From bugzilla at redhat.com Thu Nov 1 13:31:32 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 1 Nov 2007 09:31:32 -0400 Subject: [RHSA-2007:0939-01] Important: kernel security update Message-ID: <200711011331.lA1DVW91017086@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: kernel security update Advisory ID: RHSA-2007:0939-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0939.html Issue date: 2007-11-01 Updated on: 2007-11-01 Product: Red Hat Enterprise Linux CVE Names: CVE-2006-6921 CVE-2007-2878 CVE-2007-3105 CVE-2007-3739 CVE-2007-3740 CVE-2007-3843 CVE-2007-3848 CVE-2007-4308 CVE-2007-4571 - --------------------------------------------------------------------- 1. Summary: Updated kernel packages that fix various security issues in the Red Hat Enterprise Linux 4 kernel are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, noarch, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, noarch, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, noarch, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, noarch, x86_64 3. Problem description: The Linux kernel is the core of the operating system. These updated kernel packages contain fixes for the following security issues: * A flaw was found in the handling of process death signals. This allowed a local user to send arbitrary signals to the suid-process executed by that user. A successful exploitation of this flaw depends on the structure of the suid-program and its signal handling. (CVE-2007-3848, Important) * A flaw was found in the CIFS file system. This could cause the umask values of a process to not be honored on CIFS file systems where UNIX extensions are supported. (CVE-2007-3740, Important) * A flaw was found in the VFAT compat ioctl handling on 64-bit systems. This allowed a local user to corrupt a kernel_dirent struct and cause a denial of service. (CVE-2007-2878, Important) * A flaw was found in the Advanced Linux Sound Architecture (ALSA). A local user who had the ability to read the /proc/driver/snd-page-alloc file could see portions of kernel memory. (CVE-2007-4571, Moderate) * A flaw was found in the aacraid SCSI driver. This allowed a local user to make ioctl calls to the driver that should be restricted to privileged users. (CVE-2007-4308, Moderate) * A flaw was found in the stack expansion when using the hugetlb kernel on PowerPC systems. This allowed a local user to cause a denial of service. (CVE-2007-3739, Moderate) * A flaw was found in the handling of zombie processes. A local user could create processes that would not be properly reaped which could lead to a denial of service. (CVE-2006-6921, Moderate) * A flaw was found in the CIFS file system handling. The mount option "sec=" did not enable integrity checking or produce an error message if used. (CVE-2007-3843, Low) * A flaw was found in the random number generator implementation that allowed a local user to cause a denial of service or possibly gain privileges. This flaw could be exploited if the root user raised the default wakeup threshold over the size of the output pool. (CVE-2007-3105, Low) Additionally, the following bugs were fixed: * A flaw was found in the kernel netpoll code, creating a potential deadlock condition. If the xmit_lock for a given network interface is held, and a subsequent netpoll event is generated from within the lock owning context (a console message for example), deadlock on that cpu will result, because the netpoll code will attempt to re-acquire the xmit_lock. The fix is to, in the netpoll code, only attempt to take the lock, and fail if it is already acquired (rather than block on it), and queue the message to be sent for later delivery. Any user of netpoll code in the kernel (netdump or netconsole services), is exposed to this problem, and should resolve the issue by upgrading to this kernel release immediately. * A flaw was found where, under 64-bit mode (x86_64), AMD processors were not able to address greater than a 40-bit physical address space; and Intel processors were only able to address up to a 36-bit physical address space. The fix is to increase the physical addressing for an AMD processor to 48 bits, and an Intel processor to 38 bits. Please see the Red Hat Knowledgebase for more detailed information. * A flaw was found in the xenU kernel that may prevent a paravirtualized guest with more than one CPU from starting when running under an Enterprise Linux 5.1 hypervisor. The fix is to allow your Enterprise Linux 4 Xen SMP guests to boot under a 5.1 hypervisor. Please see the Red Hat Knowledgebase for more detailed information. Red Hat Enterprise Linux 4 users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 247726 - CVE-2007-2878 VFAT compat ioctls DoS on 64-bit 248126 - autofs problem with symbolic links 248325 - CVE-2007-3105 Bound check ordering issue in random driver 250972 - CVE-2007-3848 Privilege escalation via PR_SET_PDEATHSIG 252309 - CVE-2007-4308 Missing ioctl() permission checks in aacraid driver 275881 - CVE-2007-3740 CIFS should honor umask 275901 - CVE-2007-3843 CIFS signing sec= mount options don't work correctly 282351 - [PATCH] Fix memory leak of dma_alloc_coherent() on x86_64 288961 - CVE-2007-4571 ALSA memory disclosure flaw 294941 - CVE-2007-3739 LTC36188-Don't allow the stack to grow into hugetlb reserved regions 302921 - CVE-2006-6921 denial of service with wedged processes 320791 - EL4.5: Improperly flushed TLBs may lead to Machine check errors 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/kernel-2.6.9-55.0.12.EL.src.rpm 05de745759b5c8a22ca6b5e3ca43d9c1 kernel-2.6.9-55.0.12.EL.src.rpm i386: e4502cfa841859482a9e656a00dfa378 kernel-2.6.9-55.0.12.EL.i686.rpm 265629a984fdf2e1ce7839ce56a66d0e kernel-debuginfo-2.6.9-55.0.12.EL.i686.rpm 4c8f00e190b9776a76c9166fae07f4d3 kernel-devel-2.6.9-55.0.12.EL.i686.rpm 3415929d9860d0ce93a62e3bed2a1c4e kernel-hugemem-2.6.9-55.0.12.EL.i686.rpm affd7729217f9d7e2cc4b67b8aaa3e0c kernel-hugemem-devel-2.6.9-55.0.12.EL.i686.rpm e1d8a0aa1c0fc1a7320a5cddae9d4b00 kernel-smp-2.6.9-55.0.12.EL.i686.rpm 31855f5d50144c07ac1d9b33ee4b83c4 kernel-smp-devel-2.6.9-55.0.12.EL.i686.rpm 86ba089d0c80db2a3e0be5b780628bb1 kernel-xenU-2.6.9-55.0.12.EL.i686.rpm 9083f2e35e2c34c6750f6d0415641b23 kernel-xenU-devel-2.6.9-55.0.12.EL.i686.rpm ia64: 5b0f989940a5674f891afca5c01908a6 