From vmiklos at frugalware.org Mon Mar 1 20:19:47 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Mon, 1 Mar 2010 20:19:47 +0100 (CET) Subject: [Frugalware-security] [ FSA-626 ] phpmyadmin Message-ID: <20100301191947.93B451240003@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-626 Date: 2010-03-01 Package: phpmyadmin Vulnerable versions: <= 3.2.0.1-1 Unaffected versions: >= 3.2.2.1-1getorin1 Related bugreport: http://bugs.frugalware.org/task/3996 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3696 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3697 Description =========== Some vulnerabilities have been reported in phpMyAdmin, which can be exploited by malicious users to conduct script insertion and SQL injection attacks. 1) Input used as the MySQL table name is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. 2) Input passed to various parameters of the PDF schema generator feature is not properly sanitised before being used. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Updated Packages ================ Check if you have phpmyadmin installed: # pacman-g2 -Q phpmyadmin If found, then you should upgrade to the latest version: # pacman-g2 -Sy phpmyadmin Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/626 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuME1IACgkQZ7NElSD1VhmSTgCfWAfeidiLxgm1nD/gZT2M+pRG 1L4AoJpWa2NFM32NKuDFAEo+glpeJrlj =0uUZ -----END PGP SIGNATURE----- From vmiklos at frugalware.org Mon Mar 1 20:22:29 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Mon, 1 Mar 2010 20:22:29 +0100 (CET) Subject: [Frugalware-security] [ FSA-627 ] drupal-webform Message-ID: <20100301192229.210F51240003@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-627 Date: 2010-03-01 Package: drupal-webform Vulnerable versions: <= 5.x_2.7-1 Unaffected versions: >= 5.x_2.8-1getorin1 Related bugreport: http://bugs.frugalware.org/task/4000 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=4532 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4533 Description =========== Some vulnerabilities have been reported in the Webform module for Drupal, which can be exploited by malicious users to conduct script insertion attacks, and by malicious people to disclose potentially sensitive information. 1) Input passed to field labels while creating new webforms is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. Successful exploitation of this vulnerability requires permissions to create webforms. 2) An error in the handling of cached pages can be exploited to disclose session variables when caching is enabled. Updated Packages ================ Check if you have drupal-webform installed: # pacman-g2 -Q drupal-webform If found, then you should upgrade to the latest version: # pacman-g2 -Sy drupal-webform Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/627 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuME/QACgkQZ7NElSD1VhlTEACeNHispwrw8l/5bs7vm/S5ebE7 t0sAnRQERAFRwkbTWV4ibQddtfIkLmP/ =3PRS -----END PGP SIGNATURE----- From vmiklos at frugalware.org Mon Mar 1 20:25:34 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Mon, 1 Mar 2010 20:25:34 +0100 (CET) Subject: [Frugalware-security] [ FSA-628 ] drupal6-webform Message-ID: <20100301192534.720A01240003@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-628 Date: 2010-03-01 Package: drupal6-webform Vulnerable versions: <= 6.x_2.7-1 Unaffected versions: >= 6.x_2.8-1getorin1 Related bugreport: http://bugs.frugalware.org/task/4001 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=4532 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4533 Description =========== See FSA627 for details. Updated Packages ================ Check if you have drupal6-webform installed: # pacman-g2 -Q drupal6-webform If found, then you should upgrade to the latest version: # pacman-g2 -Sy drupal6-webform Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/628 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuMFK4ACgkQZ7NElSD1VhkllwCfXN0zB6bcduAmR07QqszUxwZ/ SU8AnA4KP+V76uPFZEqsh8YdOrevAYzd =x/I8 -----END PGP SIGNATURE----- From vmiklos at frugalware.org Mon Mar 1 20:29:36 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Mon, 1 Mar 2010 20:29:36 +0100 (CET) Subject: [Frugalware-security] [ FSA-629 ] wordpress Message-ID: <20100301192936.925CF1240003@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-629 Date: 2010-03-01 Package: wordpress Vulnerable versions: <= 2.8.4-1 Unaffected versions: >= 2.8.5-1getorin1 Related bugreport: http://bugs.frugalware.org/task/4007 CVE: No CVE, see http://wordpress.org/development/2009/10/wordpress-2-8-5-hardening-release/. Description =========== A vulnerability has been reported in WordPress, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to the wp-trackback.php script letting users pass multiple source character encodings to the "mb_convert_encoding()" function, which can be used to cause a high CPU load, potentially resulting in a DoS. Updated Packages ================ Check if you have wordpress installed: # pacman-g2 -Q wordpress If found, then you should upgrade to the latest version: # pacman-g2 -Sy wordpress Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/629 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuMFaAACgkQZ7NElSD1Vhl1nwCfezlPkjZVeXOmlaxG3zOdoc4r x4UAoJS/22rO4u56GDmyL9ZBOU9OFUXm =pDnT -----END PGP SIGNATURE----- From vmiklos at frugalware.org Mon Mar 1 20:33:08 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Mon, 1 Mar 2010 20:33:08 +0100 (CET) Subject: [Frugalware-security] [ FSA-630 ] drupal-link Message-ID: <20100301193308.6E4BE1240003@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-630 Date: 2010-03-01 Package: drupal-link Vulnerable versions: <= 5.x_2.5-1 Unaffected versions: >= 5.x_2.6-1getorin1 Related bugreport: http://bugs.frugalware.org/task/4024 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3915 Description =========== A vulnerability has been reported in the Link module for Drupal, which can be exploited by malicious users to conduct script insertion attacks. Input passed via the link title parameter, when using the "Separate title and URL" format, is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. Updated Packages ================ Check if you have drupal-link installed: # pacman-g2 -Q drupal-link If found, then you should upgrade to the latest version: # pacman-g2 -Sy drupal-link Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/630 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuMFnQACgkQZ7NElSD1Vhln9gCePtLG3jjF4Kz4C8ZDSs6cRWVQ WZYAn1JAroUrRGCSLnwIu6Uck5fF+OTy =2Voa -----END PGP SIGNATURE----- From vmiklos at frugalware.org Mon Mar 1 20:34:47 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Mon, 1 Mar 2010 20:34:47 +0100 (CET) Subject: [Frugalware-security] [ FSA-631 ] drupal6-link Message-ID: <20100301193447.357281240004@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-631 Date: 2010-03-01 Package: drupal6-link Vulnerable versions: <= 6.x_2.6-1 Unaffected versions: >= 6.x_2.8-1getorin1 Related bugreport: http://bugs.frugalware.org/task/4025 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3915 Description =========== See FSA630 for details. Updated Packages ================ Check if you have drupal6-link installed: # pacman-g2 -Q drupal6-link If found, then you should upgrade to the latest version: # pacman-g2 -Sy drupal6-link Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/631 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuMFtcACgkQZ7NElSD1VhmeHACeOYxCacZZmm4NqZ4Z0Dft8mA9 BVIAoKcNnP12wK5hmApOCt5mQdDp4C/Q =J0NB -----END PGP SIGNATURE----- From vmiklos at frugalware.org Mon Mar 1 20:40:49 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Mon, 1 Mar 2010 20:40:49 +0100 (CET) Subject: [Frugalware-security] [ FSA-632 ] wireshark Message-ID: <20100301194049.665BE1240003@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-632 Date: 2010-03-01 Package: wireshark Vulnerable versions: <= 1.2.2-1getorin1 Unaffected versions: >= 1.2.3-1getorin1 Related bugreport: http://bugs.frugalware.org/task/4026 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2560 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3549 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3550 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3551 Description =========== Some vulnerabilities have been reported in Wireshark, which can be exploited by malicious people to cause a DoS (Denial of Service). 1) An alignment error within the "dissect_paltalk()" function in epan/dissectors/packet-paltalk.c of the Paltalk dissector can be exploited to cause a crash. Note: Successful exploitation requires that Wireshark is running on an alignment sensitive architecture. 2) A NULL pointer dereference error within the DCERPC/NT dissector when can be exploited to cause a crash. 3) An off-by-one error within the "dissect_negprot_response()" function in epan/dissectors/packet-smb.c of the SMB dissector can be exploited to cause a crash. 