RHSA-2009:1562-01 Important: tomcat security update

Posted by Daniela Mehler

USN-853-2: Firefox and Xulrunner regression

Posted by Daniela Mehler

"Ubuntu Security Notice USN-853-2 November 11, 2009
firefox-3.5, xulrunner-1.9.1 regression
https://launchpad.net/bugs/480740
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D

A security issue affects the following Ubuntu releases:

Ubuntu 9.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
firefox-3.5 3.5.5+nobinonly-0ubuntu0.9.10.1
xulrunner-1.9.1 1.9.1.5+nobinonly-0ubuntu0.9.10.1

After a standard system upgrade you need to restart Firefox and any
applications that use xulrunner to effect the necessary changes.

Details follow:

USN-853-1 fixed vulnerabilities in Firefox and Xulrunner. The upstream
changes introduced regressions that could lead to crashes when processing
certain malformed GIF images, fonts and web pages. This update fixes the
problem.

We apologize for the inconvenience.

Original advisory details:

Alin Rad Pop discovered a heap-based buffer overflow in Firefox when it
converted strings to floating point numbers. If a user were tricked into
viewing a malicious website, a remote attacker could cause a denial of ser=
vice
or possibly execute arbitrary code with the privileges of the user invokin=
g the
program. (CVE-2009-1563)
=20
Jeremy Brown discovered that the Firefox Download Manager was vulnerable to
symlink attacks. A local attacker could exploit this to create or overwrite
files with the privileges of the user invoking the program. (CVE-2009-3274)
=20
Paul Stone discovered a flaw in the Firefox form history. If a user were
tricked into viewing a malicious website, a remote attacker could access t=
his
data to steal confidential information. (CVE-2009-3370)
=20
Orlando Berrera discovered that Firefox did not properly free memory when =
using
web-workers. If a user were tricked into viewing a malicious website, a re=
mote
attacker could cause a denial of service or possibly execute arbitrary code
with the privileges of the user invoking the program. This issue only
affected Ubuntu 9.10. (CVE-2009-3371)
=20
A flaw was discovered in the way Firefox processed Proxy Auto-configuration
(PAC) files. If a user configured the browser to use PAC files with certain
regular expressions, an attacker could cause a denial of service or possib=
ly
execute arbitrary code with the privileges of the user invoking the progra=
m.
(CVE-2009-3372)
=20
A heap-based buffer overflow was discovered in Mozilla's GIF image parser.=
If a
user were tricked into viewing a malicious website, a remote attacker could
cause a denial of service or possibly execute arbitrary code with the
privileges of the user invoking the program. (CVE-2009-3373)
=20
A flaw was discovered in the JavaScript engine of Firefox. An attacker cou=
ld
exploit this to execute scripts from page content with chrome privileges.
(CVE-2009-3374)
=20
Gregory Fleischer discovered that the same-origin check in Firefox could be
bypassed by utilizing the document.getSelection function. An attacker could
exploit this to read data from other domains. (CVE-2009-3375)
=20
Jesse Ruderman and Sid Stamm discovered that Firefox did not properly disp=
lay
filenames containing right-to-left (RTL) override characters. If a user we=
re
tricked into downloading a malicious file with a crafted filename, an atta=
cker
could exploit this to trick the user into opening a different file than the
user expected. (CVE-2009-3376)
=20
Several flaws were discovered in third party media libraries. If a user we=
re
tricked into opening a crafted media file, a remote attacker could cause a
denial of service or possibly execute arbitrary code with the privileges o=
f the
user invoking the program. This issue only affected Ubuntu 9.10.
(CVE-2009-3377)
=20
Vladimir Vukicevic, Jesse Ruderman, Martijn Wargers, Daniel Banchero, David
Keeler, Boris Zbarsky, Thomas Frederiksen, Marcia Knous, Carsten Book, Kev=
in
Brosnan, David Anderson and Jeff Walden discovered various flaws in the br=
owser
and JavaScript engines of Firefox. If a user were tricked into viewing a
malicious website, a remote attacker could cause a denial of service or
possibly execute arbitrary code with the privileges of the user invoking t=
he
program. (CVE-2009-3380, CVE-2009-3381, CVE-2009-3382, CVE-2009-3383)

Updated packages for Ubuntu 9.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5_3=
=2E5.5+nobinonly-0ubuntu0.9.10.1.diff.gz
Size/MD5: 128517 cfbe278dd79f8b469525bd6ce72947a5
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5_3=
=2E5.5+nobinonly-0ubuntu0.9.10.1.dsc
Size/MD5: 2940 de2b4954011bc7f3e75f67cef2da3251
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5_3=
=2E5.5+nobinonly.orig.tar.gz
Size/MD5: 44924176 c2cb33f3f6330cb7ec844d2c9f55640d
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner=
-1.9.1_1.9.1.5+nobinonly-0ubuntu0.9.10.1.diff.gz
Size/MD5: 64123 899bc767278d6baa6342832beebe5514
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner=
-1.9.1_1.9.1.5+nobinonly-0ubuntu0.9.10.1.dsc
Size/MD5: 2910 92e04905a7f495dfdcb5960fdd2f5d04
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner=
-1.9.1_1.9.1.5+nobinonly.orig.tar.gz
Size/MD5: 44061677 e86f3dcf09bb514e6cb33d69057d0e01

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/abrowser_3.5.=
5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 73246 04204ea7d83eff219f66209abac264cb
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.0-d=
ev_3.5.5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 73108 63c8ace0669ee16354d47360da94aa0e
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.1-d=
bg_3.5.5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 73102 54f75a67fb3e7c6d868b696fb861d4ff
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.1-d=
ev_3.5.5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 73102 f2d5e21458c758c7184efeaf87a2039a
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-gnome=
-support_3.5.5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 73164 3784be4e8f17f558c2d27833fa8defe1
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox_3.5.5=
+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 73262 0ff39670bdc7e7969feea8b5ab68e6de
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox-3.5/abrowser-=
3.0-branding_3.5.5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 73124 032d22e39128dcd32808642e83146fb6
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox-3.5/abrowser-=
3.0_3.5.5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 8936 7acacba74d082cf91affabb6c5e56705
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox-3.5/abrowser-=
3.1-branding_3.5.5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 73126 414938051da31c8d64a9a0f5c941ac81
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox-3.5/abrowser-=
3.1_3.5.5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 8936 13a0d8d613db29fba5d331b6b69db3ea
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox-3.5/abrowser-=
3.5_3.5.5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 73306 bd5e71816e30f5b5c27904c858f18c47
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox-3.5/firefox-3=
=2E0-branding_3.5.5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 73110 3c58ae77aa2dd04590b2cb229f336677
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox-3.5/firefox-3=
=2E0-dom-inspector_3.5.5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 73124 b54865237207b824ef848f6ce29e99a7
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox-3.5/firefox-3=
=2E0-gnome-support_3.5.5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 73128 1712b3f61ed77429577144ec60764238
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox-3.5/firefox-3=
=2E0-venkman_3.5.5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 73114 145469609bda2ae83c9f5f3e447f0c33
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox-3.5/firefox-3=
=2E0_3.5.5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 73094 e42cd2101c5e8c41c046605b2f0f71a1
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox-3.5/firefox-3=
=2E1-branding_3.5.5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 73112 0de735a9a9146b3d2a24783442c94e29
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox-3.5/firefox-3=
=2E1-gnome-support_3.5.5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 73126 25a291ea7275a21c51fe5cfe6f732918
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox-3.5/firefox-3=
=2E1_3.5.5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 73094 438da7953d0fd921e190044d3f6afdec
http://security.ubuntu.com/ubuntu/pool/universe/f/firefox-3.5/firefox-d=
om-inspector_3.5.5+nobinonly-0ubuntu0.9.10.1_all.deb
Size/MD5: 73112 0870b38d43a6aa3a4d14cba6580f82ae

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/abrowser-3.5-=
branding_3.5.5+nobinonly-0ubuntu0.9.10.1_amd64.deb
Size/MD5: 207660 2fb339dba8c0513e7617d2c60248d335
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5-b=
randing_3.5.5+nobinonly-0ubuntu0.9.10.1_amd64.deb
Size/MD5: 206270 3a63335221e46f76de46cf9987704aa1
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5-d=
bg_3.5.5+nobinonly-0ubuntu0.9.10.1_amd64.deb
Size/MD5: 469754 a062abe2fe3de7ae7223c18d6f9fa1a0
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5-d=
ev_3.5.5+nobinonly-0ubuntu0.9.10.1_amd64.deb
Size/MD5: 73188 a3afe59564521e3f3d761689b5b2e012
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5-g=
nome-support_3.5.5+nobinonly-0ubuntu0.9.10.1_amd64.deb
Size/MD5: 93426 0975af1fabbd7f135b729bc1c51cac58
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5_3=
=2E5.5+nobinonly-0ubuntu0.9.10.1_amd64.deb
Size/MD5: 960022 400bd441a9d82d0303b96780863c2dee
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner=
-1.9.1-dbg_1.9.1.5+nobinonly-0ubuntu0.9.10.1_amd64.deb
Size/MD5: 59824624 59f2ec17839fc193af740220f2d4e414
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner=
-1.9.1-dev_1.9.1.5+nobinonly-0ubuntu0.9.10.1_amd64.deb
Size/MD5: 4786132 4305f8af3d999b5abd2b4a5176f30a02
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner=
-1.9.1-gnome-support_1.9.1.5+nobinonly-0ubuntu0.9.10.1_amd64.deb
Size/MD5: 47776 32f3a98ac52ae547352bb909de7d4adb
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner=
-1.9.1_1.9.1.5+nobinonly-0ubuntu0.9.10.1_amd64.deb
Size/MD5: 9097846 c48db11495cf0050a33eabdfcd692e18
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner=
-dev_1.9.1.5+nobinonly-0ubuntu0.9.10.1_amd64.deb
Size/MD5: 26624 5d1b1e1b2e223549c402b4f9b118cfa9
http://security.ubuntu.com/ubuntu/pool/universe/x/xulrunner-1.9.1/xulru=
nner-1.9.1-testsuite-dev_1.9.1.5+nobinonly-0ubuntu0.9.10.1_amd64.deb
Size/MD5: 70402 1d111cb605b327300d101715e04b7127
http://security.ubuntu.com/ubuntu/pool/universe/x/xulrunner-1.9.1/xulru=
nner-1.9.1-testsuite_1.9.1.5+nobinonly-0ubuntu0.9.10.1_amd64.deb
Size/MD5: 5586656 908b8ddb02de65532d483b85b00ea80b

