From Red Hat Security Advisory 2007:0011 :

Updated libgsf packages that fix a buffer overflow flaw are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The GNOME Structured File Library is a utility library for reading and writing structured file formats.

A heap based buffer overflow flaw was found in the way GNOME Structured File Library processes and certain OLE documents. If an person opened a specially crafted OLE file, it could cause the client application to crash or execute arbitrary code. (CVE-2006-4514)

Users of GNOME Structured File Library should upgrade to these updated packages, which contain a backported patch that resolves this issue.

From Red Hat Security Advisory 2007:0008 :

Updated dbus packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

D-BUS is a system for sending messages between applications. It is used both for the systemwide message bus service, and as a per-user-login-session messaging facility.

Kimmo Hamalainen discovered a flaw in the way D-BUS processes certain messages. It is possible for a local unprivileged D-BUS process to disrupt the ability of another D-BUS process to receive messages.
(CVE-2006-6107)

Users of dbus are advised to upgrade to these updated packages, which contain backported patches to correct this issue.

From Red Hat Security Advisory 2007:0003 :

Updated X.org packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

X.org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

iDefense reported three integer overflow flaws in the X.org Render and DBE extensions. A malicious authorized client could exploit this issue to cause a denial of service (crash) or potentially execute arbitrary code with root privileges on the X.org server. (CVE-2006-6101, CVE-2006-6102, CVE-2006-6103)

Users of X.org should upgrade to these updated packages, which contain a backported patch and is not vulnerable to this issue.

From Red Hat Security Advisory 2007:0002 :

Updated XFree86 packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1 and 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

XFree86 is an implementation of the X Window System, which provides the core functionality for the Linux graphical desktop.

iDefense reported three integer overflow flaws in the XFree86 Render and DBE extensions. A malicious authorized client could exploit this issue to cause a denial of service (crash) or potentially execute arbitrary code with root privileges on the XFree86 server.
(CVE-2006-6101, CVE-2006-6102, CVE-2006-6103)

Users of XFree86 should upgrade to these updated packages, which contain a backported patch and is not vulnerable to this issue.

From Red Hat Security Advisory 2007:0001 :

Updated openoffice.org packages are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.

Several integer overflow bugs were found in the OpenOffice.org WMF file processor. An attacker could create a carefully crafted WMF file that could cause OpenOffice.org to execute arbitrary code when the file was opened by a victim. (CVE-2006-5870)

All users of OpenOffice.org are advised to upgrade to these updated packages, which contain a backported fix for this issue.

From Red Hat Security Advisory 2006:0760 :

Updated thunderbird packages that fix several security bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the way Thunderbird processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause Thunderbird to crash or execute arbitrary code as the user running Thunderbird. JavaScript support is disabled by default in Thunderbird;
this issue is not exploitable without enabling JavaScript.
(CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504)

Several flaws were found in the way Thunderbird renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running Thunderbird.
(CVE-2006-6497)

A heap based buffer overflow flaw was found in the way Thunderbird parses the Content-Type mail header. A malicious mail message could cause the Thunderbird client to crash or possibly execute arbitrary code as the user running Thunderbird. (CVE-2006-6505)

Users of Thunderbird are advised to apply this update, which contains Thunderbird version 1.5.0.9 that corrects these issues.

From Red Hat Security Advisory 2006:0759 :

Updated SeaMonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

Several flaws were found in the way SeaMonkey processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause SeaMonkey to crash or execute arbitrary code as the user running SeaMonkey.
(CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504)

Several flaws were found in the way SeaMonkey renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running SeaMonkey. (CVE-2006-6497)

A heap based buffer overflow flaw was found in the way SeaMonkey Mail parses the Content-Type mail header. A malicious mail message could cause the SeaMonkey Mail client to crash or possibly execute arbitrary code as the user running SeaMonkey Mail. (CVE-2006-6505)

Users of SeaMonkey are advised to upgrade to these erratum packages, which contain SeaMonkey version 1.0.7 that corrects these issues.

From Red Hat Security Advisory 2006:0758 :

Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

Several flaws were found in the way Firefox processes certain malformed JavaScript code. A malicious web page could cause the execution of JavaScript code in such a way that could cause Firefox to crash or execute arbitrary code as the user running Firefox.
(CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503, CVE-2006-6504)

Several flaws were found in the way Firefox renders web pages. A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running Firefox. (CVE-2006-6497)

Users of Firefox are advised to upgrade to these erratum packages, which contain Firefox version 1.5.0.9 that corrects these issues.

From Red Hat Security Advisory 2006:0754 :

Updated GnuPG packages that fix two security issues are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

Tavis Ormandy discovered a stack overwrite flaw in the way GnuPG decrypts messages. An attacker could create carefully crafted message that could cause GnuPG to execute arbitrary code if a victim attempts to decrypt the message. (CVE-2006-6235)

A heap based buffer overflow flaw was found in the way GnuPG constructs messages to be written to the terminal during an interactive session. An attacker could create a carefully crafted message which with user interaction could cause GnuPG to execute arbitrary code with the permissions of the user running GnuPG.
(CVE-2006-6169)

All users of GnuPG are advised to upgrade to this updated package, which contains a backported patch to correct these issues.

From Red Hat Security Advisory 2006:0749 :

Updated tar packages that fix a path traversal flaw are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The GNU tar program saves many files together in one archive and can restore individual files (or all of the files) from that archive.

Teemu Salmela discovered a path traversal flaw in the way GNU tar extracted archives. A malicious user could create a tar archive that could write to arbitrary files to which the user running GNU tar has write access. (CVE-2006-6097)

Users of tar should upgrade to this updated package, which contains a replacement backported patch to correct this issue.

From Red Hat Security Advisory 2006:0746 :

Updated mod_auth_kerb packages that fix a security flaw and a bug in multiple realm handling are now available for Red Hat Enterprise Linux 4.

This update has been rated as having low security impact by the Red Hat Security Response Team.

mod_auth_kerb is module for the Apache HTTP Server designed to provide Kerberos authentication over HTTP.

An off by one flaw was found in the way mod_auth_kerb handles certain Kerberos authentication messages. A remote client could send a specially crafted authentication request which could crash an httpd child process (CVE-2006-5989).

A bug in the handling of multiple realms configured using the 'KrbAuthRealms' directive has also been fixed.

All users of mod_auth_kerb should upgrade to these updated packages, which contain backported patches that resolve these issues.

From Red Hat Security Advisory 2006:0742 :

An updated elinks package that corrects a security vulnerability is now available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Elinks is a text mode Web browser used from the command line that supports rendering modern web pages.

