Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.19 (Version 3.0, Release 19). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy.

http://www.linuxsecurity.com/content/view/136174

It was discovered that crashes in the Javascript engine of xulrunner, the Gecko engine library, could potentially lead to the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/136520

Several remote vulnerabilities have been discovered in the Iceape internet suite, an unbranded version of the Seamonkey Internet Suite. The Common Vulnerabilities and Exposures project identifies the following problems:

http://www.linuxsecurity.com/content/view/136519

Several remote vulnerabilities have been discovered in phpMyAdmin, an application to administrate MySQL over the WWW. The Common Vulnerabilities and Exposures project identifies the following problems:

http://www.linuxsecurity.com/content/view/136518

It has been discovered that the Perl interpreter may encounter a buffer overflow condition when compiling certain regular expressions containing Unicode characters. This also happens if the offending characters are contained in a variable reference protected by the \Q...\E quoting construct. When encountering this condition, the Perl interpreter typically crashes, but arbitrary code execution cannot be ruled out.

http://www.linuxsecurity.com/content/view/136517

It was discovered that crashes in the Javascript engine of Iceweasel, an unbranded version of the Firefox browser could potentially lead to the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/136511

Roundup, an issue tracking system, fails to properly escape HTML input, allowing an attacker to inject client-side code (typically JavaScript) into a document that may be viewed in the victim's browser

http://www.linuxsecurity.com/content/view/136395

It was discovered that suphp, an Apache module to run PHP scripts with owner permissions handles symlinks insecurely, which may lead to privilege escalation by local users.

http://www.linuxsecurity.com/content/view/136355

Damian Put discovered that a buffer overflow in the handler for PeSpin binaries may lead to the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/136354

Xpdf's handling of embedded fonts lacks sufficient validation and type checking. If a maliciously-crafted PDF file is opened, the vulnerability may allow the execution of arbitrary code with the privileges of the user running xpdf.

http://www.linuxsecurity.com/content/view/136346

Several bugs have been discovered in the way OpenOffice.org parses Quattro Pro files that may lead to a overflow in the heap potentially leading to the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/136339

Multiple vulnerabilities have been identified in BEA JRockit.

http://www.linuxsecurity.com/content/view/136516

Multiple vulnerabilities were found in SILC Client, Server, and Toolkit, allowing for Denial of Service and execution of arbitrary code.

http://www.linuxsecurity.com/content/view/136515

A design error in Openfire might lead to a Denial of Service.

http://www.linuxsecurity.com/content/view/136513

Multiple vulnerabilities were found in VLC, allowing for the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/136512

A design error in Openfire might lead to a Denial of Service.

http://www.linuxsecurity.com/content/view/136510

Multiple vulnerabilities were found in VLC, allowing for the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/136509

Use of insufficient randomness in PowerDNS Recursor might lead to DNS cache poisoning.

http://www.linuxsecurity.com/content/view/136364

Multiple vulnerabilities have been identified, the worst of which allow arbitrary code execution on a user's system via a malicious Flash file.

http://www.linuxsecurity.com/content/view/136363

Multiple vulnerabilities have been identified in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE).

http://www.linuxsecurity.com/content/view/136357

PHP Toolkit does not quote parameters, allowing for PHP source code disclosure on Apache, and a Denial of Service.

http://www.linuxsecurity.com/content/view/136356

Poppler does not handle fonts inside PDF files safely, allowing for execution of arbitrary code.

http://www.linuxsecurity.com/content/view/136345

Poppler does not handle fonts inside PDF files safely, allowing for execution of arbitrary code.

http://www.linuxsecurity.com/content/view/136343

Improper input validation in Speex might lead to array indexing vulnerabilities in multiple player applications.

http://www.linuxsecurity.com/content/view/136342

A buffer overflow in rsync might lead to the remote execution of arbitrary code when extended attributes are being used.

http://www.linuxsecurity.com/content/view/136340

A few vulnerabilities were found in Wireshark, that could cause it to crash or hang under certain conditions. This update provides Wireshark 1.0.0, which is not vulnerable to the issues.

http://www.linuxsecurity.com/content/view/136521

Kees Cook of Ubuntu security found a flaw in how poppler prior to version 0.6 displayed malformed fonts embedded in PDF files. An attacker could create a malicious PDF file that would cause applications using poppler to crash, or possibly execute arbitrary code when opened (CVE-2008-1693). The updated packages have been patched to correct this issue.

http://www.linuxsecurity.com/content/view/136360

Multiple vulnerabilities were discovered in ClamAV and corrected with the 0.93 release, including: ClamAV 0.92 allowed local users to overwrite arbitrary files via a symlink attack on temporary files or on .ascii files in sigtool, when utf16-decode is enabled (CVE-2007-6595). A heap-based buffer overflow in ClamAV 0.92.1 allowed remote attackers to execute arbitrary code via a crafted PeSpin packed PE binary (CVE-2008-0314).

http://www.linuxsecurity.com/content/view/136359

Updated xpdf packages that fix a security issue are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. Kees Cook discovered a flaw in the way xpdf displayed malformed fonts embedded in PDF files. An attacker could create a malicious PDF file that would cause xpdf to crash, or, potentially, execute arbitrary code when opened. (CVE-2008-1693)

http://www.linuxsecurity.com/content/view/136353

Updated openoffice.org 1.x packages to correct multiple security issues are now available for Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/136348

Updated openoffice.org 2.x packages to correct multiple security issues are now available for Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/136349

Updated kdegraphics packages that fix a security issue are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/136351

Updated poppler packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/136352

New xine-lib packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix security issues. An overflow was found in the Speex decoder that could lead to a crash or possible execution of arbitrary code.

http://www.linuxsecurity.com/content/view/136391

New mozilla-firefox packages are available for Slackware 10.2, 11.0, 12.0, and -current to fix a possible security bug. More details about this issue may be found here: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1380 http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox https://bugzilla.mozilla.org/show_bug.cgi?id=425576

http://www.linuxsecurity.com/content/view/136358

These vulnerabilities can only by exploited remotely with user-assistance and in conjunction with other software receiving OOo documents over the network (like a kmail attachment).

http://www.linuxsecurity.com/content/view/136361

Flaws were discovered in Firefox which could lead to crashes during JavaScript garbage collection. If a user were tricked into opening a malicious web page, an attacker may be able to crash the browser or possibly execute arbitrary code with the user's privileges. (CVE-2008-1380)

http://www.linuxsecurity.com/content/view/136393

Thilo Pfennig and Morten Welinder discovered that the XLS spreadsheet handling code in Gnumeric did not correctly calculate needed memory sizes. If a user or automated system were tricked into loading a specially crafted XLS document, a remote attacker could execute arbitrary code with user privileges.

http://www.linuxsecurity.com/content/view/136392

It was discovered that the poppler PDF library did not correctly handle certain malformed embedded fonts. If a user or an automated system were tricked into opening a malicious PDF, a remote attacker could execute arbitrary code with user privileges.

http://www.linuxsecurity.com/content/view/136347

USN-603-1 fixed vulnerabilities in poppler. This update provides the corresponding updates for KWord, part of KOffice. Original advisory details: It was discovered that the poppler PDF library did not correctly handle certain malformed embedded fonts. If a user or an automated system were tricked into opening a malicious PDF, a remote attacker could execute arbitrary code with user privileges.

http://www.linuxsecurity.com/content/view/136350