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/abrowser-3.5-=
branding_3.5.5+nobinonly-0ubuntu0.9.10.1_i386.deb
Size/MD5: 207664 7304aac2f1cf0176c5ae403496b31373
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5-b=
randing_3.5.5+nobinonly-0ubuntu0.9.10.1_i386.deb
Size/MD5: 206272 1ce71c6c364abe78db2e4fa05b2153a7
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5-d=
bg_3.5.5+nobinonly-0ubuntu0.9.10.1_i386.deb
Size/MD5: 465302 4471d70505f6bab5d5d612f9f8e681e7
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5-d=
ev_3.5.5+nobinonly-0ubuntu0.9.10.1_i386.deb
Size/MD5: 73190 61e0cec532cd6a7bd9545f4a543faa7b
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5-g=
nome-support_3.5.5+nobinonly-0ubuntu0.9.10.1_i386.deb
Size/MD5: 89870 cef0b1e9129d089164dfbccd5978983b
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5_3=
=2E5.5+nobinonly-0ubuntu0.9.10.1_i386.deb
Size/MD5: 942118 dfe1864884bd7f9f6239544c7b38901f
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner=
-1.9.1-dbg_1.9.1.5+nobinonly-0ubuntu0.9.10.1_i386.deb
Size/MD5: 60229380 95ba41a67ba4958a18781fdf542e52e9
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner=
-1.9.1-dev_1.9.1.5+nobinonly-0ubuntu0.9.10.1_i386.deb
Size/MD5: 4806344 c412fd3b4b9d741c1c199bcfd98c2804
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner=
-1.9.1-gnome-support_1.9.1.5+nobinonly-0ubuntu0.9.10.1_i386.deb
Size/MD5: 40552 ee3b0be8c2c29fe748f687e010a752b2
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner=
-1.9.1_1.9.1.5+nobinonly-0ubuntu0.9.10.1_i386.deb
Size/MD5: 7992750 063fe69be7dd7237938b0dcdc9c75ce3
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner=
-dev_1.9.1.5+nobinonly-0ubuntu0.9.10.1_i386.deb
Size/MD5: 26624 5f7a7be53a64f55d82412e271e85879c
http://security.ubuntu.com/ubuntu/pool/universe/x/xulrunner-1.9.1/xulru=
nner-1.9.1-testsuite-dev_1.9.1.5+nobinonly-0ubuntu0.9.10.1_i386.deb
Size/MD5: 70408 c0c27c191c26453c92015dcb015d58f7
http://security.ubuntu.com/ubuntu/pool/universe/x/xulrunner-1.9.1/xulru=
nner-1.9.1-testsuite_1.9.1.5+nobinonly-0ubuntu0.9.10.1_i386.deb
Size/MD5: 5417960 e9021e868d5f499fb0b42e7d92345b09

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/f/firefox-3.5/abrowser-3.5-branding_3=
=2E5.5+nobinonly-0ubuntu0.9.10.1_lpia.deb
Size/MD5: 207664 4a93c35c1e12e5934a8f296208bc014c
http://ports.ubuntu.com/pool/main/f/firefox-3.5/firefox-3.5-branding_3.=
5.5+nobinonly-0ubuntu0.9.10.1_lpia.deb
Size/MD5: 206274 38321b3bf7b13f477a973e96ec0446f2
http://ports.ubuntu.com/pool/main/f/firefox-3.5/firefox-3.5-dbg_3.5.5+n=
obinonly-0ubuntu0.9.10.1_lpia.deb
Size/MD5: 464878 9b84cd5fa9ea80f45257aae82073fca9
http://ports.ubuntu.com/pool/main/f/firefox-3.5/firefox-3.5-dev_3.5.5+n=
obinonly-0ubuntu0.9.10.1_lpia.deb
Size/MD5: 73192 587879d36cba4974a20d30c8840be11a
http://ports.ubuntu.com/pool/main/f/firefox-3.5/firefox-3.5-gnome-suppo=
rt_3.5.5+nobinonly-0ubuntu0.9.10.1_lpia.deb
Size/MD5: 89322 f0b4447e4d64dd592d425c61d207e270
http://ports.ubuntu.com/pool/main/f/firefox-3.5/firefox-3.5_3.5.5+nobin=
only-0ubuntu0.9.10.1_lpia.deb
Size/MD5: 939956 87d63ed470d0d9023bc95be4b78361b3
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.1/xulrunner-1.9.1-dbg=
_1.9.1.5+nobinonly-0ubuntu0.9.10.1_lpia.deb
Size/MD5: 60255522 060626cb4e0c4134fb8ab9ffc5600d81
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.1/xulrunner-1.9.1-dev=
_1.9.1.5+nobinonly-0ubuntu0.9.10.1_lpia.deb
Size/MD5: 4802146 41c30cd9106f237647379783c00fa080
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.1/xulrunner-1.9.1-gno=
me-support_1.9.1.5+nobinonly-0ubuntu0.9.10.1_lpia.deb
Size/MD5: 39714 455716772735e66cfe8fe243fb85eb98
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.1/xulrunner-1.9.1_1.9=
=2E1.5+nobinonly-0ubuntu0.9.10.1_lpia.deb
Size/MD5: 7882788 6cf4298a3f47c648f99eb417ebf061f3
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.1/xulrunner-dev_1.9.1=
=2E5+nobinonly-0ubuntu0.9.10.1_lpia.deb
Size/MD5: 26624 35f4c2e34bc3d9a24a6e259e2e1edf98
http://ports.ubuntu.com/pool/universe/x/xulrunner-1.9.1/xulrunner-1.9.1=
-testsuite-dev_1.9.1.5+nobinonly-0ubuntu0.9.10.1_lpia.deb
Size/MD5: 70404 bde61f8e16379f0d88ca3df046a2f097
http://ports.ubuntu.com/pool/universe/x/xulrunner-1.9.1/xulrunner-1.9.1=
-testsuite_1.9.1.5+nobinonly-0ubuntu0.9.10.1_lpia.deb
Size/MD5: 5411074 0df4e299e9c141cd6206573933edb92e

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/f/firefox-3.5/abrowser-3.5-branding_3=
=2E5.5+nobinonly-0ubuntu0.9.10.1_powerpc.deb
Size/MD5: 207672 d3002efb2c61c46ba49b60eb21eba5bf
http://ports.ubuntu.com/pool/main/f/firefox-3.5/firefox-3.5-branding_3.=
5.5+nobinonly-0ubuntu0.9.10.1_powerpc.deb
Size/MD5: 206284 45e390fe739118cb8caacfd9a22abb43
http://ports.ubuntu.com/pool/main/f/firefox-3.5/firefox-3.5-dbg_3.5.5+n=
obinonly-0ubuntu0.9.10.1_powerpc.deb
Size/MD5: 483774 5d0e1a7b8aa69ea3a4b2d71988315b85
http://ports.ubuntu.com/pool/main/f/firefox-3.5/firefox-3.5-dev_3.5.5+n=
obinonly-0ubuntu0.9.10.1_powerpc.deb
Size/MD5: 73188 b585077e54709653761c66c4b42c848b
http://ports.ubuntu.com/pool/main/f/firefox-3.5/firefox-3.5-gnome-suppo=
rt_3.5.5+nobinonly-0ubuntu0.9.10.1_powerpc.deb
Size/MD5: 92854 9ed029b5073344115e42a93bea638e0e
http://ports.ubuntu.com/pool/main/f/firefox-3.5/firefox-3.5_3.5.5+nobin=
only-0ubuntu0.9.10.1_powerpc.deb
Size/MD5: 963006 3667e7811295d899be4a1c7e3c2bd15e
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.1/xulrunner-1.9.1-dbg=
_1.9.1.5+nobinonly-0ubuntu0.9.10.1_powerpc.deb
Size/MD5: 64975388 6f2e015a1453fd26656593bfa8dbfe30
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.1/xulrunner-1.9.1-dev=
_1.9.1.5+nobinonly-0ubuntu0.9.10.1_powerpc.deb
Size/MD5: 4791476 b7dd0c21256d617235f35abc4dff822b
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.1/xulrunner-1.9.1-gno=
me-support_1.9.1.5+nobinonly-0ubuntu0.9.10.1_powerpc.deb
Size/MD5: 47232 3c4be3cdcfb7aacf24e5ed3e47703c8c
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.1/xulrunner-1.9.1_1.9=
=2E1.5+nobinonly-0ubuntu0.9.10.1_powerpc.deb
Size/MD5: 9731746 659f13bf32c9b4b81379a7e80ec90f16
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.1/xulrunner-dev_1.9.1=
=2E5+nobinonly-0ubuntu0.9.10.1_powerpc.deb
Size/MD5: 26628 1dca5dba41604987557a14698d79e5a8
http://ports.ubuntu.com/pool/universe/x/xulrunner-1.9.1/xulrunner-1.9.1=
-testsuite-dev_1.9.1.5+nobinonly-0ubuntu0.9.10.1_powerpc.deb
Size/MD5: 70406 4c61f60ae161511e7b843fdc61848882
http://ports.ubuntu.com/pool/universe/x/xulrunner-1.9.1/xulrunner-1.9.1=
-testsuite_1.9.1.5+nobinonly-0ubuntu0.9.10.1_powerpc.deb
Size/MD5: 5679200 740745d5e80f0e17c898387d668bf3d8

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/f/firefox-3.5/abrowser-3.5-branding_3=
=2E5.5+nobinonly-0ubuntu0.9.10.1_sparc.deb
Size/MD5: 207662 71e7ade8bab944c2045dc515007452f0
http://ports.ubuntu.com/pool/main/f/firefox-3.5/firefox-3.5-branding_3.=
5.5+nobinonly-0ubuntu0.9.10.1_sparc.deb
Size/MD5: 206284 44f3ceefd0128a9b5b9301d02934389e
http://ports.ubuntu.com/pool/main/f/firefox-3.5/firefox-3.5-dbg_3.5.5+n=
obinonly-0ubuntu0.9.10.1_sparc.deb
Size/MD5: 458470 47e4bff05505cd2a00ad07294c2bd281
http://ports.ubuntu.com/pool/main/f/firefox-3.5/firefox-3.5-dev_3.5.5+n=
obinonly-0ubuntu0.9.10.1_sparc.deb
Size/MD5: 73190 db21b4ec6db977d19cf189c646997bc5
http://ports.ubuntu.com/pool/main/f/firefox-3.5/firefox-3.5-gnome-suppo=
rt_3.5.5+nobinonly-0ubuntu0.9.10.1_sparc.deb
Size/MD5: 88532 9c3f0224b8191240cc289945ca62b4fb
http://ports.ubuntu.com/pool/main/f/firefox-3.5/firefox-3.5_3.5.5+nobin=
only-0ubuntu0.9.10.1_sparc.deb
Size/MD5: 940862 41189e2a817b041c5e18f8a5b2ef9985
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.1/xulrunner-1.9.1-dbg=
_1.9.1.5+nobinonly-0ubuntu0.9.10.1_sparc.deb
Size/MD5: 59333894 c72cc9c4e33ce2d6e726b4d1362c30c9
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.1/xulrunner-1.9.1-dev=
_1.9.1.5+nobinonly-0ubuntu0.9.10.1_sparc.deb
Size/MD5: 4769098 82982c6de5a7064d356310f67a0ec702
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.1/xulrunner-1.9.1-gno=
me-support_1.9.1.5+nobinonly-0ubuntu0.9.10.1_sparc.deb
Size/MD5: 39116 9bbd1eb52b5ca83b18c1e7e871820bd1
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.1/xulrunner-1.9.1_1.9=
=2E1.5+nobinonly-0ubuntu0.9.10.1_sparc.deb
Size/MD5: 8487294 47933489b68e49f8f4db90cd8f597797
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.1/xulrunner-dev_1.9.1=
=2E5+nobinonly-0ubuntu0.9.10.1_sparc.deb
Size/MD5: 26624 a8e8d1378605b0719a6ae2a58ad88750
http://ports.ubuntu.com/pool/universe/x/xulrunner-1.9.1/xulrunner-1.9.1=
-testsuite-dev_1.9.1.5+nobinonly-0ubuntu0.9.10.1_sparc.deb
Size/MD5: 70410 68fbf0a3c2019dbfc38a6434250f81d4
http://ports.ubuntu.com/pool/universe/x/xulrunner-1.9.1/xulrunner-1.9.1=
-testsuite_1.9.1.5+nobinonly-0ubuntu0.9.10.1_sparc.deb
Size/MD5: 5400414 4f7036e8efce1bcc2f29b35d10970042

--4Ckj6UjgE2iN1+kY
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkr67Z0ACgkQW0JvuRdL8BqZLACglCecnU8ihiFnKiJICk0WVS7k
MCIAmgOEhYxHuRz4LtZ8ztnetsszf3vS
=1e2l
-----END PGP SIGNATURE-----
"

