Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.22 (Version 3.0, Release 22). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy.

http://www.linuxsecurity.com/content/view/145668

Several vulnerabilities have been found in the MIT reference implementation of Kerberos V5, a system for authenticating users and services on a network.

http://www.linuxsecurity.com/content/view/148533

Several vulnerabilities have been found in horde3, the horde web application framework.

http://www.linuxsecurity.com/content/view/148527

Several vulnerabilities have been discovered in Tunapie, a GUI frontend to video and radio streams.

http://www.linuxsecurity.com/content/view/148519

It was discovered that insufficient length validations in the ASN.1 handling of the OpenSSL crypto library may lead to denial of service when processing a manipulated certificate.

http://www.linuxsecurity.com/content/view/148498

Christian J. Eibl discovered that the TeX filter of Moodle, a web-based course management system, doesn't check user input for certain TeX commands which allows an attacker to include and display the content of arbitrary system files.

http://www.linuxsecurity.com/content/view/148491

It was discovered that icu, the internal components for Unicode, did not properly sanitise invalid encoded data, which could lead to cross- site scripting attacks.

http://www.linuxsecurity.com/content/view/148480

This update incorporates patches to fix potential read overflow and NULL pointer dereferences in the implementation of the SPNEGO GSSAPI mechanism (CVE-2009-0844, CVE-2009-0845), attempts to free an uninitialized pointer during protocol parsing (CVE-2009-0846), and a bug in length validation during protocol parsing (CVE-2009-0847).

http://www.linuxsecurity.com/content/view/148522

This update incorporates patches to fix potential read overflow and NULL pointer dereferences in the implementation of the SPNEGO GSSAPI mechanism (CVE-2009-0844, CVE-2009-0845), attempts to free an uninitialized pointer during protocol parsing (CVE-2009-0846), and a bug in length validation during protocol parsing (CVE-2009-0847).

http://www.linuxsecurity.com/content/view/148523

Fixes remaining LCMS issue, which resolves a TCK failure

http://www.linuxsecurity.com/content/view/148520

Fixes remaining LCMS issue, which resolves a TCK failure

http://www.linuxsecurity.com/content/view/148521

fix CVE-2009-1213

http://www.linuxsecurity.com/content/view/148511

fix CVE-2009-1213

http://www.linuxsecurity.com/content/view/148512

The releases contain fixes for issues discovered in an audit of the CGI by a 3rd party (tickets #2939, #2941, #2942, #2943 and #2944).

http://www.linuxsecurity.com/content/view/148503

The releases contain fixes for issues discovered in an audit of the CGI by a 3rd party (tickets #2939, #2941, #2942, #2943 and #2944).

http://www.linuxsecurity.com/content/view/148502

CVE-2009-1171: The TeX filter in Moodle 1.6 before 1.6.9+, 1.7 before 1.7.7+, 1.8 before 1.8.9, and 1.9 before 1.9.5 allows user-assisted attackers to read arbitrary files via an input command in a "$$" sequence, which causes LaTeX to include the contents of the file.

http://www.linuxsecurity.com/content/view/148483

CVE-2009-1171: The TeX filter in Moodle 1.6 before 1.6.9+, 1.7 before 1.7.7+, 1.8 before 1.8.9, and 1.9 before 1.9.5 allows user-assisted attackers to read arbitrary files via an input command in a "$$" sequence, which causes LaTeX to include the contents of the file.

http://www.linuxsecurity.com/content/view/148482

Multiple vulnerabilities in Tor might allow for heap corruption, Denial of Service, escalation of privileges and information disclosure.

http://www.linuxsecurity.com/content/view/148531

An error in Avahi might lead to a Denial of Service via network and CPU consumption.

http://www.linuxsecurity.com/content/view/148532

Multiple vulnerabilites in MIT Kerberos 5 might allow remote unauthenticated users to execute arbitrary code with root privileges.

http://www.linuxsecurity.com/content/view/148530

An error in OpenSSL might allow for a Denial of Service when printing certificate details.

