Updated openoffice.org packages are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

A heap based buffer overflow bug was found in the OpenOffice.org DOC file processor. An attacker could create a carefully crafted DOC file in such a way that it could cause OpenOffice.org to execute arbitrary code when the file was opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0941 to this issue.

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain backported fixes for these issues.

Updated net-snmp packages that fix two security issues and various bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

SNMP (Simple Network Management Protocol) is a protocol used for network management.

A denial of service bug was found in the way net-snmp uses network stream protocols. It is possible for a remote attacker to send a net-snmp agent a specially crafted packet which will crash the agent.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2177 to this issue.

An insecure temporary file usage bug was found in net-snmp's fixproc command. It is possible for a local user to modify the content of temporary files used by fixproc which can lead to arbitrary command execution. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1740 to this issue.

Additionally the following bugs have been fixed: - snmpwalk no longer hangs when a non-existent pid is listed. - snmpd no longer segfaults due to incorrect handling of lmSensors. - an incorrect assignment leading to invalid values in ASN mibs has been fixed. - on systems running a 64-bit kernel, the values in /proc/net/dev no longer become too large to fit in a 32-bit object. - the net-snmp-devel packages correctly depend on elfutils-libelf-devel. - large file systems are correctly handled - snmp daemon now reports gigabit Ethernet speeds correctly - fixed consistency between IP adresses and hostnames in configuration file

All users of net-snmp should upgrade to these updated packages, which resolve these issues.

An updated gaim package that fixes multiple denial of service issues is now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The Gaim application is a multi-protocol instant messaging client.

A buffer overflow bug was found in the way gaim escapes HTML. It is possible that a remote attacker could send a specially crafted message to a Gaim client, causing it to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0965 to this issue.

A bug was found in several of gaim's IRC processing functions. These functions fail to properly remove various markup tags within an IRC message. It is possible that a remote attacker could send a specially crafted message to a Gaim client connected to an IRC server, causing it to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0966 to this issue.

A bug was found in gaim's Jabber message parser. It is possible for a remote Jabber user to send a specially crafted message to a Gaim client, causing it to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0967 to this issue.

In addition to these denial of service issues, multiple minor upstream bugfixes are included in this update.

Users of Gaim are advised to upgrade to this updated package which contains Gaim version 1.2.1 and is not vulnerable to these issues.

An updated gzip package is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The gzip package contains the GNU gzip data compression program.

A bug was found in the way zgrep processes file names. If a user can be tricked into running zgrep on a file with a carefully crafted file name, arbitrary commands could be executed as the user running zgrep.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0758 to this issue.

A bug was found in the way gunzip modifies permissions of files being decompressed. A local attacker with write permissions in the directory in which a victim is decompressing a file could remove the file being written and replace it with a hard link to a different file owned by the victim. gunzip then gives the linked file the permissions of the uncompressed file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0988 to this issue.

A directory traversal bug was found in the way gunzip processes the -N flag. If a victim decompresses a file with the -N flag, gunzip fails to sanitize the path which could result in a file owned by the victim being overwritten. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1228 to this issue.

Users of gzip should upgrade to this updated package, which contains backported patches to correct these issues.

Updated tetex packages that fix several integer overflows are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

TeTeX is an implementation of TeX for Linux or UNIX systems. TeX takes a text file and a set of formatting commands as input and creates a typesetter-independent .dvi (DeVice Independent) file as output.

A number of security flaws have been found affecting libraries used internally within teTeX. An attacker who has the ability to trick a user into processing a malicious file with teTeX could cause teTeX to crash or possibly execute arbitrary code.

A number of integer overflow bugs that affect Xpdf were discovered.
The teTeX package contains a copy of the Xpdf code used for parsing PDF files and is therefore affected by these bugs. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0888 and CVE-2004-1125 to these issues.