kernel-2.6.9-55.0.12.EL.ia64.rpm 1a270633d11ea644a36b11d710239d1d kernel-debuginfo-2.6.9-55.0.12.EL.ia64.rpm 8758ee9e4b451c34122d5988b9e43a40 kernel-devel-2.6.9-55.0.12.EL.ia64.rpm fbc45681c832a80c66dfe7716d76d0af kernel-largesmp-2.6.9-55.0.12.EL.ia64.rpm 8daedec74af48be4e0a1a783533a3107 kernel-largesmp-devel-2.6.9-55.0.12.EL.ia64.rpm noarch: 01a3c553a08e89baebbdf5b1f511279c kernel-doc-2.6.9-55.0.12.EL.noarch.rpm ppc: 54843a74a5870f93d67cc67363426524 kernel-2.6.9-55.0.12.EL.ppc64.rpm d518efa6e99b1d20efec593cab333c91 kernel-2.6.9-55.0.12.EL.ppc64iseries.rpm d148cbdb91d2744a01a5428d145a7c69 kernel-debuginfo-2.6.9-55.0.12.EL.ppc64.rpm 3840facd65c5d75a69a6ad6f241138f9 kernel-debuginfo-2.6.9-55.0.12.EL.ppc64iseries.rpm 2ce87d2e205bcba663afc222b9506c1c kernel-devel-2.6.9-55.0.12.EL.ppc64.rpm e2710ec08d15547dc24c1ed9d287f04d kernel-devel-2.6.9-55.0.12.EL.ppc64iseries.rpm cf26e13843a00f1c85b70444cf5f9c1b kernel-largesmp-2.6.9-55.0.12.EL.ppc64.rpm 1e1258a0c4f4ae4f17b385f7916e0b2f kernel-largesmp-devel-2.6.9-55.0.12.EL.ppc64.rpm s390: 313162103b8a455a3d83db5ea9b4c84f kernel-2.6.9-55.0.12.EL.s390.rpm bf5c132eb2f9cc56e429d13a29a8e524 kernel-debuginfo-2.6.9-55.0.12.EL.s390.rpm 27305956f172c034301649f12bd7c6c8 kernel-devel-2.6.9-55.0.12.EL.s390.rpm s390x: cdef1657e7a0e86b00700374c3c76242 kernel-2.6.9-55.0.12.EL.s390x.rpm 319e563576da0b695b348927c503740e kernel-debuginfo-2.6.9-55.0.12.EL.s390x.rpm e3b4ae4f46b2cdd8c94d296b85a54330 kernel-devel-2.6.9-55.0.12.EL.s390x.rpm x86_64: ca11df7a9e610c5ad9bac211f002677e kernel-2.6.9-55.0.12.EL.x86_64.rpm 76fea225ad7e2f050effcfb929ee130c kernel-debuginfo-2.6.9-55.0.12.EL.x86_64.rpm 907f67f0036f60e010b77eef5712c534 kernel-devel-2.6.9-55.0.12.EL.x86_64.rpm faeb64ba6233c9f076d2e56ffc25a70a kernel-largesmp-2.6.9-55.0.12.EL.x86_64.rpm 3bc2b6e31638997ef62ce46163d63631 kernel-largesmp-devel-2.6.9-55.0.12.EL.x86_64.rpm 52b44370c80747d3635d3f08843ddb69 kernel-smp-2.6.9-55.0.12.EL.x86_64.rpm a619ed2995512e918c9452311b38b25c kernel-smp-devel-2.6.9-55.0.12.EL.x86_64.rpm 3e61075647e1d82e91933b191d68d04b kernel-xenU-2.6.9-55.0.12.EL.x86_64.rpm 4694b9d4f08f0950a8c87f60cdac749a kernel-xenU-devel-2.6.9-55.0.12.EL.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/kernel-2.6.9-55.0.12.EL.src.rpm 05de745759b5c8a22ca6b5e3ca43d9c1 kernel-2.6.9-55.0.12.EL.src.rpm i386: e4502cfa841859482a9e656a00dfa378 kernel-2.6.9-55.0.12.EL.i686.rpm 265629a984fdf2e1ce7839ce56a66d0e kernel-debuginfo-2.6.9-55.0.12.EL.i686.rpm 4c8f00e190b9776a76c9166fae07f4d3 kernel-devel-2.6.9-55.0.12.EL.i686.rpm 3415929d9860d0ce93a62e3bed2a1c4e kernel-hugemem-2.6.9-55.0.12.EL.i686.rpm affd7729217f9d7e2cc4b67b8aaa3e0c kernel-hugemem-devel-2.6.9-55.0.12.EL.i686.rpm e1d8a0aa1c0fc1a7320a5cddae9d4b00 kernel-smp-2.6.9-55.0.12.EL.i686.rpm 31855f5d50144c07ac1d9b33ee4b83c4 kernel-smp-devel-2.6.9-55.0.12.EL.i686.rpm 86ba089d0c80db2a3e0be5b780628bb1 kernel-xenU-2.6.9-55.0.12.EL.i686.rpm 9083f2e35e2c34c6750f6d0415641b23 kernel-xenU-devel-2.6.9-55.0.12.EL.i686.rpm noarch: 01a3c553a08e89baebbdf5b1f511279c kernel-doc-2.6.9-55.0.12.EL.noarch.rpm x86_64: ca11df7a9e610c5ad9bac211f002677e kernel-2.6.9-55.0.12.EL.x86_64.rpm 76fea225ad7e2f050effcfb929ee130c kernel-debuginfo-2.6.9-55.0.12.EL.x86_64.rpm 907f67f0036f60e010b77eef5712c534 kernel-devel-2.6.9-55.0.12.EL.x86_64.rpm faeb64ba6233c9f076d2e56ffc25a70a kernel-largesmp-2.6.9-55.0.12.EL.x86_64.rpm 3bc2b6e31638997ef62ce46163d63631 kernel-largesmp-devel-2.6.9-55.0.12.EL.x86_64.rpm 52b44370c80747d3635d3f08843ddb69 kernel-smp-2.6.9-55.0.12.EL.x86_64.rpm a619ed2995512e918c9452311b38b25c kernel-smp-devel-2.6.9-55.0.12.EL.x86_64.rpm 3e61075647e1d82e91933b191d68d04b kernel-xenU-2.6.9-55.0.12.EL.x86_64.rpm 4694b9d4f08f0950a8c87f60cdac749a kernel-xenU-devel-2.6.9-55.0.12.EL.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/kernel-2.6.9-55.0.12.EL.src.rpm 05de745759b5c8a22ca6b5e3ca43d9c1 kernel-2.6.9-55.0.12.EL.src.rpm i386: e4502cfa841859482a9e656a00dfa378 kernel-2.6.9-55.0.12.EL.i686.rpm 265629a984fdf2e1ce7839ce56a66d0e kernel-debuginfo-2.6.9-55.0.12.EL.i686.rpm 4c8f00e190b9776a76c9166fae07f4d3 kernel-devel-2.6.9-55.0.12.EL.i686.rpm 3415929d9860d0ce93a62e3bed2a1c4e kernel-hugemem-2.6.9-55.0.12.EL.i686.rpm affd7729217f9d7e2cc4b67b8aaa3e0c kernel-hugemem-devel-2.6.9-55.0.12.EL.i686.rpm e1d8a0aa1c0fc1a7320a5cddae9d4b00 kernel-smp-2.6.9-55.0.12.EL.i686.rpm 31855f5d50144c07ac1d9b33ee4b83c4 kernel-smp-devel-2.6.9-55.0.12.EL.i686.rpm 86ba089d0c80db2a3e0be5b780628bb1 kernel-xenU-2.6.9-55.0.12.EL.i686.rpm 9083f2e35e2c34c6750f6d0415641b23 kernel-xenU-devel-2.6.9-55.0.12.EL.i686.rpm ia64: 5b0f989940a5674f891afca5c01908a6 kernel-2.6.9-55.0.12.EL.ia64.rpm 1a270633d11ea644a36b11d710239d1d kernel-debuginfo-2.6.9-55.0.12.EL.ia64.rpm 8758ee9e4b451c34122d5988b9e43a40 kernel-devel-2.6.9-55.0.12.EL.ia64.rpm fbc45681c832a80c66dfe7716d76d0af kernel-largesmp-2.6.9-55.0.12.EL.ia64.rpm 8daedec74af48be4e0a1a783533a3107 kernel-largesmp-devel-2.6.9-55.0.12.EL.ia64.rpm noarch: 01a3c553a08e89baebbdf5b1f511279c kernel-doc-2.6.9-55.0.12.EL.noarch.rpm x86_64: ca11df7a9e610c5ad9bac211f002677e kernel-2.6.9-55.0.12.EL.x86_64.rpm 76fea225ad7e2f050effcfb929ee130c kernel-debuginfo-2.6.9-55.0.12.EL.x86_64.rpm 907f67f0036f60e010b77eef5712c534 kernel-devel-2.6.9-55.0.12.EL.x86_64.rpm faeb64ba6233c9f076d2e56ffc25a70a kernel-largesmp-2.6.9-55.0.12.EL.x86_64.rpm 3bc2b6e31638997ef62ce46163d63631 kernel-largesmp-devel-2.6.9-55.0.12.EL.x86_64.rpm 52b44370c80747d3635d3f08843ddb69 kernel-smp-2.6.9-55.0.12.EL.x86_64.rpm a619ed2995512e918c9452311b38b25c kernel-smp-devel-2.6.9-55.0.12.EL.x86_64.rpm 3e61075647e1d82e91933b191d68d04b kernel-xenU-2.6.9-55.0.12.EL.x86_64.rpm 4694b9d4f08f0950a8c87f60cdac749a kernel-xenU-devel-2.6.9-55.0.12.EL.