http://www.linuxsecurity.com/content/view/148507

A vulnerability in Xpdf might allow local attackers to execute arbitrary code.

http://www.linuxsecurity.com/content/view/148506

An untrusted search path vulnerability in the Eye of GNOME might result in the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/148504

An error in the OpenSSL certificate chain validation in ntp might allow for spoofing attacks.

http://www.linuxsecurity.com/content/view/148497

A processing error in WeeChat might lead to a Denial of Service.

http://www.linuxsecurity.com/content/view/148496

An untrusted search path vulnerability in Gnumeric might result in the execution of arbitrary code.

http://www.linuxsecurity.com/content/view/148492

Multiple vulnerabilities were discovered in Openfire, the worst of which may allow remote execution of arbitrary code.

http://www.linuxsecurity.com/content/view/148485

A race condition on getkey process in initscripts shipped with Mandriva CS4 will make the boot stop when entering interactive startup.

http://www.linuxsecurity.com/content/view/148529

This update provides updated perl-Crypt-SSLeay, required for mdkonline to work with restricted resources.

http://www.linuxsecurity.com/content/view/148518

The tommath library will be needed for future clamav updates.

http://www.linuxsecurity.com/content/view/148509

This update fixes an issue which could cause mdkonline to fail when attempting to setup restricted resources.

http://www.linuxsecurity.com/content/view/148505

An array indexing error in the GStreamer's QuickTime media file format decoding plug-in enables attackers to crash the application and potentially execute arbitrary code by using a crafted media file (CVE-2009-0398). This update provides fix for that security issue.

http://www.linuxsecurity.com/content/view/148495

A security vulnerability has been identified and fixed in OpenSSL, which could crash applications using OpenSSL library when parsing malformed certificates (CVE-2009-0590). The updated packages have been patched to prevent this.

http://www.linuxsecurity.com/content/view/148494

This update prevents unwanted dependency with gpilotd (bug #46302).

http://www.linuxsecurity.com/content/view/148484

Integer overflows in gstreamer0.10-plugins-base Base64 encoding and decoding functions (related with glib2.0 issue CVE-2008-4316) may lead attackers to cause denial of service. Altough vector attacks are not known yet (CVE-2009-0586). This update provide the fix for that security issue.

http://www.linuxsecurity.com/content/view/148481

Updated krb5 packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having critical security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/148516

Updated device-mapper-multipath packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/148517

Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/148513

Updated krb5 packages that fix various security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/148514

Updated krb5 packages that fix a security issue are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/148515

Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/148500

Updated gstreamer-plugins-base packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/148501

Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/148499

New php packages are available for Slackware 11.0, 12.0, 12.1, 12.2, and -current to fix security issues.

http://www.linuxsecurity.com/content/view/148524

New xine-lib packages are available for Slackware 12.0, 12.1, 12.2, and -current to fix security issues.

http://www.linuxsecurity.com/content/view/148525

New openssl packages are available for Slackware 11.0, 12.0, 12.1, 12.2, and -current to fix security issues.

http://www.linuxsecurity.com/content/view/148526

The Kerberos implementation from MIT is vulnerable to four different security issues that range from a remote crash to to possible, but very unlikely, remote code execution.

http://www.linuxsecurity.com/content/view/148528

The IBM Java 1.4.2 JDK and JRE were brought to Service Release 13 and the IBM JDK and JRE 6 were brought to Service Release 4.

http://www.linuxsecurity.com/content/view/148508

The Linux kernel for SUSE Linux Enterprise 10 Service Pack 2 was updated to fixes various bugs and several security issues.

http://www.linuxsecurity.com/content/view/148489

The Sun JDK 5 was updated to Update18 and the Sun JDK 6 was updated to Update 13 to fix various bugs and security issues

http://www.linuxsecurity.com/content/view/148487

The following security issues were fixed...

http://www.linuxsecurity.com/content/view/148486

It was discovered that PostgreSQL did not properly handle encoding conversion failures. An attacker could exploit this by sending specially crafted requests to PostgreSQL, leading to a denial of service.

http://www.linuxsecurity.com/content/view/148510