4) An error within the RADIUS dissector can be exploited to cause a crash. Updated Packages ================ Check if you have wireshark installed: # pacman-g2 -Q wireshark If found, then you should upgrade to the latest version: # pacman-g2 -Sy wireshark Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/632 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuMGEEACgkQZ7NElSD1VhkeeACfelR04Hu2+r1PxcSM/LG67r6O O1gAnjLydZSLzMPFKGlNwFVd4FejxRyq =0hpG -----END PGP SIGNATURE----- From vmiklos at frugalware.org Mon Mar 1 20:43:15 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Mon, 1 Mar 2010 20:43:15 +0100 (CET) Subject: [Frugalware-security] [ FSA-633 ] wordpress Message-ID: <20100301194315.6FAE31240004@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-633 Date: 2010-03-01 Package: wordpress Vulnerable versions: <= 2.8.5-1getorin1 Unaffected versions: >= 2.8.6-1getorin1 Related bugreport: http://bugs.frugalware.org/task/4043 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3890 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3891 Description =========== A security issue and a vulnerability have been reported in WordPress, which can be exploited by malicious users to conduct script insertion attacks and compromise a vulnerable system. 1) The security issue is caused due to the wp_check_filetype() function in /wp-includes/functions.php improperly validating uploaded files. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script with multiple extensions. Successful exploitation of this vulnerability requires that Apache is not configured to handle the mime-type for media files with an e.g. "gif", "jpg", "png", "tif", "wmv" extension. 2) Input passed via certain parameters to press-this.php is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. Updated Packages ================ Check if you have wordpress installed: # pacman-g2 -Q wordpress If found, then you should upgrade to the latest version: # pacman-g2 -Sy wordpress Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/633 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuMGNMACgkQZ7NElSD1Vhlk5gCdGN20IDKf3bHrFwJ3itPYoqTP n1YAn12xk+BR5rxbGgosf/GULdnWImEx =B3OK -----END PGP SIGNATURE----- From vmiklos at frugalware.org Mon Mar 1 20:52:22 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Mon, 1 Mar 2010 20:52:22 +0100 (CET) Subject: [Frugalware-security] [ FSA-634 ] drupal Message-ID: <20100301195222.06A1C1240004@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-634 Date: 2010-03-01 Package: drupal Vulnerable versions: <= 5.20-1getorin1 Unaffected versions: >= 5.21-1getorin1 Related bugreport: http://bugs.frugalware.org/task/4052 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4369 Description =========== A vulnerability has been reported in Drupal Core, which can be exploited by malicious users to conduct script insertion attacks. Input passed to the "Category" input field of the Contact module's administration form is not properly sanitised before being displayed to the user. Updated Packages ================ Check if you have drupal installed: # pacman-g2 -Q drupal If found, then you should upgrade to the latest version: # pacman-g2 -Sy drupal Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/634 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuMGvUACgkQZ7NElSD1VhnVogCfZCxFZWCID7SqObmckmc70ZIw LaQAoIbENHtHyT+aOvoy9tQI1fzIsWOE =ruzG -----END PGP SIGNATURE----- From vmiklos at frugalware.org Mon Mar 1 20:54:33 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Mon, 1 Mar 2010 20:54:33 +0100 (CET) Subject: [Frugalware-security] [ FSA-635 ] drupal6 Message-ID: <20100301195433.BC6D01240001@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-635 Date: 2010-03-01 Package: drupal6 Vulnerable versions: <= 6.14-1getorin1 Unaffected versions: >= 6.15-1getorin1 Related bugreport: http://bugs.frugalware.org/task/4053 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4369 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4370 Description =========== Some vulnerabilities have been reported in Drupal Core, which can be exploited by malicious users to conduct script insertion attacks. 1) Input passed to the "Category" input field of the Contact module's administration page is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. Successful exploitation requires the "administer site-wide contact form" privilege. 2) Certain unspecified input passed to the Menu module's administration page is not properly sanitised before being displayed in the menu administration overview. