavaScript code. (CVE-2005-2265)

A bug was found in the way Mozilla handled multiple frame domains. It is possible for a frame as part of a malicious website to inject content into a frame that belongs to another domain. This issue was previously fixed as CVE-2004-0718 but was accidentally disabled.
(CVE-2005-1937)

A bug was found in the way Mozilla handled child frames. It is possible for a malicious framed page to steal sensitive information from its parent page. (CVE-2005-2266)

A bug was found in the way Mozilla opened URLs from media players. If a media player opens a URL which is JavaScript, the JavaScript executes with access to the currently open webpage. (CVE-2005-2267)

A design flaw was found in the way Mozilla displayed alerts and prompts. Alerts and prompts were given the generic title [JavaScript Application] which prevented a user from knowing which site created them. (CVE-2005-2268)

A bug was found in the way Mozilla handled DOM node names. It is possible for a malicious site to overwrite a DOM node name, allowing certain privileged chrome actions to execute the malicious JavaScript.
(CVE-2005-2269)

A bug was found in the way Mozilla cloned base objects. It is possible for Web content to traverse the prototype chain to gain access to privileged chrome objects. (CVE-2005-2270)

Users of Mozilla are advised to upgrade to these updated packages, which contain Mozilla version 1.7.10 and are not vulnerable to these issues.

Updated Apache httpd packages to correct two security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache HTTP Server is a powerful, full-featured, efficient, and freely-available Web server.

Watchfire reported a flaw that occured when using the Apache server as an HTTP proxy. A remote attacker could send an HTTP request with both a 'Transfer-Encoding: chunked' header and a 'Content-Length' header.
This caused Apache to incorrectly handle and forward the body of the request in a way that the receiving server processes it as a separate HTTP request. This could allow the bypass of Web application firewall protection or lead to cross-site scripting (XSS) attacks. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2005-2088 to this issue.

Marc Stern reported an off-by-one overflow in the mod_ssl CRL verification callback. In order to exploit this issue the Apache server would need to be configured to use a malicious certificate revocation list (CRL). The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2005-1268 to this issue.

Users of Apache httpd should update to these errata packages that contain backported patches to correct these issues.

Updated CUPS packages that fix a security issue are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.

When processing a request, the CUPS scheduler would use case-sensitive matching on the queue name to decide which authorization policy should be used. However, queue names are not case-sensitive. An unauthorized user could print to a password-protected queue without needing a password. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2154 to this issue.

Please note that the version of CUPS included in Red Hat Enterprise Linux 4 is not vulnerable to this issue.

All users of CUPS should upgrade to these erratum packages which contain a backported patch to correct this issue.

Updated PHP packages that fix two security issues are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A bug was discovered in the PEAR XML-RPC Server package included in PHP. If a PHP script is used which implements an XML-RPC Server using the PEAR XML-RPC package, then it is possible for a remote attacker to construct an XML-RPC request which can cause PHP to execute arbitrary PHP commands as the 'apache' user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1921 to this issue.

When using the default SELinux 'targeted' policy on Red Hat Enterprise Linux 4, the impact of this issue is reduced since the scripts executed by PHP are constrained within the httpd_sys_script_t security context.

A race condition in temporary file handling was discovered in the shtool script installed by PHP. If a third-party PHP module which uses shtool was compiled as root, a local user may be able to modify arbitrary files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1751 to this issue.

Users of PHP should upgrade to these updated packages, which contain backported fixes for these issues.

Updated krb5 packages which fix multiple security issues are now available for Red Hat Enterprise Linux 2.1 and 3.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

[Updated 26 Sep 2005] krb5-server packages have been added to this advisory for Red Hat Enterprise Linux 3 WS and Red Hat Enterprise Linux 3 Desktop.

Kerberos is a networked authentication system which uses a trusted third party (a KDC) to authenticate clients and servers to each other.