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/kernel-2.6.9-55.0.12.EL.src.rpm 05de745759b5c8a22ca6b5e3ca43d9c1 kernel-2.6.9-55.0.12.EL.src.rpm i386: e4502cfa841859482a9e656a00dfa378 kernel-2.6.9-55.0.12.EL.i686.rpm 265629a984fdf2e1ce7839ce56a66d0e kernel-debuginfo-2.6.9-55.0.12.EL.i686.rpm 4c8f00e190b9776a76c9166fae07f4d3 kernel-devel-2.6.9-55.0.12.EL.i686.rpm 3415929d9860d0ce93a62e3bed2a1c4e kernel-hugemem-2.6.9-55.0.12.EL.i686.rpm affd7729217f9d7e2cc4b67b8aaa3e0c kernel-hugemem-devel-2.6.9-55.0.12.EL.i686.rpm e1d8a0aa1c0fc1a7320a5cddae9d4b00 kernel-smp-2.6.9-55.0.12.EL.i686.rpm 31855f5d50144c07ac1d9b33ee4b83c4 kernel-smp-devel-2.6.9-55.0.12.EL.i686.rpm 86ba089d0c80db2a3e0be5b780628bb1 kernel-xenU-2.6.9-55.0.12.EL.i686.rpm 9083f2e35e2c34c6750f6d0415641b23 kernel-xenU-devel-2.6.9-55.0.12.EL.i686.rpm ia64: 5b0f989940a5674f891afca5c01908a6 kernel-2.6.9-55.0.12.EL.ia64.rpm 1a270633d11ea644a36b11d710239d1d kernel-debuginfo-2.6.9-55.0.12.EL.ia64.rpm 8758ee9e4b451c34122d5988b9e43a40 kernel-devel-2.6.9-55.0.12.EL.ia64.rpm fbc45681c832a80c66dfe7716d76d0af kernel-largesmp-2.6.9-55.0.12.EL.ia64.rpm 8daedec74af48be4e0a1a783533a3107 kernel-largesmp-devel-2.6.9-55.0.12.EL.ia64.rpm noarch: 01a3c553a08e89baebbdf5b1f511279c kernel-doc-2.6.9-55.0.12.EL.noarch.rpm x86_64: ca11df7a9e610c5ad9bac211f002677e kernel-2.6.9-55.0.12.EL.x86_64.rpm 76fea225ad7e2f050effcfb929ee130c kernel-debuginfo-2.6.9-55.0.12.EL.x86_64.rpm 907f67f0036f60e010b77eef5712c534 kernel-devel-2.6.9-55.0.12.EL.x86_64.rpm faeb64ba6233c9f076d2e56ffc25a70a kernel-largesmp-2.6.9-55.0.12.EL.x86_64.rpm 3bc2b6e31638997ef62ce46163d63631 kernel-largesmp-devel-2.6.9-55.0.12.EL.x86_64.rpm 52b44370c80747d3635d3f08843ddb69 kernel-smp-2.6.9-55.0.12.EL.x86_64.rpm a619ed2995512e918c9452311b38b25c kernel-smp-devel-2.6.9-55.0.12.EL.x86_64.rpm 3e61075647e1d82e91933b191d68d04b kernel-xenU-2.6.9-55.0.12.EL.x86_64.rpm 4694b9d4f08f0950a8c87f60cdac749a kernel-xenU-devel-2.6.9-55.0.12.EL.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6921 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2878 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3105 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3739 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3740 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3843 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3848 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4308 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4571 http://kbase.redhat.com/ http://kbase.redhat.com/faq/FAQ_42_11697.shtm http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHKdUuXlSAg2UNWIIRAqoUAJ4sCHtQHk4qjSj7gJkwgru6etux1QCgqjV/ y9a4B2a/IhsEAyiygn+2sm4= =aaBQ -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Nov 5 15:20:20 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 5 Nov 2007 10:20:20 -0500 Subject: [RHSA-2007:0950-01] Moderate: JBoss Enterprise Application Platform security update Message-ID: <200711051520.lA5FKKZ6031260@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: JBoss Enterprise Application Platform security update Advisory ID: RHSA-2007:0950-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0950.html Issue date: 2007-11-05 Updated on: 2007-11-05 Product: Red Hat Application Stack CVE Names: CVE-2007-3382 CVE-2007-3385 - --------------------------------------------------------------------- 1. Summary: Updated JBoss Enterprise Application Platform packages that fix several security issues and bugs are now available for Red Hat Application Stack v1 and v2. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Application Stack v1 for Enterprise Linux AS (v.4) - noarch Red Hat Application Stack v1 for Enterprise Linux ES (v.4) - noarch Red Hat Application Stack v2 for Enterprise Linux (v.5) - noarch 3. Problem description: The updated packages address the following security vulnerabilities: Tomcat incorrectly treated a single quote character (') in a cookie value as a delimiter. In some circumstances this lead to the leaking of information such as session ID to an attacker (CVE-2007-3382). Tomcat incorrectly handled the character sequence \" in a cookie value. In some circumstances this lead to the leaking of information such as session ID to an attacker (CVE-2007-3385). In addition to these security fixes, this update also fixes several bugs in JBoss Enterprise Application Platform. Please see the referenced release notes for the list of bugs fixed. Users of JBoss Enterprise Application Platform should upgrade to these updated packages which contain fixes to correct these issues. For users of Red Hat Application Stack v1, installation of this errata will automatically bring the system up to V.1.2. Please note the following changes that may affect you: - - Stacks V.1.2 has a new version of JBoss Application Server which requires Java version 1.5 to run. - - Unless the JBOSS_IP variable is explicitly set in the configuration file, JBoss Application Server services are now bound to localhost. - - Unless the JBOSSCONF variable is explicitly set in the configuration file, JBoss Application Server will start with the production config when started via the init script. Refer to the release notes for more information on how to set the JBOSS_IP and JBOSSCONF variables. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 247972 - CVE-2007-3382 tomcat handling of cookies 247976 - CVE-2007-3385 tomcat handling of cookie values 6. RPMs required: Red Hat Application Stack v1 for Enterprise Linux AS (v.4): SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/RHWAS/SRPMS/berkeleydb-2.0.90-1jpp.ep1.1.src.rpm 3e6d36d2288f3119b14d0e3dd25599c9 berkeleydb-2.0.90-1jpp.ep1.1.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/RHWAS/SRPMS/hibernate3-annotations-3.2.1-1.patch01.1jpp.ep1.2.src.rpm c45bea49f9a9460400a2da68565b49cb hibernate3-annotations-3.2.1-1.patch01.1jpp.ep1.2.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/RHWAS/SRPMS/hibernate3-ejb-persistence-3.0-api-3.2.1-1jpp.ep1.1.src.rpm 3e32c2ce08a2f07dd027ff86446af6d8 hibernate3-ejb-persistence-3.0-api-3.2.1-1jpp.ep1.1.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/RHWAS/SRPMS/hibernate3-entitymanager-3.2.1-1jpp.ep1.5.src.rpm 3b350d7de3b713a06221d2edb18abbc4 hibernate3-entitymanager-3.2.1-1jpp.ep1.5.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/RHWAS/SRPMS/jacorb-2.3.0-1jpp.ep1.1.src.rpm ff1beb2147c7a5aad8e64de2b83ba0aa jacorb-2.3.0-1jpp.ep1.1.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/RHWAS/SRPMS/jboss-aop-1.5.5-0jpp.ep1.2.1.src.rpm 15e5b40fbc9f3e41dbf0b74cdf7b0017 jboss-aop-1.5.5-0jpp.ep1.2.1.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/RHWAS/SRPMS/jboss-cache-1.4.1-1.SP3.1jpp.ep1.1.src.rpm c638e8e39f4524bfddbf07c914024c0b jboss-cache-1.4.1-1.SP3.1jpp.ep1.1.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/RHWAS/SRPMS/jboss-remoting-2.2.2-1jpp.ep1.4.src.rpm d56036f4b74525ae351030f4c1a8eb9a jboss-remoting-2.2.2-1jpp.ep1.4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/RHWAS/SRPMS/jboss-seam-1.2.1-1.ep1.2.src.rpm 0c5d62cc1e37bb8dd47b2e17b96b7149 jboss-seam-1.2.1-1.ep1.2.