Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.22 (Version 3.0, Release 22). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy.

http://www.linuxsecurity.com/content/view/145668

http://www.linuxsecurity.com/content/view/148762

http://www.linuxsecurity.com/content/view/148750

http://www.linuxsecurity.com/content/view/148746

http://www.linuxsecurity.com/content/view/148745

http://www.linuxsecurity.com/content/view/148744

http://www.linuxsecurity.com/content/view/148739

http://www.linuxsecurity.com/content/view/148675

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148722

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148723

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148724

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148725

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148726

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148727

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148728

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148729

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148730

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148731

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148721

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148713

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148714

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148715

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148716

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148717

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148718

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148719

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148720

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148712

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148701

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148702

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148703

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148704

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148705

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148706

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148707

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148708

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148709

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148710

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148711

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148693

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148694

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148695

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148696

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148697

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148698

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148699

Update to Firefox 3.0.10 fixing one security issue: http://www.mozilla.org/security/known- vulnerabilities/firefox30.html#firefox3.0.10 Depending packages rebuilt against new Firefox are also included in this update. Additional bugs fixed in other packages: - totem: Fix YouTube plugin following web site changes

http://www.linuxsecurity.com/content/view/148700

Update to 0.8.7: http://sourceforge.net/project/shownotes.php?group_id=1275&release_id=675660 http://sourceforge.net/project/shownotes.php?group_id=1275&release_id=677065 http://sourceforge.net/project/shownotes.php?group_id=1275&release_id=678622

http://www.linuxsecurity.com/content/view/148691

Update to 0.8.7: http://sourceforge.net/project/shownotes.php?group_id=1275&release_id=675660 http://sourceforge.net/project/shownotes.php?group_id=1275&release_id=677065 http://sourceforge.net/project/shownotes.php?group_id=1275&release_id=678622

http://www.linuxsecurity.com/content/view/148692

The permissions on the prewikka.conf file are world readable and contain the sql database password used by prewikka. This update makes it readable just by the apache group.

http://www.linuxsecurity.com/content/view/148686

The permissions on the prewikka.conf file are world readable and contain the sql database password used by prewikka. This update makes it readable just by the apache group.

http://www.linuxsecurity.com/content/view/148685

A vulnerability has been found and corrected in apache: mod_proxy_ajp.c in the mod_proxy_ajp module in the Apache HTTP Server 2.2.11 allows remote attackers to obtain sensitive response data, intended for a client that sent an earlier POST request with no request body, via an HTTP request (CVE-2009-1191). This update provides fixes for that vulnerability.

http://www.linuxsecurity.com/content/view/148761

udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space (CVE-2009-1185). The updated packages have been patched to prevent this.

http://www.linuxsecurity.com/content/view/148756

Security vulnerabilities have been identified and fixed in udev. udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space (CVE-2009-1185). Buffer overflow in the util_path_encode function in udev/lib/libudev-util.c in udev before 1.4.1 allows local users to cause a denial of service (service outage) via vectors that trigger a call with crafted arguments (CVE-2009-1186). The updated packages have been patched to prevent this.

http://www.linuxsecurity.com/content/view/148755

Some problems were discovered and corrected in the Linux 2.6 kernel: Filesystem could become read-only in the event of a I/O retry or path failover of the VMWare ESX Server's SAN or iSCSI storage. To update your kernel, please follow the directions located at: http://www.mandriva.com/en/security/kernelupdate

http://www.linuxsecurity.com/content/view/148754

A configuration error in usermode was preventing some Mandriva graphical tools requiring superuser privileges to be started correctly if session was started from KDM. This updates fixes this issue.