0 comments

USN-854-1: GD library vulnerabilities

Posted by Daniela Mehler

"Ubuntu Security Notice USN-854-1 November 05, 2009
libgd2 vulnerabilities
CVE-2007-3475, CVE-2007-3476, CVE-2007-3477, CVE-2009-3293,
CVE-2009-3546
==========================
==========================
=========

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 8.04 LTS
Ubuntu 8.10
Ubuntu 9.04
Ubuntu 9.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
libgd2-noxpm 2.0.33-2ubuntu5.4
libgd2-xpm 2.0.33-2ubuntu5.4

Ubuntu 8.04 LTS:
libgd2-noxpm 2.0.35.dfsg-3ubuntu2.1
libgd2-xpm 2.0.35.dfsg-3ubuntu2.1

Ubuntu 8.10:
libgd2-noxpm 2.0.36~rc1~dfsg-3ubuntu1.8.10.1
libgd2-xpm 2.0.36~rc1~dfsg-3ubuntu1.8.10.1

Ubuntu 9.04:
libgd2-noxpm 2.0.36~rc1~dfsg-3ubuntu1.9.04.1
libgd2-xpm 2.0.36~rc1~dfsg-3ubuntu1.9.04.1

Ubuntu 9.10:
libgd2-noxpm 2.0.36~rc1~dfsg-3ubuntu1.9.10.1
libgd2-xpm 2.0.36~rc1~dfsg-3ubuntu1.9.10.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

Tomas Hoger discovered that the GD library did not properly handle the
number of colors in certain malformed GD images. If a user or automated
system were tricked into processing a specially crafted GD image, an
attacker could cause a denial of service or possibly execute arbitrary
code. (CVE-2009-3546)

It was discovered that the GD library did not properly handle incorrect
color indexes. An attacker could send specially crafted input to
applications linked against libgd2 and cause a denial of service or
possibly execute arbitrary code. This issue only affected Ubuntu 6.06 LTS.
(CVE-2009-3293)

It was discovered that the GD library did not properly handle certain
malformed GIF images. If a user or automated system were tricked into
processing a specially crafted GIF image, an attacker could cause a denial
of service. This issue only affected Ubuntu 6.06 LTS. (CVE-2007-3475,
CVE-2007-3476)

It was discovered that the GD library did not properly handle large angle
degree values. An attacker could send specially crafted input to
applications linked against libgd2 and cause a denial of service. This
issue only affected Ubuntu 6.06 LTS. (CVE-2007-3477)

Updated packages for Ubuntu 6.06 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2_2.0.33-2=
ubuntu5.4.diff.gz
Size/MD5: 258547 04046c5a93a087f4f5ade0055bbf22cb
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2_2.0.33-2=
ubuntu5.4.dsc
Size/MD5: 973 c7ce6a684cc67dbc69f03e03b54b51b2
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2_2.0.33.o=
rig.tar.gz
Size/MD5: 587617 be0a6d326cd8567e736fbc75df0a5c45

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-dev_2.0.=
33-2ubuntu5.4_all.deb
Size/MD5: 129774 a31ad9eacfd696ffe3fdef93acef73c3
http://security.ubuntu.com/ubuntu/pool/universe/libg/libgd2/libgd2_2.0.=
33-2ubuntu5.4_all.deb
Size/MD5: 129750 4d8c0ad2d083e789d953e6182d078ef4

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm-de=
v_2.0.33-2ubuntu5.4_amd64.deb
Size/MD5: 341658 4561d10b25acda7165cd538d88a9e5a9
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm_2.=
0.33-2ubuntu5.4_amd64.deb
Size/MD5: 200492 e6457ffbe31f4e546d4484d5bd1bc2ed
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm-dev_=
2.0.33-2ubuntu5.4_amd64.deb
Size/MD5: 343380 0d023589f24ca1a95040993d1d4a30c1
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm_2.0.=
33-2ubuntu5.4_amd64.deb
Size/MD5: 202212 7cec8f0bc8704d35e453eb2b07a21e01
http://security.ubuntu.com/ubuntu/pool/universe/libg/libgd2/libgd-tools=
_2.0.33-2ubuntu5.4_amd64.deb
Size/MD5: 143136 f438666205ada39092897b6e959345d8

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm-de=
v_2.0.33-2ubuntu5.4_i386.deb
Size/MD5: 331210 a0480de5209f2e66de2164997c3bcb25
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm_2.=
0.33-2ubuntu5.4_i386.deb
Size/MD5: 193572 b195270648b35995a62b1887995e4025
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm-dev_=
2.0.33-2ubuntu5.4_i386.deb
Size/MD5: 331984 a1a1c0b922638f2adcbd86188f689df1
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm_2.0.=
33-2ubuntu5.4_i386.deb
Size/MD5: 195218 100b604eb7ada1ac48c38fddaeeee7d5
http://security.ubuntu.com/ubuntu/pool/universe/libg/libgd2/libgd-tools=
_2.0.33-2ubuntu5.4_i386.deb
Size/MD5: 142190 8cb1e1126490d20129355cea61535cea

powerpc architecture (Apple Macintosh G3/G4/G5):

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm-de=
v_2.0.33-2ubuntu5.4_powerpc.deb
Size/MD5: 342796 c1bf1b5a00916f51d60266cac243d152
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm_2.=
0.33-2ubuntu5.4_powerpc.deb
Size/MD5: 200630 20f64b15460b57ed8f76758eea5b22a7
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm-dev_=
2.0.33-2ubuntu5.4_powerpc.deb
Size/MD5: 344696 b5eb207979cea4e3f29101177591599c
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm_2.0.=
33-2ubuntu5.4_powerpc.deb
Size/MD5: 202184 ddf0bf913ff41c27fbf635dfe26fe34e
http://security.ubuntu.com/ubuntu/pool/universe/libg/libgd2/libgd-tools=
_2.0.33-2ubuntu5.4_powerpc.deb
Size/MD5: 151384 574ab21f61657b6c713c917d98636c83

sparc architecture (Sun SPARC/UltraSPARC):

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm-de=
v_2.0.33-2ubuntu5.4_sparc.deb
Size/MD5: 334374 672949b6e6eed63db0372617b9c62b69
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm_2.=
0.33-2ubuntu5.4_sparc.deb
Size/MD5: 194718 bc9eaf1f8bde7c9de9eb946c55c54883
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm-dev_=
2.0.33-2ubuntu5.4_sparc.deb
Size/MD5: 335598 b27bef38e70d8b2895346b4b8d89a6c9
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm_2.0.=
33-2ubuntu5.4_sparc.deb
Size/MD5: 196614 92e83e3d10c5c9803df672fd86ba8f1e
http://security.ubuntu.com/ubuntu/pool/universe/libg/libgd2/libgd-tools=
_2.0.33-2ubuntu5.4_sparc.deb
Size/MD5: 142438 5a968a81069fe918ad28bfa21c4b1c1b

Updated packages for Ubuntu 8.04 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2_2.0.35.d=
fsg-3ubuntu2.1.diff.gz
Size/MD5: 27319 45adf128acd808dabf385651895aa09e
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2_2.0.35.d=
fsg-3ubuntu2.1.dsc
Size/MD5: 1164 84af33aef5005c99f753b91d9a7320ab
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2_2.0.35.d=
fsg.orig.tar.gz
Size/MD5: 1338565 49d550f8e74802c1d890b97174366211

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm-de=
v_2.0.35.dfsg-3ubuntu2.1_amd64.deb
Size/MD5: 219144 d36dea3db101fe2d441f2fe620571984
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm_2.=
0.35.dfsg-3ubuntu2.1_amd64.deb
Size/MD5: 323234 557dd7a585796404e5875dd3c33cb017
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm-dev_=
2.0.35.dfsg-3ubuntu2.1_amd64.deb
Size/MD5: 221410 2f02000bf6d14063fb7a7f4c9dad50ef
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm_2.0.=
35.dfsg-3ubuntu2.1_amd64.deb
Size/MD5: 325608 e1ae6eeb633ccdde8761eba0a67770b2
http://security.ubuntu.com/ubuntu/pool/universe/libg/libgd2/libgd-tools=
_2.0.35.dfsg-3ubuntu2.1_amd64.deb
Size/MD5: 19388 49c6db93a2b1f52e809a83e21db6b527

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm-de=
v_2.0.35.dfsg-3ubuntu2.1_i386.deb
Size/MD5: 210258 a4ca408ab1ec958177f4ba7a5bcd5e7d
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm_2.=
0.35.dfsg-3ubuntu2.1_i386.deb
Size/MD5: 319256 6a3e993b8c7f12e58228c4291d2c3149
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm-dev_=
2.0.35.dfsg-3ubuntu2.1_i386.deb
Size/MD5: 212532 78fa81129cc415e920a3ee0ef776e415
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm_2.0.=
35.dfsg-3ubuntu2.1_i386.deb
Size/MD5: 320800 4e67408e5d55cf425bbf0d21cad78dd5
http://security.ubuntu.com/ubuntu/pool/universe/libg/libgd2/libgd-tools=
_2.0.35.dfsg-3ubuntu2.1_i386.deb
Size/MD5: 18516 4457cd2e18381a7b7269009da1fb5529

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm-dev_2.0.35.d=
fsg-3ubuntu2.1_lpia.deb
Size/MD5: 210804 b021b96240efc9e6cfd1335b140bc13e
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm_2.0.35.dfsg-=
3ubuntu2.1_lpia.deb
Size/MD5: 319102 5a67bdbb47ef8b56e2601e8cba84a459
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm-dev_2.0.35.dfs=
g-3ubuntu2.1_lpia.deb
Size/MD5: 213014 55fc97845073af3dbdd52be2c56f67d6
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm_2.0.35.dfsg-3u=
buntu2.1_lpia.deb
Size/MD5: 320882 3633a3aef5f3be13d476fba61048f0bb
http://ports.ubuntu.com/pool/universe/libg/libgd2/libgd-tools_2.0.35.df=
sg-3ubuntu2.1_lpia.deb
Size/MD5: 18486 e850d523d32fd5f2e1071e051ae038df

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm-dev_2.0.35.d=
fsg-3ubuntu2.1_powerpc.deb
Size/MD5: 219994 79a26d5fb9b61711e50b500026a41124
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm_2.0.35.dfsg-=
3ubuntu2.1_powerpc.deb
Size/MD5: 326274 e57da4b175aa027c30ec7e54c2052c0c
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm-dev_2.0.35.dfs=
g-3ubuntu2.1_powerpc.deb
Size/MD5: 222422 25e575dbc93ab0cc2752962c94997a29
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm_2.0.35.dfsg-3u=
buntu2.1_powerpc.deb
Size/MD5: 328528 988ca39c65157c572d2f694ade3190e7
http://ports.ubuntu.com/pool/universe/libg/libgd2/libgd-tools_2.0.35.df=
sg-3ubuntu2.1_powerpc.deb
Size/MD5: 29048 539a28718a024af12d04928aa7778bd9

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm-dev_2.0.35.d=
fsg-3ubuntu2.1_sparc.deb
Size/MD5: 211608 77263c03ab268f0425bc70f0284f5c72
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm_2.0.35.dfsg-=
3ubuntu2.1_sparc.deb
Size/MD5: 318440 89589e71997820728ba1cf8627078cf9
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm-dev_2.0.35.dfs=
g-3ubuntu2.1_sparc.deb
Size/MD5: 214044 96628507c274fdf974e744be7afecc60
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm_2.0.35.dfsg-3u=
buntu2.1_sparc.deb
Size/MD5: 320356 dc1b6b6b52469fda8fac7b60fa2214f5
http://ports.ubuntu.com/pool/universe/libg/libgd2/libgd-tools_2.0.35.df=
sg-3ubuntu2.1_sparc.deb
Size/MD5: 18960 a1d103ca723f4d9402a50a5405536b0b