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/RHWAS/SRPMS/jboss-serialization-1.0.3-1jpp.ep1.3.src.rpm 862809bc4e78e5a8777c0c31fcd3a555 jboss-serialization-1.0.3-1jpp.ep1.3.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/RHWAS/SRPMS/jbossas-4.2.0-2.CP01.ep1.4.src.rpm d137454d4f562778a0cfd9475ed3bbf0 jbossas-4.2.0-2.CP01.ep1.4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/RHWAS/SRPMS/jbossweb-2.0.0-2.CP01.0jpp.ep1.4.src.rpm cba7829b13f79de64b4cbd0422acbaa2 jbossweb-2.0.0-2.CP01.0jpp.ep1.4.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/RHWAS/SRPMS/jbossxb-1.0.0-1.CP01.0jpp.ep1.1.src.rpm 16a51b52b0d53b65d474c1c104c125e9 jbossxb-1.0.0-1.CP01.0jpp.ep1.1.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/RHWAS/SRPMS/jcommon-0.9.7-1jpp.el4ep1.1.src.rpm 92c34a206cecaf59e62d7a3eb38fdc1f jcommon-0.9.7-1jpp.el4ep1.1.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/RHWAS/SRPMS/jfreechart-0.9.21-2jpp.el4ep1.1.src.rpm d474fd5e30d873738eec028c88164bab jfreechart-0.9.21-2jpp.el4ep1.1.src.rpm ftp://updates.redhat.com/enterprise/4AS/en/RHWAS/SRPMS/rh-eap-docs-4.2.0-2.CP01.ep1.2.src.rpm 723a3f1afb218740be1f5d782e80cc25 rh-eap-docs-4.2.0-2.CP01.ep1.2.src.rpm noarch: 9603b96542df9e138e252ee5a701aed4 berkeleydb-2.0.90-1jpp.ep1.1.noarch.rpm 379f1308aa47160a341c35e9bf45aa65 hibernate3-annotations-3.2.1-1.patch01.1jpp.ep1.2.noarch.rpm 5e39db41c091e098c95edd53c94d3c2d hibernate3-annotations-javadoc-3.2.1-1.patch01.1jpp.ep1.2.noarch.rpm 53896bfbb3bb3f874e160e237b30e2ca hibernate3-ejb-persistence-3.0-api-3.2.1-1jpp.ep1.1.noarch.rpm c54b366b96e62fee6ea225d802c0e3d2 hibernate3-ejb-persistence-3.0-api-javadoc-3.2.1-1jpp.ep1.1.noarch.rpm 8635620bce0bef87a8256ec82577f804 hibernate3-entitymanager-3.2.1-1jpp.ep1.5.noarch.rpm 11076de6fc94fe5fc92ededfa22b46a6 hibernate3-entitymanager-javadoc-3.2.1-1jpp.ep1.5.noarch.rpm 05b568ffc52cefb9abad01678b8cd7ef jacorb-2.3.0-1jpp.ep1.1.noarch.rpm 75f791f3a359dac015d7159e1fdee9ce jboss-aop-1.5.5-0jpp.ep1.2.1.noarch.rpm dc933213e3041cbe05a61685913b234b jboss-cache-1.4.1-1.SP3.1jpp.ep1.1.noarch.rpm 30d63ec755235f595dd4fc8207926fa7 jboss-remoting-2.2.2-1jpp.ep1.4.noarch.rpm 63b040353b821f8cbc5ccd186cd4d792 jboss-seam-1.2.1-1.ep1.2.noarch.rpm 5543500f72d98d57105e45e33f227fea jboss-seam-docs-1.2.1-1.ep1.2.noarch.rpm 6b3266b5951ed27bedf610e47c619bb1 jboss-serialization-1.0.3-1jpp.ep1.3.noarch.rpm 672f485649dcfbb7a2720939a946893b jbossas-4.2.0-2.CP01.ep1.4.noarch.rpm fb3cc11b0a1719c625820d63c3eb0d5d jbossweb-2.0.0-2.CP01.0jpp.ep1.4.noarch.rpm 3a03da161c9148892c706332f97cc53d jbossxb-1.0.0-1.CP01.0jpp.ep1.1.noarch.rpm ec2d3af5e0a2dbc092e334444d31f2f4 jcommon-0.9.7-1jpp.el4ep1.1.noarch.rpm e064470349b6cc22b1ce1a5bb0b91034 jfreechart-0.9.21-2jpp.el4ep1.1.noarch.rpm 18e8c6084efaa0be97865e3f97b13db2 rh-eap-docs-4.2.0-2.CP01.ep1.2.noarch.rpm Red Hat Application Stack v1 for Enterprise Linux ES (v.4): SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/RHWAS/SRPMS/berkeleydb-2.0.90-1jpp.ep1.1.src.rpm 3e6d36d2288f3119b14d0e3dd25599c9 berkeleydb-2.0.90-1jpp.ep1.1.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/RHWAS/SRPMS/hibernate3-annotations-3.2.1-1.patch01.1jpp.ep1.2.src.rpm c45bea49f9a9460400a2da68565b49cb hibernate3-annotations-3.2.1-1.patch01.1jpp.ep1.2.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/RHWAS/SRPMS/hibernate3-ejb-persistence-3.0-api-3.2.1-1jpp.ep1.1.src.rpm 3e32c2ce08a2f07dd027ff86446af6d8 hibernate3-ejb-persistence-3.0-api-3.2.1-1jpp.ep1.1.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/RHWAS/SRPMS/hibernate3-entitymanager-3.2.1-1jpp.ep1.5.src.rpm 3b350d7de3b713a06221d2edb18abbc4 hibernate3-entitymanager-3.2.1-1jpp.ep1.5.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/RHWAS/SRPMS/jacorb-2.3.0-1jpp.ep1.1.src.rpm ff1beb2147c7a5aad8e64de2b83ba0aa jacorb-2.3.0-1jpp.ep1.1.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/RHWAS/SRPMS/jboss-aop-1.5.5-0jpp.ep1.2.1.src.rpm 15e5b40fbc9f3e41dbf0b74cdf7b0017 jboss-aop-1.5.5-0jpp.ep1.2.1.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/RHWAS/SRPMS/jboss-cache-1.4.1-1.SP3.1jpp.ep1.1.src.rpm c638e8e39f4524bfddbf07c914024c0b jboss-cache-1.4.1-1.SP3.1jpp.ep1.1.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/RHWAS/SRPMS/jboss-remoting-2.2.2-1jpp.ep1.4.src.rpm d56036f4b74525ae351030f4c1a8eb9a jboss-remoting-2.2.2-1jpp.ep1.4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/RHWAS/SRPMS/jboss-seam-1.2.1-1.ep1.2.src.rpm 0c5d62cc1e37bb8dd47b2e17b96b7149 jboss-seam-1.2.1-1.ep1.2.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/RHWAS/SRPMS/jboss-serialization-1.0.3-1jpp.ep1.3.src.rpm 862809bc4e78e5a8777c0c31fcd3a555 jboss-serialization-1.0.3-1jpp.ep1.3.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/RHWAS/SRPMS/jbossas-4.2.0-2.CP01.ep1.4.src.rpm d137454d4f562778a0cfd9475ed3bbf0 jbossas-4.2.0-2.CP01.ep1.4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/RHWAS/SRPMS/jbossweb-2.0.0-2.CP01.0jpp.ep1.4.src.rpm cba7829b13f79de64b4cbd0422acbaa2 jbossweb-2.0.0-2.CP01.0jpp.ep1.4.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/RHWAS/SRPMS/jbossxb-1.0.0-1.CP01.0jpp.ep1.1.src.rpm 16a51b52b0d53b65d474c1c104c125e9 jbossxb-1.0.0-1.CP01.0jpp.ep1.1.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/RHWAS/SRPMS/jcommon-0.9.7-1jpp.el4ep1.1.src.rpm 92c34a206cecaf59e62d7a3eb38fdc1f jcommon-0.9.7-1jpp.el4ep1.1.