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. Successful exploitation requires the privilege to create new menus. Updated Packages ================ Check if you have drupal6 installed: # pacman-g2 -Q drupal6 If found, then you should upgrade to the latest version: # pacman-g2 -Sy drupal6 Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/635 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuMG3kACgkQZ7NElSD1VhmI7QCfYqMCiMddHxckszYYyI5wF/pY 1LMAn13CmXq4pjrgMPDm6rYzYJC1Rxe3 =pLW4 -----END PGP SIGNATURE----- From vmiklos at frugalware.org Mon Mar 1 21:05:09 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Mon, 1 Mar 2010 21:05:09 +0100 (CET) Subject: [Frugalware-security] [ FSA-636 ] wireshark Message-ID: <20100301200509.EAB881240001@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-636 Date: 2010-03-01 Package: wireshark Vulnerable versions: <= 1.2.5-1getorin1 Unaffected versions: >= 1.2.6-1getorin1 Related bugreport: http://bugs.frugalware.org/task/4087 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2563 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4377 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0304 Description =========== Some vulnerabilities have been reported in Wireshark, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a user's system. The vulnerabilities are caused due to errors within the LWRES dissector, which can be exploited to cause e.g. a stack-based buffer overflow via a specially crafted network packet or by tricking a user into loading a specially crafted capture file. Successful exploitation allows execution of arbitrary code. Updated Packages ================ Check if you have wireshark installed: # pacman-g2 -Q wireshark If found, then you should upgrade to the latest version: # pacman-g2 -Sy wireshark Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/636 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuMHfUACgkQZ7NElSD1VhlvXACcC0CcYb/zUyAUgMtEPbiUrZRW B/cAn28ahUg4gSZoS6wcP0oL3HDe2w+t =H6Wc -----END PGP SIGNATURE----- From vmiklos at frugalware.org Tue Mar 9 00:25:45 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Tue, 9 Mar 2010 00:25:45 +0100 (CET) Subject: [Frugalware-security] [ FSA-637 ] xar Message-ID: <20100308232545.CF60A20E000A@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-637 Date: 2010-03-09 Package: xar Vulnerable versions: <= 1.5.2-1 Unaffected versions: >= 1.5.2-2locris1 Related bugreport: http://bugs.frugalware.org/task/4128 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0055 Description =========== Braden Thomas from Apple has discovered a signature verification bypass issue in xar. The issue is that xar_open assumes that the checksum is stored at offset 0, but xar_signature_copy_signed_data uses xar property "checksum/offset" to find the offset to the checksum when validating the signature. As a result, a modified xar archive can pass signature validation by putting the checksum for the modified TOC at offset 0, pointing "checksum/offset" at the non-modified checksum at a higher offset, and using the original non-modified signature. Updated Packages ================ Check if you have xar installed: # pacman-g2 -Q xar If found, then you should upgrade to the latest version: # pacman-g2 -Sy xar Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/637 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuVh3kACgkQZ7NElSD1VhmEBACfefFMrIqLmzTzH8KoGWV/qeFZ bN4Anjdi1D60z5XzOFhPiIGwVb8labXb =j0Kn -----END PGP SIGNATURE----- From vmiklos at frugalware.org Wed Mar 10 01:04:22 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Wed, 10 Mar 2010 01:04:22 +0100 (CET) Subject: [Frugalware-security] [ FSA-638 ] wordpress Message-ID: <20100310000422.4CCE6124000C@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-638 Date: 2010-03-10 Package: wordpress Vulnerable versions: <= 2.9.1-1 Unaffected versions: >= 2.9.2-1locris1 Related bugreport: http://bugs.frugalware.org/task/4131 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0682 Description =========== A vulnerability has been discovered in WordPress, which can be exploited by malicious users to bypass certain security restrictions. The vulnerability is caused due to WordPress not properly restricting access to trashed posts, which can be exploited to e.g. view a trashed post by accessing it's page directly. Successful exploitation requires a valid user account. Updated Packages ================ Check if you have wordpress installed: # pacman-g2 -Q wordpress If found, then you should upgrade to the latest version: # pacman-g2 -Sy wordpress Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/638 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuW4gUACgkQZ7NElSD1VhmXgwCeP7UkVbCejepN0KEudp1/cQhy Ve8An0umAwnLV1u6oo+pR4d72WwYCRcz =oZAz -----END PGP SIGNATURE----- From vmiklos at frugalware.org Thu Mar 11 00:51:57 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Thu, 11 Mar 2010 00:51:57 +0100 (CET) Subject: [Frugalware-security] [ FSA-639 ] drupal Message-ID: <20100310235157.DE21B1240003@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-639 Date: 2010-03-11 Package: drupal Vulnerable versions: <= 5.21-1 Unaffected versions: >= 5.22-2locris1 Related bugreport: http://bugs.frugalware.org/task/4132 CVE: No CVE references, see http://drupal.org/node/731710. Description =========== Some vulnerabilities have been reported in Drupal, which can be exploited by malicious users to conduct script insertion attacks and bypass certain security restrictions. 