An arbitrary file access flaw was found in the Elinks SMB protocol handler. A malicious web page could have caused Elinks to read or write files with the permissions of the user running Elinks.
(CVE-2006-5925)

All users of Elinks are advised to upgrade to this updated package, which resolves this issue by removing support for the SMB protocol from Elinks.

Note: this issue did not affect the Elinks package shipped with Red Hat Enterprise Linux 3, or the Links package shipped with Red Hat Enterprise Linux 2.1.

From Red Hat Security Advisory 2006:0738 :

Updated openssh packages that fix an authentication flaw are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having low security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This package includes the core files necessary for both the OpenSSH client and server.

An authentication flaw was found in OpenSSH's privilege separation monitor. If it ever becomes possible to alter the behavior of the unprivileged process when OpenSSH is using privilege separation, an attacker may then be able to login without possessing proper credentials. (CVE-2006-5794)

Please note that this flaw by itself poses no direct threat to OpenSSH users. Without another security flaw that could allow an attacker to alter the behavior of OpenSSH's unprivileged process, this flaw cannot be exploited. There are currently no known flaws to exploit this behavior. However, we have decided to issue this erratum to fix this flaw to reduce the security impact if an unprivileged process flaw is ever found.

Users of openssh should upgrade to these updated packages, which contain a backported patch to resolve this issue.

Updated thunderbird packages that fix several security bugs are now available for Red Hat Enterprise Linux 4. 

This update has been rated as having critical security impact by the Red Hat Security Response Team. 

Mozilla Thunderbird is a standalone mail and newsgroup client. 

Users of Thunderbird are advised to upgrade to this update, which contains Thunderbird version 1.5.0.8 that corrects these issues. 


From Red Hat Security Advisory 2006:0735 :

Several flaws were found in the way Thunderbird processes certain malformed Javascript code.  A malicious HTML mail message could cause the execution of Javascript code in such a way that could cause Thunderbird to crash or execute arbitrary code as the user running Thunderbird.  (CVE-2006-5463, CVE-2006-5747, CVE-2006-5748)

Several flaws were found in the way Thunderbird renders HTML mail messages.  A malicious HTML mail message could cause the mail client to crash or possibly execute arbitrary code as the user running Thunderbird.  (CVE-2006-5464)

A flaw was found in the way Thunderbird verifies RSA signatures.  For RSA keys with exponent 3 it is possible for an attacker to forge a signature that would be incorrectly verified by the NSS library. Thunderbird as shipped trusts several root Certificate Authorities that use exponent 3.  An attacker could have created a carefully crafted SSL certificate which would be incorrectly trusted when their site was visited by a victim.  This flaw was previously thought to be fixed in Thunderbird 1.5.0.7, however Ulrich Kuehn discovered the fix was incomplete (CVE-2006-5462)


From Red Hat Security Advisory 2006:0677 :

Two flaws were found in the way Thunderbird processed certain regular expressions.  A malicious HTML email could cause a crash or possibly execute arbitrary code as the user running Thunderbird.  (CVE-2006-4565, CVE-2006-4566)

A flaw was found in the Thunderbird auto-update verification system.  An attacker who has the ability to spoof a victim's DNS could get Firefox to download and install malicious code.  In order to exploit this issue an attacker would also need to get a victim to previously accept an unverifiable certificate.  (CVE-2006-4567)

A flaw was found in the handling of Javascript timed events.  A malicious HTML email could crash the browser or possibly execute arbitrary code as the user running Thunderbird.  (CVE-2006-4253)

Daniel Bleichenbacher recently described an implementation error in RSA signature verification.  For RSA keys with exponent 3 it is possible for an attacker to forge a signature that which would be incorrectly verified by the NSS library.  (CVE-2006-4340)

A flaw was found in Thunderbird that triggered when a HTML message contained a remote image pointing to a XBL script.  An attacker could have created a carefully crafted message which would execute Javascript if certain actions were performed on the email by the recipient, even if Javascript was disabled.  (CVE-2006-4570)

A number of flaws were found in Thunderbird.  A malicious HTML email could cause a crash or possibly execute arbitrary code as the user running Thunderbird.  (CVE-2006-4571)


From Red Hat Bug Fix Advisory 2006:0624 :

A problem was found in Thunderbird where starting the application from a graphical launcher (such as a menu item) did not work. 


From Red Hat Security Advisory 2006:0611 :

The Mozilla Foundation has discontinued support for the Mozilla Thunderbird 1.0 branch.  This update deprecates the Mozilla Thunderbird 1.0 branch in Red Hat Enterprise Linux 4 in favor of the supported Mozilla Thunderbird 1.5 branch. 

This update also resolves a number of outstanding Thunderbird security issues :

Several flaws were found in the way Thunderbird processed certain javascript actions.  A malicious mail message could execute arbitrary javascript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware. (CVE-2006-2776, CVE-2006-2784, CVE-2006-2785, CVE-2006-2787, CVE-2006-3807, CVE-2006-3809)

Several denial of service flaws were found in the way Thunderbird processed certain mail messages.  A malicious web page could crash the browser or possibly execute arbitrary code as the user running Thunderbird.  (CVE-2006-2779, CVE-2006-2780, CVE-2006-3801, CVE-2006-3677, CVE-2006-3113, CVE-2006-3803, CVE-2006-3805, CVE-2006-3806, CVE-2006-3811)

Several flaws were found in the way Thunderbird processed certain javascript actions.  A malicious mail message could conduct a cross-site scripting attack or steal sensitive information (such as cookies owned by other domains).  (CVE-2006-3802, CVE-2006-3810)

A form file upload flaw was found in the way Thunderbird handled javascript input object mutation.  A malicious mail message could upload an arbitrary local file at form submission time without user interaction.  (CVE-2006-2782)

A denial of service flaw was found in the way Thunderbird called the crypto.signText() javascript function.  A malicious mail message could crash the browser if the victim had a client certificate loaded. (CVE-2006-2778)

A flaw was found in the way Thunderbird processed Proxy AutoConfig scripts.  A malicious Proxy AutoConfig server could execute arbitrary javascript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install client malware. (CVE-2006-3808)

Note: Please note that JavaScript support is disabled by default in Thunderbird.  The above issues are not exploitable with JavaScript disabled. 

Two flaws were found in the way Thunderbird displayed malformed inline vcard attachments.  If a victim viewed an email message containing a carefully crafted vcard it was possible to execute arbitrary code as the user running Thunderbird.  (CVE-2006-2781, CVE-2006-3804)

A cross site scripting flaw was found in the way Thunderbird processed Unicode Byte-order-Mark (BOM) markers in UTF-8 mail messages.  A malicious web page could execute a script within the browser that a web input sanitizer could miss due to a malformed 'script' tag. (CVE-2006-2783)

Two HTTP response smuggling flaws were found in the way Thunderbird processed certain invalid HTTP response headers.  A malicious web site could return specially crafted HTTP response headers which may bypass HTTP proxy restrictions.  (CVE-2006-2786)

A double free flaw was found in the way the nsIX509::getRawDER method was called.  If a victim visited a carefully crafted web page, it was possible to crash Thunderbird.  (CVE-2006-2788)

Updated seamonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 4. 

