[ISN] Linux Security Week - November 6th 2009

From: InfoSec News <alerts_at_private>
Date: Mon, 9 Nov 2009 00:42:36 -0600 (CST)
+----------------------------------------------------------------------+
| LinuxSecurity.com                                  Weekly Newsletter |
| November 6th, 2009                              Volume 10, Number 45 |
|                                                                      |
| Editorial Team:              Dave Wreski <dwreski_at_private> |
|                       Benjamin D. Thomas <bthomas_at_private> |
+----------------------------------------------------------------------+

Thank you for reading the LinuxSecurity.com weekly security newsletter.
The purpose of this document is to provide our readers with a quick
summary of each week's most relevant Linux security headlines.

This week, advisories were released for typo3, libhtml, expat, pyxml,
mimetex, squidguard, yelp, gnome-python, gnome-web-photo, kazehakase,
mozvoikko, miro, mugshot, pcmanx, ruby-gnome, xulrunner, epiphany,
evolution, firefox, galeon, wireshark, jetty, wget, kernel-rt, pidgin,
mozilla-firefox, and poppler.  The distributors include Debian, Fedora,
Mandriva, Red Hat, Slackware, SuSE, Ubuntu, and Pardus.

---

>> Linux+DVD Magazine <<

In each issue you can find information concerning the best use of Linux:
safety, databases, multimedia, scientific tools, entertainment,
programming, e-mail, news and desktop environments.

Catch up with what professional network and database administrators,
system programmers, webmasters and all those who believe in the power of
Open Source software are doing!

http://www.linuxsecurity.com/ads/adclick.php?bannerid=26

---

Review: Googling Security: How Much Does Google Know About You
--------------------------------------------------------------
If I ask "How much do you know about Google?" You may not take even a
second to respond.  But if I may ask "How much does Google know about
you"? You may instantly reply "Wait... what!? Do they!?"  The book
"Googling Security: How Much Does Google Know About You" by Greg Conti
(Computer Science Professor at West Point) is the first book to reveal
how Google's vast information stockpiles could be used against you or
your business and what you can do to protect yourself.

http://www.linuxsecurity.com/content/view/145939

---

A Secure Nagios Server
----------------------
Nagios is a monitoring software designed to let you know about problems
on your hosts and networks quickly. You can configure it to be used on
any network. Setting up a Nagios server on any Linux distribution is a
very quick process however to make it a secure setup it takes some
work. This article will not show you how to install Nagios since there
are tons of them out there but it will show you in detail ways to
improve your Nagios security.

http://www.linuxsecurity.com/content/view/144088

-->  Take advantage of the LinuxSecurity.com Quick Reference Card!  <--
-->  http://www.linuxsecurity.com/docs/QuickRefCard.pdf             <--

------------------------------------------------------------------------

* EnGarde Secure Community 3.0.22 Now Available! (Dec 9)
  ------------------------------------------------------
  Guardian Digital is happy to announce the release of EnGarde Secure
  Community 3.0.22 (Version 3.0, Release 22).  This release includes
  many updated packages and bug fixes and some feature enhancements to
  the EnGarde Secure Linux Installer and the SELinux policy.

  http://www.linuxsecurity.com/content/view/145668

------------------------------------------------------------------------

* Debian: New Linux 2.6.26 packages fix several vulnerabilities (Nov 5)
  ---------------------------------------------------------------------


  http://www.linuxsecurity.com/content/view/150601

* Debian: New TYPO3 packages fix several vulnerabilities (Nov 4)
  --------------------------------------------------------------


  http://www.linuxsecurity.com/content/view/150599

* Debian: New libhtml-parser-perl packages fix denial of service (Oct 29)
  -----------------------------------------------------------------------


  http://www.linuxsecurity.com/content/view/150535

------------------------------------------------------------------------

* Fedora 10 Update: expat-2.0.1-5.fc10.1 (Nov 4)
  ----------------------------------------------
  This update fixes a security vulnerability:	 A buffer over-read
  flaw was found in the way Expat handles malformed UTF-8 sequences
  when processing XML files. A specially-crafted XML file could cause
  applications using Expat to crash while parsing the file.
  (CVE-2009-3720)

  http://www.linuxsecurity.com/content/view/150592

* Fedora 11 Update: PyXML-0.8.4-16.fc11 (Nov 4)
  ---------------------------------------------
  Switched to using system expat library. Updated expat packages are
  needed to fully resolve this flaw.