1) Input passed via the "langcode", "name", and "native" parameters in the languages interface while using the Locale module is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed. Successful exploitation requires "administer languages" permissions. 2) An error in the handling of certain sessions can be exploited to maintain an open session despite the user being blocked. Updated Packages ================ Check if you have drupal installed: # pacman-g2 -Q drupal If found, then you should upgrade to the latest version: # pacman-g2 -Sy drupal Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/639 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuYMJ0ACgkQZ7NElSD1VhmUyACghxJJU0VKt/BF5uIHSIlxffEM hXUAnjaUn/kV8YvbpJcmZU6SikDiWVen =71l6 -----END PGP SIGNATURE----- From vmiklos at frugalware.org Thu Mar 11 00:53:52 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Thu, 11 Mar 2010 00:53:52 +0100 (CET) Subject: [Frugalware-security] [ FSA-640 ] drupal6 Message-ID: <20100310235352.F31A71240001@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-640 Date: 2010-03-11 Package: drupal6 Vulnerable versions: <= 6.15-1 Unaffected versions: >= 6.16-1locris1 Related bugreport: http://bugs.frugalware.org/task/4133 CVE: No CVE references, see http://drupal.org/node/731710. Description =========== See FSA639 for details. Updated Packages ================ Check if you have drupal6 installed: # pacman-g2 -Q drupal6 If found, then you should upgrade to the latest version: # pacman-g2 -Sy drupal6 Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/640 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuYMRAACgkQZ7NElSD1VhnJyACgjOFBKaA4dvZuShZKj2vjkxiQ u7gAnRPZTCzcZACmpuFCPAW856JUHxoX =sfig -----END PGP SIGNATURE----- From vmiklos at frugalware.org Fri Mar 12 02:44:35 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Fri, 12 Mar 2010 02:44:35 +0100 (CET) Subject: [Frugalware-security] [ FSA-641 ] drupal-i18n Message-ID: <20100312014435.5EC0A124000C@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-641 Date: 2010-03-12 Package: drupal-i18n Vulnerable versions: <= 5.x_2.5-1 Unaffected versions: >= 5.x_2.6-1locris1 Related bugreport: http://bugs.frugalware.org/task/4134 CVE: No CVE references, see http://drupal.org/node/731632. Description =========== A vulnerability has been reported in the Internationalization module for Drupal, which can be exploited by malicious users to compromise a vulnerable system. Certain unspecified input is not properly sanitised before being used to translate the text. This can be exploited to execute arbitrary PHP code by passing a malicious string to the input filter. Updated Packages ================ Check if you have drupal-i18n installed: # pacman-g2 -Q drupal-i18n If found, then you should upgrade to the latest version: # pacman-g2 -Sy drupal-i18n Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/641 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuZnIMACgkQZ7NElSD1Vhm/EQCeLl5+CfbRYoU7DOR23fdfWnew QP8AoKINEWDb7ymAOdkdNwND6Y5otkqK =zy0M -----END PGP SIGNATURE----- From vmiklos at frugalware.org Fri Mar 12 02:46:35 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Fri, 12 Mar 2010 02:46:35 +0100 (CET) Subject: [Frugalware-security] [ FSA-642 ] drupal6-i18n Message-ID: <20100312014635.DE46D124000C@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-642 Date: 2010-03-12 Package: drupal6-i18n Vulnerable versions: <= 6.x_1.2-1 Unaffected versions: >= 6.x_1.3-1locris1 Related bugreport: http://bugs.frugalware.org/task/4134 CVE: No CVE references, see http://drupal.org/node/731632. Description =========== See FSA641 for details. Updated Packages ================ Check if you have drupal6-i18n installed: # pacman-g2 -Q drupal6-i18n If found, then you should upgrade to the latest version: # pacman-g2 -Sy drupal6-i18n Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/642 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuZnPsACgkQZ7NElSD1Vhnb0gCgiENfxValG925cCx5L2P1ZiCt NWcAn2zQMzlJVUOgGFLLr9VZkIvqE4v/ =nN2j -----END