This update has been rated as having critical security impact by the Red Hat Security Response Team. 

SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. 

Users of SeaMonkey are advised to upgrade to these erratum packages, which contains SeaMonkey version 1.0.6 that corrects these issues.


From Red Hat Security Advisory 2006:0734 :

Several flaws were found in the way SeaMonkey processes certain malformed Javascript code.  A malicious web page could cause the execution of Javascript code in such a way that could cause SeaMonkey to crash or execute arbitrary code as the user running SeaMonkey. (CVE-2006-5463, CVE-2006-5747, CVE-2006-5748)

Several flaws were found in the way SeaMonkey renders web pages.  A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running SeaMonkey.  (CVE-2006-5464)

A flaw was found in the way SeaMonkey verifies RSA signatures.  For RSA keys with exponent 3 it is possible for an attacker to forge a signature that would be incorrectly verified by the NSS library.  SeaMonkey as shipped trusts several root Certificate Authorities that use exponent 3. An attacker could have created a carefully crafted SSL certificate which be incorrectly trusted when their site was visited by a victim.  This flaw was previously thought to be fixed in SeaMonkey 1.0.5, however Ulrich Kuehn discovered the fix was incomplete (CVE-2006-5462)


From Red Hat Security Advisory 2006:0676 :

Two flaws were found in the way SeaMonkey processed certain regular expressions.  A malicious web page could crash the browser or possibly execute arbitrary code as the user running SeaMonkey.  (CVE-2006-4565, CVE-2006-4566)

A flaw was found in the handling of Javascript timed events.  A malicious web page could crash the browser or possibly execute arbitrary code as the user running SeaMonkey.  (CVE-2006-4253)

Daniel Bleichenbacher recently described an implementation error in RSA signature verification.  For RSA keys with exponent 3 it is possible for an attacker to forge a signature that would be incorrectly verified by the NSS library.  SeaMonkey as shipped trusts several root Certificate Authorities that use exponent 3.  An attacker could have created a carefully crafted SSL certificate which be incorrectly trusted when their site was visited by a victim.  (CVE-2006-4340)

SeaMonkey did not properly prevent a frame in one domain from injecting content into a sub-frame that belongs to another domain, which facilitates website spoofing and other attacks (CVE-2006-4568)

A flaw was found in SeaMonkey Messenger triggered when a HTML message contained a remote image pointing to a XBL script.  An attacker could have created a carefully crafted message which would execute Javascript if certain actions were performed on the email by the recipient, even if Javascript was disabled.  (CVE-2006-4570)

A number of flaws were found in SeaMonkey.  A malicious web page could crash the browser or possibly execute arbitrary code as the user running SeaMonkey.  (CVE-2006-4571)

Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4. 

This update has been rated as having critical security impact by the Red Hat Security Response Team. 

Mozilla Firefox is an open source Web browser. 

Users of Firefox are advised to upgrade to these erratum packages, which contain Firefox version 1.5.0.8 that corrects these issues. 


From Red Hat Security Advisory 2006:0733 :

Several flaws were found in the way Firefox processes certain malformed Javascript code.  A malicious web page could cause the execution of Javascript code in such a way that could cause Firefox to crash or execute arbitrary code as the user running Firefox.  (CVE-2006-5463, CVE-2006-5747, CVE-2006-5748)

Several flaws were found in the way Firefox renders web pages.  A malicious web page could cause the browser to crash or possibly execute arbitrary code as the user running Firefox.  (CVE-2006-5464)

A flaw was found in the way Firefox verifies RSA signatures.  For RSA keys with exponent 3 it is possible for an attacker to forge a signature that would be incorrectly verified by the NSS library.  Firefox as shipped trusts several root Certificate Authorities that use exponent 3. An attacker could have created a carefully crafted SSL certificate which be incorrectly trusted when their site was visited by a victim.  This flaw was previously thought to be fixed in Firefox 1.5.0.7, however Ulrich Kuehn discovered the fix was incomplete (CVE-2006-5462)


From Red Hat Security Advisory 2006:0675 :

Two flaws were found in the way Firefox processed certain regular expressions.  A malicious web page could crash the browser or possibly execute arbitrary code as the user running Firefox.  (CVE-2006-4565, CVE-2006-4566)

A number of flaws were found in Firefox.  A malicious web page could crash the browser or possibly execute arbitrary code as the user running Firefox.  (CVE-2006-4571)

A flaw was found in the handling of Javascript timed events.  A malicious web page could crash the browser or possibly execute arbitrary code as the user running Firefox.  (CVE-2006-4253)

Daniel Bleichenbacher recently described an implementation error in RSA signature verification.  For RSA keys with exponent 3 it is possible for an attacker to forge a signature that would be incorrectly verified by the NSS library.  Firefox as shipped trusts several root Certificate Authorities that use exponent 3.  An attacker could have created a carefully crafted SSL certificate which be incorrectly trusted when their site was visited by a victim.  (CVE-2006-4340)

A flaw was found in the Firefox auto-update verification system.  An attacker who has the ability to spoof a victim's DNS could get Firefox to download and install malicious code.  In order to exploit this issue an attacker would also need to get a victim to previously accept an unverifiable certificate.  (CVE-2006-4567)

Firefox did not properly prevent a frame in one domain from injecting content into a sub-frame that belongs to another domain, which facilitates website spoofing and other attacks (CVE-2006-4568)

Firefox did not load manually opened, blocked popups in the right domain context, which could lead to cross-site scripting attacks.  In order to exploit this issue an attacker would need to find a site which would frame their malicious page and convince the user to manually open a blocked popup.  (CVE-2006-4569)


From Red Hat Security Advisory 2006:0610 :

The Mozilla Foundation has discontinued support for the Mozilla Firefox 1.0 branch.  This update deprecates the Mozilla Firefox 1.0 branch in Red Hat Enterprise Linux 4 in favor of the supported Mozilla Firefox 1.5 branch. 

