Updated package.

http://www.linuxsecurity.com/content/view/127288

Updated package.

http://www.linuxsecurity.com/content/view/127331

Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language, which may lead to the execution of arbitrary code.

The Common Vulnerabilities and Exposures project identifies the following problems:

http://www.linuxsecurity.com/content/view/127347

Unspecified vulnerability in the listxattr system call in Linux kernel, when a "bad inode" is present, allows local users to cause a denial of service (data corruption) and possibly gain privileges via unknown vectors.

http://www.linuxsecurity.com/content/view/127272

The Linux kernel before 2.6.20.1 allows remote attackers to cause a denial of service (oops) via a crafted NFSACL 2 ACCESS request that triggers a free of an incorrect pointer.

http://www.linuxsecurity.com/content/view/127273

Updates the SELinux policy configuration. This update allows samba to run as domain controller - execute useradd

http://www.linuxsecurity.com/content/view/127274

The Snort DCE/RPC preprocessor contains a buffer overflow that could result in the remote execution of arbitrary code.

http://www.linuxsecurity.com/content/view/127261

SpamAssassin is vulnerable to a Denial of Service attack.

http://www.linuxsecurity.com/content/view/127262

ClamAV contains two vulnerabilities allowing a Denial of Service.

http://www.linuxsecurity.com/content/view/127263

Multiple vulnerabilities have been reported in Mozilla Firefox, some of which may allow user-assisted arbitrary remote code execution.

http://www.linuxsecurity.com/content/view/127284

Several vulnerabilities exist in the Mozilla Suite, which is no longer supported by the Mozilla project.

http://www.linuxsecurity.com/content/view/127285

Updated package.

http://www.linuxsecurity.com/content/view/127286

The AMD64 x86 emulation Qt library makes use of an insecure version of the Qt library, potentially allowing for the remote execution of arbitrary code.

http://www.linuxsecurity.com/content/view/127287

Two buffer overflows have been discovered in STLport possibly leading to the remote execution of arbitrary code.

http://www.linuxsecurity.com/content/view/127328

Tcpdump would cause a segmentation fault on certain packets when reading back a captured tcpdump file. This update corrects that problem.

http://www.linuxsecurity.com/content/view/127259

Updated timezone packages are being provided for older Mandriva Linux systems that do not contain the new Daylight Savings Time information for 2007 for certain time zones. These updated packages contain the new information.

http://www.linuxsecurity.com/content/view/127260

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 1.5.0.10. This update provides the latest Firefox to correct these issues.

http://www.linuxsecurity.com/content/view/127283

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 1.5.0.10. This update provides the latest Thunderbird to correct these issues.

http://www.linuxsecurity.com/content/view/127333

Umount allows local users to trigger a NULL dereference and application crash by invoking the program with a pathname for a USB pen drive that was mounted and then physically removed, which might allow the users to obtain sensitive information, including core file contents. Updated packages have been patched to address this issue.

http://www.linuxsecurity.com/content/view/127334

Updated thunderbird packages that fix several security bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/127280

Updated the mod_jk packages this fixes a security issue are now available for Red Hat Application Stack v1.1. This update has been rated as having critical security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/127281

Updated GnuPG packages that fix a security issue are now available. This update has been rated as having important security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/127309

New mozilla-firefox packages are available for Slackware 10.2, and 11.0 to fix security issues.

http://www.linuxsecurity.com/content/view/127361

New x11 packages are available for Slackware 10.2 and 11.0. More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database.

http://www.linuxsecurity.com/content/view/127362

A new seamonkey package is available for Slackware 11.0 to fix security issues.

http://www.linuxsecurity.com/content/view/127363

A new imagemagick package is available for Slackware 11.0 to fix security issues.

http://www.linuxsecurity.com/content/view/127364

New mozilla-thunderbird packages are available for Slackware 10.2, and 11.0 to fix security issues.

http://www.linuxsecurity.com/content/view/127365

New gnupg packages are available for Slackware 9.0, 9.1, 10.0, 10.1, 10.2, and 11.0 to fix security ramifications of incorrect gpg usage.

http://www.linuxsecurity.com/content/view/127366

Updated package.

http://www.linuxsecurity.com/content/view/127322

USN-416-1 fixed various vulnerabilities in the Linux kernel. Unfortunately that update caused the 'nvidia-glx-config' script to not work any more. The new version fixes the problem. We apologize for the inconvenience.

http://www.linuxsecurity.com/content/view/127252

USN-428-1 fixed vulnerabilities in Firefox 1.5. However, changes to library paths caused applications depending on libnss3 to fail to start up. This update fixes the problem.

http://www.linuxsecurity.com/content/view/127266

Miles Egan discovered that mod_python, when used in output filter mode, did not handle output larger than 16384 bytes, and would display freed memory, possibly disclosing private data. Thanks to Jim Garrison of the Software Freedom Law Center for identifying the original bug as a security vulnerability.

http://www.linuxsecurity.com/content/view/127329

Moritz Jodeit discovered that tcpdump had an overflow in the 802.11 packet parser. Remote attackers could send specially crafted packets, crashing tcpdump, possibly leading to a denial of service.

http://www.linuxsecurity.com/content/view/127330

The SSLv2 protocol support in the NSS library did not sufficiently check the validity of public keys presented with a SSL certificate. A malicious SSL web site using SSLv2 could potentially exploit this to execute arbitrary code with the user's privileges. (CVE-2007-0008) The SSLv2 protocol support in the NSS library did not sufficiently verify the validity of client master keys presented in an SSL client certificate. A remote attacker could exploit this to execute arbitrary code in a server application that uses the NSS library.

http://www.linuxsecurity.com/content/view/127332

Gerardo Richarte from Core Security Technologies discovered that when gnupg is used without --status-fd, there is no way to distinguish initial unsigned messages from a following signed message.

http://www.linuxsecurity.com/content/view/127368

USN-424-1 fixed vulnerabilities in PHP. However, some upstream changes were not included, which caused errors in the stream filters. This update fixes the problem.

http://www.linuxsecurity.com/content/view/127369