A double-free flaw was found in the krb5_recvauth() routine which may be triggered by a remote unauthenticated attacker. Although no exploit is currently known to exist, this issue could potentially be exploited to allow arbitrary code execution on a Key Distribution Center (KDC).
The Common Vulnerabilities and Exposures project assigned the name CVE-2005-1689 to this issue.

Daniel Wachdorf discovered a single byte heap overflow in the krb5_unparse_name() function, part of krb5-libs. Sucessful exploitation of this flaw would lead to a denial of service (crash).
To trigger this flaw an attacker would need to have control of a kerberos realm that shares a cross-realm key with the target, making exploitation of this flaw unlikely. (CVE-2005-1175).

Gael Delalleau discovered an information disclosure issue in the way some telnet clients handle messages from a server. An attacker could construct a malicious telnet server that collects information from the environment of any victim who connects to it using the Kerberos-aware telnet client (CVE-2005-0488).

The rcp protocol allows a server to instruct a client to write to arbitrary files outside of the current directory. This could potentially cause a security issue if a user uses the Kerberos-aware rcp to copy files from a malicious server (CVE-2004-0175).

All users of krb5 should update to these erratum packages which contain backported patches to correct these issues. Red Hat would like to thank the MIT Kerberos Development Team for their responsible disclosure of these issues.

Updated openssh packages that fix a potential security vulnerability and various other bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This includes the core files necessary for both the OpenSSH client and server.

A bug was found in the way the OpenSSH server handled the MaxStartups and LoginGraceTime configuration variables. A malicious user could connect to the SSH daemon in such a way that it would prevent additional logins from occuring until the malicious connections are closed. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-2069 to this issue.

Additionally, the following issues are resolved with this update :

  - The -q option of the ssh client did not suppress the     banner message sent by the server, which caused errors     when used in scripts.

  - The sshd daemon failed to close the client connection if     multiple X clients were forwarded over the connection     and the client session exited.

  - The sftp client leaked memory if used for extended     periods.

  - The sshd daemon called the PAM functions incorrectly if     the user was unknown on the system.

All users of openssh should upgrade to these updated packages, which contain backported patches and resolve these issues.

An updated sudo package is available that fixes a race condition in sudo's pathname validation.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root with logging.

A race condition bug was found in the way sudo handles pathnames. It is possible that a local user with limited sudo access could create a race condition that would allow the execution of arbitrary commands as the root user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1993 to this issue.

Users of sudo should update to this updated package, which contains a backported patch and is not vulnerable to this issue.

Updated freeradius packages that fix a buffer overflow and possible SQL injection attacks in the sql module are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

FreeRADIUS is a high-performance and highly configurable free RADIUS server designed to allow centralized authentication and authorization for a network.

A buffer overflow bug was found in the way FreeRADIUS escapes data in a SQL query. An attacker may be able to crash FreeRADIUS if they cause FreeRADIUS to escape a string containing three or less characters. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1454 to this issue.

Additionally a bug was found in the way FreeRADIUS escapes SQL data.
It is possible that an authenticated user could execute arbitrary SQL queries by sending a specially crafted request to FreeRADIUS. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1455 to this issue.

Users of FreeRADIUS should update to these erratum packages, which contain backported patches and are not vulnerable to these issues.

An updated gaim package that fixes two denial of service issues is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Gaim application is a multi-protocol instant messaging client.

Jacopo Ottaviani discovered a bug in the way Gaim handles Yahoo! Messenger file transfers. It is possible for a malicious user to send a specially crafted file transfer request that causes Gaim to crash.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1269 to this issue.

Additionally, Hugo de Bokkenrijder discovered a bug in the way Gaim parses MSN Messenger messages. It is possible for a malicious user to send a specially crafted MSN Messenger message that causes Gaim to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1934 to this issue.

Users of gaim are advised to upgrade to this updated package, which contains version 1.3.1 and is not vulnerable to these issues.

Updated mikmod packages that fix a security issue are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

MikMod is a well known MOD music file player for UNIX-based systems.

A buffer overflow bug was found in mikmod during the processing of archive filenames. An attacker could create a malicious archive that when opened by mikmod could result in arbitrary code execution. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0427 to this issue.