Updated packages for Ubuntu 8.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2_2.0.36~r=
c1~dfsg-3ubuntu1.8.10.1.diff.gz
Size/MD5: 30244 9d64fc5360ba87d898032613292e961d
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2_2.0.36~r=
c1~dfsg-3ubuntu1.8.10.1.dsc
Size/MD5: 1695 1d2b7ad373e102d068a1711453d9f814
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2_2.0.36~r=
c1~dfsg.orig.tar.gz
Size/MD5: 761899 0f4d2fa45627af0e87fcb74f653b66dd

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm-de=
v_2.0.36~rc1~dfsg-3ubuntu1.8.10.1_amd64.deb
Size/MD5: 219946 7af0ca1ab929bd62db64214e526925f8
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm_2.=
0.36~rc1~dfsg-3ubuntu1.8.10.1_amd64.deb
Size/MD5: 212962 6c4c588af279289240159afc716570b0
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm-dev_=
2.0.36~rc1~dfsg-3ubuntu1.8.10.1_amd64.deb
Size/MD5: 222240 9bbf4da1e70cab88ce6e965f4d0be05f
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm_2.0.=
36~rc1~dfsg-3ubuntu1.8.10.1_amd64.deb
Size/MD5: 215382 cc9a6b114f7de96e61141e3029ec638d
http://security.ubuntu.com/ubuntu/pool/universe/libg/libgd2/libgd-tools=
_2.0.36~rc1~dfsg-3ubuntu1.8.10.1_amd64.deb
Size/MD5: 19456 502552b6eda11dd0c080b01b37c34357

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm-de=
v_2.0.36~rc1~dfsg-3ubuntu1.8.10.1_i386.deb
Size/MD5: 211642 3ba494ce963f86b5f606dff7beaa690c
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm_2.=
0.36~rc1~dfsg-3ubuntu1.8.10.1_i386.deb
Size/MD5: 208744 d880c620a27496bba02de3fe6fa6a8ca
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm-dev_=
2.0.36~rc1~dfsg-3ubuntu1.8.10.1_i386.deb
Size/MD5: 213802 ecb7303b0b23d3b3623c65f520bbb4ba
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm_2.0.=
36~rc1~dfsg-3ubuntu1.8.10.1_i386.deb
Size/MD5: 210894 040af3732b9215d0b66f2f7d875a2bc6
http://security.ubuntu.com/ubuntu/pool/universe/libg/libgd2/libgd-tools=
_2.0.36~rc1~dfsg-3ubuntu1.8.10.1_i386.deb
Size/MD5: 17872 4c9f087a570c86bcc1b7653d782e3964

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm-dev_2.0.36~r=
c1~dfsg-3ubuntu1.8.10.1_lpia.deb
Size/MD5: 211954 e775cc54a3a24eab57184ba4cd80e9aa
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm_2.0.36~rc1~d=
fsg-3ubuntu1.8.10.1_lpia.deb
Size/MD5: 209030 ce49cbe652495669f47a54b6e4e29795
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm-dev_2.0.36~rc1=
~dfsg-3ubuntu1.8.10.1_lpia.deb
Size/MD5: 214092 6d0e18a51be52249139a9b9ca66bfbc7
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm_2.0.36~rc1~dfs=
g-3ubuntu1.8.10.1_lpia.deb
Size/MD5: 211218 5a804b00b6b3c915123cf05e12e14434
http://ports.ubuntu.com/pool/universe/libg/libgd2/libgd-tools_2.0.36~rc=
1~dfsg-3ubuntu1.8.10.1_lpia.deb
Size/MD5: 17798 da21ca96e5abc06e9ae7ce6df48306e7

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm-dev_2.0.36~r=
c1~dfsg-3ubuntu1.8.10.1_powerpc.deb
Size/MD5: 220994 0fc96e78170cc201002082d8b790b398
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm_2.0.36~rc1~d=
fsg-3ubuntu1.8.10.1_powerpc.deb
Size/MD5: 216112 84090bd428afa9840f0c815808bc9944
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm-dev_2.0.36~rc1=
~dfsg-3ubuntu1.8.10.1_powerpc.deb
Size/MD5: 223368 d88a20d286892ec6f067e06b3eb81e7a
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm_2.0.36~rc1~dfs=
g-3ubuntu1.8.10.1_powerpc.deb
Size/MD5: 218320 c82eb96e8061fcc55f4d05836fd821cc
http://ports.ubuntu.com/pool/universe/libg/libgd2/libgd-tools_2.0.36~rc=
1~dfsg-3ubuntu1.8.10.1_powerpc.deb
Size/MD5: 27322 a1f8627970e51ee1edfd96b7d6bb5a52

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm-dev_2.0.36~r=
c1~dfsg-3ubuntu1.8.10.1_sparc.deb
Size/MD5: 211908 61bc8a1e4d9f5ac3336981ee5a297b3e
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm_2.0.36~rc1~d=
fsg-3ubuntu1.8.10.1_sparc.deb
Size/MD5: 206664 9dc649281c574ddae6098dcba1bc2b4a
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm-dev_2.0.36~rc1=
~dfsg-3ubuntu1.8.10.1_sparc.deb
Size/MD5: 214364 43588afd1df97e39561f2b858e347dec
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm_2.0.36~rc1~dfs=
g-3ubuntu1.8.10.1_sparc.deb
Size/MD5: 208834 cad75d76f33068bf0fefffb08d0c4319
http://ports.ubuntu.com/pool/universe/libg/libgd2/libgd-tools_2.0.36~rc=
1~dfsg-3ubuntu1.8.10.1_sparc.deb
Size/MD5: 18738 975c39c043c1627fab52a981fbdec336

Updated packages for Ubuntu 9.04:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2_2.0.36~r=
c1~dfsg-3ubuntu1.9.04.1.diff.gz
Size/MD5: 30247 9114e8b92ac867d48c84b40e5de119b5
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2_2.0.36~r=
c1~dfsg-3ubuntu1.9.04.1.dsc
Size/MD5: 1695 806082d3e955a27f5f725e6423567afb
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2_2.0.36~r=
c1~dfsg.orig.tar.gz
Size/MD5: 761899 0f4d2fa45627af0e87fcb74f653b66dd

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm-de=
v_2.0.36~rc1~dfsg-3ubuntu1.9.04.1_amd64.deb
Size/MD5: 219948 3ee02e54449d23e19f4bdad856db3e94
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm_2.=
0.36~rc1~dfsg-3ubuntu1.9.04.1_amd64.deb
Size/MD5: 212918 c14ac0c6aaa4710840cab2027bc49eb6
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm-dev_=
2.0.36~rc1~dfsg-3ubuntu1.9.04.1_amd64.deb
Size/MD5: 222236 5bdf89e2f69274160b0c543461dd4447
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm_2.0.=
36~rc1~dfsg-3ubuntu1.9.04.1_amd64.deb
Size/MD5: 215338 c7b162d896956ac9f97bc5ef5a4f19ce
http://security.ubuntu.com/ubuntu/pool/universe/libg/libgd2/libgd-tools=
_2.0.36~rc1~dfsg-3ubuntu1.9.04.1_amd64.deb
Size/MD5: 19458 c6ff85b327aa9d9255cf6167e880919b

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm-de=
v_2.0.36~rc1~dfsg-3ubuntu1.9.04.1_i386.deb
Size/MD5: 211648 c95bd0c9742fc59e1c7eafce79293970
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm_2.=
0.36~rc1~dfsg-3ubuntu1.9.04.1_i386.deb
Size/MD5: 208700 fc3065061bd6dc7109ab0bcf70783108
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm-dev_=
2.0.36~rc1~dfsg-3ubuntu1.9.04.1_i386.deb
Size/MD5: 213824 05132639e083a74172b533558a31ba9c
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm_2.0.=
36~rc1~dfsg-3ubuntu1.9.04.1_i386.deb
Size/MD5: 210848 6bb0c2ac1b44880f8946f2c88c9152f7
http://security.ubuntu.com/ubuntu/pool/universe/libg/libgd2/libgd-tools=
_2.0.36~rc1~dfsg-3ubuntu1.9.04.1_i386.deb
Size/MD5: 17854 020eb3d7e630c04f421011e01a3ab417

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm-dev_2.0.36~r=
c1~dfsg-3ubuntu1.9.04.1_lpia.deb
Size/MD5: 211938 88ddcd34f6c54f70e82eac5af941c59a
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm_2.0.36~rc1~d=
fsg-3ubuntu1.9.04.1_lpia.deb
Size/MD5: 209024 742a54caabb80548765c7a411281c010
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm-dev_2.0.36~rc1=
~dfsg-3ubuntu1.9.04.1_lpia.deb
Size/MD5: 214076 80b1e57b7ac85f0b678712dd924bf45e
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm_2.0.36~rc1~dfs=
g-3ubuntu1.9.04.1_lpia.deb
Size/MD5: 211160 179c604147f0da8bc4bc9eb027a46e32
http://ports.ubuntu.com/pool/universe/libg/libgd2/libgd-tools_2.0.36~rc=
1~dfsg-3ubuntu1.9.04.1_lpia.deb
Size/MD5: 17786 04f24c5d4d0010d42b91b63726cbff89

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm-dev_2.0.36~r=
c1~dfsg-3ubuntu1.9.04.1_powerpc.deb
Size/MD5: 220998 add2de0d80ba76d36451c7fd5e2c5ec6
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm_2.0.36~rc1~d=
fsg-3ubuntu1.9.04.1_powerpc.deb
Size/MD5: 216092 c1fdc00eba685bb143c14dfd383cb634
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm-dev_2.0.36~rc1=
~dfsg-3ubuntu1.9.04.1_powerpc.deb
Size/MD5: 223358 08de60d5f7560471076770e03c1ff864
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm_2.0.36~rc1~dfs=
g-3ubuntu1.9.04.1_powerpc.deb
Size/MD5: 218276 8dbcb65ccb85507d9d9963134366bba9
http://ports.ubuntu.com/pool/universe/libg/libgd2/libgd-tools_2.0.36~rc=
1~dfsg-3ubuntu1.9.04.1_powerpc.deb
Size/MD5: 27326 5428b1461321872221f14af0be9ca46b

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm-dev_2.0.36~r=
c1~dfsg-3ubuntu1.9.04.1_sparc.deb
Size/MD5: 211904 aa0c223bc1a2a54a1cba6791344deabd
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm_2.0.36~rc1~d=
fsg-3ubuntu1.9.04.1_sparc.deb
Size/MD5: 206600 4eb3f388e8ff46b37706f51c3c9dfc96
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm-dev_2.0.36~rc1=
~dfsg-3ubuntu1.9.04.1_sparc.deb
Size/MD5: 214364 b2eb3db5b306d85af16d40c44431032f
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm_2.0.36~rc1~dfs=
g-3ubuntu1.9.04.1_sparc.deb
Size/MD5: 208764 24566329bbb403d4d891e8d79e0046b1
http://ports.ubuntu.com/pool/universe/libg/libgd2/libgd-tools_2.0.36~rc=
1~dfsg-3ubuntu1.9.04.1_sparc.deb
Size/MD5: 18744 502a67b239cf0f7d8b61b69bfa70dc68

