Updated ghostscript packages that fix a PDF output issue and a temporary file security bug are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Ghostscript is a program for displaying PostScript files or printing them to non-PostScript printers.

A bug was found in the way several of Ghostscript's utility scripts created temporary files. A local user could cause these utilities to overwrite files that the victim running the utility has write access to. The Common Vulnerabilities and Exposures project assigned the name CVE-2004-0967 to this issue.

Additionally, this update addresses the following issue :

A problem has been identified in the PDF output driver, which can cause output to be delayed indefinitely on some systems. The fix has been backported from GhostScript 7.07.

All users of ghostscript should upgrade to these updated packages, which contain backported patches to resolve these issues.

Updated rsh packages that fix various bugs and a theoretical security issue are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team

The rsh package contains a set of programs that allow users to run commands on remote machines, login to other machines, and copy files between machines, using the rsh, rlogin, and rcp commands. All three of these commands use rhosts-style authentication.

The rcp protocol allows a server to instruct a client to write to arbitrary files outside of the current directory. This could potentially cause a security issue if a user uses rcp to copy files from a malicious server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0175 to this issue.

These updated packages also address the following bugs :

The rexec command failed with 'Invalid Argument', because the code used sigaction() as an unsupported signal.

The rlogind server reported 'SIGCHLD set to SIG_IGN but calls wait()' message to the system log because the original BSD code was ported incorrectly to linux.

The rexecd server did not function on systems where client hostnames were not in the DNS service, because server code called gethostbyaddr() for each new connection.

The rcp command incorrectly used the 'errno' variable and produced erroneous error messages.

The rexecd command ignored settings in the /etc/security/limits file, because the PAM session was incorrectly initialized.

The rexec command prompted for username and password regardless of the ~/.netrc configuration file contents. This updated package contains a patch that no longer skips the ~/.netrc file.

All users of rsh should upgrade to these updated packages, which resolve these issues.

Updated kdegraphics packages that resolve multiple security issues in kfax are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team

The kdegraphics package contains graphics applications for the K Desktop Environment.

During a source code audit, Chris Evans discovered a number of integer overflow bugs that affect libtiff. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these bugs. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0886 and CVE-2004-0804 to these issues.

Additionally, a number of buffer overflow bugs that affect libtiff have been found. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these bugs. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0803 to this issue.

Users of kfax should upgrade to these updated packages, which contain backported patches and are not vulnerable to this issue.

An updated libxml package that fixes multiple buffer overflows is now available.

[Updated 24 May 2005] Multilib packages have been added to this advisory

The libxml package contains a library for manipulating XML files.

Multiple buffer overflow bugs have been found in libxml versions prior to 2.6.14. If an attacker can trick a user into passing a specially crafted FTP URL or FTP proxy URL to an application that uses the vulnerable functions of libxml, it could be possible to execute arbitrary code. Additionally, if an attacker can return a specially crafted DNS request to libxml, it could be possible to execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0989 to this issue.

Yuuichi Teranishi discovered a flaw in libxml versions prior to 2.6.6.
When fetching a remote resource via FTP or HTTP, libxml uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0110 to this issue.

All users are advised to upgrade to this updated package, which contains backported patches and is not vulnerable to these issues.

Updated gd packages that fix security issues with overflow in various memory allocation calls are now available.

[Updated 24 May 2005] Multilib packages have been added to this advisory

The gd packages contain a graphics library used for the dynamic creation of images such as PNG and JPEG.

Several buffer overflows were reported in various memory allocation calls. An attacker could create a carefully crafted image file in such a way that it could cause ImageMagick to execute arbitrary code when processing the image. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0990 to these issues.

While researching the fixes to these overflows, additional buffer overflows were discovered in calls to gdMalloc. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0941 to these issues.

Users of gd should upgrade to these updated packages, which contain a backported security patch, and are not vulnerable to these issues.

ID	Name	Severity
21797	CentOS 3 : ghostscript (CESA-2005:081)	high
21796	CentOS 3 : rsh (CESA-2005:074)	medium
21795	CentOS 3 : kdegraphics (CESA-2005:021)	critical
21794	CentOS 3 : libxml (CESA-2004:650)	critical
21793	CentOS 3 : gd (CESA-2004:638)	critical

Detections

Analytics

CentOS Local Security Checks Family for Nessus

high

medium

critical

critical

critical