Linux Advisory Watch: April 27th 2007

It was discovered that WebCalendar, a PHP-based calendar application, performs insufficient sanitising in the exports handler, which allows injection of web script.

advisories/debian/debian-new-webcalendar-packages-fix-cross-site-scripting

It was discovered that aircrack-ng, a WEP/WPA security analysis tool, performs insufficient validation of 802.11 authentication packets, which allows the execution of arbitrary code.

advisories/debian/debian-new-aircrack-ng-packages-fix-arbitrary-code-execution

Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. The Common Vulnerabilities and Exposures project identifies the following problems.

advisories/debian/debian-new-clamav-packages-fix-several-vulnerabilities-27806

Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems:

advisories/debian/debian-new-php4-packages-fix-several-vulnerabilities-67618

Aircrack-ng contains a buffer overflow that could lead to the remote execution of arbitrary code with root privileges.

A vulnerability has been discovered in 3proxy allowing for the remote execution of arbitrary code.

A vulnerability has been discovered in Courier-IMAP allowing for remote code execution with root privileges.

A vulnerability has been discovered in Blender allowing for user-assisted arbitrary code execution.

The Network Audio System is vulnerable to a buffer overflow that could result in the execution of arbitrary code with root privileges.

Multiple vulnerabilities have been discovered in ClamAV allowing for the remote execution of arbitrary code. iDefense Labs have reported a stack-based buffer overflow in the cab_unstore() function when processing negative values in .cab files. Multiple file descriptor leaks have also been reported in chmunpack.c, pdf.c and dblock.c when processing .chm files.

A heap-based buffer overflow vulnerability was found in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution (CVE-2007-1001). A DoS flaw was found in how PHP processed a deeply nested array. A remote attacker could cause the PHP intrerpreter to creash by submitting an input variable with a deeply nested array (CVE-2007-1285).

A heap-based buffer overflow vulnerability was found in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution (CVE-2007-1001).

A heap-based buffer overflow vulnerability was found in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution (CVE-2007-1001).

A heap-based buffer overflow vulnerability was found in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution (CVE-2007-1001). A DoS flaw was found in how PHP processed a deeply nested array. A remote attacker could cause the PHP intrerpreter to creash by submitting an input variable with a deeply nested array (CVE-2007-1285).

A buffer overflow in sqlite could allow context-dependent attackers to execute arbitrary code via an empty value of the 'in' parameter. Updated packages have been patched to correct this issue.

Multiple buffer overflows were found in the FreeRADIUS package version 1.0.4 and prior that could allow a remote attacker to cause a crash via the rlm_sqlcounter module (CVE-2005-4746). As well, an SQL injection vulnerability was also found in the rlm_sqlcounter that could allow a remote attacker to execute arbitrary SQL commands via unknown attack vectors (CVE-2005-4745). Updated packages have been patched to correct this issue.

A stack-based buffer overflow in the ZZIPlib library could allow user-assisted remote attackers to cause an application crash (DoS) or execute arbitrary code via a long filename. Updated packages have been patched to correct this issue.

A weakness in previous versions of PostgreSQL was found in the security definer functions in which an authenticated but otherwise unprivileged SQL user could use temporary objects to execute arbitrary code with the privileges of the security-definer function.

Updated PHP packages that fix several security issues are now available for Red Hat Enterprise Linux 5. HTTP Web server. A flaw was found in the way the mbstring extension set global variables. A script which used the mb_parse_str() function to set global variables could be forced to enable the register_globals configuration option, possibly resulting in global variable injection. (CVE-2007-1583)

advisories/red-hat/redhat-moderate-php-security-update-38610

Updated java-1.4.2-ibm packages to correct a security issue are now available for Red Hat Enterprise Linux 3 and 4 Extras. A flaw in GIF image handling was found in the SUN Java Runtime Environment that has now been reported as also affecting IBM Java 2. An untrusted applet or application could use this flaw to elevate its privileges and potentially execute arbitrary code.

advisories/red-hat/redhat-critical-java-142-ibm-security-update-6214

java-1.5.0-ibm packages that correct a security issue are available for Red Hat Enterprise Linux 5 Supplementary and Enterprise Linux 4 Extras. This update has been rated as having critical security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-critical-java-150-ibm-security-update-89380

New xine-lib packages are available for Slackware 10.0, 10.1, 10.2, 11.0, and -current to fix security issues. More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1246

New x11 and/or freetype and fontconfig packages are available for Slackware 10.1, 10.2, 11.0, and -current to fix security issues in freetype. Freetype was packaged with X11 prior to Slackware version 11.0. More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database:

The AntiVirus scan engine clamav was updated to version 0.90.2. Among other bugs two security problems were fixed which could cause a remote denial of service attack against clamav or potentially be used to execute code.

Several X security problems were fixed that could be used by local attackers to crash the X server or potentially to execute code as root user.

Avoided a vulnerability in Adobe Flash Player.

USN-453-1 provided an updated libx11 package to fix a security vulnerability. This triggered an error in rdesktop so that it crashed on startup. This update fixes the problem.

advisories/ubuntu/ubuntu-rdesktop-regression