A number of integer overflow bugs that affect libtiff were discovered.
The teTeX package contains an internal copy of libtiff used for parsing TIFF image files and is therefore affected by these bugs. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0803, CVE-2004-0804 and CVE-2004-0886 to these issues.

Also latex2html is added to package tetex-latex for 64bit platforms.

Users of teTeX should upgrade to these updated packages, which contain backported patches and are not vulnerable to these issues.

An updated slocate package that fixes a denial of service and various bugs is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Slocate is a security-enhanced version of locate. Like locate, slocate searches through a central database (updated nightly) for files that match a given pattern. Slocate allows you to quickly find files anywhere on your system.

A bug was found in the way slocate scans the local filesystem. A carefully prepared directory structure could cause updatedb's file system scan to fail silently, resulting in an incomplete slocate database. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2499 to this issue.

Additionally this update addresses the following issues :

  - Files with a size of 2 GB and larger were not entered     into the slocate database.

  - File system type exclusions were processed only when     starting updatedb and did not reflect file systems     mounted while updatedb was running (for example,     automounted file systems).

  - File system type exclusions were ignored for file     systems that were mounted to a path containing a     symbolic link.

  - Databases created by slocate were owned by the slocate     group even if they were created by regular users.

Users of slocate are advised to upgrade to this updated package, which contains backported patches and is not affected by these issues.

Updated gtk2 packages that fix a double free vulnerability are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The gtk2 package contains the GIMP ToolKit (GTK+), a library for creating graphical user interfaces for the X Window System.

A bug was found in the way gtk2 processes BMP images. It is possible that a specially crafted BMP image could cause a denial of service attack on applications linked against gtk2. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0891 to this issue.

Users of gtk2 are advised to upgrade to these packages, which contain a backported patch and is not vulnerable to this issue.

Updated gdk-pixbuf packages that fix a double free vulnerability are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The gdk-pixbuf package contains an image loading library used with the GNOME GUI desktop environment.

A bug was found in the way gdk-pixbuf processes BMP images. It is possible that a specially crafted BMP image could cause a denial of service attack on applications linked against gdk-pixbuf. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0891 to this issue.

Users of gdk-pixbuf are advised to upgrade to these packages, which contain a backported patch and is not vulnerable to this issue.

Updated curl packages are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and Dict servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity.

Multiple buffer overflow bugs were found in the way curl processes base64 encoded replies. If a victim can be tricked into visiting a URL with curl, a malicious web server could execute arbitrary code on a victim's machine. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0490 to this issue.

All users of curl are advised to upgrade to these updated packages, which contain backported fixes for these issues.

Updated XFree86 packages that fix a libXpm integer overflow flaw are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

XFree86 is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces (GUIs) such as GNOME and KDE are designed upon.

An integer overflow flaw was found in libXpm, which is used by some applications for loading of XPM images. An attacker could create a malicious XPM file that would execute arbitrary code if opened by a victim using an application linked to the vulnerable library. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0605 to this issue.

The updated XFree86 packages also address the following minor issues :

  - Updated     XFree86-4.3.0-keyboard-disable-ioport-access-v3.patch to     make warning messages less alarmist.

  - Backported XFree86-4.3.0-libX11-stack-overflow.patch     from xorg-x11-6.8.1 packaging to fix stack overflow in     libX11, which was discovered by new security features of     gcc4.

Users of XFree86 should upgrade to these updated packages, which contain a backported patch and are not vulnerable to this issue.

Updated krb5 packages which fix two buffer overflow vulnerabilities in the included Kerberos-aware telnet client are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Kerberos is a networked authentication system which uses a trusted third party (a KDC) to authenticate clients and servers to each other.

The krb5-workstation package includes a Kerberos-aware telnet client.
Two buffer overflow flaws were discovered in the way the telnet client handles messages from a server. An attacker may be able to execute arbitrary code on a victim's machine if the victim can be tricked into connecting to a malicious telnet server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0468 and CVE-2005-0469 to these issues.

Users of krb5 should update to these erratum packages which contain a backported patch to correct this issue.