Users of mikmod are advised to upgrade to these erratum packages, which contain backported security patches and are not vulnerable to these issues.

Updated telnet packages that fix an information disclosure issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The telnet package provides a command line telnet client.

Gael Delalleau discovered an information disclosure issue in the way the telnet client handles messages from a server. An attacker could construct a malicious telnet server that collects information from the environment of any victim who connects to it. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0488 to this issue.

Users of telnet should upgrade to this updated package, which contains a backported patch to correct this issue.

Updated XFree86 packages that fix several integer overflows, various bugs, and add ATI RN50/ES1000 support are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

XFree86 is an implementation of the X Window System, which provides the core functionality for the Linux graphical desktop.

Several integer overflow bugs were found in the way XFree86 parses pixmap images. It is possible for a user to gain elevated privileges by loading a specially crafted pixmap image. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2495 to this issue.

Additionally this update adds the following new features in this release: - Support for ATI RN50/ES1000 chipsets has been added.

The following bugs were also fixed in this release: - A problem with the X server's module loading system that led to cache incoherency on the Itanium architecture.

  - The X server's PCI config space accesses caused     contention with the kernel if accesses occurred while     the kernel lock was held.

  - X font server (xfs) crashed when accessing Type 1 fonts     via showfont.

  - A problem with the X transport library prevented X     applications from starting if the hostname started with     a digit.

  - An issue where refresh rates were being restricted to     60Hz on some Intel i8xx systems

Users of XFree86 should upgrade to these updated packages, which contain a backported patch and are not vulnerable to this issue.

An updated gedit package that fixes a file name format string vulnerability is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team

gEdit is a small text editor designed specifically for the GNOME GUI desktop.

A file name format string vulnerability has been discovered in gEdit.
It is possible for an attacker to create a file with a carefully crafted name which, when the file is opened, executes arbitrary instructions on a victim's machine. Although it is unlikely that a user would manually open a file with such a carefully crafted file name, a user could, for example, be tricked into opening such a file from within an email client. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1686 to this issue.

Users of gEdit should upgrade to this updated package, which contains a backported patch to correct this issue.

Updated ImageMagick packages that fix a denial of service issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ImageMagick(TM) is an image display and manipulation tool for the X Window System that can read and write multiple image formats.

A denial of service bug was found in the way ImageMagick parses XWD files. A user or program executing ImageMagick to process a malicious XWD file can cause ImageMagick to enter an infinite loop causing a denial of service condition. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1739 to this issue.

Users of ImageMagick should upgrade to these updated packages, which contain a backported patch, and are not vulnerable to this issue.

Updated OpenSSL packages that fix security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenSSL is a toolkit that implements Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library.

Colin Percival reported a cache timing attack that could allow a malicious local user to gain portions of cryptographic keys. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2005-0109 to the issue. The OpenSSL library has been patched to add a new fixed-window mod_exp implementation as default for RSA, DSA, and DH private-key operations. This patch is designed to mitigate cache timing and potentially related attacks.

A flaw was found in the way the der_chop script creates temporary files. It is possible that a malicious local user could cause der_chop to overwrite files (CVE-2004-0975). The der_chop script was deprecated and has been removed from these updated packages. Red Hat Enterprise Linux 4 did not ship der_chop and is therefore not vulnerable to this issue.

Users are advised to update to these erratum packages which contain patches to correct these issues.

Please note: After installing this update, users are advised to either restart all services that use OpenSSL or restart their system.

Updated bzip2 packages that fix multiple issues are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

[Updated 13 February 2006] Replacement bzip2 packages for Red Hat Enterprise Linux 4 have been created as the original erratum packages did not fix CVE-2005-0758.

Bzip2 is a data compressor.

A bug was found in the way bzgrep processes file names. If a user can be tricked into running bzgrep on a file with a carefully crafted file name, arbitrary commands could be executed as the user running bzgrep.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0758 to this issue.