  http://www.linuxsecurity.com/content/view/150593

* Fedora 11 Update: mimetex-1.71-1.fc11 (Nov 4)
  ---------------------------------------------
  - Fixes a buffer-overflow as detailed in #511049.  - Updates to 1.7.

  http://www.linuxsecurity.com/content/view/150590

* Fedora 10 Update: squidGuard-1.4-8.fc10 (Nov 4)
  -----------------------------------------------
  Fixes language file issue, but more importantly. . .
  --------------- squidGuard upstream has released patches fixing
  (quoting  from upstream advisories):	  a, This patch fixes one
  buffer overflow problem in sgLog.c when overlong URLs  are requested.
  SquidGuard will then go into emergency mode were no blocking	occurs.
  This is not required in this situation.

  http://www.linuxsecurity.com/content/view/150591

* Fedora 11 Update: expat-2.0.1-6.fc11.1 (Nov 4)
  ----------------------------------------------
  This update fixes a security vulnerability:	 A buffer over-read
  flaw was found in the way Expat handles malformed UTF-8 sequences
  when processing XML files. A specially-crafted XML file could cause
  applications using Expat to crash while parsing the file.
  (CVE-2009-3720)

  http://www.linuxsecurity.com/content/view/150589

* Fedora 10 Update: yelp-2.24.0-14.fc10 (Nov 4)
  ---------------------------------------------
  Update to new upstream Firefox version 3.0.15, fixing multiple
  security issues detailed in the upstream advisories:
  http://www.mozilla.org/security/known-
  vulnerabilities/firefox30.html#firefox3.0.15	  Update also includes
  all packages depending on gecko-libs rebuilt against new version of
  Firefox / XULRunner.

  http://www.linuxsecurity.com/content/view/150588

* Fedora 10 Update: gnome-python2-extras-2.19.1-35.fc10 (Nov 4)
  -------------------------------------------------------------
  Update to new upstream Firefox version 3.0.15, fixing multiple
  security issues detailed in the upstream advisories:
  http://www.mozilla.org/security/known-
  vulnerabilities/firefox30.html#firefox3.0.15	  Update also includes
  all packages depending on gecko-libs rebuilt against new version of
  Firefox / XULRunner.

  http://www.linuxsecurity.com/content/view/150577

* Fedora 10 Update: gnome-web-photo-0.3-23.fc10 (Nov 4)
  -----------------------------------------------------
  Update to new upstream Firefox version 3.0.15, fixing multiple
  security issues detailed in the upstream advisories:
  http://www.mozilla.org/security/known-
  vulnerabilities/firefox30.html#firefox3.0.15	  Update also includes
  all packages depending on gecko-libs rebuilt against new version of
  Firefox / XULRunner.

  http://www.linuxsecurity.com/content/view/150578

* Fedora 10 Update: google-gadgets-0.10.5-11.fc10 (Nov 4)
  -------------------------------------------------------
  Update to new upstream Firefox version 3.0.15, fixing multiple
  security issues detailed in the upstream advisories:
  http://www.mozilla.org/security/known-
  vulnerabilities/firefox30.html#firefox3.0.15	  Update also includes
  all packages depending on gecko-libs rebuilt against new version of
  Firefox / XULRunner.

  http://www.linuxsecurity.com/content/view/150579

* Fedora 10 Update: kazehakase-0.5.6-4.fc10.7 (Nov 4)
  ---------------------------------------------------
  Update to new upstream Firefox version 3.0.15, fixing multiple
  security issues detailed in the upstream advisories:
  http://www.mozilla.org/security/known-
  vulnerabilities/firefox30.html#firefox3.0.15	  Update also includes
  all packages depending on gecko-libs rebuilt against new version of
  Firefox / XULRunner.