Red Hat would like to thank iDEFENSE for their responsible disclosure of this issue.

Updated kdelibs packages that fix a local denial of service issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kdelibs package provides libraries for the K Desktop Environment.

Sebastian Krahmer discovered a flaw in dcopserver, the KDE Desktop Communication Protocol (DCOP) daemon. A local user could use this flaw to stall the DCOP authentication process, affecting any local desktop users and causing a reduction in their desktop functionality. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0396 to this issue.

Users of KDE should upgrade to these erratum packages, which contain backported patches to correct these issues.

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux version 3. This is the fifth regular update.

The Linux kernel handles the basic functions of the operating system.

This is the fifth regular kernel update to Red Hat Enterprise Linux 3.

New features introduced by this update include :

  - support for 2-TB partitions on block devices - support     for new disk, network, and USB devices - support for     clustered APIC mode on AMD64 NUMA systems - netdump     support on AMD64, Intel EM64T, Itanium, and ppc64     systems - diskdump support on sym53c8xx and SATA     piix/promise adapters - NMI switch support on AMD64 and     Intel EM64T systems

There were many bug fixes in various parts of the kernel. The ongoing effort to resolve these problems has resulted in a marked improvement in the reliability and scalability of Red Hat Enterprise Linux 3.

Some key areas affected by these fixes include the kernel's networking, SATA, TTY, and USB subsystems, as well as the architecture-dependent handling under the ia64, ppc64, and x86_64 directories. Scalability improvements were made primarily in the memory management and file system areas.

A flaw in offset handling in the xattr file system code backported to Red Hat Enterprise Linux 3 was fixed. On 64-bit systems, a user who can access an ext3 extended-attribute-enabled file system could cause a denial of service (system crash). This issue is rated as having a moderate security impact (CVE-2005-0757).

The following device drivers have been upgraded to new versions :

3c59x ------ LK1.1.18 3w-9xxx ---- 2.24.00.011fw (new in Update 5) 3w-xxxx ---- 1.02.00.037 8139too ---- (upstream 2.4.29) b44 -------- 0.95 cciss ------ v2.4.54.RH1 e100 ------- 3.3.6-k2 e1000 ------ 5.6.10.1-k2 lpfcdfc ---- 1.0.13 (new in Update 5) tg3 -------- 3.22RH

Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architectures and configurations as listed in this erratum.

Updated glibc packages that address several bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The GNU libc packages (known as glibc) contain the standard C libraries used by applications.

It was discovered that the use of LD_DEBUG, LD_SHOW_AUXV, and LD_DYNAMIC_WEAK were not restricted for a setuid program. A local user could utilize this flaw to gain information, such as the list of symbols used by the program. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1453 to this issue.

This erratum addresses the following bugs in the GNU C Library :

  - fix stack alignment in IA-32 clone - fix double free in     globfree - fix fnmatch to avoid jumping based on     uninitialized memory read - fix fseekpos after ungetc -     fix TZ env var handling if the variable ends with + or -
    - avoid depending on values read from uninitialized     memory in strtold on certain architectures - fix mapping     alignment computation in dl-load - fix i486+ strncat     inline assembly - make gethostid/sethostid work on     bi-arch platforms - fix ppc64 getcontext/swapcontext -     fix pthread_exit if called after pthread_create, but     before the created thread actually started - fix return     values for tgamma (+-0) - fix handling of very long     lines in /etc/hosts - avoid page aliasing of thread     stacks on AMD64 - avoid busy loop in malloc if     concurrent with fork - allow putenv and setenv in shared     library constructors - fix restoring of CCR in     swapcontext and getcontext on ppc64 - avoid using     sigaction (SIGPIPE, ...) in syslog implementation

All users of glibc should upgrade to these updated packages, which resolve these issues.