This update also resolves a number of outstanding Firefox security issues :

Several flaws were found in the way Firefox processed certain javascript actions.  A malicious web page could execute arbitrary javascript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware.  (CVE-2006-2776, CVE-2006-2784, CVE-2006-2785, CVE-2006-2787, CVE-2006-3807, CVE-2006-3809, CVE-2006-3812)

Several denial of service flaws were found in the way Firefox processed certain web content.  A malicious web page could crash the browser or possibly execute arbitrary code as the user running Firefox. (CVE-2006-2779, CVE-2006-2780, CVE-2006-3801, CVE-2006-3677, CVE-2006-3113, CVE-2006-3803, CVE-2006-3805, CVE-2006-3806, CVE-2006-3811)

A cross-site scripting flaw was found in the way Firefox processed Unicode Byte-Order-Mark (BOM) markers in UTF-8 web pages.  A malicious web page could execute a script within the browser that a web input sanitizer could miss due to a malformed 'script' tag.  (CVE-2006-2783)

Several flaws were found in the way Firefox processed certain javascript actions.  A malicious web page could conduct a cross-site scripting attack or steal sensitive information (such as cookies owned by other domains).  (CVE-2006-3802, CVE-2006-3810)

A form file upload flaw was found in the way Firefox handled javascript input object mutation.  A malicious web page could upload an arbitrary local file at form submission time without user interaction. (CVE-2006-2782)

A denial of service flaw was found in the way Firefox called the crypto.signText() javascript function.  A malicious web page could crash the browser if the victim had a client certificate loaded. (CVE-2006-2778)

Two HTTP response smuggling flaws were found in the way Firefox processed certain invalid HTTP response headers.  A malicious web site could return specially crafted HTTP response headers which may bypass HTTP proxy restrictions.  (CVE-2006-2786)

A flaw was found in the way Firefox processed Proxy AutoConfig scripts. A malicious Proxy AutoConfig server could execute arbitrary javascript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware.  (CVE-2006-3808)

A double free flaw was found in the way the nsIX509::getRawDER method was called.  If a victim visited a carefully crafted web page, it was possible to execute arbitrary code as the user running Firefox. (CVE-2006-2788)

Updated PHP packages that fix a security issue are now available. 

This update has been rated as having important security impact by the Red Hat Security Response Team. 

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. 

Users of PHP should upgrade to these updated packages which contain backported patches to correct these issues.  These packages also contain a fix for a bug where certain input strings to the metaphone() function could cause memory corruption. 


From Red Hat Security Advisory 2006:0730 :

The Hardened-PHP Project discovered an overflow in the PHP htmlentities() and htmlspecialchars() routines. If a PHP script used the vulnerable functions to parse UTF-8 data, a remote attacker sending a carefully crafted request could trigger the overflow and potentially execute arbitrary code as the 'apache' user.
(CVE-2006-5465)


From Red Hat Security Advisory 2006:0669 :

A response-splitting issue was discovered in the PHP session handling.
If a remote attacker can force a carefully crafted session identifier to be used, a cross-site-scripting or response-splitting attack could be possible. (CVE-2006-3016)

A buffer overflow was discovered in the PHP sscanf() function. If a script used the sscanf() function with positional arguments in the format string, a remote attacker sending a carefully crafted request could execute arbitrary code as the 'apache' user. (CVE-2006-4020)

An integer overflow was discovered in the PHP wordwrap() and str_repeat() functions. If a script running on a 64-bit server used either of these functions on untrusted user data, a remote attacker sending a carefully crafted request might be able to cause a heap overflow. (CVE-2006-4482)

A buffer overflow was discovered in the PHP gd extension. If a script was set up to process GIF images from untrusted sources using the gd extension, a remote attacker could cause a heap overflow.
(CVE-2006-4484)

An integer overflow was discovered in the PHP memory allocation handling. On 64-bit platforms, the 'memory_limit' setting was not enforced correctly, which could allow a denial of service attack by a remote user. (CVE-2006-4486)

From Red Hat Security Advisory 2006:0729 :

Updated ruby packages that fix a denial of service issue for the CGI instance are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ruby is an interpreted scripting language for object-oriented programming.

A flaw was discovered in the way Ruby's CGI module handles certain multipart/form-data MIME data. If a remote attacker sends a specially crafted multipart-form-data request, it is possible to cause the ruby CGI script to enter an infinite loop, causing a denial of service.
(CVE-2006-5467)

Users of Ruby should upgrade to these updated packages which contain backported patches and are not vulnerable to these issues.

From Red Hat Security Advisory 2006:0727 :

New Texinfo packages that fix various security vulnerabilities are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Texinfo is a documentation system that can produce both online information and printed output from a single source file.

A buffer overflow flaw was found in Texinfo's texindex command. An attacker could construct a carefully crafted Texinfo file that could cause texindex to crash or possibly execute arbitrary code when opened. (CVE-2006-4810)

A flaw was found in the way Texinfo's texindex command creates temporary files. A local user could leverage this flaw to overwrite files the user executing texindex has write access to. (CVE-2005-3011)

Users of Texinfo should upgrade to these updated packages which contain backported patches and are not vulnerable to these issues.

New Wireshark packages that fix various security vulnerabilities are now available. 

This update has been rated as having moderate security impact by the Red Hat Security Response Team. 

Wireshark is a program for monitoring network traffic. 

Users of Wireshark should upgrade to these updated packages containing Wireshark version 0.99.4, which is not vulnerable to these issues.


From Red Hat Security Advisory 2006:0726 :

Several flaws were found in Wireshark's HTTP, WBXML, LDAP, and XOT protocol dissectors.  Wireshark could crash or stop responding if it read a malformed packet off the network.  (CVE-2006-4805, CVE-2006-5468, CVE-2006-5469, CVE-2006-5740)

A single NULL byte heap based buffer overflow was found in Wireshark's MIME Multipart dissector.  Wireshark could crash or possibly execute arbitrary arbitrary code as the user running Wireshark.  (CVE-2006-4574)


From Red Hat Security Advisory 2006:0658 :

Bugs were found in Wireshark's SCSI and SSCOP protocol dissectors. Ethereal could crash or stop responding if it read a malformed packet off the network.  (CVE-2006-4330, CVE-2006-4333)

An off-by-one bug was found in the IPsec ESP decryption preference parser.  Ethereal could crash or stop responding if it read a malformed packet off the network.  (CVE-2006-4331)


From Red Hat Security Advisory 2006:0602 :

In May 2006, Ethereal changed its name to Wireshark.  This update deprecates the Ethereal packages in Red Hat Enterprise Linux 2.1, 3, and 4 in favor of the supported Wireshark packages. 