  http://www.linuxsecurity.com/content/view/150580

* Fedora 10 Update: mozvoikko-0.9.5-15.fc10 (Nov 4)
  -------------------------------------------------
  Update to new upstream Firefox version 3.0.15, fixing multiple
  security issues detailed in the upstream advisories:
  http://www.mozilla.org/security/known-
  vulnerabilities/firefox30.html#firefox3.0.15	  Update also includes
  all packages depending on gecko-libs rebuilt against new version of
  Firefox / XULRunner.

  http://www.linuxsecurity.com/content/view/150581

* Fedora 10 Update: Miro-2.0.5-5.fc10 (Nov 4)
  -------------------------------------------
  Update to new upstream Firefox version 3.0.15, fixing multiple
  security issues detailed in the upstream advisories:
  http://www.mozilla.org/security/known-
  vulnerabilities/firefox30.html#firefox3.0.15	  Update also includes
  all packages depending on gecko-libs rebuilt against new version of
  Firefox / XULRunner.

  http://www.linuxsecurity.com/content/view/150582

* Fedora 10 Update: mugshot-1.2.2-14.fc10 (Nov 4)
  -----------------------------------------------
  Update to new upstream Firefox version 3.0.15, fixing multiple
  security issues detailed in the upstream advisories:
  http://www.mozilla.org/security/known-
  vulnerabilities/firefox30.html#firefox3.0.15	  Update also includes
  all packages depending on gecko-libs rebuilt against new version of
  Firefox / XULRunner.

  http://www.linuxsecurity.com/content/view/150583

* Fedora 10 Update: perl-Gtk2-MozEmbed-0.08-6.fc10.6 (Nov 4)
  ----------------------------------------------------------
  Update to new upstream Firefox version 3.0.15, fixing multiple
  security issues detailed in the upstream advisories:
  http://www.mozilla.org/security/known-
  vulnerabilities/firefox30.html#firefox3.0.15	  Update also includes
  all packages depending on gecko-libs rebuilt against new version of
  Firefox / XULRunner.

  http://www.linuxsecurity.com/content/view/150584

* Fedora 10 Update: pcmanx-gtk2-0.3.8-14.fc10 (Nov 4)
  ---------------------------------------------------
  Update to new upstream Firefox version 3.0.15, fixing multiple
  security issues detailed in the upstream advisories:
  http://www.mozilla.org/security/known-
  vulnerabilities/firefox30.html#firefox3.0.15	  Update also includes
  all packages depending on gecko-libs rebuilt against new version of
  Firefox / XULRunner.

  http://www.linuxsecurity.com/content/view/150585

* Fedora 10 Update: ruby-gnome2-0.19.3-3.fc10 (Nov 4)
  ---------------------------------------------------
  Update to new upstream Firefox version 3.0.15, fixing multiple
  security issues detailed in the upstream advisories:
  http://www.mozilla.org/security/known-
  vulnerabilities/firefox30.html#firefox3.0.15	  Update also includes
  all packages depending on gecko-libs rebuilt against new version of
  Firefox / XULRunner.

  http://www.linuxsecurity.com/content/view/150586

* Fedora 10 Update: xulrunner-1.9.0.15-1.fc10 (Nov 4)
  ---------------------------------------------------
  Update to new upstream Firefox version 3.0.15, fixing multiple
  security issues detailed in the upstream advisories:
  http://www.mozilla.org/security/known-
  vulnerabilities/firefox30.html#firefox3.0.15	  Update also includes
  all packages depending on gecko-libs rebuilt against new version of
  Firefox / XULRunner.