A bug was found in the way bzip2 modifies file permissions during decompression. If an attacker has write access to the directory into which bzip2 is decompressing files, it is possible for them to modify permissions on files owned by the user running bzip2 (CVE-2005-0953).

A bug was found in the way bzip2 decompresses files. It is possible for an attacker to create a specially crafted bzip2 file which will cause bzip2 to cause a denial of service (by filling disk space) if decompressed by a victim (CVE-2005-1260).

Users of Bzip2 should upgrade to these updated packages, which contain backported patches to correct these issues.

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the three security issues described below as well as an important fix for a problem that could lead to data corruption on x86-architecture SMP systems with greater than 4GB of memory through heavy usage of multi-threaded applications.

A flaw between execve() syscall handling and core dumping of ELF-format executables allowed local unprivileged users to cause a denial of service (system crash) or possibly gain privileges. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-1263 to this issue.

A flaw in shared memory locking allowed local unprivileged users to lock and unlock regions of shared memory segments they did not own (CVE-2005-0176).

A flaw in the locking of SysV IPC shared memory regions allowed local unprivileged users to bypass their RLIMIT_MEMLOCK resource limit (CVE-2004-0491).

Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

Please also consult the RHEL3 Update 5 advisory RHSA-2005:294 for the complete list of features added and bugs fixed in U5, which was released only a week prior to this security update.

Updated mozilla packages that fix various security bugs are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

[Updated 24 May 2005] This erratum now includes updated devhelp packages which are required to satisfy a dependency on systems that have devhelp packages installed.

Mozilla is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

Several bugs were found in the way Mozilla executes JavaScript code.
JavaScript executed from a web page should run with a restricted access level, preventing dangerous actions. It is possible that a malicious web page could execute JavaScript code with elevated privileges, allowing access to protected data and functions. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-1476, CVE-2005-1477, CVE-2005-1531, and CVE-2005-1532 to these issues.

Users of Mozilla are advised to upgrade to this updated package, which contains Mozilla version 1.7.8 to correct these issues.

Updated postgresql packages that fix several security vulnerabilities and risks of data loss are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL constructs (including transactions, subselects and user-defined types and functions).

The PostgreSQL community discovered two distinct errors in initial system catalog entries that could allow authorized database users to crash the database and possibly escalate their privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-1409 and CVE-2005-1410 to these issues.

Although installing this update will protect new (freshly initdb'd) database installations from these errors, administrators MUST TAKE MANUAL ACTION to repair the errors in pre-existing databases. The appropriate procedures are explained at http://www.postgresql.org/docs/8.0/static/release-7-4-8.html for Red Hat Enterprise Linux 4 users, or http://www.postgresql.org/docs/8.0/static/release-7-3-10.html for Red Hat Enterprise Linux 3 users.

This update corrects several problems that might occur while trying to upgrade a Red Hat Enterprise Linux 3 installation (containing rh-postgresql packages) to Red Hat Enterprise Linux 4 (containing postgresql packages). These updated packages correctly supersede the rh-postgresql packages.

The original release of Red Hat Enterprise Linux 4 failed to initialize the database correctly if started for the first time with SELinux in enforcement mode. This update corrects that problem.

If you already have a nonfunctional database in place, shut down the postgresql service if running, install this update, then do 'sudo rm
-rf /var/lib/pgsql/data' before restarting the postgresql service.

This update also solves the problem that the PostgreSQL server might fail to restart after a system reboot, due to a stale lockfile.

This update also corrects a problem with wrong error messages in libpq, the postgresql client library. The library would formerly report kernel error messages incorrectly when the locale setting was not C.

This update also includes fixes for several other errors, including two race conditions that could result in apparent data inconsistency or actual data loss.

All users of PostgreSQL are advised to upgrade to these updated packages and to apply the recommended manual corrections to existing databases.

An updated gaim package that fixes two security issues is now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The Gaim application is a multi-protocol instant messaging client.