Several denial of service bugs were found in Ethereal's protocol dissectors.  It was possible for Ethereal to crash or stop responding if it read a malformed packet off the network.  (CVE-2006-3627, CVE-2006-3629, CVE-2006-3631)

Several buffer overflow bugs were found in Ethereal's ANSI MAP, NCP NMAS, and NDPStelnet dissectors.  It was possible for Ethereal to crash or execute arbitrary code if it read a malformed packet off the network. (CVE-2006-3630, CVE-2006-3632)

Several format string bugs were found in Ethereal's Checkpoint FW-1, MQ, XML, and NTP dissectors.  It was possible for Ethereal to crash or execute arbitrary code if it read a malformed packet off the network. (CVE-2006-3628)

From Red Hat Security Advisory 2006:0725 :

Updated qt packages that correct an integer overflow flaw are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Qt is a software toolkit that simplifies the task of writing and maintaining GUI (Graphical User Interface) applications for the X Window System.

An integer overflow flaw was found in the way Qt handled certain pixmap images. If an application linked against Qt created a pixmap image in a certain way, it could lead to a denial of service or possibly allow the execution of arbitrary code. (CVE-2006-4811)

Users of Qt should upgrade to these updated packages, which contain a backported patch to correct this issue.

From Red Hat Security Advisory 2006:0720 :

Updated kdelibs packages that correct an integer overflow flaw are now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

The kdelibs package provides libraries for the K Desktop Environment (KDE). Qt is a GUI software toolkit for the X Window System.

An integer overflow flaw was found in the way Qt handled pixmap images. The KDE khtml library uses Qt in such a way that untrusted parameters could be passed to Qt, triggering the overflow. An attacker could for example create a malicious web page that when viewed by a victim in the Konqueror browser would cause Konqueror to crash or possibly execute arbitrary code with the privileges of the victim.
(CVE-2006-4811)

Users of KDE should upgrade to these updated packages, which contain a backported patch to correct this issue.

From Red Hat Security Advisory 2006:0719 :

Updated nss_ldap packages that fix a security flaw are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

nss_ldap is a set of C library extensions that allow X.500 and LDAP directory servers to be used as primary sources for aliases, ethers, groups, hosts, networks, protocols, users, RPCs, services, and shadow passwords.

A flaw was found in the way nss_ldap handled a PasswordPolicyResponse control sent by an LDAP server. If an LDAP server responded to an authentication request with a PasswordPolicyResponse control, it was possible for an application using nss_ldap to improperly authenticate certain users. (CVE-2006-5170)

This flaw was only exploitable within applications which did not properly process nss_ldap error messages. Only xscreensaver is currently known to exhibit this behavior.

All users of nss_ldap should upgrade to these updated packages, which contain a backported patch that resolves this issue.

From Red Hat Security Advisory 2006:0713 :

Updated Python packages are now available to correct a security issue in Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Python is an interpreted, interactive, object-oriented programming language.

A flaw was discovered in the way that the Python repr() function handled UTF-32/UCS-4 strings. If an application written in Python used the repr() function on untrusted data, this could lead to a denial of service or possibly allow the execution of arbitrary code with the privileges of the Python application. (CVE-2006-4980)

In addition, this errata fixes a regression in the SimpleXMLRPCServer backport for Red Hat Enterprise Linux 3 that was introduced with RHSA-2005:109.

Users of Python should upgrade to these updated packages, which contain a backported patch to correct this issue.

From Red Hat Security Advisory 2006:0710 :

Updated kernel packages that fix several security issues in the Red Hat Enterprise Linux 3 kernel are now available.

This security advisory has been rated as having important security impact by the Red Hat Security Response Team.

The Linux kernel handles the basic functions of the operating system.

These new kernel packages contain fixes for the security issues described below :

* a flaw in the IPC shared-memory implementation that allowed a local user to cause a denial of service (deadlock) that resulted in freezing the system (CVE-2006-4342, Important)

* an information leak in the copy_from_user() implementation on s390 and s390x platforms that allowed a local user to read arbitrary kernel memory (CVE-2006-5174, Important)

* a flaw in the ATM subsystem affecting systems with installed ATM hardware and configured ATM support that allowed a remote user to cause a denial of service (panic) by accessing socket buffer memory after it has been freed (CVE-2006-4997, Moderate)

* a directory traversal vulnerability in smbfs that allowed a local user to escape chroot restrictions for an SMB-mounted filesystem via '..\\' sequences (CVE-2006-1864, Moderate)

* a flaw in the mprotect system call that allowed enabling write permission for a read-only attachment of shared memory (CVE-2006-2071, Moderate)

* a flaw in the DVD handling of the CDROM driver that could be used together with a custom built USB device to gain root privileges (CVE-2006-2935, Moderate)

In addition to the security issues described above, a bug fix for a clock skew problem (which could lead to unintended keyboard repeat under X11) was also included. The problem only occurred when running the 32-bit x86 kernel on 64-bit dual-core x86_64 hardware.

Note: The kernel-unsupported package contains various drivers and modules that are unsupported and therefore might contain security problems that have not been addressed.

All Red Hat Enterprise Linux 3 users are advised to upgrade their kernels to the packages associated with their machine architecture and configurations as listed in this erratum.

From Red Hat Security Advisory 2006:0697 :

Updated openssh packages that fix two security flaws are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This package includes the core files necessary for both the OpenSSH client and server.

Mark Dowd discovered a signal handler race condition in the OpenSSH sshd server. A remote attacker could possibly leverage this flaw to cause a denial of service (crash). (CVE-2006-5051) The OpenSSH project believes the likelihood of successful exploitation leading to arbitrary code execution appears remote. However, the Red Hat Security Response Team have not yet been able to verify this claim due to lack of upstream vulnerability information. We are therefore including a fix for this flaw and have rated it important security severity in the event our continued investigation finds this issue to be exploitable.

Tavis Ormandy of the Google Security Team discovered a denial of service bug in the OpenSSH sshd server. A remote attacker can send a specially crafted SSH-1 request to the server causing sshd to consume a large quantity of CPU resources. (CVE-2006-4924)

All users of openssh should upgrade to these updated packages, which contain backported patches that resolves these issues.

From Red Hat Security Advisory 2006:0695 :

Updated OpenSSL packages are now available to correct several security issues.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols.

Tavis Ormandy and Will Drewry of the Google Security Team discovered a buffer overflow in the SSL_get_shared_ciphers() utility function. An attacker could send a list of ciphers to an application that used this function and overrun a buffer (CVE-2006-3738). Few applications make use of this vulnerable function and generally it is used only when applications are compiled for debugging.

Tavis Ormandy and Will Drewry of the Google Security Team discovered a flaw in the SSLv2 client code. When a client application used OpenSSL to create an SSLv2 connection to a malicious server, that server could cause the client to crash. (CVE-2006-4343)

Dr S. N. Henson of the OpenSSL core team and Open Network Security recently developed an ASN.1 test suite for NISCC (www.niscc.gov.uk) which uncovered denial of service vulnerabilities :

* Certain public key types can take disproportionate amounts of time to process, leading to a denial of service. (CVE-2006-2940)

* During parsing of certain invalid ASN.1 structures an error condition was mishandled. This can result in an infinite loop which consumed system memory (CVE-2006-2937). This issue does not affect the OpenSSL version distributed in Red Hat Enterprise Linux 2.1.