  http://www.linuxsecurity.com/content/view/150587

* Fedora 10 Update: epiphany-2.24.3-11.fc10 (Nov 4)
  -------------------------------------------------
  Update to new upstream Firefox version 3.0.15, fixing multiple
  security issues detailed in the upstream advisories:
  http://www.mozilla.org/security/known-
  vulnerabilities/firefox30.html#firefox3.0.15	  Update also includes
  all packages depending on gecko-libs rebuilt against new version of
  Firefox / XULRunner.

  http://www.linuxsecurity.com/content/view/150571

* Fedora 10 Update: evolution-rss-0.1.4-5.fc10 (Nov 4)
  ----------------------------------------------------
  Update to new upstream Firefox version 3.0.15, fixing multiple
  security issues detailed in the upstream advisories:
  http://www.mozilla.org/security/known-
  vulnerabilities/firefox30.html#firefox3.0.15	  Update also includes
  all packages depending on gecko-libs rebuilt against new version of
  Firefox / XULRunner.

  http://www.linuxsecurity.com/content/view/150572

* Fedora 10 Update: gecko-sharp2-0.13-13.fc10 (Nov 4)
  ---------------------------------------------------
  Update to new upstream Firefox version 3.0.15, fixing multiple
  security issues detailed in the upstream advisories:
  http://www.mozilla.org/security/known-
  vulnerabilities/firefox30.html#firefox3.0.15	  Update also includes
  all packages depending on gecko-libs rebuilt against new version of
  Firefox / XULRunner.

  http://www.linuxsecurity.com/content/view/150573

* Fedora 10 Update: firefox-3.0.15-1.fc10 (Nov 4)
  -----------------------------------------------
  Update to new upstream Firefox version 3.0.15, fixing multiple
  security issues detailed in the upstream advisories:
  http://www.mozilla.org/security/known-
  vulnerabilities/firefox30.html#firefox3.0.15	  Update also includes
  all packages depending on gecko-libs rebuilt against new version of
  Firefox / XULRunner.

  http://www.linuxsecurity.com/content/view/150574

* Fedora 10 Update: epiphany-extensions-2.24.3-6.fc10 (Nov 4)
  -----------------------------------------------------------
  Update to new upstream Firefox version 3.0.15, fixing multiple
  security issues detailed in the upstream advisories:
  http://www.mozilla.org/security/known-
  vulnerabilities/firefox30.html#firefox3.0.15	  Update also includes
  all packages depending on gecko-libs rebuilt against new version of
  Firefox / XULRunner.

  http://www.linuxsecurity.com/content/view/150575

* Fedora 10 Update: galeon-2.0.7-15.fc10 (Nov 4)
  ----------------------------------------------
  Update to new upstream Firefox version 3.0.15, fixing multiple
  security issues detailed in the upstream advisories:
  http://www.mozilla.org/security/known-
  vulnerabilities/firefox30.html#firefox3.0.15	  Update also includes
  all packages depending on gecko-libs rebuilt against new version of
  Firefox / XULRunner.

  http://www.linuxsecurity.com/content/view/150576

------------------------------------------------------------------------

* Mandriva: Subject: [Security Announce] [ MDVSA-2009:293 ] squidGuard (Nov 3)
  ----------------------------------------------------------------------------
  Multiple vulnerabilities has been found and corrected in squidGuard:
  Buffer overflow in sgLog.c in squidGuard 1.3 and 1.4 allows remote
  attackers to cause a denial of service (application hang or loss of
  blocking functionality) via a long URL with many / (slash)
  characters, related to emergency mode. (CVE-2009-3700). Multiple
  buffer overflows in squidGuard 1.4 allow remote attackers to bypass
  intended URL blocking via a long URL, related to (1) the relationship
  between a certain buffer size in squidGuard and a certain buffer size
  in Squid and (2) a redirect URL that contains information about the
  originally requested URL (CVE-2009-3826). squidGuard was upgraded to
  1.2.1 for MNF2/CS3/CS4 with additional upstream security and bug
  fixes patches applied. This update fixes these vulnerabilities.

