Thank you for reading the Linux Advisory Watch Security Newsletter. The purpose of this document is to provide our readers with a quick summary of each week's vendor security bulletins and pointers on methods to improve the security posture of your open source system. Vulnerabilities affect nearly every vendor virtually every week, so be sure to read through to find the updates your distributor have made available.

LinuxSecurity.com Feature Extras:

Peter Smith Releases Linux Network Security Online - Thanks so much to Peter Smith for announcing on linuxsecurity.com the release of his Linux Network Security book available free online. "In 2005 I wrote a book on Linux security. 8 years later and the publisher has gone out of business. Now that I'm free from restrictions on reproducing material from the book, I have decided to make the entire book available online."

Securing a Linux Web Server - With the significant prevalence of Linux web servers globally, security is often touted as a strength of the platform for such a purpose. However, a Linux based web server is only as secure as its configuration and very often many are quite vulnerable to compromise. While specific configurations vary wildly due to environments or specific use, there are various general steps that can be taken to insure basic security considerations are in place.

(Aug 6)

Security Report Summary
(Aug 5)

Security Report Summary
(Aug 3)

Security Report Summary
(Aug 3)

Security Report Summary
(Jul 31)

Security Report Summary
(Jul 31)

Security Report Summary
(Aug 4)

A vulnerability in Zend Framework could allow a remote attacker to inject SQL commands.
Mandriva: 2014:158: openssl (Aug 8)

Multiple vulnerabilities has been discovered and corrected in openssl: A flaw in OBJ_obj2txt may cause pretty printing functions such as X509_name_oneline, X509_name_print_ex et al. to leak some information from the stack. Applications may be affected if they echo pretty [More...]
Mandriva: 2014:157: ipython (Aug 8)

Updated ipython package fixes security vulnerability: In IPython before 1.2, the origin of websocket requests was not verified within the IPython notebook server. If an attacker has knowledge of an IPython kernel id they can run arbitrary code on [More...]
Mandriva: 2014:156: ocsinventory (Aug 7)

Updated ocsinventory packages fix security vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in the OCS Reports Web Interface in OCS Inventory NG allow remote attackers to inject arbitrary web script or HTML via unspecified vectors (CVE-2014-4722). [More...]
Mandriva: 2014:155: kernel (Aug 7)

Multiple vulnerabilities has been found and corrected in the Linux kernel: Multiple buffer overflows in drivers/staging/wlags49_h2/wl_priv.c in the Linux kernel before 3.12 allow local users to cause a [More...]
Mandriva: 2014:154: readline (Aug 6)

Updated readline packages fix security vulnerability: Steve Kemp discovered the _rl_tropen() function in readline insecurely handled a temporary file. This could allow a local attacker to perform symbolic link attacks (CVE-2014-2524). [More...]
Mandriva: 2014:153: mediawiki (Aug 6)

Updated mediawiki packages fix security vulnerabilities: MediaWiki before 1.23.2 is vulnerable to JSONP injection in Flash, XSS in mediawiki.page.image.pagination.js, and clickjacking between OutputPage and ParserOutput. [More...]
Mandriva: 2014:152: glibc (Aug 6)

Updated glibc packages fix security issues: Stephane Chazelas discovered that directory traversal issue in locale handling in glibc. glibc accepts relative paths with .. components in the LC_* and LANG variables. Together with typical OpenSSH [More...]
Mandriva: 2014:151: cups (Aug 6)

Updated cups packages fix security vulnerability: In CUPS before 1.7.4, a local user with privileges of group=lp can write symbolic links in the rss directory and use that to gain '@SYSTEM' group privilege with cupsd (CVE-2014-3537). [More...]
Mandriva: 2014:150: tor (Aug 6)

Updated tor package fixes security vulnerability: Tor before 0.2.4.23 maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern [More...]
Mandriva: 2014:149: php (Aug 6)

Multiple vulnerabilities has been discovered and corrected in php: Use-after-free vulnerability in ext/spl/spl_array.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via [More...]
Mandriva: 2014:148: dbus (Jul 31)