These vulnerabilities can affect applications which use OpenSSL to parse ASN.1 data from untrusted sources, including SSL servers which enable client authentication and S/MIME applications.

Users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Note: After installing this update, users are advised to either restart all services that use OpenSSL or restart their system.

From Red Hat Security Advisory 2006:0680 :

Updated gnutls packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The GnuTLS Library provides support for cryptographic algorithms and protocols such as TLS. GnuTLS includes libtasn1, a library developed for ASN.1 structures management that includes DER encoding and decoding.

Daniel Bleichenbacher recently described an attack on PKCS #1 v1.5 signatures. Where an RSA key with exponent 3 is used it may be possible for an attacker to forge a PKCS #1 v1.5 signature that would be incorrectly verified by implementations that do not check for excess data in the RSA exponentiation result of the signature.

The core GnuTLS team discovered that GnuTLS is vulnerable to a variant of the Bleichenbacker attack. This issue affects applications that use GnuTLS to verify X.509 certificates as well as other uses of PKCS #1 v1.5. (CVE-2006-4790)

In Red Hat Enterprise Linux 4, the GnuTLS library is only used by the Evolution client when connecting to an Exchange server or when publishing calendar information to a WebDAV server.

Users are advised to upgrade to these updated packages, which contain a backported patch from the GnuTLS maintainers to correct this issue.

From Red Hat Security Advisory 2006:0668 :

A new squirrelmail package that fixes a security issue as well as several bugs is now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SquirrelMail is a standards-based webmail package written in PHP.

A dynamic variable evaluation flaw was found in SquirrelMail. Users who have an account on a SquirrelMail server and are logged in could use this flaw to overwrite variables which may allow them to read or write other users' preferences or attachments. (CVE-2006-4019)

Users of SquirrelMail should upgrade to this erratum package, which contains SquirrelMail 1.4.8 to correct this issue. This package also contains a number of additional patches to correct various bugs.

Note: After installing this update, users are advised to restart their httpd service to ensure that the new version functions correctly.

From Red Hat Security Advisory 2006:0667 :

Updated gzip packages that fix several security issues are now available for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The gzip package contains the GNU gzip data compression program.

Tavis Ormandy of the Google Security Team discovered two denial of service flaws in the way gzip expanded archive files. If a victim expanded a specially crafted archive, it could cause the gzip executable to hang or crash. (CVE-2006-4334, CVE-2006-4338)

Tavis Ormandy of the Google Security Team discovered several code execution flaws in the way gzip expanded archive files. If a victim expanded a specially crafted archive, it could cause the gzip executable to crash or execute arbitrary code. (CVE-2006-4335, CVE-2006-4336, CVE-2006-4337)

Users of gzip should upgrade to these updated packages, which contain a backported patch and is not vulnerable to these issues.

From Red Hat Security Advisory 2006:0665 :

Updated X.org packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

X.org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

iDefense reported two integer overflow flaws in the way the X.org server processed CID font files. A malicious authorized client could exploit this issue to cause a denial of service (crash) or potentially execute arbitrary code with root privileges on the X.org server.
(CVE-2006-3739, CVE-2006-3740)

Users of X.org should upgrade to these updated packages, which contain a backported patch and is not vulnerable to this issue.

From Red Hat Security Advisory 2006:0663 :

Updated ncompress packages that address a security issue and fix bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The ncompress package contains file compression and decompression utilities, which are compatible with the original UNIX compress utility (.Z file extensions).

Tavis Ormandy of the Google Security Team discovered a lack of bounds checking in ncompress. An attacker could create a carefully crafted file that could execute arbitrary code if uncompressed by a victim.
(CVE-2006-1168)

In addition, two bugs that affected Red Hat Enterprise Linux 4 ncompress packages were fixed :

* The display statistics and compression results in verbose mode were not shown when operating on zero length files.

* An attempt to compress zero length files resulted in an unexpected return code.

Users of ncompress are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Updated OpenSSL packages are now available to correct several security issues. 

This update has been rated as having important security impact by the Red Hat Security Response Team. 

The OpenSSL toolkit provides support for secure communications between machines.  OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols. 

These vulnerabilities can affect applications which use OpenSSL to parse ASN.1 data from untrusted sources, including SSL servers which enable client authentication and S/MIME applications.

Users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Note: After installing this update, users are advised to either restart all services that use OpenSSL or restart their system.


From Red Hat Security Advisory 2006:0695 :

Tavis Ormandy and Will Drewry of the Google Security Team discovered a buffer overflow in the SSL_get_shared_ciphers() utility function. An attacker could send a list of ciphers to an application that used this function and overrun a buffer (CVE-2006-3738). Few applications make use of this vulnerable function and generally it is used only when applications are compiled for debugging.

Tavis Ormandy and Will Drewry of the Google Security Team discovered a flaw in the SSLv2 client code. When a client application used OpenSSL to create an SSLv2 connection to a malicious server, that server could cause the client to crash. (CVE-2006-4343)

Dr S. N. Henson of the OpenSSL core team and Open Network Security recently developed an ASN.1 test suite for NISCC (www.niscc.gov.uk) which uncovered denial of service vulnerabilities :

* Certain public key types can take disproportionate amounts of time to process, leading to a denial of service. (CVE-2006-2940)

* During parsing of certain invalid ASN.1 structures an error condition was mishandled. This can result in an infinite loop which consumed system memory (CVE-2006-2937). This issue does not affect the OpenSSL version distributed in Red Hat Enterprise Linux 2.1.


From Red Hat Security Advisory 2006:0661 :

Daniel Bleichenbacher recently described an attack on PKCS #1 v1.5 signatures. Where an RSA key with exponent 3 is used it may be possible for an attacker to forge a PKCS #1 v1.5 signature that would be incorrectly verified by implementations that do not check for excess data in the RSA exponentiation result of the signature.

The Google Security Team discovered that OpenSSL is vulnerable to this attack. This issue affects applications that use OpenSSL to verify X.509 certificates as well as other uses of PKCS #1 v1.5.
(CVE-2006-4339)

This errata also resolves a problem where a customized ca-bundle.crt file was overwritten when the openssl package was upgraded.

From Red Hat Security Advisory 2006:0648 :

Updated kdegraphics packages that fix several security flaws in kfax are now available for Red Hat Enterprise Linux 2.1, and 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kdegraphics package contains graphics applications for the K Desktop Environment.