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/RHWAS/SRPMS/jfreechart-0.9.21-2jpp.el4ep1.1.src.rpm d474fd5e30d873738eec028c88164bab jfreechart-0.9.21-2jpp.el4ep1.1.src.rpm ftp://updates.redhat.com/enterprise/4ES/en/RHWAS/SRPMS/rh-eap-docs-4.2.0-2.CP01.ep1.2.src.rpm 723a3f1afb218740be1f5d782e80cc25 rh-eap-docs-4.2.0-2.CP01.ep1.2.src.rpm noarch: 9603b96542df9e138e252ee5a701aed4 berkeleydb-2.0.90-1jpp.ep1.1.noarch.rpm 379f1308aa47160a341c35e9bf45aa65 hibernate3-annotations-3.2.1-1.patch01.1jpp.ep1.2.noarch.rpm 5e39db41c091e098c95edd53c94d3c2d hibernate3-annotations-javadoc-3.2.1-1.patch01.1jpp.ep1.2.noarch.rpm 53896bfbb3bb3f874e160e237b30e2ca hibernate3-ejb-persistence-3.0-api-3.2.1-1jpp.ep1.1.noarch.rpm c54b366b96e62fee6ea225d802c0e3d2 hibernate3-ejb-persistence-3.0-api-javadoc-3.2.1-1jpp.ep1.1.noarch.rpm 8635620bce0bef87a8256ec82577f804 hibernate3-entitymanager-3.2.1-1jpp.ep1.5.noarch.rpm 11076de6fc94fe5fc92ededfa22b46a6 hibernate3-entitymanager-javadoc-3.2.1-1jpp.ep1.5.noarch.rpm 05b568ffc52cefb9abad01678b8cd7ef jacorb-2.3.0-1jpp.ep1.1.noarch.rpm 75f791f3a359dac015d7159e1fdee9ce jboss-aop-1.5.5-0jpp.ep1.2.1.noarch.rpm dc933213e3041cbe05a61685913b234b jboss-cache-1.4.1-1.SP3.1jpp.ep1.1.noarch.rpm 30d63ec755235f595dd4fc8207926fa7 jboss-remoting-2.2.2-1jpp.ep1.4.noarch.rpm 63b040353b821f8cbc5ccd186cd4d792 jboss-seam-1.2.1-1.ep1.2.noarch.rpm 5543500f72d98d57105e45e33f227fea jboss-seam-docs-1.2.1-1.ep1.2.noarch.rpm 6b3266b5951ed27bedf610e47c619bb1 jboss-serialization-1.0.3-1jpp.ep1.3.noarch.rpm 672f485649dcfbb7a2720939a946893b jbossas-4.2.0-2.CP01.ep1.4.noarch.rpm fb3cc11b0a1719c625820d63c3eb0d5d jbossweb-2.0.0-2.CP01.0jpp.ep1.4.noarch.rpm 3a03da161c9148892c706332f97cc53d jbossxb-1.0.0-1.CP01.0jpp.ep1.1.noarch.rpm ec2d3af5e0a2dbc092e334444d31f2f4 jcommon-0.9.7-1jpp.el4ep1.1.noarch.rpm e064470349b6cc22b1ce1a5bb0b91034 jfreechart-0.9.21-2jpp.el4ep1.1.noarch.rpm 18e8c6084efaa0be97865e3f97b13db2 rh-eap-docs-4.2.0-2.CP01.ep1.2.noarch.rpm Red Hat Application Stack v2 for Enterprise Linux (v.5): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHWAS/SRPMS/berkeleydb-2.0.90-1jpp.ep1.1.el5.src.rpm 1364824c1ee97e7f0fcb241328e9df69 berkeleydb-2.0.90-1jpp.ep1.1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHWAS/SRPMS/bsh2-2.0-0.b4.1jpp.ep1.1.el5.src.rpm 40d5faea59fd9e5f9436fd45523c8070 bsh2-2.0-0.b4.1jpp.ep1.1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHWAS/SRPMS/hibernate3-annotations-3.2.1-1.patch01.1jpp.ep1.3.el5.src.rpm 8f6f712b7a2253f1d6b29ae35f8b7c94 hibernate3-annotations-3.2.1-1.patch01.1jpp.ep1.3.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHWAS/SRPMS/hibernate3-ejb-persistence-3.0-api-3.2.1-1jpp.ep1.1.el5.src.rpm 9cdd12f342aa59b7107739ee4d8705be hibernate3-ejb-persistence-3.0-api-3.2.1-1jpp.ep1.1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHWAS/SRPMS/hibernate3-entitymanager-3.2.1-1jpp.ep1.5.el5.src.rpm aae323eb86189e960036688084c3fe44 hibernate3-entitymanager-3.2.1-1jpp.ep1.5.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHWAS/SRPMS/jboss-cache-1.4.1-1.SP3.1jpp.ep1.1.el5.src.rpm 8fbbf0b14100f6321d390b8778ef4c1e jboss-cache-1.4.1-1.SP3.1jpp.ep1.1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHWAS/SRPMS/jboss-remoting-2.2.2-1jpp.ep1.5.el5.src.rpm ce29506939a744277b93b37c7dafec83 jboss-remoting-2.2.2-1jpp.ep1.5.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHWAS/SRPMS/jboss-seam-1.2.1-1.ep1.2.el5.src.rpm e563128ec97b2be57b56b9997711f36b jboss-seam-1.2.1-1.ep1.2.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHWAS/SRPMS/jboss-serialization-1.0.3-1jpp.ep1.4.el5.src.rpm 60d15223c3215e23627723e5603da12b jboss-serialization-1.0.3-1jpp.ep1.4.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHWAS/SRPMS/jbossas-4.2.0-2.CP01.ep1.3.el5.src.rpm e7f2185315348598788131da1c83dec8 jbossas-4.2.0-2.CP01.ep1.3.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHWAS/SRPMS/jbossweb-2.0.0-2.CP01.0jpp.ep1.4.el5.src.rpm d82e72da9bac49c8ba90ab425cbaa894 jbossweb-2.0.0-2.CP01.0jpp.ep1.4.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHWAS/SRPMS/jbossxb-1.0.0-1.CP01.0jpp.ep1.2.el5.src.rpm 07c5344200f93a07e8e46619a8b0d469 jbossxb-1.0.0-1.CP01.0jpp.ep1.2.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHWAS/SRPMS/jcommon-0.9.7-1jpp.ep1.1.el5.src.rpm 854f94d9d2d8816ab556233173e262d2 jcommon-0.9.7-1jpp.ep1.1.el5.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHWAS/SRPMS/jfreechart-0.9.21-2jpp.ep1.1.el5.2.src.rpm 61d66b662ef265be93c48a09b30dde4d jfreechart-0.9.21-2jpp.ep1.1.el5.2.src.rpm ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHWAS/SRPMS/rh-eap-docs-4.2.0-2.CP01.ep1.2.el5.src.rpm 7c8b1e2360100685e1b0ac4b4e05cc26 rh-eap-docs-4.2.0-2.CP01.ep1.2.el5.src.rpm noarch: ff70a7c2ece755ce4ce357b484eda115 berkeleydb-2.0.90-1jpp.ep1.1.el5.noarch.rpm c6ca766ab43cca7b1988989c87c8024e bsh2-2.0-0.b4.1jpp.ep1.1.el5.noarch.rpm 39220cf779de34db59de5f911dc83fe4 hibernate3-annotations-3.2.1-1.patch01.1jpp.ep1.3.el5.noarch.rpm 38d14e60c80432ae28d64c55df8263f0 hibernate3-annotations-javadoc-3.2.1-1.patch01.1jpp.ep1.3.el5.noarch.rpm b66229122a3a9c50a738734dc3b52543 hibernate3-ejb-persistence-3.0-api-3.2.1-1jpp.ep1.1.el5.noarch.rpm 96e5571896595832aa0f03d4bdac01d7 hibernate3-ejb-persistence-3.0-api-javadoc-3.2.1-1jpp.ep1.1.el5.noarch.rpm 1f12ab51909c31709d1322a8b425997b hibernate3-entitymanager-3.2.1-1jpp.ep1.5.el5.noarch.rpm d084bb0e4cf54d4a2ac3c0a520310dbd hibernate3-entitymanager-javadoc-3.2.1-1jpp.ep1.5.el5.noarch.rpm 55e29258406c1decddc23793152dd497 jboss-cache-1.4.1-1.SP3.1jpp.ep1.1.el5.noarch.rpm a836aa273e7af578292fc7327db7c005 jboss-remoting-2.2.2-1jpp.ep1.5.el5.noarch.rpm 37aefe6fa970e840ed69ed5b0169cd92 jboss-seam-1.2.1-1.ep1.2.el5.noarch.rpm 56032018c262062aec27e7909b526e39 jboss-seam-docs-1.2.1-1.ep1.2.el5.noarch.rpm a1f90135b91310cbbc57dcb983684022 jboss-serialization-1.0.3-1jpp.ep1.4.el5.noarch.rpm 2baed88bbd3d80ca3f9835f50d44dec2 jbossas-4.2.0-2.CP01.ep1.3.el5.noarch.rpm f0fb7530810ea9edff633c6080b09116 jbossweb-2.0.0-2.CP01.0jpp.ep1.4.el5.noarch.rpm 8aa3b658479515e7caae1eb304c3f6a1 jbossxb-1.0.0-1.CP01.0jpp.ep1.2.el5.noarch.rpm be2f08599120e22b74e37b360c984348 jcommon-0.9.7-1jpp.ep1.1.el5.noarch.rpm 33366ca9ba0a15acb3d77e884d58675e jfreechart-0.9.21-2jpp.ep1.1.el5.2.noarch.rpm 6ac949ba8f4dd30894a2260e038c30c8 rh-eap-docs-4.2.0-2.CP01.ep1.2.el5.