Updated evolution packages that fix various bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Evolution is the GNOME collection of personal information management (PIM) tools. Evolution includes a mailer, calendar, contact manager, and communication facility. The tools which make up Evolution are tightly integrated with one another and act as a seamless personal information management tool.

A bug was found in Evolution's helper program camel-lock-helper. This bug could allow a local attacker to gain root privileges if camel-lock-helper has been built to execute with elevated privileges.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0102 to this issue. On Red Hat Enterprise Linux, camel-lock-helper is not built to execute with elevated privileges by default. Please note however that if users have rebuilt Evolution from the source RPM, as the root user, camel-lock-helper may be given elevated privileges.

Additionally, these updated packages address the following issues :

-- If evolution ran during a GNOME session, the evolution-wombat process did not exit when the user logged out of the desktop.

-- For folders marked for Offline Synchronization: if a user moved a message from a Local Folder to an IMAP folder while in Offline mode, the message was not present in either folder after returning to Online mode.

This update fixes this problem. Email messages that have been lost this way may still be present in the following path :

~/evolution/<NAME_OF_MAIL_STORE>/ \ <path-to-folder-via-subfolder-directories>/ \ <temporary-uid-of-message>

If this bug has affected you it may be possible to recover data by examining the contents of this directory.

All users of evolution should upgrade to these updated packages, which resolve these issues.

Updated openssh packages that fix a potential security vulnerability and various other bugs are now available for Red Hat Enterprise Linux 3.

This update has been rated as having low security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. SSH replaces rlogin and rsh, and provides secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forwarded over a secure channel. Public key authentication can be used for 'passwordless' access to servers.

The scp protocol allows a server to instruct a client to write to arbitrary files outside of the current directory. This could potentially cause a security issue if a user uses scp to copy files from a malicious server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0175 to this issue.

These updated packages also correct the following bugs :

On systems where direct ssh access for the root user was disabled by configuration (setting 'PermitRootLogin no'), attempts to guess the root password could be judged as sucessful or unsucessful by observing a delay.

On systems where the privilege separation feature was turned on, the user resource limits were not correctly set if the configuration specified to raise them above the defaults. It was also not possible to change an expired password.

Users of openssh should upgrade to these updated packages, which contain backported patches to resolve these issues.

Updated ghostscript packages that fix a PDF output issue and a temporary file security bug are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Ghostscript is a program for displaying PostScript files or printing them to non-PostScript printers.

A bug was found in the way several of Ghostscript's utility scripts created temporary files. A local user could cause these utilities to overwrite files that the victim running the utility has write access to. The Common Vulnerabilities and Exposures project assigned the name CVE-2004-0967 to this issue.

Additionally, this update addresses the following issue :

A problem has been identified in the PDF output driver, which can cause output to be delayed indefinitely on some systems. The fix has been backported from GhostScript 7.07.

All users of ghostscript should upgrade to these updated packages, which contain backported patches to resolve these issues.

Updated rsh packages that fix various bugs and a theoretical security issue are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team

The rsh package contains a set of programs that allow users to run commands on remote machines, login to other machines, and copy files between machines, using the rsh, rlogin, and rcp commands. All three of these commands use rhosts-style authentication.

The rcp protocol allows a server to instruct a client to write to arbitrary files outside of the current directory. This could potentially cause a security issue if a user uses rcp to copy files from a malicious server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0175 to this issue.

These updated packages also address the following bugs :

The rexec command failed with 'Invalid Argument', because the code used sigaction() as an unsupported signal.

The rlogind server reported 'SIGCHLD set to SIG_IGN but calls wait()' message to the system log because the original BSD code was ported incorrectly to linux.

The rexecd server did not function on systems where client hostnames were not in the DNS service, because server code called gethostbyaddr() for each new connection.

The rcp command incorrectly used the 'errno' variable and produced erroneous error messages.

The rexecd command ignored settings in the /etc/security/limits file, because the PAM session was incorrectly initialized.

The rexec command prompted for username and password regardless of the ~/.netrc configuration file contents. This updated package contains a patch that no longer skips the ~/.netrc file.