Tavis Ormandy of Google discovered a number of flaws in libtiff during a security audit. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these flaws. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. (CVE-2006-3459, CVE-2006-3460, CVE-2006-3461, CVE-2006-3462, CVE-2006-3463, CVE-2006-3464, CVE-2006-3465)

Red Hat Enterprise Linux 4 is not vulnerable to these issues as kfax uses the shared libtiff library which has been fixed in a previous update.

Users of kfax should upgrade to these updated packages, which contain backported patches and are not vulnerable to this issue.

From Red Hat Security Advisory 2006:0633 :

Updated ImageMagick packages that fix several security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

ImageMagick(TM) is an image display and manipulation tool for the X Window System that can read and write multiple image formats.

Tavis Ormandy discovered several integer and buffer overflow flaws in the way ImageMagick decodes XCF, SGI, and Sun bitmap graphic files. An attacker could execute arbitrary code on a victim's machine if they were able to trick the victim into opening a specially crafted image file. (CVE-2006-3743, CVE-2006-3744, CVE-2006-4144)

Users of ImageMagick should upgrade to these updated packages, which contain backported patches and are not vulnerable to these issues.

From Red Hat Security Advisory 2006:0619 :

Updated Apache httpd packages that correct security issues and resolve bugs are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Apache HTTP Server is a popular Web server available for free.

A bug was found in Apache where an invalid Expect header sent to the server was returned to the user in an unescaped error message. This could allow an attacker to perform a cross-site scripting attack if a victim was tricked into connecting to a site and sending a carefully crafted Expect header. (CVE-2006-3918)

While a web browser cannot be forced to send an arbitrary Expect header by a third-party attacker, it was recently discovered that certain versions of the Flash plugin can manipulate request headers.
If users running such versions can be persuaded to load a web page with a malicious Flash applet, a cross-site scripting attack against the server may be possible.

On Red Hat Enterprise Linux 3 and 4 systems, due to an unrelated issue in the handling of malformed Expect headers, the page produced by the cross-site scripting attack will only be returned after a timeout expires (2-5 minutes by default) if not first canceled by the user.

Users of httpd should update to these erratum packages, which contain a backported patch to correct these issues.

Updated kernel packages that fix security issues are now available. 

This update has been rated as having important security impact by the Red Hat Security Response Team. 

The Linux kernel handles the basic functions of the operating system. 

These new kernel packages contain fixes for the security issues described below :


From Red Hat Security Advisory 2006-0617 :

* a flaw in the proc file system that allowed a local user to use a suid-wrapper for scripts to gain root privileges (CVE-2006-3626, Important)

* a flaw in the SCTP implementation that allowed a local user to cause a denial of service (panic) or to possibly gain root privileges (CVE-2006-3745, Important)

* a flaw in NFS exported ext2/ext3 partitions when handling invalid inodes that allowed a remote authenticated user to cause a denial of service (filesystem panic) (CVE-2006-3468, Important)

* a flaw in the restore_all code path of the 4/4GB split support of non-hugemem kernels that allowed a local user to cause a denial of service (panic) (CVE-2006-2932, Important)

* a flaw in IPv4 netfilter handling for the unlikely use of SNMP NAT processing that allowed a remote user to cause a denial of service (crash) or potential memory corruption (CVE-2006-2444, Moderate)

* a flaw in the DVD handling of the CDROM driver that could be used together with a custom built USB device to gain root privileges (CVE-2006-2935, Moderate)

* a flaw in the handling of O_DIRECT writes that allowed a local user to cause a denial of service (memory consumption) (CVE-2004-2660, Low)

* a flaw in the SCTP chunk length handling that allowed a remote user to cause a denial of service (crash) (CVE-2006-1858, Low)

* a flaw in the input handling of the ftdi_sio driver that allowed a local user to cause a denial of service (memory consumption) (CVE-2006-2936, Low)

In addition a bugfix was added to enable a clean reboot for the IBM Pizzaro machines.

Red Hat would like to thank Wei Wang of McAfee Avert Labs and Kirill Korotaev for reporting issues fixed in this erratum.


From Red Hat Security Advisory ELSA-2006-0689 :

* a flaw in the SCTP support that allowed a local user to cause a denial of service (crash) with a specific SO_LINGER value.
(CVE-2006-4535, Important)

* a flaw in the hugepage table support that allowed a local user to cause a denial of service (crash). (CVE-2005-4811, Important)

* a flaw in the mprotect system call that allowed setting write permission for a read-only attachment of shared memory.
(CVE-2006-2071, Moderate)

* a flaw in HID0[31] (en_attn) register handling on PowerPC 970 systems that allowed a local user to cause a denial of service.
(crash) (CVE-2006-4093, Moderate)

* a flaw in the perfmon support of Itanium systems that allowed a local user to cause a denial of service by consuming all file descriptors. (CVE-2006-3741, Moderate)

* a flaw in the ATM subsystem. On systems with installed ATM hardware and configured ATM support, a remote user could cause a denial of service (panic) by accessing socket buffers memory after freeing them.
(CVE-2006-4997, Moderate)

* a flaw in the DVB subsystem. On systems with installed DVB hardware and configured DVB support, a remote user could cause a denial of service (panic) by sending a ULE SNDU packet with length of 0.
(CVE-2006-4623, Low)

* an information leak in the network subsystem that possibly allowed a local user to read sensitive data from kernel memory. (CVE-2006-0039, Low)

In addition, two bugfixes for the IPW-2200 wireless driver were included. The first one ensures that wireless management applications correctly identify IPW-2200 controlled devices, while the second fix ensures that DHCP requests using the IPW-2200 operate correctly.

Red Hat would like to thank Olof Johansson, Stephane Eranian and Solar Designer for reporting issues fixed in this erratum.

From Red Hat Security Advisory 2006:0615 :

Updated GnuPG packages that fix a security issue is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

GnuPG is a utility for encrypting data and creating digital signatures.

An integer overflow flaw was found in GnuPG. An attacker could create a carefully crafted message packet with a large length that could cause GnuPG to crash or possibly overwrite memory when opened.
(CVE-2006-3746)

All users of GnuPG are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

Updated ruby packages that fix security issues are now available. 

This update has been rated as having moderate security impact by the Red Hat Security Response Team. 

Ruby is an interpreted scripting language for object-oriented programming. 

Users of Ruby should upgrade to these updated packages which contain backported patches and are not vulnerable to these issues. 