A stack based buffer overflow bug was found in the way gaim processes a message containing a URL. A remote attacker could send a carefully crafted message resulting in the execution of arbitrary code on a victim's machine. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1261 to this issue.

A bug was found in the way gaim handles malformed MSN messages. A remote attacker could send a carefully crafted MSN message causing gaim to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1262 to this issue.

Users of Gaim are advised to upgrade to this updated package which contains backported patches and is not vulnerable to these issues.

Updated Ethereal packages that fix various security vulnerabilities are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The ethereal package is a program for monitoring network traffic.

A number of security flaws have been discovered in Ethereal. On a system where Ethereal is running, a remote attacker could send malicious packets to trigger these flaws and cause Ethereal to crash or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-1456, CVE-2005-1457, CVE-2005-1458, CVE-2005-1459, CVE-2005-1460, CVE-2005-1461, CVE-2005-1462, CVE-2005-1463, CVE-2005-1464, CVE-2005-1465, CVE-2005-1466, CVE-2005-1467, CVE-2005-1468, CVE-2005-1469, and CVE-2005-1470 to these issues.

Users of ethereal should upgrade to these updated packages, which contain version 0.10.11 which is not vulnerable to these issues.

Updated tcpdump packages that fix several security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

These updated packages also add support for output files larger than 2 GB, add support for some new VLAN IDs, and fix message parsing on 64bit architectures.

Tcpdump is a command-line tool for monitoring network traffic.

Several denial of service bugs were found in the way tcpdump processes certain network packets. It is possible for an attacker to inject a carefully crafted packet onto the network, crashing a running tcpdump session. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-1278, CVE-2005-1279, and CVE-2005-1280 to these issues.

Additionally, the tcpdump utility can now write a file larger than 2 GB, parse some new VLAN IDs, and parse messages on 64bit architectures.

Users of tcpdump are advised to upgrade to these erratum packages, which contain backported security patches and are not vulnerable to these issues.

An updated squid package that fixes several security issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Squid is a full-featured Web proxy cache.

A race condition bug was found in the way Squid handles the now obsolete Set-Cookie header. It is possible that Squid can leak Set-Cookie header information to other clients connecting to Squid.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0626 to this issue. Please note that this issue only affected Red Hat Enterprise Linux 4.

A bug was found in the way Squid handles PUT and POST requests. It is possible for an authorised remote user to cause a failed PUT or POST request which can cause Squid to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0718 to this issue.

A bug was found in the way Squid processes errors in the access control list. It is possible that an error in the access control list could give users more access than intended. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1345 to this issue.

A bug was found in the way Squid handles access to the cachemgr.cgi script. It is possible for an authorised remote user to bypass access control lists with this flaw. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-1999-0710 to this issue.

A bug was found in the way Squid handles DNS replies. If the port Squid uses for DNS requests is not protected by a firewall it is possible for a remote attacker to spoof DNS replies, possibly redirecting a user to spoofed or malicious content. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1519 to this issue.

Additionally this update fixes the following bugs: - LDAP Authentication fails with an assertion error when using Red Hat Enterprise Linux 4

Users of Squid should upgrade to this updated package, which contains backported patches to correct these issues.

Updated ImageMagick packages that fix a buffer overflow issue are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

ImageMagick(TM) is an image display and manipulation tool for the X Window System which can read and write multiple image formats.

A heap based buffer overflow bug was found in the way ImageMagick parses PNM files. An attacker could execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted PNM file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1275 to this issue.

Users of ImageMagick should upgrade to these updated packages, which contain a backported patch, and are not vulnerable to this issue.

Updated openmotif packages that fix a flaw in the Xpm image library are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenMotif provides libraries which implement the Motif industry standard graphical user interface.

An integer overflow flaw was found in libXpm, which is used to decode XPM (X PixMap) images. A vulnerable version of this library was found within OpenMotif. An attacker could create a carefully crafted XPM file which would cause an application to crash or potentially execute arbitrary code if opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0605 to this issue.

Users of OpenMotif are advised to upgrade to these erratum packages, which contains a backported security patch to the embedded libXpm library.