All users of rsh should upgrade to these updated packages, which resolve these issues.

Updated kdegraphics packages that resolve multiple security issues in kfax are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team

The kdegraphics package contains graphics applications for the K Desktop Environment.

During a source code audit, Chris Evans discovered a number of integer overflow bugs that affect libtiff. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these bugs. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0886 and CVE-2004-0804 to these issues.

Additionally, a number of buffer overflow bugs that affect libtiff have been found. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these bugs. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0803 to this issue.

Users of kfax should upgrade to these updated packages, which contain backported patches and are not vulnerable to this issue.

An updated libxml package that fixes multiple buffer overflows is now available.

[Updated 24 May 2005] Multilib packages have been added to this advisory

The libxml package contains a library for manipulating XML files.

Multiple buffer overflow bugs have been found in libxml versions prior to 2.6.14. If an attacker can trick a user into passing a specially crafted FTP URL or FTP proxy URL to an application that uses the vulnerable functions of libxml, it could be possible to execute arbitrary code. Additionally, if an attacker can return a specially crafted DNS request to libxml, it could be possible to execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0989 to this issue.

Yuuichi Teranishi discovered a flaw in libxml versions prior to 2.6.6.
When fetching a remote resource via FTP or HTTP, libxml uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0110 to this issue.

All users are advised to upgrade to this updated package, which contains backported patches and is not vulnerable to these issues.

Updated gd packages that fix security issues with overflow in various memory allocation calls are now available.

[Updated 24 May 2005] Multilib packages have been added to this advisory

The gd packages contain a graphics library used for the dynamic creation of images such as PNG and JPEG.

Several buffer overflows were reported in various memory allocation calls. An attacker could create a carefully crafted image file in such a way that it could cause ImageMagick to execute arbitrary code when processing the image. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0990 to these issues.

While researching the fixes to these overflows, additional buffer overflows were discovered in calls to gdMalloc. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0941 to these issues.

Users of gd should upgrade to these updated packages, which contain a backported security patch, and are not vulnerable to these issues.

ID	Name	Severity
21813	CentOS 3 / 4 : OpenOffice.org (CESA-2005:375)	medium
21812	CentOS 3 : net-snmp (CESA-2005:373)	critical
21811	CentOS 3 / 4 : gaim (CESA-2005:365)	medium
21810	CentOS 3 / 4 : gzip (CESA-2005:357)	medium
21809	CentOS 3 : tetex (CESA-2005:354)	critical
21808	CentOS 3 : slocate (CESA-2005:345)	low
21807	CentOS 3 / 4 : gtk2 (CESA-2005:344)	medium
21806	CentOS 3 / 4 : gdk-pixbuf (CESA-2005:343)	medium
21805	CentOS 3 / 4 : curl (CESA-2005:340)	medium
21804	CentOS 3 : XFree86 (CESA-2005:331)	high
21803	CentOS 3 : krb5 (CESA-2005:330)	high
21802	CentOS 3 / 4 : kdelibs (CESA-2005:307)	low
21801	CentOS 3 : kernel (CESA-2005:294)	low
21800	CentOS 3 : glibc (CESA-2005:256)	low
21799	CentOS 3 : evolution (CESA-2005:238)	high
21798	CentOS 3 : openssh (CESA-2005:106)	medium
21797	CentOS 3 : ghostscript (CESA-2005:081)	high
21796	CentOS 3 : rsh (CESA-2005:074)	medium
21795	CentOS 3 : kdegraphics (CESA-2005:021)	critical
21794	CentOS 3 : libxml (CESA-2004:650)	critical
21793	CentOS 3 : gd (CESA-2004:638)	critical

Detections

Analytics

CentOS Local Security Checks Family for Nessus

medium

critical

medium

medium

critical

low

medium

medium

medium

high

high

low

low

low

high

medium

high

medium

critical

critical

critical