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3382 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3385 http://www.redhat.com/docs/manuals/jboss/jboss-eap-4.2.0.cp01/readme.html https://rhstack.108.redhat.com/docs/Red_Hat_Application_Stack_V.1.2_Release_Notes.html http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHLzSuXlSAg2UNWIIRAuIcAJ4xvuo1Vd1TiCy19nk+xF/2DJLEEwCfcRQB tB8jElfWK17wqGg+u1QLdjw= =0is4 -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Nov 5 16:28:40 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 5 Nov 2007 11:28:40 -0500 Subject: [RHSA-2007:0966-01] Important: perl security update Message-ID: <200711051628.lA5GSe2c008992@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: perl security update Advisory ID: RHSA-2007:0966-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0966.html Issue date: 2007-11-05 Updated on: 2007-11-05 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-5116 - --------------------------------------------------------------------- 1. Summary: Updated Perl packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: Perl is a high-level programming language commonly used for system administration utilities and Web programming. A flaw was found in Perl's regular expression engine. Specially crafted input to a regular expression can cause Perl to improperly allocate memory, possibly resulting in arbitrary code running with the permissions of the user running Perl. (CVE-2007-5116) Users of Perl are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. Red Hat would like to thank Tavis Ormandy and Will Drewry for properly disclosing this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 323571 - CVE-2007-5116 perl regular expression UTF parsing errors 6. RPMs required: Red Hat Enterprise Linux AS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/perl-5.8.0-97.EL3.src.rpm 2e856bc3cc39e71d98848cfa162c6bfb perl-5.8.0-97.EL3.src.rpm i386: 08110ae481534b78aca8583e466d0d11 perl-5.8.0-97.EL3.i386.rpm 84b160db5c07c87cb35a5b0911778b6d perl-CGI-2.89-97.EL3.i386.rpm b8d85a465f3e1358d3f3646005f5247c perl-CPAN-1.61-97.EL3.i386.rpm 55383931393e8ccfae6d20f5988878a1 perl-DB_File-1.806-97.EL3.i386.rpm 740d8f97dc683b8ce7d81889ea2caaf4 perl-debuginfo-5.8.0-97.EL3.i386.rpm b9b06f99e1078fefc178582b03a508bf perl-suidperl-5.8.0-97.EL3.i386.rpm ia64: 8daacbf394685b47dcd68cb3a1c87bee perl-5.8.0-97.EL3.ia64.rpm 46b2846b37ca14e8e4ebd960435a2e3a perl-CGI-2.89-97.EL3.ia64.rpm dc6f8cad4ca4779ff43fad3d99599d87 perl-CPAN-1.61-97.EL3.ia64.rpm ba5572804a0300adcf821914806bfed1 perl-DB_File-1.806-97.EL3.ia64.rpm 1e9a1cccea333cd08b27c48793163ffb perl-debuginfo-5.8.0-97.EL3.ia64.rpm e0944c1db59ba589012b7dac36521de9 perl-suidperl-5.8.0-97.EL3.ia64.rpm ppc: e615fd2475ce99ca74d5a4956b042f77 perl-5.8.0-97.EL3.ppc.rpm 795d3acbb9c53adc03d794fc149b68ee perl-CGI-2.89-97.EL3.ppc.rpm 6db24a415cbd5ec6d4cf010c8e438191 perl-CPAN-1.61-97.EL3.ppc.rpm 3c187eb1c14ba3abb3e995b98f3252c7 perl-DB_File-1.806-97.EL3.ppc.rpm ae0a212933e8b2c1e3c0d77f1e64c39c perl-debuginfo-5.8.0-97.EL3.ppc.rpm c5f452f0c24cc1d8481eaaf01ac328e2 perl-suidperl-5.8.0-97.EL3.ppc.rpm s390: 2a72259ab24620832ecb561959117eed perl-5.8.0-97.EL3.s390.rpm 12183a27b2ff2de7d789e8aa5f1108b5 perl-CGI-2.89-97.EL3.s390.rpm 428a1688d05660f07bc492147d041bad perl-CPAN-1.61-97.EL3.s390.rpm 3096dd9080963cfceeac8bf95261f01d perl-DB_File-1.806-97.EL3.s390.rpm 39842e40fa258dd16f3b434df44eba4a perl-debuginfo-5.8.0-97.EL3.s390.rpm c3bd3d5726b222cd77e15cfecf5efda5 perl-suidperl-5.8.0-97.EL3.s390.rpm s390x: 52f0e7173410f550c5c26bbe79f7f29d perl-5.8.0-97.EL3.s390x.rpm 878d39ad48bac5bc724083d6fafc5bac perl-CGI-2.89-97.EL3.s390x.rpm 3f3b35f013b39d6f736d832b4a877be2 perl-CPAN-1.61-97.EL3.s390x.rpm 3ce11d8210bd2a35484c4e66eae587e4 perl-DB_File-1.806-97.EL3.s390x.rpm efee43aed37dbe6750cf9d2a96edb630 perl-debuginfo-5.8.0-97.EL3.s390x.rpm 96df21531273fa0e5ea61a2e94274535 perl-suidperl-5.8.0-97.EL3.s390x.rpm x86_64: 019400b949f68db6ee1922ffb9dec9fa perl-5.8.0-97.EL3.x86_64.rpm 297b7c738c1eed805e55121c575153e8 perl-CGI-2.89-97.EL3.x86_64.rpm 9fe0bfb15b169b385af387b3a72a1227 perl-CPAN-1.61-97.EL3.x86_64.rpm 0ba63fa437a712587b758160ca6b3570 perl-DB_File-1.806-97.EL3.x86_64.rpm e332067ed6df2e02478d11d218b9dec3 perl-debuginfo-5.8.0-97.EL3.x86_64.rpm 0179496930519b1954ec9f50f3aefb1d perl-suidperl-5.8.0-97.EL3.x86_64.rpm Red Hat Desktop version 3: SRPMS: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/perl-5.8.0-97.EL3.src.rpm 2e856bc3cc39e71d98848cfa162c6bfb perl-5.8.0-97.EL3.src.rpm i386: 08110ae481534b78aca8583e466d0d11 perl-5.8.0-97.EL3.i386.rpm 84b160db5c07c87cb35a5b0911778b6d perl-CGI-2.89-97.EL3.i386.rpm b8d85a465f3e1358d3f3646005f5247c perl-CPAN-1.61-97.EL3.i386.rpm 55383931393e8ccfae6d20f5988878a1 perl-DB_File-1.806-97.EL3.i386.rpm 740d8f97dc683b8ce7d81889ea2caaf4 perl-debuginfo-5.8.0-97.EL3.i386.rpm b9b06f99e1078fefc178582b03a508bf perl-suidperl-5.8.0-97.EL3.i386.rpm x86_64: 019400b949f68db6ee1922ffb9dec9fa perl-5.8.0-97.EL3.x86_64.rpm 297b7c738c1eed805e55121c575153e8 perl-CGI-2.89-97.EL3.x86_64.rpm 9fe0bfb15b169b385af387b3a72a1227 perl-CPAN-1.61-97.EL3.x86_64.rpm 0ba63fa437a712587b758160ca6b3570 perl-DB_File-1.806-97.EL3.x86_64.rpm e332067ed6df2e02478d11d218b9dec3 perl-debuginfo-5.8.0-97.EL3.x86_64.rpm 0179496930519b1954ec9f50f3aefb1d perl-suidperl-5.8.0-97.EL3.x86_64.rpm Red Hat Enterprise Linux ES version 3: SRPMS: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/perl-5.8.0-97.EL3.src.rpm 2e856bc3cc39e71d98848cfa162c6bfb perl-5.8.0-97.EL3.src.rpm i386: 08110ae481534b78aca8583e466d0d11 perl-5.8.0-97.EL3.i386.rpm 84b160db5c07c87cb35a5b0911778b6d perl-CGI-2.89-97.EL3.i386.rpm b8d85a465f3e1358d3f3646005f5247c perl-CPAN-1.61-97.EL3.i386.rpm 55383931393e8ccfae6d20f5988878a1 perl-DB_File-1.806-97.EL3.i386.rpm 740d8f97dc683b8ce7d81889ea2caaf4 perl-debuginfo-5.8.0-97.EL3.i386.rpm b9b06f99e1078fefc178582b03a508bf perl-suidperl-5.8.0-97.EL3.i386.rpm ia64: 8daacbf394685b47dcd68cb3a1c87bee perl-5.8.0-97.EL3.ia64.rpm 46b2846b37ca14e8e4ebd960435a2e3a perl-CGI-2.89-97.EL3.ia64.rpm dc6f8cad4ca4779ff43fad3d99599d87 perl-CPAN-1.61-97.EL3.ia64.rpm ba5572804a0300adcf821914806bfed1 perl-DB_File-1.806-97.EL3.ia64.rpm 1e9a1cccea333cd08b27c48793163ffb perl-debuginfo-5.8.0-97.EL3.ia64.rpm e0944c1db59ba589012b7dac36521de9 perl-suidperl-5.8.0-97.EL3.ia64.rpm x86_64: 019400b949f68db6ee1922ffb9dec9fa perl-5.8.0-97.EL3.x86_64.rpm 297b7c738c1eed805e55121c575153e8 perl-CGI-2.89-97.EL3.x86_64.rpm 9fe0bfb15b169b385af387b3a72a1227 perl-CPAN-1.61-97.EL3.x86_64.rpm 0ba63fa437a712587b758160ca6b3570 perl-DB_File-1.806-97.EL3.x86_64.rpm e332067ed6df2e02478d11d218b9dec3 perl-debuginfo-5.8.0-97.EL3.x86_64.rpm 0179496930519b1954ec9f50f3aefb1d perl-suidperl-5.8.0-97.EL3.x86_64.rpm Red Hat Enterprise Linux WS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/perl-5.8.0-97.EL3.src.rpm 2e856bc3cc39e71d98848cfa162c6bfb perl-5.8.0-97.EL3.src.rpm i386: 08110ae481534b78aca8583e466d0d11 perl-5.8.0-97.EL3.i386.rpm 84b160db5c07c87cb35a5b0911778b6d perl-CGI-2.89-97.EL3.i386.rpm b8d85a465f3e1358d3f3646005f5247c perl-CPAN-1.61-97.EL3.i386.rpm 55383931393e8ccfae6d20f5988878a1 perl-DB_File-1.806-97.EL3.i386.rpm 740d8f97dc683b8ce7d81889ea2caaf4 perl-debuginfo-5.8.0-97.EL3.i386.rpm b9b06f99e1078fefc178582b03a508bf