An updated gFTP package that fixes a directory traversal issue is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

gFTP is a multi-threaded FTP client for the X Window System.

A directory traversal bug was found in gFTP. If a user can be tricked into downloading a file from a malicious ftp server, it is possible to overwrite arbitrary files owned by the victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0372 to this issue.

Users of gftp should upgrade to this updated package, which contains a backported fix for this issue.

Updated PHP packages that fix various security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A bug was found in the way PHP processes IFF and JPEG images. It is possible to cause PHP to consume CPU resources for a short period of time by supplying a carefully crafted IFF or JPEG image. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0524 and CVE-2005-0525 to these issues.

A buffer overflow bug was also found in the way PHP processes EXIF image headers. It is possible for an attacker to construct an image file in such a way that it could execute arbitrary instructions when processed by PHP. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1042 to this issue.

A denial of service bug was found in the way PHP processes EXIF image headers. It is possible for an attacker to cause PHP to enter an infinite loop for a short period of time by supplying a carefully crafted image file to PHP for processing. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1043 to this issue.

Several bug fixes are also included in this update :

  - The security fixes in RHSA-2004-687 to the     'unserializer' code introduced some performance issues.

  - In the gd extension, the 'imagecopymerge' function did     not correctly handle transparency. The original image     was being obscured in the resultant image.

  - In the curl extension, safe mode was not enforced for     'file:///' URL lookups (CVE-2004-1392).

Users of PHP should upgrade to these updated packages, which contain backported fixes for these issues.

An updated cvs package that fixes security bugs is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

CVS (Concurrent Version System) is a version control system.

A buffer overflow bug was found in the way the CVS client processes version and author information. If a user can be tricked into connecting to a malicious CVS server, an attacker could execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0753 to this issue.

Additionally, a bug was found in which CVS freed an invalid pointer.
However, this issue does not appear to be exploitable.

All users of cvs should upgrade to this updated package, which includes a backported patch to correct these issues.

An updated nasm package that fixes multiple security issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

NASM is an 80x86 assembler.

Two stack based buffer overflow bugs have been found in nasm. An attacker could create an ASM file in such a way that when compiled by a victim, could execute arbitrary code on their machine. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-1287 and CVE-2005-1194 to these issues.

All users of nasm are advised to upgrade to this updated package, which contains backported fixes for these issues.

An updated cpio package that fixes multiple issues is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

GNU cpio copies files into or out of a cpio or tar archive.

A race condition bug was found in cpio. It is possible for a local malicious user to modify the permissions of a local file if they have write access to a directory in which a cpio archive is being extracted. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1111 to this issue.

Additionally, this update adds cpio support for archives larger than 2GB. However, the size of individual files within an archive is limited to 4GB.

All users of cpio are advised to upgrade to this updated package, which contains backported fixes for these issues.

An updated sharutils package is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The sharutils package contains a set of tools for encoding and decoding packages of files in binary or text format.

A stack based overflow bug was found in the way shar handles the -o option. If a user can be tricked into running a specially crafted command, it could lead to arbitrary code execution. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1772 to this issue. Please note that this issue does not affect Red Hat Enterprise Linux 4.

Two buffer overflow bugs were found in sharutils. If an attacker can place a malicious 'wc' command on a victim's machine, or trick a victim into running a specially crafted command, it could lead to arbitrary code execution. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1773 to this issue.

A bug was found in the way unshar creates temporary files. A local user could use symlinks to overwrite arbitrary files the victim running unshar has write access to. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0990 to this issue.

All users of sharutils should upgrade to this updated package, which includes backported fixes to correct these issues.