Updated dbus packages fix security vulnerabilities: A flaw was reported in D-Bus's file descriptor passing feature. A local attacker could use this flaw to cause a service or application to disconnect from the bus, typically resulting in that service or [More...]
Mandriva: 2014:147: sendmail (Jul 31)

Updated sendmail packages fix security vulnerability: Sendmail before 8.14.9 does not properly closing file descriptors before executing programs. This bug could enable local users to interfere with an open SMTP connection if they can execute their own [More...]
Mandriva: 2014:146: file (Jul 31)

A vulnerability has been found and corrected in file: file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers [More...]
Mandriva: 2014:145: php-ZendFramework (Jul 31)

A vulnerability has been found and corrected in php-ZendFramework: The implementation of the ORDER BY SQL statement in Zend_Db_Select of Zend Framework 1 contains a potential SQL injection when the query string passed contains parentheses (CVE-2014-4914). [More...]
Red Hat: 2014:1036-01: java-1.5.0-ibm: Important Advisory (Aug 7)

Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Important security [More...]
Red Hat: 2014:1031-01: 389-ds-base: Important Advisory (Aug 7)

Updated 389-ds-base packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Important security [More...]
Red Hat: 2014:1033-01: java-1.6.0-ibm: Critical Advisory (Aug 7)

Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6 Supplementary. Red Hat Product Security has rated this update as having Critical security [More...]
Red Hat: 2014:1034-01: tomcat: Low Advisory (Aug 7)

Updated tomcat packages that fix one security issue are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Low security [More...]
Red Hat: 2014:1025-01: kernel: Important Advisory (Aug 6)

Updated kernel packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 6.2 Advanced Update Support. The Red Hat Security Response Team has rated this update as having [More...]
Red Hat: 2014:1023-01: kernel: Important Advisory (Aug 6)

Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having [More...]
Red Hat: 2014:1013-01: php: Moderate Advisory (Aug 6)

Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Moderate [More...]
Red Hat: 2014:1012-01: php53 and php: Moderate Advisory (Aug 6)

Updated php53 and php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. The Red Hat Security Response Team has rated this update as having Moderate [More...]
Red Hat: 2014:1011-01: resteasy-base: Moderate Advisory (Aug 5)

Updated resteasy-base packages that fix one security issue are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Moderate [More...]
Red Hat: 2014:1008-01: samba: Important Advisory (Aug 5)

Updated samba packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having [More...]
Red Hat: 2014:1009-01: samba4: Important Advisory (Aug 5)

Updated samba4 packages that fix one security issue are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having [More...]
Red Hat: 2014:1004-01: yum-updatesd: Important Advisory (Aug 5)

An updated yum-updatesd package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having [More...]
Red Hat: 2014:0994-01: openstack-keystone: Important Advisory (Jul 31)

Updated openstack-keystone packages that fix two security issues are now available for Red Hat Enterprise Linux OpenStack Platform 3.0 and 4.0. The Red Hat Security Response Team has rated this update as having [More...]
(Aug 1)

New samba packages are available for Slackware 14.1 and -current to fix a security issue. [More Info...]
(Aug 1)

New dhcpcd packages are available for Slackware 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue. [More Info...]
Ubuntu: 2308-1: OpenSSL vulnerabilities (Aug 7)

Several security issues were fixed in OpenSSL.
Ubuntu: 2307-1: GPGME vulnerability (Aug 6)

GPGME could be made to crash or run programs as your login if it processeda specially crafted certificate.
Ubuntu: 2306-2: GNU C Library regression (Aug 5)

USN-2306-1 introduced a regression in the GNU C Library.
Ubuntu: 2306-1: GNU C Library vulnerabilities (Aug 4)

Several security issues were fixed in the GNU C Library.
Ubuntu: 2305-1: Samba vulnerability (Aug 1)

Samba could be made to run programs as an administrator if it receivedspecially crafted network traffic.
Ubuntu: 2304-1: KDE-Libs vulnerability (Jul 31)

kauth could be tricked into bypassing polkit authorizations.
Ubuntu: 2303-1: Unity vulnerability (Jul 31)

The Unity lock screen could possibly be bypassed in certain circumstances.