PGP SIGNATURE----- From vmiklos at frugalware.org Tue Mar 16 20:49:10 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Tue, 16 Mar 2010 20:49:10 +0100 (CET) Subject: [Frugalware-security] [ FSA-643 ] libesmtp Message-ID: <20100316194910.F3C331240001@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-643 Date: 2010-03-16 Package: libesmtp Vulnerable versions: <= 1.0.4-1 Unaffected versions: >= 1.0.4-2locris1 Related bugreport: http://bugs.frugalware.org/task/4141 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2408 Description =========== libesmtp did not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. Updated Packages ================ Check if you have libesmtp installed: # pacman-g2 -Q libesmtp If found, then you should upgrade to the latest version: # pacman-g2 -Sy libesmtp Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/643 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuf4LYACgkQZ7NElSD1VhkhdgCgiP5MyNePf2A6aM60NqvbjgDa ZwwAn1kaa48rLS2BbutLdhTD67x715z1 =m/qE -----END PGP SIGNATURE----- From vmiklos at frugalware.org Tue Mar 23 14:10:41 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Tue, 23 Mar 2010 14:10:41 +0100 (CET) Subject: [Frugalware-security] [ FSA-644 ] firefox Message-ID: <20100323131041.0FAD21240005@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-644 Date: 2010-03-23 Package: firefox Vulnerable versions: <= 3.6-1 Unaffected versions: >= 3.6.2-1locris1 Related bugreport: http://bugs.frugalware.org/task/4158 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1028 Description =========== A vulnerability has been reported in Mozilla Firefox, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to an integer overflow error when processing WOFF fonts. This can be exploited to cause a heap-based buffer overflow via a web page embedding a WOFF font with an overly large "origLen" field. Updated Packages ================ Check if you have firefox installed: # pacman-g2 -Q firefox If found, then you should upgrade to the latest version: # pacman-g2 -Sy firefox Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/644 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuovdAACgkQZ7NElSD1VhmlbQCdEaKfbPHWPUorh4LUZyB1AjN4 7o4An1qCIZe1uB26D6srYrR/zwNGDYdC =adXP -----END PGP SIGNATURE----- From vmiklos at frugalware.org Sun Mar 28 01:56:07 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Sun, 28 Mar 2010 01:56:07 +0100 (CET) Subject: [Frugalware-security] [ FSA-645 ] drupal-mimemail Message-ID: <20100328005607.5AC491240001@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-645 Date: 2010-03-28 Package: drupal-mimemail Vulnerable versions: <= 5.x_1.0-1 Unaffected versions: >= 5.x_1.1-1locris1 Related bugreport: http://bugs.frugalware.org/task/4159 CVE: No CVE, see http://drupal.org/node/751934. Description =========== A vulnerability has been reported in the Mime Mail module for Drupal, while can be exploited by malicious users to compromise a vulnerable system. The vulnerability is caused due to an error in the PCRE regular expression engine, which can be exploited to execute arbitrary PHP code. Successful exploitation requires the ability to send HTML email via the Mime Mail module. Updated Packages ================ Check if you have drupal-mimemail installed: # pacman-g2 -Q drupal-mimemail If found, then you should upgrade to the latest version: # pacman-g2 -Sy drupal-mimemail Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/645 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuuqScACgkQZ7NElSD1Vhn8XQCeMJ9Vv13q5MttrQHPrt06R++u bPcAn0c0s31itBRSNEXdVU20C15gGTxo =XMcB -----END PGP SIGNATURE----- From vmiklos at frugalware.org Tue Mar 30 00:03:46 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Tue, 30 Mar 2010 00:03:46 +0200 (CEST) Subject: [Frugalware-security] [ FSA-646 ] pulseaudio Message-ID: <20100329220346.35FFD1240019@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-646 Date: 2010-03-30 Package: pulseaudio Vulnerable versions: <= 0.9.21-2 Unaffected versions: >= 0.9.21-3locris1 Related bugreport: http://bugs.frugalware.org/task/4130 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1299 Description =========== This fixes a security issue, which can be exploited by malicious, local users to perform certain actions with escalated privileges. The security issue is caused due to the application performing chown() and chmod() calls without checking for symbolic links in existing directories. This can be exploited to e.g. change permissions and ownership of arbitrary files via symlink attacks. Updated Packages ================ Check if you have pulseaudio installed: # pacman-g2 -Q pulseaudio If found, then you should upgrade to the latest version: # pacman-g2 -Sy pulseaudio Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/646 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuxI8EACgkQZ7NElSD1Vhm83ACeIXhXVvyvSig2iTruJlqSo1FB wL0AoJmpaJ9ucme9T/NLknufitYilOWy =jrUv -----END PGP SIGNATURE----- From vmiklos at frugalware.org Tue Mar 30 14:09:13 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Tue, 30 Mar 2010 14:09:13 +0200 (CEST) Subject: [Frugalware-security] [ FSA-647 ] krb5 Message-ID: <20100330120913.D708D1240001@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-647 Date: 2010-03-30 Package: krb5 Vulnerable versions: <= 1.7-4 Unaffected versions: >= 1.7-5locris1 Related bugreport: http://bugs.frugalware.org/task/4137 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0628 Description =========== A vulnerability has been reported in Kerberos, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an assertion error within the "spnego_gss_accept_sec_context()" function in src/lib/gssapi/spnego/spnego_mech.c when receiving an invalid packet, which can be exploited to e.g. crash an application using the library by sending a specially crafted packet. Updated Packages ================ Check if you have krb5 installed: # pacman-g2 -Q krb5 If found, then you should upgrade to the latest version: # pacman-g2 -Sy krb5 Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/647 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkux6ekACgkQZ7NElSD1VhmwugCfRfRPTLIZhBYSdIEqHFkvNPRx 8jMAoIolDsdqPZFgxtwG8lSDbTP/8qL9 =byCn -----END PGP SIGNATURE----- From vmiklos at frugalware.org Tue Mar 30 17:56:39 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Tue, 30 Mar 2010 17:56:39 +0200 (CEST) Subject: [Frugalware-security] [ FSA-648 ] curl Message-ID: <20100330155639.64BEB1240019@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-648 Date: 2010-03-30 Package: curl Vulnerable versions: <= 7.19.7-1 Unaffected versions: >= 7.19.7-2locris1 Related bugreport: http://bugs.frugalware.org/task/4162 CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0734 Description =========== A security issue has been reported in cURL / libcURL, which can potentially be exploited by malicious people to cause a DoS (Denial of Service) or compromise an application using the library. The security issue is caused due to an error when returning data to the registered callback function for downloading compressed content over HTTP. The library may send back up to 64Kb of data to the callback function, exceeding the documented maximum data size of 16Kb (CURL_MAX_WRITE_SIZE). This can potentially lead to buffer overflows in client applications. Updated Packages ================ Check if you have curl installed: # pacman-g2 -Q curl If found, then you should upgrade to the latest version: # pacman-g2 -Sy curl Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/648 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuyHzcACgkQZ7NElSD1Vhne4ACgmUtyN0ZuJu/FTo3T9d9UzuPa CDYAn0zaatJv6CaAsUFXz47tyegHN5h0 =VU8o -----END PGP SIGNATURE----- From vmiklos at frugalware.org Wed Mar 31 18:50:34 2010 From: vmiklos at frugalware.org (Miklos Vajna) Date: Wed, 31 Mar 2010 18:50:34 +0200 (CEST) Subject: [Frugalware-security] [ FSA-649 ] amsn Message-ID: <20100331165034.31321124001D@genesis.frugalware.org> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Frugalware Security Advisory FSA-649 Date: 2010-03-31 Package: amsn Vulnerable versions: <= 0.98.1-1 Unaffected versions: >= 0.98.1-2locris1 Related bugreport: http://bugs.frugalware.org/task/4161 CVE: No CVE, see http://seclists.org/bugtraq/2009/Jun/239. Description =========== Gabriel Menezes Nunes has discovered a security issue in aMSN, which can be exploited by malicious people to conduct spoofing attacks. The security issue is caused due to the application improperly verifying the validity of the SSL certificate presented when logging in. This can be exploited to spoof a valid server and obtain the user's MSN username and password via e.g. a man-in-the-middle attack. Updated Packages ================ Check if you have amsn installed: # pacman-g2 -Q amsn If found, then you should upgrade to the latest version: # pacman-g2 -Sy amsn Availability ============ The latest revision of this advisory is available at http://frugalware.org/security/649 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: See http://ftp.frugalware.org/pub/README.GPG for info iEYEARECAAYFAkuzfVkACgkQZ7NElSD1Vhm/1gCbBq+EZznGMF9CA0GTbG2AWeza 5lAAn0k6/aFN9oFgivwXwqHgyKFdDQFd =dJ48 -----END PGP SIGNATURE-----