ID	Name	Severity
21863	CentOS 3 / 4 : lynx (CESA-2005:803)	high
21862	CentOS 3 / 4 : xloadimage (CESA-2005:802)	medium
21861	CentOS 3 / 4 : openssl (CESA-2005:800)	medium
21860	CentOS 3 / 4 : ruby (CESA-2005:799)	high
21859	CentOS 3 / 4 : Mozilla (CESA-2005:789)	high
21858	CentOS 3 / 4 : util-linux / mount (CESA-2005:782)	high
21857	CentOS 3 / 4 : wget (CESA-2005:771)	medium
21856	CentOS 3 / 4 : mozilla (CESA-2005:769)	high
21855	CentOS 3 / 4 : squid (CESA-2005:766)	medium
21854	CentOS 3 / 4 : pcre (CESA-2005:761)	high
21853	CentOS 3 / 4 : cvs (CESA-2005:756)	medium
21852	CentOS 3 : openldap / nss_ldap (CESA-2005:751)	high
21851	CentOS 3 / 4 : cups (CESA-2005:706)	low
21850	CentOS 3 / 4 : ethereal (CESA-2005:687)	high
21849	CentOS 3 : kernel (CESA-2005:663)	medium
21848	CentOS 3 : binutils (CESA-2005:659)	medium
21847	CentOS 3 / 4 : fetchmail (CESA-2005:640)	medium
21846	CentOS 3 / 4 : gaim (CESA-2005:627)	high
21845	CentOS 3 / 4 : httpd (CESA-2005:608)	critical
21844	CentOS 3 / 4 : mozilla (CESA-2005:587)	high
21843	CentOS 3 / 4 : httpd (CESA-2005:582)	medium
21842	CentOS 3 : cups (CESA-2005:571)	high
21841	CentOS 3 / 4 : php (CESA-2005:564)	high
21840	CentOS 3 : krb5 (CESA-2005:562)	high
21839	CentOS 3 : openssh (CESA-2005:550)	medium
21838	CentOS 3 / 4 : sudo (CESA-2005:535)	low
21837	CentOS 3 / 4 : freeradius (CESA-2005:524)	high
21836	CentOS 3 / 4 : gaim (CESA-2005:518)	medium
21835	CentOS 3 / 4 : mikmod (CESA-2005:506)	high
21834	CentOS 3 / 4 : telnet (CESA-2005:504)	medium
21833	CentOS 3 : XFree86 (CESA-2005:501)	medium
21832	CentOS 3 / 4 : gedit (CESA-2005:499)	low
21831	CentOS 3 / 4 : ImageMagick (CESA-2005:480)	medium
21830	CentOS 3 / 4 : openssl (CESA-2005:476)	medium
21829	CentOS 3 / 4 : bzip2 (CESA-2005:474)	medium
21828	CentOS 3 : kernel (CESA-2005:472)	high
21827	CentOS 3 / 4 : mozilla (CESA-2005:435)	high
21826	CentOS 3 / 4 : postgresql (CESA-2005:433)	high
21825	CentOS 3 / 4 : gaim (CESA-2005:429)	high
21824	CentOS 3 / 4 : ethereal (CESA-2005:427)	high
21823	CentOS 3 : tcpdump (CESA-2005:421)	medium
21822	CentOS 3 / 4 : squid (CESA-2005:415)	high
21821	CentOS 3 / 4 : ImageMagick (CESA-2005:413)	medium
21820	CentOS 3 / 4 : openmotif (CESA-2005:412)	high
21819	CentOS 3 / 4 : gftp (CESA-2005:410)	medium
21818	CentOS 3 : PHP (CESA-2005:405)	high
21817	CentOS 3 / 4 : cvs (CESA-2005:387)	high
21816	CentOS 3 / 4 : nasm (CESA-2005:381)	critical
21815	CentOS 3 / 4 : cpio (CESA-2005:378)	low
21814	CentOS 3 / 4 : sharutils (CESA-2005:377)	high

Detections

Analytics

CentOS Local Security Checks Family for Nessus

high

medium

medium

high

high

high

medium

high

medium

high

medium

high

low

high

medium

medium

medium

high

critical

high

medium

high

high

high

medium

low

high

medium

high

medium

medium

low

medium

medium

medium

high

high

high

high

high

medium

high

medium

high

medium

high

high

critical

low

high