Thank you for reading the Linux Advisory Watch Security Newsletter. The purpose of this document is to provide our readers with a quick summary of each week's vendor security bulletins and pointers on methods to improve the security posture of your open source system. Vulnerabilities affect nearly every vendor virtually every week, so be sure to read through to find the updates your distributor have made available.

LinuxSecurity.com Feature Extras:

Password guessing with Medusa 2.0 - Medusa was created by the fine folks at foofus.net, in fact the much awaited Medusa 2.0 update was released in February of 2010. For a complete change log please visit

Password guessing as an attack vector - Using password guessing as an attack vector. Over the years we've been taught a strong password must be long and complex to be considered secure. Some of us have taken that notion to heart and always ensure our passwords are strong. But some don't give a second thought to the complexity or length of our password.

(Feb 2)

Stefan Esser discovered that the implementation of the max_input_vars configuration variable in a recent PHP security update was flawed such that it allows remote attackers to crash PHP or potentially execute code. [More...]
(Feb 2)

Several vulnerabilities have been found in the Iceape internet suite, an unbranded version of Seamonkey: CVE-2011-3670 [More...]
(Feb 2)

Several vulnerabilities have been discovered in Iceweasel, a web browser based on Firefox. The included XULRunner library provides rendering services for several other applications included in Debian. [More...]
(Feb 2)

Several vulnerabilities have been found in Tomcat, a servlet and JSP engine: CVE-2011-1184 CVE-2011-5062 CVE-2011-5063 CVE-2011-5064 [More...]
(Jan 31)

A regression was found in the fix for PHP's XSLT transformations (CVE-2012-0057). Updated packages are now available to address this regression. For reference, the original advisory text follows. [More...]
(Jan 31)

Several vulnerabilities have been discovered in PHP, the web scripting language. The Common Vulnerabilities and Exposures project identifies the following issues: [More...]
(Jan 30)

Several vulnerabilities have been discovered in Curl, an URL transfer library. The Common Vulnerabilities and Exposures project identifies the following problems: [More...]
(Jan 29)

It was discovered that a buffer overflow in the Unicode libraray ICU could lead to the execution of arbitrary code. For the oldstable distribution (lenny), this problem has been fixed in [More...]
(Jan 27)

Nicolae Mogoraenu discovered a heap overflow in the emulated e1000e network interface card of KVM, a solution for full virtualization on x86 hardware, which could result in denial of service or privilege escalation. [More...]
(Jan 27)

Laurent Butti discovered a buffer underflow in the LANalyzer dissector of the Wireshark network traffic analyzer, which could lead to the execution of arbitrary code (CVE-2012-0068) [More...]
(Jan 26)

Many security problems had been fixed in libxml2, a popular library to handle XML data files. CVE-2011-3919: [More...]
(Jan 30)

Multiple vulnerabilities in bip might allow remote unauthenticatedattackers to cause a Denial of Service or possibly execute arbitrarycode.
(Jan 30)

Multiple vulnerabilities in Adobe Reader might allow remote attackersto execute arbitrary code or conduct various other attacks.
(Jan 27)

Multiple vulnerabilities have been reported in Chromium, some of whichmay allow execution of arbitrary code.
(Jan 27)

A debugging functionality in the X.Org X Server that is bound to ahotkey by default can be used by local attackers to circumvent screenlocking utilities.
(Jan 27)

Two vulnerabilities have been found in ktsuss, allowing local attackersto gain escalated privileges.
Mandriva: 2012:012: apache (Feb 2)

Multiple vulnerabilities has been found and corrected in apache (ASF HTTPD): The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded [More...]
Mandriva: 2012:011: openssl (Jan 29)

A vulnerability has been found and corrected in openssl: OpenSSL 0.9.8s and 1.0.0f does not properly support DTLS applications, which allows remote attackers to cause a denial of service via unspecified vectors. NOTE: this vulnerability exists because of an [More...]
Red Hat: 2012:0093-01: php: Critical Advisory (Feb 2)

Updated php packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5 and 6. The Red Hat Security Response Team has rated this update as having critical [More...]
Red Hat: 2012:0095-01: ghostscript: Moderate Advisory (Feb 2)

Updated ghostscript packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate [More...]
Red Hat: 2012:0096-01: ghostscript: Moderate Advisory (Feb 2)

Updated ghostscript packages that fix two security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate [More...]
Red Hat: 2012:0094-01: freetype: Important Advisory (Feb 2)

Updated freetype packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.6 Extended Update Support. The Red Hat Security Response Team has rated this update as having [More...]
Red Hat: 2012:0092-01: php53: Critical Advisory (Feb 2)

Updated php53 packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having critical [More...]
Red Hat: 2012:0086-01: openssl: Moderate Advisory (Feb 1)

Updated openssl packages that fix two security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate [More...]
Red Hat: 2012:0085-01: thunderbird: Critical Advisory (Feb 1)

An updated thunderbird package that fixes two security issues is now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having critical [More...]
Red Hat: 2012:0084-01: seamonkey: Critical Advisory (Feb 1)

Updated seamonkey packages that fix two security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having critical [More...]
Red Hat: 2012:0079-01: firefox: Critical Advisory (Jan 31)

Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having critical [More...]
Red Hat: 2012:0080-01: thunderbird: Critical Advisory (Jan 31)

An updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having critical [More...]
Ubuntu: 1354-1: usbmuxd vulnerability (Feb 1)

usbmuxd could be made to crash or run programs if it received speciallycrafted input.
Ubuntu: 1351-1: AccountsService vulnerability (Jan 31)

AccountsService could be made to overwrite files as the administrator.
Ubuntu: 1349-1: X.Org vulnerability (Jan 26)

X could be made to start by a user who lacked appropriate permissions.
Ubuntu: 1348-1: ICU vulnerability (Jan 26)

ICU could be made to crash or run programs as your login if itopened specially crafted data.