In some circumstances, the sshd server may not honor the "from=" option that can be associated with a key in a user's ~/.ssh/authorized_keys2 file if multiple keys are listed. This could allow key-based logins from hosts which should not be allowed access.
We are aware of the problem and are currently working on a solution. As a workaround, until an update becomes available, please boot with the devfs=nomount option.
Zen Parse discovered that an argument handling problem that exists in the uucp package can allow a local attacker to gain access to the uucp user or group.
To browse through our weekly Linux Advisory Watch newsletters,