Updated packages for Ubuntu 9.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2_2.0.36~r=
c1~dfsg-3ubuntu1.9.10.1.diff.gz
Size/MD5: 30249 6c2f3c7c02d7f69d50ed5ffc7197b7de
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2_2.0.36~r=
c1~dfsg-3ubuntu1.9.10.1.dsc
Size/MD5: 1695 b05d9d806f7c09b300a03d58361fd100
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2_2.0.36~r=
c1~dfsg.orig.tar.gz
Size/MD5: 761899 0f4d2fa45627af0e87fcb74f653b66dd

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm-de=
v_2.0.36~rc1~dfsg-3ubuntu1.9.10.1_amd64.deb
Size/MD5: 220902 55be622b462feb7219692bc6d0fc4016
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm_2.=
0.36~rc1~dfsg-3ubuntu1.9.10.1_amd64.deb
Size/MD5: 213832 4669837f252534f290f3c7dc8aa9c223
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm-dev_=
2.0.36~rc1~dfsg-3ubuntu1.9.10.1_amd64.deb
Size/MD5: 223176 9e64773dbc9a4f6c0d3dcce2ef4be386
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm_2.0.=
36~rc1~dfsg-3ubuntu1.9.10.1_amd64.deb
Size/MD5: 216308 8f47355cc8c818ad8c7f235a03fcc67b
http://security.ubuntu.com/ubuntu/pool/universe/libg/libgd2/libgd-tools=
_2.0.36~rc1~dfsg-3ubuntu1.9.10.1_amd64.deb
Size/MD5: 19578 fa5acd3d4ed0d38c557ac3ae9956cccc

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm-de=
v_2.0.36~rc1~dfsg-3ubuntu1.9.10.1_i386.deb
Size/MD5: 211556 ca2bff218a8adc5983a969d872fb6b06
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-noxpm_2.=
0.36~rc1~dfsg-3ubuntu1.9.10.1_i386.deb
Size/MD5: 208578 b384c376d002f0985b1d443ee5875231
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm-dev_=
2.0.36~rc1~dfsg-3ubuntu1.9.10.1_i386.deb
Size/MD5: 213810 5fe2e224224d3fe70135dc401f10e042
http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/libgd2-xpm_2.0.=
36~rc1~dfsg-3ubuntu1.9.10.1_i386.deb
Size/MD5: 210680 5cb31f48ba665e97873240bca35d0df9
http://security.ubuntu.com/ubuntu/pool/universe/libg/libgd2/libgd-tools=
_2.0.36~rc1~dfsg-3ubuntu1.9.10.1_i386.deb
Size/MD5: 17932 44522c5bbae0da3e1b6f12c969bd9780

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm-dev_2.0.36~r=
c1~dfsg-3ubuntu1.9.10.1_lpia.deb
Size/MD5: 211756 05ff9aa04779bd808d3d11de4c793c0f
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm_2.0.36~rc1~d=
fsg-3ubuntu1.9.10.1_lpia.deb
Size/MD5: 208578 51ff00ac1ccf5ee7ddfd96bdbbd630a5
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm-dev_2.0.36~rc1=
~dfsg-3ubuntu1.9.10.1_lpia.deb
Size/MD5: 213898 a32989d6a1d706ef2400655dba7692d2
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm_2.0.36~rc1~dfs=
g-3ubuntu1.9.10.1_lpia.deb
Size/MD5: 210686 78086d8025414976501cddfeb9495459
http://ports.ubuntu.com/pool/universe/libg/libgd2/libgd-tools_2.0.36~rc=
1~dfsg-3ubuntu1.9.10.1_lpia.deb
Size/MD5: 17938 73e13e49bba851a6249df8c6454b6e3d

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm-dev_2.0.36~r=
c1~dfsg-3ubuntu1.9.10.1_powerpc.deb
Size/MD5: 222046 59e46ae219de5a321c4392aa05796e9f
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm_2.0.36~rc1~d=
fsg-3ubuntu1.9.10.1_powerpc.deb
Size/MD5: 214998 0601765bd180d78e552cb64f83e70cca
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm-dev_2.0.36~rc1=
~dfsg-3ubuntu1.9.10.1_powerpc.deb
Size/MD5: 224372 25f3258333a51d80791f8bbe229b3e09
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm_2.0.36~rc1~dfs=
g-3ubuntu1.9.10.1_powerpc.deb
Size/MD5: 217170 53ed85c9a0a75892e19c41aee045d82d
http://ports.ubuntu.com/pool/universe/libg/libgd2/libgd-tools_2.0.36~rc=
1~dfsg-3ubuntu1.9.10.1_powerpc.deb
Size/MD5: 18728 1bb235f1e0f8891698dc336a1329b075

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm-dev_2.0.36~r=
c1~dfsg-3ubuntu1.9.10.1_sparc.deb
Size/MD5: 213288 9ede7ae62429404acc302982c1af74ed
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-noxpm_2.0.36~rc1~d=
fsg-3ubuntu1.9.10.1_sparc.deb
Size/MD5: 207760 18ff396ddc2982df67ec2384c794bef2
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm-dev_2.0.36~rc1=
~dfsg-3ubuntu1.9.10.1_sparc.deb
Size/MD5: 215770 8561766182b28b196f63b332d9ad57f5
http://ports.ubuntu.com/pool/main/libg/libgd2/libgd2-xpm_2.0.36~rc1~dfs=
g-3ubuntu1.9.10.1_sparc.deb
Size/MD5: 209844 30e13659020c5d85a00e292c439777fd
http://ports.ubuntu.com/pool/universe/libg/libgd2/libgd-tools_2.0.36~rc=
1~dfsg-3ubuntu1.9.10.1_sparc.deb
Size/MD5: 18724 015a4a171a3add4f468bd950741c77e5

--=-MCodpxckhh4fxvxuERnG
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEABECAAYFAkrzJ78ACgkQLMAs/0C4zNpHkQCeKScWnJ1uJDfVXaNK/8dhvKJQ
Hs8An0q50aa3kF0zFeTTi7/EjR11aRKg
=MEfZ
-----END PGP SIGNATURE-----
"

0 comments

DSA 1928-1: New Linux 2.6.24 packages fix several vulnerabilities

Posted by Daniela Mehler

"-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ----------------------------------------------------------------------
Debian Security Advisory DSA-1928-1 security@debian.org
http://www.debian.org/security/ Dann Frazier
November 5, 2009 http://www.debian.org/security/faq
- ----------------------------------------------------------------------

Package : linux-2.6.24
Vulnerability : privilege escalation/denial of service/sensitive memory leak
Problem type : local/remote
Debian-specific: no
CVE Id(s) : CVE-2009-2846 CVE-2009-2847 CVE-2009-2848 CVE-2009-2849
CVE-2009-2903 CVE-2009-2908 CVE-2009-2909 CVE-2009-2910
CVE-2009-3001 CVE-2009-3002 CVE-2009-3228 CVE-2009-3238
CVE-2009-3286 CVE-2009-3547 CVE-2009-3612 CVE-2009-3613
CVE-2009-3620 CVE-2009-3621

Several vulnerabilities have been discovered in the Linux kernel that
may lead to a denial of service, sensitive memory leak or privilege
escalation. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2009-2846

Michael Buesch noticed a typing issue in the eisa-eeprom driver
for the hppa architecture. Local users could exploit this issue to
gain access to restricted memory.

CVE-2009-2847

Ulrich Drepper noticed an issue in the do_sigalstack routine on
64-bit systems. This issue allows local users to gain access to
potentially sensitive memory on the kernel stack.

CVE-2009-2848

Eric Dumazet discovered an issue in the execve path, where the
clear_child_tid variable was not being properly cleared. Local
users could exploit this issue to cause a denial of service
(memory corruption).

CVE-2009-2849

Neil Brown discovered an issue in the sysfs interface to md
devices. When md arrays are not active, local users can exploit
this vulnerability to cause a denial of service (oops).

CVE-2009-2903

Mark Smith discovered a memory leak in the appletalk
implementation. When the appletalk and ipddp modules are loaded,
but no ipddp"N" device is found, remote attackers can cause a
denial of service by consuming large amounts of system memory.

CVE-2009-2908

Loic Minier discovered an issue in the eCryptfs filesystem. A
local user can cause a denial of service (kernel oops) by causing
a dentry value to go negative.

CVE-2009-2909

Arjan van de Ven discovered an issue in the AX.25 protocol
implementation. A specially crafted call to setsockopt() can
result in a denial of service (kernel oops).

CVE-2009-2910

Jan Beulich discovered the existence of a sensitive kernel memory
leak. Systems running the 'amd64' kernel do not properly sanitize
registers for 32-bit processes.

CVE-2009-3001

Jiri Slaby fixed a sensitive memory leak issue in the ANSI/IEEE
802.2 LLC implementation. This is not exploitable in the Debian
lenny kernel as root privileges are required to exploit this
issue.

CVE-2009-3002

Eric Dumazet fixed several sensitive memory leaks in the IrDA,
X.25 PLP (Rose), NET/ROM, Acorn Econet/AUN, and Controller Area
Network (CAN) implementations. Local users can exploit these
issues to gain access to kernel memory.

CVE-2009-3228

Eric Dumazet reported an instance of uninitialized kernel memory
in the network packet scheduler. Local users may be able to
exploit this issue to read the contents of sensitive kernel
memory.

CVE-2009-3238

Linus Torvalds provided a change to the get_random_int() function
to increase its randomness.

CVE-2009-3286

Eric Paris discovered an issue with the NFSv4 server
implementation. When an O_EXCL create fails, files may be left
with corrupted permissions, possibly granting unintentional
privileges to other local users.

CVE-2009-3547

Earl Chew discovered a NULL pointer dereference issue in the
pipe_rdwr_open function which can be used by local users to gain
elevated privileges.

CVE-2009-3612

Jiri Pirko discovered a typo in the initialization of a structure
in the netlink subsystem that may allow local users to gain access
to sensitive kernel memory.

CVE-2009-3613

Alistair Strachan reported an issue in the r8169 driver. Remote
users can cause a denial of service (IOMMU space exhaustion and
system crash) by transmitting a large amount of jumbo frames.

CVE-2009-3620

Ben Hutchings discovered an issue in the DRM manager for ATI Rage
128 graphics adapters. Local users may be able to exploit this
vulnerability to cause a denial of service (NULL pointer
dereference).

CVE-2009-3621

Tomoki Sekiyama discovered a deadlock condition in the UNIX domain
socket implementation. Local users can exploit this vulnerability
to cause a denial of service (system hang).

For the oldstable distribution (etch), this problem has been fixed in
version 2.6.24-6~etchnhalf.9etch1.

We recommend that you upgrade your linux-2.6.24 packages.

Note: Debian 'etch' includes linux kernel packages based upon both the
2.6.18 and 2.6.24 linux releases. All known security issues are
carefully tracked against both packages and both packages will receive
security updates until security support for Debian 'etch'
concludes. However, given the high frequency at which low-severity
security issues are discovered in the kernel and the resource
requirements of doing an update, lower severity 2.6.18 and 2.6.24
updates will typically release in a staggered or "leap-frog" fashion.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Oldstable updates are available for alpha, amd64, hppa, i386, ia64, and mipsel.
Updates for other architectures will be released as the they become available.

