Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.22 (Version 3.0, Release 22). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy.

http://www.linuxsecurity.com/content/view/145668

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems:

http://www.linuxsecurity.com/content/view/151755

Several denial of service vulnerabilities have been discovered in polipo, a small, caching web proxy. The Common Vulnerabilities and Exposures project identifies the following problems:

http://www.linuxsecurity.com/content/view/151740

Several remote vulnerabilities have been discovered in PHP 5, an hypertext preprocessor. The Common Vulnerabilities and Exposures project identifies the following problems:

http://www.linuxsecurity.com/content/view/151739

Several vulnerabilities have been discovered in ffmpeg, a multimedia player, server and encoder, which also provides a range of multimedia libraries used in applications like MPlayer:

http://www.linuxsecurity.com/content/view/151736

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications, such as the Iceweasel web browser. The Common Vulnerabilities and Exposures project identifies the following problems:

http://www.linuxsecurity.com/content/view/151734

This release fixes several important issues to help prevent a detection bypass and denial of service attacks against ModSecurity. Quite a few small but notable bugs were fixed. The latest Core Ruleset (2.0.5) is included. [More...]

http://www.linuxsecurity.com/content/view/151785

A vulnerabilitiy has been found and corrected in sudo: sudo 1.6.x before 1.6.9p21 and 1.7.x before 1.7.2p4, when a pseudo-command is enabled, permits a match between the name of the pseudo-command and the name of an executable file in an arbitrary [More...]

http://www.linuxsecurity.com/content/view/151781

Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests (CVE-2010-0464). [More...]

http://www.linuxsecurity.com/content/view/151780

A race condition has been found in fuse that could escalate privileges for local users and lead to a DoS (Denial of Service) (CVE-2009-3297). The updated packages have been patched to correct this issue. [More...] _______________________________________________________________________

http://www.linuxsecurity.com/content/view/151766

A vulnerability has been found in ncpfs which can be exploited by local users to disclose potentially sensitive information, cause a DoS (Denial of Service), and potentially gain escalated privileges (CVE-2009-3297). [More...]

http://www.linuxsecurity.com/content/view/151765

A vulnerability has been found and corrected in php: PHP before 5.2.12 does not properly handle session data, which has unspecified impact and attack vectors related to (1) interrupt corruption of the SESSION superglobal array and (2) the [More...]

http://www.linuxsecurity.com/content/view/151758

A vulnerabilitiy has been found and corrected in mysql: MySQL is vulnerable to a symbolic link attack when the data home directory contains a symlink to a different filesystem which allows remote authenticated users to bypass intended access restrictions (CVE-2008-7247). The updated packages have been patched to correct these issues.

http://www.linuxsecurity.com/content/view/151748

The blogtk package in 2010.0 was crashing on start. This update fixes the problem by updating blogtk to the latest version. Additionally the python-gdata packages are being provided as well due to requirements.

http://www.linuxsecurity.com/content/view/151747

A vulnerability have been discovered and corrected in libtheora: Integer overflow in libtheora in Xiph.Org Theora before 1.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a video with large dimensions (CVE-2009-3389). The updated packages have been patched to correct this issue.

http://www.linuxsecurity.com/content/view/151746

Security issues were identified and fixed in firefox 3.0.x and 3.5.x: Mozilla developers identified and fixed several stability bugs in the browser engine used in Firefox and other Mozilla-based products.

http://www.linuxsecurity.com/content/view/151741

This update enables files to be properly attached when xdg-email is used with Thunderbird as the default mail client.

http://www.linuxsecurity.com/content/view/151735

The DHCP client ignores the interface-mtu option set by server. This update fixes the issue.

http://www.linuxsecurity.com/content/view/151733

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel: Array index error in the gdth_read_event function in drivers/scsi/gdth.c in the Linux kernel before 2.6.32-rc8 allows local users to cause a denial of service or possibly gain privileges via a negative event index in an IOCTL request.

http://www.linuxsecurity.com/content/view/151732

The new mdkonline packages adds the extended maintenance support to mdkonline. Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers as well as for official 2008.0 updates.

http://www.linuxsecurity.com/content/view/151731

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel: Array index error in the gdth_read_event function in drivers/scsi/gdth.c in the Linux kernel before 2.6.32-rc8 allows local users to cause a denial of service or possibly gain privileges via a negative event index in an IOCTL request.

http://www.linuxsecurity.com/content/view/151728

Multiple security vulnerabilities has been identified and fixed in pidgin: Certain malformed SLP messages can trigger a crash because the MSN protocol plugin fails to check that all pieces of the message are set correctly (CVE-2010-0277).

http://www.linuxsecurity.com/content/view/151727

An updated sudo package that fixes two security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/151784

Updated acroread packages that fix two security issues and a bug are now available for Red Hat Enterprise Linux 4 Extras and Red Hat Enterprise Linux 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/151729

Updated pidgin packages that fix three security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

http://www.linuxsecurity.com/content/view/151730

http://www.linuxsecurity.com/content/view/151737

It was discovered that the XML HMAC signature system did not correctly check certain lengths. If an attacker sent a truncated HMAC, it could bypass authentication, leading to potential privilege escalation. (CVE-2009-0217) [More...]

http://www.linuxsecurity.com/content/view/151767

Fabian Yamaguchi discovered that Pidgin incorrectly validated all fields of an incoming message in the MSN protocol handler. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service. (CVE-2010-0277)

http://www.linuxsecurity.com/content/view/151750

USN-890-1 fixed vulnerabilities in Expat. This update provides the corresponding updates for XML-RPC for C and C++. Original advisory details: Jukka Taimisto, Tero Rontti and Rauli Kaksonen discovered that Expat did not properly process malformed XML. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service via application crash. (CVE-2009-2625, CVE-2009-3720)

http://www.linuxsecurity.com/content/view/151738

Multiple vulnerabilities have been fixed in kernel, which can be exploited by malicious people to cause denial of service, or possibly arbitrary code execution.

http://www.linuxsecurity.com/content/view/151776

Multiple vulnerabilities have been fixed in Flashplugin, which can be used by malicious people to possibly 1) cause denial of service 2) make cross domain requests

http://www.linuxsecurity.com/content/view/151777

A vulnerability has been fixed in Kernel, which can be exploited by malicious people to crash kernel due to divide by zero in azx_position_ok

http://www.linuxsecurity.com/content/view/151778

Multiple vulnerabilities have been fixed in Pidgin, which can be used by malicious people to cause denial of service.

http://www.linuxsecurity.com/content/view/151779