Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.19 (Version 3.0, Release 19). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy.

http://www.linuxsecurity.com/content/view/136174

libvorbis does not properly handle a zero value which allows remote attackers to cause a denial of service (crash or infinite loop) or trigger an integer overflow.

http://www.linuxsecurity.com/content/view/138083

Johannes Bauer discovered an integer overflow condition in the hrtimer subsystem on 64-bit systems. This can be exploited by local users to trigger a denial of service (DoS) by causing the kernel to execute an infinite loop.

http://www.linuxsecurity.com/content/view/137849

Alin Rad Pop discovered that Samba contained a buffer overflow condition when processing certain responses received while acting as a client, leading to arbitrary code execution (CVE-2008-1105).

http://www.linuxsecurity.com/content/view/137848

A stack-based buffer overflow was found in mtr, possibly resulting in the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/138088

A vulnerability was found in libxslt, possibly resulting in the execution of arbitrary code and Denial of Service.

http://www.linuxsecurity.com/content/view/138086

A stack-based buffer overflow was found in mtr, possibly resulting in the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/138085

A heap-based buffer overflow vulnerability was found in Samba, allowing for the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/137841

An integer overflow vulnerability in MPlayer may allow for the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/137840

A vulnerability was discovered and corrected in the Linux 2.6 kernel: The bdx_ioctl_priv function in the tehuti driver (tehuti.c) in Linux kernel 2.6.x before 2.6.25.1 does not properly check certain information related to register size, which has unspecified impact and local attack vectors, probably related to reading or writing kernel memory. (CVE-2008-1675)

http://www.linuxsecurity.com/content/view/138090

Gnome-settings-daemon was not respecting correctly user settings when disabling the background completely. This bug has been sfixed, improvement have been made in the time needed to display background when nautilus is used by the system, additional bugfixes and translations have been integrated in this updated package.

http://www.linuxsecurity.com/content/view/137843

Updated evolution28 packages that address two buffer overflow vulnerabilities are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/138102

An integer overflow flaw leading to a heap buffer overflow was discovered in the Portable Network Graphics (PNG) decoding routines used by the CUPS image converting filters "imagetops" and "imagetoraster". An attacker could create a malicious PNG file that could possibly execute arbitrary code as the "lp" user if the file was printed.

http://www.linuxsecurity.com/content/view/138103

Updated evolution packages that fix two buffer overflow vulnerabilities are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/138097

Updated evolution packages that address a buffer overflow vulnerability are now available for Red Hat Enterprise Linux 3 and Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/138098

Updated evolution packages that address a buffer overflow vulnerability are now available for Red Hat Enterprise Linux 4.5 Extended Update Support. This update has been rated as having critical security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/138099

New samba packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, and -current to fix a security issue: "Specifically crafted SMB responses can result in a heap overflow in the Samba client code. Because the server process, smbd, can itself act as a client during operations such as printer notification and domain authentication, this issue affects both Samba client and server installations."

http://www.linuxsecurity.com/content/view/137837

It was discovered that PowerPC kernels did not correctly handle reporting certain system details. By requesting a specific set of information, a local attacker could cause a system crash resulting in a denial of service. (CVE-2007-6694)

http://www.linuxsecurity.com/content/view/138089