Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.22 (Version 3.0, Release 22). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy.

http://www.linuxsecurity.com/content/view/145668

Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems...

http://www.linuxsecurity.com/content/view/147395

Tobias Klein discovered that integer overflows in the code the Amarok media player uses to parse Audible files may lead to the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/147394

It was discovered that netatalk, an implementation of the AppleTalk suite, is affected by a command injection vulnerability when processing PostScript streams via papd. This could lead to the execution of arbitrary code. Please note that this only affects installations that are configured to use a pipe command in combination with wildcard symbols substituted with values of the printed job.

http://www.linuxsecurity.com/content/view/147391

SA-CORE-2009-001 ( http://drupal.org/node/358957 ) Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script.

http://www.linuxsecurity.com/content/view/147690

SA-CORE-2009-001 ( http://drupal.org/node/358957 ) Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script.

http://www.linuxsecurity.com/content/view/147691

This build includes a security fix concerning the parsing of malformed Audible digital audio files.

http://www.linuxsecurity.com/content/view/147692

- Fixed path to make mumbles run on x86_64 bug #479158 - Security fix for Firefox plugin bug #479171

http://www.linuxsecurity.com/content/view/147693

Fix for spellcheck security flaw, and some font correction.

http://www.linuxsecurity.com/content/view/147694

Fix for spellcheck security flaw, and some font correction.

http://www.linuxsecurity.com/content/view/147695

Update to new upstream version - 2007e. Contains fix for a security issue - buffer overflow in rfc822_output_char / rfc822_output_data (CVE-2008-5514).

http://www.linuxsecurity.com/content/view/147696

- Fix missing symbols (rh 480269) - Fix off by one error in CVE-2008-5262 check (rh 479864)

http://www.linuxsecurity.com/content/view/147697

Update to new upstream version - 2007e. Contains fix for a security issue - buffer overflow in rfc822_output_char / rfc822_output_data (CVE-2008-5514).

http://www.linuxsecurity.com/content/view/147698

- Fix missing symbols (rh 480269) - Fix off by one error in CVE-2008-5262 check (rh 479864)

http://www.linuxsecurity.com/content/view/147699

A vulnerability in Net-SNMP could lead to a Denial of Service.

http://www.linuxsecurity.com/content/view/147682

An insecure temporary file usage has been reported in Scilab, allowing for symlink attacks.

http://www.linuxsecurity.com/content/view/147681

A buffer overflow in the imageloadfont() function in PHP allowed context-dependent attackers to cause a denial of service (crash) and potentially execute arbitrary code via a crafted font file (CVE-2008-3658). A buffer overflow in the memnstr() function allowed context-dependent attackers to cause a denial of service (crash) and potentially execute arbitrary code via the delimiter argument to the explode() function (CVE-2008-3659). PHP, when used as a FastCGI module, allowed remote attackers to cause a denial of service (crash) via a request with multiple dots preceding the extension (CVE-2008-3660). The updated packages have been patched to correct these issues.

http://www.linuxsecurity.com/content/view/147687

A vulnerability in PHP allowed context-dependent attackers to cause a denial of service (crash) via a certain long string in the glob() or fnmatch() functions (CVE-2007-4782)... The updated packages have been patched to correct these issues.

http://www.linuxsecurity.com/content/view/147686

A vulnerability in PHP allowed context-dependent attackers to cause a denial of service (crash) via a certain long string in the glob() or fnmatch() functions (CVE-2007-4782).. The updated packages have been patched to correct these issues.

http://www.linuxsecurity.com/content/view/147685

A buffer overflow in the imageloadfont() function in PHP allowed context-dependent attackers to cause a denial of service (crash) and potentially execute arbitrary code via a crafted font file (CVE-2008-3658)... The updated packages have been patched to correct these issues.

http://www.linuxsecurity.com/content/view/147684

Failure on Ogg files manipulation can lead remote attackers to cause a denial of service by using crafted files (CVE-2008-3231).... This update provides the fix for all these security issues found in xine-lib 1.1.11 of Mandriva 2008.1. The vulnerabilities: CVE-2008-5234, CVE-2008-5236, CVE-2008-5237, CVE-2008-5239, CVE-2008-5240, CVE-2008-5243 are found in xine-lib 1.1.15 of Mandriva 2009.0 and are also fixed by this update.