perl-suidperl-5.8.0-97.EL3.i386.rpm ia64: 8daacbf394685b47dcd68cb3a1c87bee perl-5.8.0-97.EL3.ia64.rpm 46b2846b37ca14e8e4ebd960435a2e3a perl-CGI-2.89-97.EL3.ia64.rpm dc6f8cad4ca4779ff43fad3d99599d87 perl-CPAN-1.61-97.EL3.ia64.rpm ba5572804a0300adcf821914806bfed1 perl-DB_File-1.806-97.EL3.ia64.rpm 1e9a1cccea333cd08b27c48793163ffb perl-debuginfo-5.8.0-97.EL3.ia64.rpm e0944c1db59ba589012b7dac36521de9 perl-suidperl-5.8.0-97.EL3.ia64.rpm x86_64: 019400b949f68db6ee1922ffb9dec9fa perl-5.8.0-97.EL3.x86_64.rpm 297b7c738c1eed805e55121c575153e8 perl-CGI-2.89-97.EL3.x86_64.rpm 9fe0bfb15b169b385af387b3a72a1227 perl-CPAN-1.61-97.EL3.x86_64.rpm 0ba63fa437a712587b758160ca6b3570 perl-DB_File-1.806-97.EL3.x86_64.rpm e332067ed6df2e02478d11d218b9dec3 perl-debuginfo-5.8.0-97.EL3.x86_64.rpm 0179496930519b1954ec9f50f3aefb1d perl-suidperl-5.8.0-97.EL3.x86_64.rpm Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/perl-5.8.5-36.el4_5.2.src.rpm daab18b1dafbe8d3176bc8be5d39b428 perl-5.8.5-36.el4_5.2.src.rpm i386: f1161acf28aa300ac3a56196e41bc0c0 perl-5.8.5-36.el4_5.2.i386.rpm 71f9fe459a1f55c07e74395caea1c960 perl-debuginfo-5.8.5-36.el4_5.2.i386.rpm efc4e73d1b8afcb409b7e237442ae0b1 perl-suidperl-5.8.5-36.el4_5.2.i386.rpm ia64: 7d7126bde8dce636b1829855a3179925 perl-5.8.5-36.el4_5.2.ia64.rpm 6a32482132d4ecc5176a3251daac6d55 perl-debuginfo-5.8.5-36.el4_5.2.ia64.rpm 5facb1cdc620ed11ef59d3bc1743c731 perl-suidperl-5.8.5-36.el4_5.2.ia64.rpm ppc: 3ead10eac85b4511ba84c5caa2fcd4fe perl-5.8.5-36.el4_5.2.ppc.rpm 90d3f87db8da1a5c64262a6789e21e72 perl-debuginfo-5.8.5-36.el4_5.2.ppc.rpm f9e58d14af224e7e7a854af2b4c238a3 perl-suidperl-5.8.5-36.el4_5.2.ppc.rpm s390: 083df771d205431a023ce3106b3abc62 perl-5.8.5-36.el4_5.2.s390.rpm bb60f65df1e7ae736d85420fea4a5e5b perl-debuginfo-5.8.5-36.el4_5.2.s390.rpm 15ff0e8a816551349bfcfdc0adb3cd52 perl-suidperl-5.8.5-36.el4_5.2.s390.rpm s390x: d337f71d48b8577bb6fb32497cf43799 perl-5.8.5-36.el4_5.2.s390x.rpm db8498f048c019f311f85a8df10654af perl-debuginfo-5.8.5-36.el4_5.2.s390x.rpm 195293ce097b26f3e219ba9697c66445 perl-suidperl-5.8.5-36.el4_5.2.s390x.rpm x86_64: d3b72a8a2577ad7fc59b05ee2c31c806 perl-5.8.5-36.el4_5.2.x86_64.rpm 6152ce32ff44dc9f6266ec7b689a2a6a perl-debuginfo-5.8.5-36.el4_5.2.x86_64.rpm de5d8bf1735c31e69aa74ce1921b7610 perl-suidperl-5.8.5-36.el4_5.2.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/perl-5.8.5-36.el4_5.2.src.rpm daab18b1dafbe8d3176bc8be5d39b428 perl-5.8.5-36.el4_5.2.src.rpm i386: f1161acf28aa300ac3a56196e41bc0c0 perl-5.8.5-36.el4_5.2.i386.rpm 71f9fe459a1f55c07e74395caea1c960 perl-debuginfo-5.8.5-36.el4_5.2.i386.rpm efc4e73d1b8afcb409b7e237442ae0b1 perl-suidperl-5.8.5-36.el4_5.2.i386.rpm x86_64: d3b72a8a2577ad7fc59b05ee2c31c806 perl-5.8.5-36.el4_5.2.x86_64.rpm 6152ce32ff44dc9f6266ec7b689a2a6a perl-debuginfo-5.8.5-36.el4_5.2.x86_64.rpm de5d8bf1735c31e69aa74ce1921b7610 perl-suidperl-5.8.5-36.el4_5.2.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/perl-5.8.5-36.el4_5.2.src.rpm daab18b1dafbe8d3176bc8be5d39b428 perl-5.8.5-36.el4_5.2.src.rpm i386: f1161acf28aa300ac3a56196e41bc0c0 perl-5.8.5-36.el4_5.2.i386.rpm 71f9fe459a1f55c07e74395caea1c960 perl-debuginfo-5.8.5-36.el4_5.2.i386.rpm efc4e73d1b8afcb409b7e237442ae0b1 perl-suidperl-5.8.5-36.el4_5.2.i386.rpm ia64: 7d7126bde8dce636b1829855a3179925 perl-5.8.5-36.el4_5.2.ia64.rpm 6a32482132d4ecc5176a3251daac6d55 perl-debuginfo-5.8.5-36.el4_5.2.ia64.rpm 5facb1cdc620ed11ef59d3bc1743c731 perl-suidperl-5.8.5-36.el4_5.2.ia64.rpm x86_64: d3b72a8a2577ad7fc59b05ee2c31c806 perl-5.8.5-36.el4_5.2.x86_64.rpm 6152ce32ff44dc9f6266ec7b689a2a6a perl-debuginfo-5.8.5-36.el4_5.2.x86_64.rpm de5d8bf1735c31e69aa74ce1921b7610 perl-suidperl-5.8.5-36.el4_5.2.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/perl-5.8.5-36.el4_5.2.src.rpm daab18b1dafbe8d3176bc8be5d39b428 perl-5.8.5-36.el4_5.2.src.rpm i386: f1161acf28aa300ac3a56196e41bc0c0 perl-5.8.5-36.el4_5.2.i386.rpm 71f9fe459a1f55c07e74395caea1c960 perl-debuginfo-5.8.5-36.el4_5.2.i386.rpm efc4e73d1b8afcb409b7e237442ae0b1 perl-suidperl-5.8.5-36.el4_5.2.i386.rpm ia64: 7d7126bde8dce636b1829855a3179925 perl-5.8.5-36.el4_5.2.ia64.rpm 6a32482132d4ecc5176a3251daac6d55 perl-debuginfo-5.8.5-36.el4_5.2.ia64.rpm 5facb1cdc620ed11ef59d3bc1743c731 perl-suidperl-5.8.5-36.el4_5.2.ia64.rpm x86_64: d3b72a8a2577ad7fc59b05ee2c31c806 perl-5.8.5-36.el4_5.2.x86_64.rpm 6152ce32ff44dc9f6266ec7b689a2a6a perl-debuginfo-5.8.5-36.el4_5.2.x86_64.rpm de5d8bf1735c31e69aa74ce1921b7610 perl-suidperl-5.8.5-36.el4_5.2.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/perl-5.8.8-10.el5_0.2.src.rpm 80ae3681c13ce42f0ca7f7b0d3f65ad9 perl-5.8.8-10.el5_0.2.src.rpm i386: 4c75d8927b2d9b48ea8eff28bd815f58 perl-5.8.8-10.el5_0.2.i386.rpm fe7c4efeb215effd89f4b651dbd6ee29 perl-debuginfo-5.8.8-10.el5_0.2.i386.rpm 069f811d020867de13242a28c1050cfb perl-suidperl-5.8.8-10.el5_0.2.i386.rpm x86_64: 7fb4459c9e02e7b698b72a1cf885ddd1 perl-5.8.8-10.el5_0.2.x86_64.rpm 58269ad060a5dcdb8522ec496aa9784b perl-debuginfo-5.8.8-10.el5_0.2.x86_64.rpm 8dbbca6942da4350cb3921ded784055f perl-suidperl-5.8.8-10.el5_0.2.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/perl-5.8.8-10.el5_0.2.src.rpm 80ae3681c13ce42f0ca7f7b0d3f65ad9 perl-5.8.8-10.el5_0.2.src.rpm i386: 4c75d8927b2d9b48ea8eff28bd815f58 perl-5.8.8-10.el5_0.2.i386.rpm fe7c4efeb215effd89f4b651dbd6ee29 perl-debuginfo-5.8.8-10.el5_0.2.i386.rpm 069f811d020867de13242a28c1050cfb perl-suidperl-5.8.8-10.el5_0.2.i386.rpm ia64: 92ac4f52c137c7406da353b7d8463034 perl-5.8.8-10.el5_0.2.ia64.rpm df83934e1aca8c50ac331822f054eb20 perl-debuginfo-5.8.8-10.el5_0.2.ia64.rpm 50749b5171123f123890bd9cc5dd07d6 perl-suidperl-5.8.8-10.el5_0.2.ia64.rpm ppc: 8820cedc46e66a62e5fdd1ac949c4b8f perl-5.8.8-10.el5_0.2.ppc.rpm d0ed851ad533205fa5cca7099337af41 perl-debuginfo-5.8.8-10.el5_0.2.ppc.rpm 702ab8dfbb86555057782d04e6892ed5 perl-suidperl-5.8.8-10.el5_0.2.ppc.rpm s390x: 05056e414bd207108f1a4b46f4186631 perl-5.8.8-10.el5_0.2.s390x.rpm f9f28930496ed8dbaa84573a573c9279 perl-debuginfo-5.8.8-10.el5_0.2.s390x.rpm 1542ed29a717c3cb39cf521c7ff11caf perl-suidperl-5.8.8-10.el5_0.2.s390x.rpm x86_64: 7fb4459c9e02e7b698b72a1cf885ddd1 perl-5.8.8-10.el5_0.2.x86_64.rpm 58269ad060a5dcdb8522ec496aa9784b perl-debuginfo-5.8.8-10.el5_0.2.x86_64.rpm 8dbbca6942da4350cb3921ded784055f perl-suidperl-5.8.8-10.el5_0.2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5116 