Source archives:

http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-2.6.24_2.6.24-6~etchnhalf.9etch1.dsc
Size/MD5 checksum: 5118 11c39e0f0505c5a71453ba177ec2f780
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-2.6.24_2.6.24-6~etchnhalf.9etch1.diff.gz
Size/MD5 checksum: 4062851 38835b393eaf53915dbee39ef0ef0bce
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-2.6.24_2.6.24.orig.tar.gz
Size/MD5 checksum: 59630522 6b8751d1eb8e71498ba74bbd346343af

Architecture independent packages:

http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-doc-2.6.24_2.6.24-6~etchnhalf.9etch1_all.deb
Size/MD5 checksum: 4262022 bb1c503dcb847b700814d433cdddb1f9
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-tree-2.6.24_2.6.24-6~etchnhalf.9etch1_all.deb
Size/MD5 checksum: 83302 2a8576eb3003b7ba1ead19ad7ef6ce0c
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-manual-2.6.24_2.6.24-6~etchnhalf.9etch1_all.deb
Size/MD5 checksum: 1548296 3e044fb0d0bb8614f787f78fee86ce04
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-source-2.6.24_2.6.24-6~etchnhalf.9etch1_all.deb
Size/MD5 checksum: 46864328 20c0417498421842a7175074aea06a0f
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-support-2.6.24-etchnhalf.1_2.6.24-6~etchnhalf.9etch1_all.deb
Size/MD5 checksum: 97672 b1aa55ab4464293f5dac5b38e05948bb
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-patch-debian-2.6.24_2.6.24-6~etchnhalf.9etch1_all.deb
Size/MD5 checksum: 964124 a40463a66e93920bdd639d2c70d870cb

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-all-alpha_2.6.24-6~etchnhalf.9etch1_alpha.deb
Size/MD5 checksum: 82894 819512914da24a2d82d471a17a6126ea
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-alpha-legacy_2.6.24-6~etchnhalf.9etch1_alpha.deb
Size/MD5 checksum: 332670 c249c0b58448936c450c26b1340994d0
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-alpha-generic_2.6.24-6~etchnhalf.9etch1_alpha.deb
Size/MD5 checksum: 26758158 1a5497e6cd4f62b36f4cfdae9a606e24
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-alpha-legacy_2.6.24-6~etchnhalf.9etch1_alpha.deb
Size/MD5 checksum: 26737882 fc949e1dbc0d0c6c7688148babdfd5d1
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-common_2.6.24-6~etchnhalf.9etch1_alpha.deb
Size/MD5 checksum: 3454880 83a5e26b99def049eec7571242778961
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-alpha-generic_2.6.24-6~etchnhalf.9etch1_alpha.deb
Size/MD5 checksum: 332158 8f3a3adf61a6e150763a383d4b566db2
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-alpha-smp_2.6.24-6~etchnhalf.9etch1_alpha.deb
Size/MD5 checksum: 330952 0ec11881ba63842e135d3752a765177d
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-all_2.6.24-6~etchnhalf.9etch1_alpha.deb
Size/MD5 checksum: 82868 b5396790365bab5a2d032d1b3bece1ed
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-alpha-smp_2.6.24-6~etchnhalf.9etch1_alpha.deb
Size/MD5 checksum: 27341634 d11f40ed34af0197de7f61ef07d30abb

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-amd64_2.6.24-6~etchnhalf.9etch1_amd64.deb
Size/MD5 checksum: 354620 0decd6646f19383f6958e5d90b92e87b
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-all_2.6.24-6~etchnhalf.9etch1_amd64.deb
Size/MD5 checksum: 82864 2869e673de24c9741042e2bb37f84d58
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-common_2.6.24-6~etchnhalf.9etch1_amd64.deb
Size/MD5 checksum: 3650612 1b0f205b955558d402611693f783c495
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-amd64_2.6.24-6~etchnhalf.9etch1_amd64.deb
Size/MD5 checksum: 19598112 ed3b7a91d93a116a4b175d173ad0f078
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-all-amd64_2.6.24-6~etchnhalf.9etch1_amd64.deb
Size/MD5 checksum: 82872 c560fbca727844a090f88f9d6569ed0b

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-all_2.6.24-6~etchnhalf.9etch1_hppa.deb
Size/MD5 checksum: 82992 1604c10382bd677723af0a811fdb466f
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-parisc_2.6.24-6~etchnhalf.9etch1_hppa.deb
Size/MD5 checksum: 258316 90502abd75a09ceed13a5efd22e996c5
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-common_2.6.24-6~etchnhalf.9etch1_hppa.deb
Size/MD5 checksum: 3445284 32e69244553a870750d771254d1c95bd
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-parisc64_2.6.24-6~etchnhalf.9etch1_hppa.deb
Size/MD5 checksum: 258996 fc63f1ef7e55c899b9ef2d736bc5e648
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-parisc-smp_2.6.24-6~etchnhalf.9etch1_hppa.deb
Size/MD5 checksum: 260542 97df4eda2fbd582dd6951bb1b7f31e85
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-parisc64-smp_2.6.24-6~etchnhalf.9etch1_hppa.deb
Size/MD5 checksum: 14830274 fb45fe9d1b77d908d5adbb353b211994
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-parisc64-smp_2.6.24-6~etchnhalf.9etch1_hppa.deb
Size/MD5 checksum: 261064 f5d2cbb6216c1ffebbd73153a75e75a5
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-all-hppa_2.6.24-6~etchnhalf.9etch1_hppa.deb
Size/MD5 checksum: 83020 103285de6aad099908a2fedbbca24069
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-parisc-smp_2.6.24-6~etchnhalf.9etch1_hppa.deb
Size/MD5 checksum: 13847626 3c429ea0e61a446b3e7b13b943eafcb5
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-parisc64_2.6.24-6~etchnhalf.9etch1_hppa.deb
Size/MD5 checksum: 14374844 760d7850faff110d14494c86095aa45c
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-parisc_2.6.24-6~etchnhalf.9etch1_hppa.deb
Size/MD5 checksum: 13335298 2b476692a155f3f735f3af76f7170cd8

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-486_2.6.24-6~etchnhalf.9etch1_i386.deb
Size/MD5 checksum: 358770 0778828f3b2061e293f3aabc0aa78315
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-686-bigmem_2.6.24-6~etchnhalf.9etch1_i386.deb
Size/MD5 checksum: 358342 3c8b34971bd6f2b69854328888aa4349
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-686_2.6.24-6~etchnhalf.9etch1_i386.deb
Size/MD5 checksum: 19146708 1818f00a12bc38f393e6d84f71afae73
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-all-i386_2.6.24-6~etchnhalf.9etch1_i386.deb
Size/MD5 checksum: 82890 318cd7ef9d8b39d02da83a3a982f7c40
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-amd64_2.6.24-6~etchnhalf.9etch1_i386.deb
Size/MD5 checksum: 19481866 bb86c9b5a4944b48492a38f81ea38026
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-common_2.6.24-6~etchnhalf.9etch1_i386.deb
Size/MD5 checksum: 3655456 fb818a8696c619e5c9c7af73eec2b3c3
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-686_2.6.24-6~etchnhalf.9etch1_i386.deb
Size/MD5 checksum: 358104 388750612fda29fb362771823e54993c
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-686-bigmem_2.6.24-6~etchnhalf.9etch1_i386.deb
Size/MD5 checksum: 19213920 bc5f6ef45349d25064125c5c34e78fde
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-486_2.6.24-6~etchnhalf.9etch1_i386.deb
Size/MD5 checksum: 19215890 868b1eb9c46677d9d97d0678b4a21894
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-amd64_2.6.24-6~etchnhalf.9etch1_i386.deb
Size/MD5 checksum: 346092 1874a566f494c8fa93946f7cdf71557f
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-all_2.6.24-6~etchnhalf.9etch1_i386.deb
Size/MD5 checksum: 82864 321874f0f13b6e236c428568a492cb90

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-all_2.6.24-6~etchnhalf.9etch1_ia64.deb
Size/MD5 checksum: 82866 410b7f438b9b8468e3789058dcb31d63
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-mckinley_2.6.24-6~etchnhalf.9etch1_ia64.deb
Size/MD5 checksum: 32208224 154e3adb6765a43a000dcb9f9256db56
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-common_2.6.24-6~etchnhalf.9etch1_ia64.deb
Size/MD5 checksum: 3568326 aa15646940c12e9f722d3668cca00270
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-all-ia64_2.6.24-6~etchnhalf.9etch1_ia64.deb
Size/MD5 checksum: 82888 31354bcffa90ddfd3dd3905f37b53685
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-mckinley_2.6.24-6~etchnhalf.9etch1_ia64.deb
Size/MD5 checksum: 319102 7e62e5eadf5b3b8eecc22ccdfa57b19a
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-itanium_2.6.24-6~etchnhalf.9etch1_ia64.deb
Size/MD5 checksum: 319462 44040aba13eedc65922aa25a05fc8b86
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-itanium_2.6.24-6~etchnhalf.9etch1_ia64.deb
Size/MD5 checksum: 32025040 474e2842ef8f69677380db67882b0fb0

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-r5k-cobalt_2.6.24-6~etchnhalf.9etch1_mipsel.deb
Size/MD5 checksum: 13317670 61df26ad246695fad18f2f76c3c5163f
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-common_2.6.24-6~etchnhalf.9etch1_mipsel.deb
Size/MD5 checksum: 3804192 393d33cc947f3e091c5858ef9179a70a
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-5kc-malta_2.6.24-6~etchnhalf.9etch1_mipsel.deb
Size/MD5 checksum: 308984 157b8af3aa5634f7a516cdf5cc220836
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-4kc-malta_2.6.24-6~etchnhalf.9etch1_mipsel.deb
Size/MD5 checksum: 309750 d7ff28e982746494de3626cd747287c5
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-4kc-malta_2.6.24-6~etchnhalf.9etch1_mipsel.deb
Size/MD5 checksum: 21737172 78c5c433465bc97c6c16a49fea05b575
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-sb1-bcm91250a_2.6.24-6~etchnhalf.9etch1_mipsel.deb
Size/MD5 checksum: 246818 884f377e13d22f6633a49d4c0367f848
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-all_2.6.24-6~etchnhalf.9etch1_mipsel.deb
Size/MD5 checksum: 82870 cacc5fac473c021a7e0c0f7103e1efc0
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-r5k-cobalt_2.6.24-6~etchnhalf.9etch1_mipsel.deb
Size/MD5 checksum: 246614 31c1c45fab75abb6221285c152b23cfd
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-sb1-bcm91250a_2.6.24-6~etchnhalf.9etch1_mipsel.deb
Size/MD5 checksum: 16567458 f1da961b02a1c60672349c1a9c19c9d1
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-all-mipsel_2.6.24-6~etchnhalf.9etch1_mipsel.deb
Size/MD5 checksum: 82916 4b4d12b65b14c90ac9dda0c6303f9f5c
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-sb1a-bcm91480b_2.6.24-6~etchnhalf.9etch1_mipsel.deb
Size/MD5 checksum: 16631254 b956adbf57f77bc34f06ca58d0d6a73f
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-image-2.6.24-etchnhalf.1-5kc-malta_2.6.24-6~etchnhalf.9etch1_mipsel.deb
Size/MD5 checksum: 26990038 bd115b24191672415033fb0d077e33e8
http://security.debian.org/pool/updates/main/l/linux-2.6.24/linux-headers-2.6.24-etchnhalf.1-sb1a-bcm91480b_2.6.24-6~etchnhalf.9etch1_mipsel.deb
Size/MD5 checksum: 247676 99d036e308655b4fb11d460fd50c4dd1

These changes will probably be included in the oldstable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show ' and http://packages.debian.org/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iD8DBQFK80tBhuANDBmkLRkRAj8vAJ9fKUFHKAQOSNoUzwbDY1ep4gqF0wCfcyxM
YnZRXAn8UGyZzqSA660Vm/o=
=Ey4e
-----END PGP SIGNATURE-----
"

0 comments

RHSA-2009:1540-01 Important: kernel-rt security, bug fix, and enhancement update

Posted by Daniela Mehler

"-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Important: kernel-rt security, bug fix, and enhancement update
Advisory ID: RHSA-2009:1540-01
Product: Red Hat Enterprise MRG for RHEL-5
Advisory URL: https://rhn.redhat.com/errata/RHSA-2009-1540.html
Issue date: 2009-11-03
CVE Names: CVE-2009-1895 CVE-2009-2691 CVE-2009-2695
CVE-2009-2849 CVE-2009-2910 CVE-2009-3002
CVE-2009-3228 CVE-2009-3547 CVE-2009-3612
CVE-2009-3613 CVE-2009-3620 CVE-2009-3621
=====================================================================

1. Summary:

Updated kernel-rt packages that fix several security issues, multiple bugs,
and add enhancements are now available for Red Hat Enterprise MRG 1.1.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

MRG Realtime for RHEL 5 Server - i386, noarch, x86_64

3. Description:

The kernel-rt packages contain the Linux kernel, the core of any Linux
operating system.