  http://www.linuxsecurity.com/content/view/150554

* Mandriva: Subject: [Security Announce] [ MDVSA-2009:292 ] wireshark (Nov 3)
  ---------------------------------------------------------------------------
  Vulnerabilities have been discovered and corrected in wireshark,
  affecting DCERPC/NT dissector, which allows remote attackers to cause
  a denial of service (NULL pointer dereference and application crash)
  via a file that records a malformed packet trace (CVE-2009-3550); and
  in wiretap/erf.c which allows remote attackers to execute arbitrary
  code or cause a denial of service (application crash) via a crafted
  erf file (CVE-2009-3829). The wireshark package has been updated to
  fix these vulnerabilities.

  http://www.linuxsecurity.com/content/view/150553

* Mandriva: Subject: [Security Announce] [ MDVSA-2009:291 ] jetty5 (Oct 29)
  -------------------------------------------------------------------------
  A vulnerability has been identified and corrected in jetty5:
  Directory traversal vulnerability in the HTTP server in Mort Bay
  Jetty before 6.1.17, and 7.0.0.M2 and earlier 7.x versions, allows
  remote attackers to access arbitrary files via directory traversal
  sequences in the URI (CVE-2009-1523). This update fixes this
  vulnerability.

  http://www.linuxsecurity.com/content/view/150534

* Mandriva: Subject: [Security Announce] [ MDVSA-2009:290 ] firefox (Oct 29)
  --------------------------------------------------------------------------
  Security issues were identified and fixed in firefox 3.0.x: Security
  researcher Alin Rad Pop of Secunia Research reported a heap-based
  buffer overflow in Mozilla's string to floating point number
  conversion routines. Using this vulnerability an attacker could craft
  some malicious JavaScript code containing a very long string to be
  converted to a floating point number which would result in improper
  memory allocation and the execution of an arbitrary memory location.
  This vulnerability could thus be leveraged by the attacker to run
  arbitrary code on a victim's computer (CVE-2009-1563). Security
  researcher Jeremy Brown reported that the file naming scheme used for
  downloading a file which already exists in the downloads folder is
  predictable. If an attacker had local access to a victim's computer

  http://www.linuxsecurity.com/content/view/150531

------------------------------------------------------------------------

* RedHat: Important: kernel security and bug fix update (Nov 3)
  -------------------------------------------------------------
  Updated kernel packages that fix several security issues and multiple
  bugs are now available for Red Hat Enterprise Linux 3. This update
  has been rated as having important security impact by the Red Hat
  Security Response Team.

  http://www.linuxsecurity.com/content/view/150559

* RedHat: Important: kernel security update (Nov 3)
  -------------------------------------------------
  Updated kernel packages that fix security issues are now available
  for Red Hat Enterprise Linux 4. This update has been rated as having
  important security impact by the Red Hat Security Response Team.

  http://www.linuxsecurity.com/content/view/150556

* RedHat: Important: kernel security and bug fix update (Nov 3)
  -------------------------------------------------------------
  Updated kernel packages that fix multiple security issues and several
  bugs are now available for Red Hat Enterprise Linux 5. This update
  has been rated as having important security impact by the Red Hat
  Security Response Team.

  http://www.linuxsecurity.com/content/view/150557

* RedHat: Moderate: wget security update (Nov 3)
  ----------------------------------------------
  An updated wget package that fixes a security issue is now available
  for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated
  as having moderate security impact by the Red Hat Security Response
  Team.

  http://www.linuxsecurity.com/content/view/150558

* RedHat: Important: kernel-rt security, bug fix, (Nov 3)
  -------------------------------------------------------
  Updated kernel-rt packages that fix several security issues, multiple
  bugs, and add enhancements are now available for Red Hat Enterprise
  MRG 1.1. This update has been rated as having important security
  impact by the Red Hat Security Response Team.

  http://www.linuxsecurity.com/content/view/150555

* RedHat: Moderate: pidgin security update (Oct 29)
  -------------------------------------------------
  An updated pidgin package that fixes several security issues is now
  available for Red Hat Enterprise Linux 3. This update has been rated
  as having moderate security impact by the Red Hat Security Response
  Team.