http://www.linuxsecurity.com/content/view/147683

A vulnerability in KDM allowed a local user to cause a denial of service via unknown vectors (CVE-2007-5963). The updated packages have been patched to prevent this issue.

http://www.linuxsecurity.com/content/view/147405

Ian Jackson found a security issue in the QEMU block device drivers backend that could allow a guest operating system to issue a block device request and read or write arbitrary memory locations, which could then lead to privilege escalation (CVE-2008-0928)... The updated packages have been patched to prevent these issues.

http://www.linuxsecurity.com/content/view/147404

Several vulnerabilities have been discovered in ffmpeg, related to the execution of DTS generation code (CVE-2008-4866) and incorrect handling of DCA_MAX_FRAME_SIZE value (CVE-2008-4867). The updated packages have been patched to prevent this.

http://www.linuxsecurity.com/content/view/147401

Several vulnerabilities have been discovered in mplayer, which could allow remote attackers to execute arbitrary code via a malformed TwinVQ file (CVE-2008-5616), and in ffmpeg, as used by mplayer, related to the execution of DTS generation code (CVE-2008-4866). The updated packages have been patched to prevent this.

http://www.linuxsecurity.com/content/view/147400

Several vulnerabilities have been discovered in mplayer, which could allow remote attackers to execute arbitrary code via a malformed TwinVQ file (CVE-2008-5616), and in ffmpeg, as used by mplayer, related to the execution of DTS generation code (CVE-2008-4866) and incorrect handling of DCA_MAX_FRAME_SIZE value (CVE-2008-4867). The updated packages have been patched to prevent this.

http://www.linuxsecurity.com/content/view/147399

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 2.0.0.19 (CVE-2008-5500, CVE-2008-5503, CVE-2008-5506, CVE-2008-5507, CVE-2008-5508, CVE-2008-5510, CVE-2008-5511, CVE-2008-5512). This update provides the latest Thunderbird to correct these issues.

http://www.linuxsecurity.com/content/view/147396

Kphotoalbum in Mandriva Linux 2009.0 had some unimplemented functions that could lead to crashes. This new package implements those functions and fixes the crashes.

http://www.linuxsecurity.com/content/view/147393

This package updates the libkdraw and libkexiv2 libraries making it possible to build newer versions of digikam.

http://www.linuxsecurity.com/content/view/147392

Updated kernel packages that fix several security issues and several bugs are now available for Red Hat Enterprise MRG 1.0. This update has been rated as having important security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/147689

Updated bind packages are available for Slackware 10.2 and 11.0 to address a load problem. It was reported that the initial build of these updates complained that the Linux capability module was not present and would refuse to load. It was determined that the packages which were compiled on 10.2 and 11.0 systems running 2.6 kernels, and although the installed kernel headers are from 2.4.x, it picked up on this resulting in packages that would only run under 2.4 kernels. These new packages address the issue. As always, any problems noted with update patches should be reported to security@slackware.com, and we will do our best to address them as quickly as possible.

http://www.linuxsecurity.com/content/view/147398

New ntp packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to a fix security issue.

http://www.linuxsecurity.com/content/view/147388

New openssl packages are available for Slackware 11.0, 12.0, 12.1, 12.2, and -current to fix a security issue when connecting to an SSL/TLS server that uses a certificate containing a DSA or ECDSA key.

http://www.linuxsecurity.com/content/view/147389

New bind packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to fix a security issue.

http://www.linuxsecurity.com/content/view/147387

The DNS daemon bind is used to resolve and lookup addresses on the inter- net. Some month ago a vulnerability in the DNS protocol and its numbers was published that allowed easy spoofing of DNS entries. The only way to pro- tect against spoofing is to use DNSSEC. Unfortunately the bind code that verifys the certification chain of a DNS- SEC zone transfer does not properly check the return value of function DSA_do_verify(). This allows the spoofing of records signed with DSA or NSEC3DSA.

http://www.linuxsecurity.com/content/view/147688

USN-700-1 fixed vulnerabilities in Perl. Due to problems with the Ubuntu 8.04 build, some Perl .ph files were missing from the resulting update. This update fixes the problem. We apologize for the inconvenience.

http://www.linuxsecurity.com/content/view/147397