Security fixes:

* the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags were not cleared when a
setuid or setgid program was executed. A local, unprivileged user could use
this flaw to bypass the mmap_min_addr protection mechanism and perform a
NULL pointer dereference attack, or bypass the Address Space Layout
Randomization (ASLR) security feature. (CVE-2009-1895, Important)

* a system with SELinux enforced was more permissive in allowing local
users in the unconfined_t domain to map low memory areas even if the
mmap_min_addr restriction was enabled. This could aid in the local
exploitation of NULL pointer dereference bugs. (CVE-2009-2695, Important)

* missing initialization flaws were found in getname() implementations in
numerous network protocol implementations in the Linux kernel. Certain
data structures in these getname() implementations were not initialized
properly before being copied to user-space. These flaws could lead to an
information leak. (CVE-2009-3002, Important)

* a NULL pointer dereference flaw was found in each of the following
functions in the Linux kernel: pipe_read_open(), pipe_write_open(), and
pipe_rdwr_open(). When the mutex lock is not held, the i_pipe pointer could
be released by other processes before it is used to update the pipe's
reader and writer counters. This could lead to a local denial of service or
privilege escalation. (CVE-2009-3547, Important)

* a flaw was found in the Realtek r8169 Ethernet driver in the Linux
kernel. pci_unmap_single() presented a memory leak that could lead to IOMMU
space exhaustion and a system crash. An attacker on the local network could
abuse this flaw by using jumbo frames for large amounts of network traffic.
(CVE-2009-3613, Important)

* NULL pointer dereference flaws were found in the r128 driver in the
Linux kernel. Checks to test if the Concurrent Command Engine state was
initialized were missing in private IOCTL functions. An attacker could use
these flaws to cause a local denial of service or escalate their
privileges. (CVE-2009-3620, Important)

* Kees Cook and Steve Beattie discovered a race condition in the /proc
code in the Linux kernel. This could lead to information in the
"/proc/[pid]/maps" and "/proc/[pid]/smaps" files being leaked to users (who
would otherwise not have access to this information) during ELF loading.
This could help a local attacker bypass the ASLR security feature.
(CVE-2009-2691, Moderate)

* a NULL pointer dereference flaw was found in the md driver in the Linux
kernel. If the suspend_lo or suspend_hi file in "/sys/" is modified when
the disk array is inactive, it could lead to a local denial of service or
privilege escalation. By default, only root can write to these two files.
(CVE-2009-2849, Moderate)

* an information leak was found in the Linux kernel. On AMD64 systems,
32-bit processes could access and read certain 64-bit registers by
temporarily switching themselves to 64-bit mode. (CVE-2009-2910, Moderate)

* padding data in several core network structures was not initialized
properly before being sent to user-space, possibly leading to information
leaks. (CVE-2009-3228, CVE-2009-3612, Moderate)

* the unix_stream_connect() function in the Linux kernel did not check if a
UNIX domain socket was in the shutdown state. This could lead to a
deadlock. A local, unprivileged user could use this flaw to cause a denial
of service. (CVE-2009-3621, Moderate)

These updated packages also include bug fixes and enhancements. Users are
directed to the Realtime Security Update Release Notes for version 1.1 for
information on these changes, which will be available shortly from:

http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_MRG/

Users should upgrade to these updated packages, which contain backported
patches to correct these issues and add enhancements. The system must be
rebooted for this update to take effect.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

511171 - CVE-2009-1895 kernel: personality: fix PER_CLEAR_ON_SETID
516171 - CVE-2009-2691 kernel: /proc/$pid/maps visible during initial setuid ELF loading
517830 - CVE-2009-2695 kernel: SELinux and mmap_min_addr
518132 - CVE-2009-2849 kernel: md: NULL pointer deref when accessing suspend_* sysfs attributes
518160 - [FOCUS] Boot hang with x3950 using MRG's -108 kernel
519305 - CVE-2009-3001, CVE-2009-3002 kernel: numerous getname() infoleaks
520990 - CVE-2009-3228 kernel: tc: uninitialised kernel memory leak
521999 - ip_tables: connlimit match: invalid size 32 != 24
522359 - MRG 1.1 SMI remeidation support for HS22 and Rackmounts
522501 - Turn off IPX protocol module
522503 - Turn off AppleTalk protocol module in realtime kernel
523986 - kernel: ipt_recent: sanity check hit count [mrg-1]
526788 - CVE-2009-2910 kernel: x86_64 32 bit process register leak
528139 - FTRACE: check for failure for all conversions, tracing: correct module boundaries for ftrace_release
528868 - CVE-2009-3612 kernel: tcf_fill_node() infoleak due to typo in 9ef1d4c7
529137 - CVE-2009-3613 kernel: flood ping cause out-of-iommu error and panic when mtu larger than 1500
529597 - CVE-2009-3620 kernel: r128 IOCTL NULL pointer dereferences when CCE state is uninitialised
529626 - CVE-2009-3621 kernel: AF_UNIX: Fix deadlock on connecting to shutdown socket
530490 - CVE-2009-3547 kernel: fs: pipe.c null pointer dereference

6. Package List:

MRG Realtime for RHEL 5 Server:

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHEMRG/SRPMS/kernel-rt-2.6.24.7-137.el5rt.src.rpm

i386:
kernel-rt-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-debug-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-debug-debuginfo-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-debug-devel-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-debuginfo-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-debuginfo-common-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-devel-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-trace-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-trace-debuginfo-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-trace-devel-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-vanilla-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-vanilla-debuginfo-2.6.24.7-137.el5rt.i686.rpm
kernel-rt-vanilla-devel-2.6.24.7-137.el5rt.i686.rpm

noarch:
kernel-rt-doc-2.6.24.7-137.el5rt.noarch.rpm

x86_64:
kernel-rt-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-debug-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-debug-debuginfo-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-debug-devel-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-debuginfo-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-debuginfo-common-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-devel-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-trace-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-trace-debuginfo-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-trace-devel-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-vanilla-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-vanilla-debuginfo-2.6.24.7-137.el5rt.x86_64.rpm
kernel-rt-vanilla-devel-2.6.24.7-137.el5rt.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1895
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2691
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2695
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2849
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2910
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3002
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3228
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3547
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3612
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3613
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3620
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3621
http://www.redhat.com/security/updates/classification/#important
http://kbase.redhat.com/faq/docs/DOC-18042
http://kbase.redhat.com/faq/docs/DOC-17866
http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_MRG/

8. Contact:

The Red Hat security contact is . More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFK8IH9XlSAg2UNWIIRAoXjAKC8JqO1mR+ZMWpACdn/M13k/mUAYACeJIFP
G87fP0mndnWlj6GTX9t3IP0=
=emIg
-----END PGP SIGNATURE-----
"

0 comments

RHSA-2009:1550-01 Important: kernel security and bug fix update

Posted by Daniela Mehler

"-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
Red Hat Security Advisory

Synopsis: Important: kernel security and bug fix update
Advisory ID: RHSA-2009:1550-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2009-1550.html
Issue date: 2009-11-03
CVE Names: CVE-2008-5029 CVE-2008-5300 CVE-2009-1337
CVE-2009-1385 CVE-2009-1895 CVE-2009-2848
CVE-2009-3002 CVE-2009-3547
=====================================================================

1. Summary:

Updated kernel packages that fix several security issues and multiple bugs
are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

3. Description:

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

Security fixes:

* when fput() was called to close a socket, the __scm_destroy() function in
the Linux kernel could make indirect recursive calls to itself. This could,
potentially, lead to a denial of service issue. (CVE-2008-5029, Important)

* the sendmsg() function in the Linux kernel did not block during UNIX
socket garbage collection. This could, potentially, lead to a local denial
of service. (CVE-2008-5300, Important)

* the exit_notify() function in the Linux kernel did not properly reset the
exit signal if a process executed a set user ID (setuid) application before
exiting. This could allow a local, unprivileged user to elevate their
privileges. (CVE-2009-1337, Important)

* a flaw was found in the Intel PRO/1000 network driver in the Linux
kernel. Frames with sizes near the MTU of an interface may be split across
multiple hardware receive descriptors. Receipt of such a frame could leak
through a validation check, leading to a corruption of the length check. A
remote attacker could use this flaw to send a specially-crafted packet that
would cause a denial of service or code execution. (CVE-2009-1385,
Important)

* the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags were not cleared when a
setuid or setgid program was executed. A local, unprivileged user could use
this flaw to bypass the mmap_min_addr protection mechanism and perform a
NULL pointer dereference attack, or bypass the Address Space Layout
Randomization (ASLR) security feature. (CVE-2009-1895, Important)

* it was discovered that, when executing a new process, the clear_child_tid
pointer in the Linux kernel is not cleared. If this pointer points to a
writable portion of the memory of the new program, the kernel could corrupt
four bytes of memory, possibly leading to a local denial of service or
privilege escalation. (CVE-2009-2848, Important)

* missing initialization flaws were found in getname() implementations in
the IrDA sockets, AppleTalk DDP protocol, NET/ROM protocol, and ROSE
protocol implementations in the Linux kernel. Certain data structures in
these getname() implementations were not initialized properly before being
copied to user-space. These flaws could lead to an information leak.
(CVE-2009-3002, Important)

* a NULL pointer dereference flaw was found in each of the following
functions in the Linux kernel: pipe_read_open(), pipe_write_open(), and
pipe_rdwr_open(). When the mutex lock is not held, the i_pipe pointer could
be released by other processes before it is used to update the pipe's
reader and writer counters. This could lead to a local denial of service or
privilege escalation. (CVE-2009-3547, Important)

Bug fixes:

* this update adds the mmap_min_addr tunable and restriction checks to help
prevent unprivileged users from creating new memory mappings below the
minimum address. This can help prevent the exploitation of NULL pointer
dereference bugs. Note that mmap_min_addr is set to zero (disabled) by
default for backwards compatibility. (BZ#512642)

* a bridge reference count problem in IPv6 has been fixed. (BZ#457010)

* enforce null-termination of user-supplied arguments to setsockopt().
(BZ#505514)

* the gcc flag "-fno-delete-null-pointer-checks" was added to the kernel
build options. This prevents gcc from optimizing out NULL pointer checks
after the first use of a pointer. NULL pointer bugs are often exploited by
attackers. Keeping these checks is a safety measure. (BZ#511185)

* a check has been added to the IPv4 code to make sure that rt is not NULL,
to help prevent future bugs in functions that call ip_append_data() from
being exploitable. (BZ#520300)

Users should upgrade to these updated packages, which contain backported
patches to correct these issues. The system must be rebooted for this
update to take effect.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