  http://www.linuxsecurity.com/content/view/150529

* RedHat: Moderate: pidgin security update (Oct 29)
  -------------------------------------------------
  Updated pidgin packages that fix a security issue are now available
  for Red Hat Enterprise Linux 4 and 5. This update has been rated as
  having moderate security impact by the Red Hat Security Response
  Team.

  http://www.linuxsecurity.com/content/view/150530

------------------------------------------------------------------------

* Slackware:   mozilla-firefox (Nov 2)
  ------------------------------------
  New mozilla-firefox packages are available for Slackware 12.2, 13.0,
  and -current to fix security issues. The Firefox 3.0.15 package may
  also be used with Slackware 11.0 or newer.

  More details about the issues may be found on the Mozilla website:
  http://www.mozilla.org/security/known-vulnerabilities/firefox30.html
   http://www.mozilla.org/security/known-vulnerabilities/firefox35.html

  http://www.linuxsecurity.com/content/view/150548

* Slackware:   poppler (Oct 29)
  -----------------------------
  New poppler packages are available for Slackware 12.0, 12.1, 12.2,
  13.0, and -current to fix security issues. More details about this
  issue may be found in the Common Vulnerabilities and Exposures (CVE)
  database:
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3603
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3604
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3605
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3606
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3608
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3609

  http://www.linuxsecurity.com/content/view/150527

* Slackware:   xpdf (Oct 29)
  --------------------------
  New xpdf packages are available for Slackware 9.1, 10.0, 10.1, 10.2,
  11.0, 12.0, 12.1, 12.2, 13.0, and -current to fix security issues.
  More details about the issues may be found in the Common
  Vulnerabilities and Exposures (CVE) database:
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3603
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3604
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3605
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3606
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3608
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3609

  http://www.linuxsecurity.com/content/view/150526

------------------------------------------------------------------------

* SuSE: IBM Java 6 (SUSE-SA:2009:053) (Nov 4)
  -------------------------------------------


  http://www.linuxsecurity.com/content/view/150595

* SuSE: Mozilla Firefox (SUSE-SA:2009:052) (Nov 4)
  ------------------------------------------------


  http://www.linuxsecurity.com/content/view/150594

* SuSE: Linux kernel (SUSE-SA:2009:051) (Nov 2)
  ---------------------------------------------


  http://www.linuxsecurity.com/content/view/150546

------------------------------------------------------------------------

* Ubuntu:  poppler vulnerabilities (Nov 2)
  ----------------------------------------
  USN-850-1 fixed vulnerabilities in poppler. This update provides the
  corresponding updates for Ubuntu 9.10. Original advisory details:  It
  was discovered that poppler contained multiple security issues when
  parsing malformed PDF documents. If a user or automated system were
  tricked  into opening a crafted PDF file, an attacker could cause a
  denial of  service or execute arbitrary code with privileges of the
  user invoking the  program.

  http://www.linuxsecurity.com/content/view/150547

------------------------------------------------------------------------

* Pardus: [UPDATED] Gd: Integer Overflow (Nov 3)
  ----------------------------------------------
  [UPDATE] Same issue was fixed in Pardus 2008, please update your
  system.

  http://www.linuxsecurity.com/content/view/150549

* Pardus: [UPDATED] Perl-HTML-Parser: (Oct 30)
  --------------------------------------------
  A vulnerability has been found in Perl HTML-Parser module which
  causes denial of service (infinite loop) via crafted input.

  http://www.linuxsecurity.com/content/view/150536

------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc.                LinuxSecurity.com

     To unsubscribe email vuln-newsletter-request_at_private
         with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------


________________________________________ 
Did a friend send you this? From now on, be the 
first to find out! Subscribe to InfoSec News 
http://www.infosecnews.org
Received on Sun Nov 08 2009 - 22:42:36 PST

This archive was generated by hypermail 2.2.0 : Sun Nov 08 2009 - 22:52:13 PST