http://www.linuxsecurity.com/content/view/148742

Multiple buffer overflows in the JBIG2 decoder allows remote attackers to cause a denial of service (crash) via a crafted PDF file (CVE-2009-0146). Multiple integer overflows in the JBIG2 decoder allows remote attackers to cause a denial of service (crash) via a crafted PDF file (CVE-2009-0147). An integer overflow in the JBIG2 decoder has unspecified impact. (CVE-2009-0165). A free of uninitialized memory flaw in the the JBIG2 decoder allows remote to cause a denial of service (crash) via a crafted PDF file (CVE-2009-0166). Multiple input validation flaws in the JBIG2 decoder allows remote attackers to execute arbitrary code via a crafted PDF file (CVE-2009-0800). An out-of-bounds read flaw in the JBIG2 decoder allows remote attackers to cause a denial of service (crash) via a crafted PDF file (CVE-2009-0799). An integer overflow in the JBIG2 decoder allows remote attackers to execute arbitrary code via a crafted PDF file (CVE-2009-1179). A free of invalid data flaw in the JBIG2 decoder allows remote attackers to execute arbitrary code via a crafted PDF (CVE-2009-1180). A NULL pointer dereference flaw in the JBIG2 decoder allows remote attackers to cause denial of service (crash) via a crafted PDF file (CVE-2009-1181). Multiple buffer overflows in the JBIG2 MMR decoder allows remote attackers to cause denial of service or to execute arbitrary code via a crafted PDF file (CVE-2009-1182, CVE-2009-1183). This update provides fixes for that vulnerabilities.

http://www.linuxsecurity.com/content/view/148741

Multiple vulnerabilities has been found and corrected in openafs: The cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Linux allows remote attackers to cause a denial of service (system crash) via an RX response with a large error-code value that is interpreted as a pointer and dereferenced, related to use of the ERR_PTR macro (CVE-2009-1250). Heap-based buffer overflow in the cache manager in the client in OpenAFS 1.0 through 1.4.8 and 1.5.0 through 1.5.58 on Unix platforms allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via an RX response containing more data than specified in a request, related to use of XDR arrays (CVE-2009-1251). The updated packages have been patched to correct these issues.

http://www.linuxsecurity.com/content/view/148690

A buffer underflow in Ghostscript's CCITTFax decoding filter allows remote attackers to cause denial of service and possibly to execute arbitrary by using a crafted PDF file (CVE-2007-6725). Multiple interger overflows in Ghostsript's International Color Consortium Format Library (icclib) allows attackers to cause denial of service (heap-based buffer overflow and application crash) and possibly execute arbirary code by using either a PostScript or PDF file with crafte embedded images (CVE-2009-0583, CVE-2009-0584). Multiple interger overflows in Ghostsript's International Color Consortium Format Library (icclib) allows attackers to cause denial of service (heap-based buffer overflow and application crash) and possibly execute arbirary code by using either a PostScript or PDF file with crafte embedded images. Note: this issue exists because of an incomplete fix for CVE-2009-0583 (CVE-2009-0792). This update provides fixes for that vulnerabilities.

Update:

The previous update went with a wrong require version of perl-base in the foomatic-db-engine package. It is fixed on this update.

http://www.linuxsecurity.com/content/view/148683

The intel driver shipped wtih 2009.0 had problems when sealing with some Intel x4500MHD graphics chips like that found on Sony Vaio FW series laptops. This package includes an upstream fix for this issue.

http://www.linuxsecurity.com/content/view/148682

Multiple vulnerabilities has been found and corrected in krb5: The get_input_token function in the SPNEGO implementation in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to cause a denial of service (daemon crash) and possibly obtain sensitive information via a crafted length value that triggers a buffer over-read (CVE-2009-0844). The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors involving an invalid DER encoding that triggers a free of an uninitialized pointer (CVE-2009-0846). The asn1buf_imbed function in the ASN.1 decoder in MIT Kerberos 5 (aka krb5) 1.6.3, when PK-INIT is used, allows remote attackers to cause a denial of service (application crash) via a crafted length value that triggers an erroneous malloc call, related to incorrect calculations with pointer arithmetic (CVE-2009-0847). The updated packages have been patched to correct these issues.