457010 - ipv6: use timer pending to fix bridge reference count problem [rhel-3.9]
470201 - CVE-2008-5029 kernel: Unix sockets kernel panic
473259 - CVE-2008-5300 kernel: fix soft lockups/OOM issues with unix socket garbage collector
493771 - CVE-2009-1337 kernel: exit_notify: kill the wrong capable(CAP_KILL) check
502981 - CVE-2009-1385 kernel: e1000_clean_rx_irq() denial of service
505514 - kernel: ensure devname passed to SO_BINDTODEVICE is NULL-terminated [rhel-3]
511171 - CVE-2009-1895 kernel: personality: fix PER_CLEAR_ON_SETID
511185 - kernel: build with -fno-delete-null-pointer-checks [rhel-3]
512642 - kernel: security: implement mmap_min_addr infrastructure [rhel-3]
515423 - CVE-2009-2848 kernel: execve: must clear current->clear_child_tid
519305 - CVE-2009-3001, CVE-2009-3002 kernel: numerous getname() infoleaks
520300 - kernel: ipv4: make ip_append_data() handle NULL routing table [rhel-3]
530490 - CVE-2009-3547 kernel: fs: pipe.c null pointer dereference

6. Package List:

Red Hat Enterprise Linux AS version 3:

Source:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/kernel-2.4.21-63.EL.src.rpm

i386:
kernel-2.4.21-63.EL.athlon.rpm
kernel-2.4.21-63.EL.i686.rpm
kernel-BOOT-2.4.21-63.EL.i386.rpm
kernel-debuginfo-2.4.21-63.EL.athlon.rpm
kernel-debuginfo-2.4.21-63.EL.i386.rpm
kernel-debuginfo-2.4.21-63.EL.i686.rpm
kernel-doc-2.4.21-63.EL.i386.rpm
kernel-hugemem-2.4.21-63.EL.i686.rpm
kernel-hugemem-unsupported-2.4.21-63.EL.i686.rpm
kernel-smp-2.4.21-63.EL.athlon.rpm
kernel-smp-2.4.21-63.EL.i686.rpm
kernel-smp-unsupported-2.4.21-63.EL.athlon.rpm
kernel-smp-unsupported-2.4.21-63.EL.i686.rpm
kernel-source-2.4.21-63.EL.i386.rpm
kernel-unsupported-2.4.21-63.EL.athlon.rpm
kernel-unsupported-2.4.21-63.EL.i686.rpm

ia64:
kernel-2.4.21-63.EL.ia64.rpm
kernel-debuginfo-2.4.21-63.EL.ia64.rpm
kernel-doc-2.4.21-63.EL.ia64.rpm
kernel-source-2.4.21-63.EL.ia64.rpm
kernel-unsupported-2.4.21-63.EL.ia64.rpm

ppc:
kernel-2.4.21-63.EL.ppc64iseries.rpm
kernel-2.4.21-63.EL.ppc64pseries.rpm
kernel-debuginfo-2.4.21-63.EL.ppc64.rpm
kernel-debuginfo-2.4.21-63.EL.ppc64iseries.rpm
kernel-debuginfo-2.4.21-63.EL.ppc64pseries.rpm
kernel-doc-2.4.21-63.EL.ppc64.rpm
kernel-source-2.4.21-63.EL.ppc64.rpm
kernel-unsupported-2.4.21-63.EL.ppc64iseries.rpm
kernel-unsupported-2.4.21-63.EL.ppc64pseries.rpm

s390:
kernel-2.4.21-63.EL.s390.rpm
kernel-debuginfo-2.4.21-63.EL.s390.rpm
kernel-doc-2.4.21-63.EL.s390.rpm
kernel-source-2.4.21-63.EL.s390.rpm
kernel-unsupported-2.4.21-63.EL.s390.rpm

s390x:
kernel-2.4.21-63.EL.s390x.rpm
kernel-debuginfo-2.4.21-63.EL.s390x.rpm
kernel-doc-2.4.21-63.EL.s390x.rpm
kernel-source-2.4.21-63.EL.s390x.rpm
kernel-unsupported-2.4.21-63.EL.s390x.rpm

x86_64:
kernel-2.4.21-63.EL.ia32e.rpm
kernel-2.4.21-63.EL.x86_64.rpm
kernel-debuginfo-2.4.21-63.EL.ia32e.rpm
kernel-debuginfo-2.4.21-63.EL.x86_64.rpm
kernel-doc-2.4.21-63.EL.x86_64.rpm
kernel-smp-2.4.21-63.EL.x86_64.rpm
kernel-smp-unsupported-2.4.21-63.EL.x86_64.rpm
kernel-source-2.4.21-63.EL.x86_64.rpm
kernel-unsupported-2.4.21-63.EL.ia32e.rpm
kernel-unsupported-2.4.21-63.EL.x86_64.rpm

Red Hat Desktop version 3:

Source:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/kernel-2.4.21-63.EL.src.rpm

i386:
kernel-2.4.21-63.EL.athlon.rpm
kernel-2.4.21-63.EL.i686.rpm
kernel-BOOT-2.4.21-63.EL.i386.rpm
kernel-debuginfo-2.4.21-63.EL.athlon.rpm
kernel-debuginfo-2.4.21-63.EL.i386.rpm
kernel-debuginfo-2.4.21-63.EL.i686.rpm
kernel-doc-2.4.21-63.EL.i386.rpm
kernel-hugemem-2.4.21-63.EL.i686.rpm
kernel-hugemem-unsupported-2.4.21-63.EL.i686.rpm
kernel-smp-2.4.21-63.EL.athlon.rpm
kernel-smp-2.4.21-63.EL.i686.rpm
kernel-smp-unsupported-2.4.21-63.EL.athlon.rpm
kernel-smp-unsupported-2.4.21-63.EL.i686.rpm
kernel-source-2.4.21-63.EL.i386.rpm
kernel-unsupported-2.4.21-63.EL.athlon.rpm
kernel-unsupported-2.4.21-63.EL.i686.rpm

x86_64:
kernel-2.4.21-63.EL.ia32e.rpm
kernel-2.4.21-63.EL.x86_64.rpm
kernel-debuginfo-2.4.21-63.EL.ia32e.rpm
kernel-debuginfo-2.4.21-63.EL.x86_64.rpm
kernel-doc-2.4.21-63.EL.x86_64.rpm
kernel-smp-2.4.21-63.EL.x86_64.rpm
kernel-smp-unsupported-2.4.21-63.EL.x86_64.rpm
kernel-source-2.4.21-63.EL.x86_64.rpm
kernel-unsupported-2.4.21-63.EL.ia32e.rpm
kernel-unsupported-2.4.21-63.EL.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

Source:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/kernel-2.4.21-63.EL.src.rpm

i386:
kernel-2.4.21-63.EL.athlon.rpm
kernel-2.4.21-63.EL.i686.rpm
kernel-BOOT-2.4.21-63.EL.i386.rpm
kernel-debuginfo-2.4.21-63.EL.athlon.rpm
kernel-debuginfo-2.4.21-63.EL.i386.rpm
kernel-debuginfo-2.4.21-63.EL.i686.rpm
kernel-doc-2.4.21-63.EL.i386.rpm
kernel-hugemem-2.4.21-63.EL.i686.rpm
kernel-hugemem-unsupported-2.4.21-63.EL.i686.rpm
kernel-smp-2.4.21-63.EL.athlon.rpm
kernel-smp-2.4.21-63.EL.i686.rpm
kernel-smp-unsupported-2.4.21-63.EL.athlon.rpm
kernel-smp-unsupported-2.4.21-63.EL.i686.rpm
kernel-source-2.4.21-63.EL.i386.rpm
kernel-unsupported-2.4.21-63.EL.athlon.rpm
kernel-unsupported-2.4.21-63.EL.i686.rpm

ia64:
kernel-2.4.21-63.EL.ia64.rpm
kernel-debuginfo-2.4.21-63.EL.ia64.rpm
kernel-doc-2.4.21-63.EL.ia64.rpm
kernel-source-2.4.21-63.EL.ia64.rpm
kernel-unsupported-2.4.21-63.EL.ia64.rpm

x86_64:
kernel-2.4.21-63.EL.ia32e.rpm
kernel-2.4.21-63.EL.x86_64.rpm
kernel-debuginfo-2.4.21-63.EL.ia32e.rpm
kernel-debuginfo-2.4.21-63.EL.x86_64.rpm
kernel-doc-2.4.21-63.EL.x86_64.rpm
kernel-smp-2.4.21-63.EL.x86_64.rpm
kernel-smp-unsupported-2.4.21-63.EL.x86_64.rpm
kernel-source-2.4.21-63.EL.x86_64.rpm
kernel-unsupported-2.4.21-63.EL.ia32e.rpm
kernel-unsupported-2.4.21-63.EL.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

Source:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/kernel-2.4.21-63.EL.src.rpm

i386:
kernel-2.4.21-63.EL.athlon.rpm
kernel-2.4.21-63.EL.i686.rpm
kernel-BOOT-2.4.21-63.EL.i386.rpm
kernel-debuginfo-2.4.21-63.EL.athlon.rpm
kernel-debuginfo-2.4.21-63.EL.i386.rpm
kernel-debuginfo-2.4.21-63.EL.i686.rpm
kernel-doc-2.4.21-63.EL.i386.rpm
kernel-hugemem-2.4.21-63.EL.i686.rpm
kernel-hugemem-unsupported-2.4.21-63.EL.i686.rpm
kernel-smp-2.4.21-63.EL.athlon.rpm
kernel-smp-2.4.21-63.EL.i686.rpm
kernel-smp-unsupported-2.4.21-63.EL.athlon.rpm
kernel-smp-unsupported-2.4.21-63.EL.i686.rpm
kernel-source-2.4.21-63.EL.i386.rpm
kernel-unsupported-2.4.21-63.EL.athlon.rpm
kernel-unsupported-2.4.21-63.EL.i686.rpm

ia64:
kernel-2.4.21-63.EL.ia64.rpm
kernel-debuginfo-2.4.21-63.EL.ia64.rpm
kernel-doc-2.4.21-63.EL.ia64.rpm
kernel-source-2.4.21-63.EL.ia64.rpm
kernel-unsupported-2.4.21-63.EL.ia64.rpm

x86_64:
kernel-2.4.21-63.EL.ia32e.rpm
kernel-2.4.21-63.EL.x86_64.rpm
kernel-debuginfo-2.4.21-63.EL.ia32e.rpm
kernel-debuginfo-2.4.21-63.EL.x86_64.rpm
kernel-doc-2.4.21-63.EL.x86_64.rpm
kernel-smp-2.4.21-63.EL.x86_64.rpm
kernel-smp-unsupported-2.4.21-63.EL.x86_64.rpm
kernel-source-2.4.21-63.EL.x86_64.rpm
kernel-unsupported-2.4.21-63.EL.ia32e.rpm
kernel-unsupported-2.4.21-63.EL.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5029
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5300
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1337
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1385
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1895
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2848
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3002
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3547
http://www.redhat.com/security/updates/classification/#important
http://kbase.redhat.com/faq/docs/DOC-17866

8. Contact:

The Red Hat security contact is . More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFK8KzSXlSAg2UNWIIRArWtAJ92slWmSRS3oiyIP72ioK2CImFXuQCfQd/v
xKcJ+uoh5n3q0tv76k8JjhU=
=opMk
-----END PGP SIGNATURE-----
"

0 comments

RHSA-2009:1541-01 Important: kernel security update

Posted by Daniela Mehler

0 comments

Linux More

RHSA-2009:1562-01 Important: tomcat security update

USN-853-2: Firefox and Xulrunner regression

USN-854-1: GD library vulnerabilities

DSA 1928-1: New Linux 2.6.24 packages fix several vulnerabilities

RHSA-2009:1540-01 Important: kernel-rt security, bug fix, and enhancement update

RHSA-2009:1550-01 Important: kernel security and bug fix update

RHSA-2009:1541-01 Important: kernel security update

Archives