From Red Hat Security Advisory 2006:0604 :

A number of flaws were found in the safe-level restrictions in Ruby.  It was possible for an attacker to create a carefully crafted malicious script that can allow the bypass of certain safe-level restrictions. (CVE-2006-3694)


From Red Hat Security Advisory 2006:0729 :

A flaw was discovered in the way Ruby's CGI module handles certain multipart/form-data MIME data.  If a remote attacker sends a specially crafted multipart-form-data request, it is possible to cause the ruby CGI script to enter an infinite loop, causing a denial of service. (CVE-2006-5467)

From Red Hat Security Advisory 2006:0603 :

Updated libtiff packages that fix several security flaws are now available for Red Hat Enterprise Linux.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libtiff package contains a library of functions for manipulating TIFF (Tagged Image File Format) files.

Tavis Ormandy of Google discovered a number of flaws in libtiff during a security audit. An attacker could create a carefully crafted TIFF file in such a way that it was possible to cause an application linked with libtiff to crash or possibly execute arbitrary code.
(CVE-2006-3459, CVE-2006-3460, CVE-2006-3461, CVE-2006-3462, CVE-2006-3463, CVE-2006-3464, CVE-2006-3465)

All users are advised to upgrade to these updated packages, which contain backported fixes for these issues.

From Red Hat Security Advisory 2006:0600 :

Updated mailman packages that fix security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Mailman is a program used to help manage email discussion lists.

A flaw was found in the way Mailman handled MIME multipart messages.
An attacker could send a carefully crafted MIME multipart email message to a mailing list run by Mailman which caused that particular mailing list to stop working. (CVE-2006-2941)

Several cross-site scripting (XSS) issues were found in Mailman. An attacker could exploit these issues to perform cross-site scripting attacks against the Mailman administrator. (CVE-2006-3636)

Red Hat would like to thank Barry Warsaw for disclosing these vulnerabilities.

Users of Mailman should upgrade to these updated packages, which contain backported patches to correct this issue.

From Red Hat Security Advisory 2006:0576 :

Updated kdebase packages that resolve a security issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kdebase packages provide the core applications for KDE, the K Desktop Environment.

A flaw was found in KDE where the kdesktop_lock process sometimes failed to terminate properly. This issue could either block the user's ability to manually lock the desktop or prevent the screensaver to activate, both of which could have a security impact for users who rely on these functionalities. (CVE-2006-2933)

Please note that this issue only affected Red Hat Enterprise Linux 3.

All users of kdebase should upgrade to these updated packages, which contain a patch to resolve this issue.

ID	Name	Severity
67437	Oracle Linux 3 / 4 : libgsf (ELSA-2007-0011)	high
67436	Oracle Linux 4 : dbus (ELSA-2007-0008)	low
67435	Oracle Linux 4 : xorg-x11 (ELSA-2007-0003)	critical
67434	Oracle Linux 3 : XFree86 (ELSA-2007-0002)	critical
67433	Oracle Linux 4 : openoffice.org (ELSA-2007-0001)	high
67432	Oracle Linux 4 : thunderbird (ELSA-2006-0760)	high
67431	Oracle Linux 4 : seamonkey (ELSA-2006-0759)	high
67430	Oracle Linux 4 : firefox (ELSA-2006-0758)	high
67429	Oracle Linux 4 : gnupg (ELSA-2006-0754)	critical
67428	Oracle Linux 3 / 4 : tar (ELSA-2006-0749)	medium
67427	Oracle Linux 4 : mod_auth_kerb (ELSA-2006-0746)	medium
67426	Oracle Linux 4 : elinks (ELSA-2006-0742)	high
67425	Oracle Linux 3 / 4 : openssh (ELSA-2006-0738)	high
67424	Oracle Linux 4 : thunderbird (ELSA-2006-0735 / ELSA-2006-0677 / ELBA-2006-0624 / ELSA-2006-0611)	critical
67423	Oracle Linux 4 : seamonkey (ELSA-2006-0734 / ELSA-2006-0676)	critical
67422	Oracle Linux 4 : firefox (ELSA-2006-0733 / ELSA-2006-0675 / ELSA-2006-0610)	critical
67421	Oracle Linux 4 : php (ELSA-2006-0730 / ELSA-2006-0669)	high
67420	Oracle Linux 3 : ruby (ELSA-2006-0729)	medium
67419	Oracle Linux 3 / 4 : texinfo (ELSA-2006-0727)	medium
67418	Oracle Linux 4 : wireshark (ELSA-2006-0726 / ELSA-2006-0658 / ELSA-2006-0602)	critical
67417	Oracle Linux 3 / 4 : qt (ELSA-2006-0725)	medium
67416	Oracle Linux 3 / 4 : kdelibs (ELSA-2006-0720)	medium
67415	Oracle Linux 4 : nss_ldap (ELSA-2006-0719)	high
67414	Oracle Linux 3 / 4 : python (ELSA-2006-0713)	high
67413	Oracle Linux 3 : kernel (ELSA-2006-0710)	high
67412	Oracle Linux 4 : openssh (ELSA-2006-0697)	high
67411	Oracle Linux 3 : openssl (ELSA-2006-0695)	critical
67410	Oracle Linux 4 : gnutls (ELSA-2006-0680)	medium
67409	Oracle Linux 4 : squirrelmail (ELSA-2006-0668)	medium
67408	Oracle Linux 3 / 4 : gzip (ELSA-2006-0667)	high
67407	Oracle Linux 4 : xorg-x11 (ELSA-2006-0665)	high
67406	Oracle Linux 3 / 4 : ncompress (ELSA-2006-0663)	high
67405	Oracle Linux 4 : openssl (ELSA-2006-0695 / ELSA-2006-0661)	critical
67404	Oracle Linux 3 : kdegraphics (ELSA-2006-0648)	high
67403	Oracle Linux 4 : ImageMagick (ELSA-2006-0633)	medium
67402	Oracle Linux 3 / 4 : httpd (ELSA-2006-0619)	medium
67401	Oracle Linux 4 : kernel (ELSA-2006-0617 / ELSA-2006-0689)	high
67400	Oracle Linux 4 : gnupg (ELSA-2006-0615)	medium
67399	Oracle Linux 3 / 4 : ruby (ELSA-2006-0604 / ELSA-2006-0729)	medium
67398	Oracle Linux 3 : libtiff (ELSA-2006-0603)	high
67397	Oracle Linux 3 / 4 : mailman (ELSA-2006-0600)	medium
67396	Oracle Linux 3 : kdebase (ELSA-2006-0576)	medium

Detections

Analytics

Oracle Linux Local Security Checks Family for Nessus

high

low

critical

critical

high

high

high

high

critical

medium

medium

high

high

critical

critical

critical

high

medium

medium

critical

medium

medium

high

high

high

high

critical

medium

medium

high

high

high

critical

high

medium

medium

high

medium

medium

high

medium

medium