Update:

krb5 packages for Mandriva Linux Corporate Server 3 and 4 are not affected by CVE-2009-0844 and CVE-2009-0845

http://www.linuxsecurity.com/content/view/148681

Updated libwmf packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/148751

An updated gpdf package that fixes multiple security issues is now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/148752

Updated kernel packages that fix several security issues and various bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/148753

Updated kernel-rt packages that fix several security issues and a bug are now available for Red Hat Enterprise MRG 1.1.2. This update has been rated as having important security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/148747

Updated firefox packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/148684

New ruby packages are available for Slackware 11.0, 12.0, 12.1, 12.2, and -current to fix a problem with REXML and other security issues. For details about the REXML issue, see: http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/ A full list may be found in the ChangeLog file included with the source code.

http://www.linuxsecurity.com/content/view/148757

New mozilla-firefox packages are available for Slackware 12.2 and -current to fix security issues. The updated packages may also be used with Slackware 11.0 or newer.

More details about the issues may be found on the Mozilla website: http://www.mozilla.org/security/known-vulnerabilities/firefox30.html

http://www.linuxsecurity.com/content/view/148743

New cups packages are available for Slackware 12.0, 12.1, 12.2, and -current to fix security issues. More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0146 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0147 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0163 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0164 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0166

http://www.linuxsecurity.com/content/view/148676

This is a notice that bitchx, an IRC client based on ircii-EPIC4, has been removed from Slackware -current and will not be part of future Slackware releases. Security issues and bugs have been reported, but upstream work seems to have stalled leaving bitchx in a state where there are known problems without official (or in some cases any) fixes. The most secure course of action is to remove bitchx from the system and switch to using a supported IRC client. We have not compiled a complete list of open issues in BitchX, but here are a few that we know about: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3360 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4584 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5839

Package removal instructions: +---------------------------+ Remove the package as root: # removepkg bitchx Some admins may also want to add a symlink to another console IRC client such as irssi to help users migrate: cd /usr/bin ln -sf irssi BitchX

+-----+ Slackware Linux Security Team http://slackware.com/gpg-key

http://www.linuxsecurity.com/content/view/148677

USN-761-1 fixed vulnerabilities in PHP. This update provides the corresponding updates for Ubuntu 9.04. Original advisory details: It was discovered that PHP did not sanitize certain error messages when display_errors is enabled, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain. (CVE-2008-5814) It was discovered that PHP did not properly handle certain malformed strings when being parsed by the json_decode function. A remote attacker could exploit this flaw and cause the PHP server to crash, resulting in a denial of service. This issue only affected Ubuntu 8.04 and 8.10. (CVE-2009-1271)

http://www.linuxsecurity.com/content/view/148687

It was discovered that acpid did not properly handle a large number of connections. A local user could exploit this and monopolize CPU resources, leading to a denial of service.

http://www.linuxsecurity.com/content/view/148688

Tavis Ormandy discovered that FreeType did not correctly handle certain large values in font files. If a user were tricked into using a specially crafted font file, a remote attacker could execute arbitrary code with user privileges.

http://www.linuxsecurity.com/content/view/148689

A vulnerability has been reported in libmodplug, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise an application using the library.

http://www.linuxsecurity.com/content/view/148760

Multiple vulnerabilities have been reported in Poppler, which can be exploited by malicious people to cause a DoS (Denial of Service).

http://www.linuxsecurity.com/content/view/148759

Some vulnerabilities have been reported in Ghostscript which can be exploited by malicious people to potentially compromise a user's system.

http://www.linuxsecurity.com/content/view/148758

Some vulnerabilities have been reported in udev, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or gain escalated privileges.

http://www.linuxsecurity.com/content/view/148736

A stack-based buffer overflow was found in the zsh command interpreter.

http://www.linuxsecurity.com/content/view/148733

A vulnerability has been reported in mpg123, which can be exploited by malicious people to potentially compromise a user's system.

http://www.linuxsecurity.com/content/view/148734

A vulnerability has been reported in libmodplug, which can be exploited by malicious people to compromise an application using the library.

http://www.linuxsecurity.com/content/view/148735

A vulnerability has been reported in International Components for Unicode, which can be exploited by malicious people to bypass certain security restrictions.

http://www.linuxsecurity.com/content/view/148732