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHL0S0XlSAg2UNWIIRAtsOAJ4kMVBGRohsuJMB12k5McaG5J2xEQCfR736 AF9SXL0qcaLJG8IuR4VFHNk= =C25p -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Nov 5 16:29:07 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 5 Nov 2007 11:29:07 -0500 Subject: [RHSA-2007:1011-01] Important: perl security update Message-ID: <200711051629.lA5GT7fo009026@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: perl security update Advisory ID: RHSA-2007:1011-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1011.html Issue date: 2007-11-05 Updated on: 2007-11-05 Product: Red Hat Application Stack CVE Names: CVE-2007-5116 - --------------------------------------------------------------------- 1. Summary: Updated Perl packages that fix security issues for Red Hat Application Stack v1.2 are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Application Stack v1 for Enterprise Linux AS (v.4) - i386, x86_64 Red Hat Application Stack v1 for Enterprise Linux ES (v.4) - i386, x86_64 3. Problem description: Perl is a high-level programming language commonly used for system administration utilities and Web programming. A flaw was found in Perl's regular expression engine. Specially crafted input to a regular expression can cause Perl to improperly allocate memory, possibly resulting in arbitrary code running with the permissions of the user running Perl. (CVE-2007-5116) Users of Perl are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Red Hat would like to thank Tavis Ormandy and Will Drewry for properly disclosing this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 323571 - CVE-2007-5116 perl regular expression UTF parsing errors 6. RPMs required: Red Hat Application Stack v1 for Enterprise Linux AS (v.4): SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/RHWAS/SRPMS/perl-5.8.8-5.el4s1_2.src.rpm 73b5b047e89da16e563da600fb1f27bb perl-5.8.8-5.el4s1_2.src.rpm i386: 594456f0c0a07778426f2db35dc6d83c perl-5.8.8-5.el4s1_2.i386.rpm cf0e2c42cc134c75c932d8bfae8b7ac0 perl-debuginfo-5.8.8-5.el4s1_2.i386.rpm c412d4db3a2d6b963115b811e2a3fe7a perl-suidperl-5.8.8-5.el4s1_2.i386.rpm x86_64: 24c17031ef19b328c25517a5e89e3766 perl-5.8.8-5.el4s1_2.x86_64.rpm 2038481ca705701df16082bc989e3279 perl-debuginfo-5.8.8-5.el4s1_2.x86_64.rpm 523b0a11d061ae2a51a13f09620e0c64 perl-suidperl-5.8.8-5.el4s1_2.x86_64.rpm Red Hat Application Stack v1 for Enterprise Linux ES (v.4): SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/RHWAS/SRPMS/perl-5.8.8-5.el4s1_2.src.rpm 73b5b047e89da16e563da600fb1f27bb perl-5.8.8-5.el4s1_2.src.rpm i386: 594456f0c0a07778426f2db35dc6d83c perl-5.8.8-5.el4s1_2.i386.rpm cf0e2c42cc134c75c932d8bfae8b7ac0 perl-debuginfo-5.8.8-5.el4s1_2.i386.rpm c412d4db3a2d6b963115b811e2a3fe7a perl-suidperl-5.8.8-5.el4s1_2.i386.rpm x86_64: 24c17031ef19b328c25517a5e89e3766 perl-5.8.8-5.el4s1_2.x86_64.rpm 2038481ca705701df16082bc989e3279 perl-debuginfo-5.8.8-5.el4s1_2.x86_64.rpm 523b0a11d061ae2a51a13f09620e0c64 perl-suidperl-5.8.8-5.el4s1_2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5116 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHL0TNXlSAg2UNWIIRAgQlAJ9Oyhp+oLUht3ruGkJN90/YIoszCwCgqyc1 CgUXBjPVbh9hJAvIZWxfxhY= =OWEX -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Nov 5 16:43:34 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 5 Nov 2007 11:43:34 -0500 Subject: [RHSA-2007:0967-01] Critical: pcre security update Message-ID: <200711051643.lA5GhioL011479@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Critical: pcre security update Advisory ID: RHSA-2007:0967-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0967.html Issue date: 2007-11-05 Updated on: 2007-11-05 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-1659 CVE-2007-1660 - --------------------------------------------------------------------- 1. Summary: Updated pcre packages that correct two security flaws are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: PCRE is a Perl-compatible regular expression library. Multiple flaws were found in the way pcre handles certain malformed regular expressions. If an application linked against pcre, such as Konqueror, parses a malicious regular expression, it may be possible to run arbitrary code as the user running the application. (CVE-2007-1659, CVE-2007-1660) Users of pcre are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Red Hat would like to thank Tavis Ormandy and Will Drewry for properly disclosing these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 315871 - CVE-2007-1659 pcre regular expression flaws 315881 - CVE-2007-1660 pcre regular expression flaws 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pcre-6.6-2.el5_0.1.src.rpm 37b0c60c16fb136bd5f47082c42a399f pcre-6.6-2.el5_0.1.src.rpm i386: 1e0fe12062836b8838d902f6f13005c4 pcre-6.6-2.el5_0.1.i386.rpm 0c6be04f491c5738e28ca227cd083c44 pcre-debuginfo-6.6-2.el5_0.1.i386.rpm x86_64: 1e0fe12062836b8838d902f6f13005c4 pcre-6.6-2.el5_0.1.i386.rpm 73869b659e16a5c0c4738780b8dbf54a pcre-6.6-2.el5_0.1.x86_64.rpm 0c6be04f491c5738e28ca227cd083c44 pcre-debuginfo-6.6-2.el5_0.1.i386.rpm 9fe6268f7f099d309a198dbc073484c5 pcre-debuginfo-6.6-2.el5_0.1.x86_64.rpm RHEL Desktop Workstation (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pcre-6.6-2.el5_0.1.src.rpm 37b0c60c16fb136bd5f47082c42a399f pcre-6.6-2.el5_0.1.src.rpm i386: 0c6be04f491c5738e28ca227cd083c44 pcre-debuginfo-6.6-2.el5_0.1.i386.rpm 55180d96fa4e1b20fcdd580b13c94e76 pcre-devel-6.6-2.el5_0.1.i386.rpm x86_64: 0c6be04f491c5738e28ca227cd083c44 pcre-debuginfo-6.6-2.el5_0.1.i386.rpm 9fe6268f7f099d309a198dbc073484c5 pcre-debuginfo-6.6-2.el5_0.1.x86_64.rpm 55180d96fa4e1b20fcdd580b13c94e76 pcre-devel-6.6-2.el5_0.1.i386.rpm f60b3e0576aeee879d13906ab55519da pcre-devel-6.6-2.el5_0.1.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/pcre-6.6-2.el5_0.1.src.rpm 37b0c60c16fb136bd5f47082c42a399f pcre-6.6-2.el5_0.1.src.rpm i386: 1e0fe12062836b8838d902f6f13005c4 pcre-6.6-2.el5_0.1.i386.rpm 0c6be04f491c5738e28ca227cd083c44 pcre-debuginfo-6.6-2.el5_0.1.i386.rpm 55180d96fa4e1b20fcdd580b13c94e76 pcre-devel-6.6-2.el5_0.1.i386.rpm ia64: ef36cfa42ba674ffe2c7201dfb112b59 pcre-6.6-2.el5_0.1.ia64.rpm 64e720230c68a59e962a7bd990c75ccb pcre-debuginfo-6.6-2.el5_0.1.ia64.rpm f0a778987dd0c57bcfe3e763b6395ea7 pcre-devel-6.6-2.el5_0.1.ia64.rpm ppc: a25c490d1f71d860ad5eb772046dbed0 pcre-6.6-2.el5_0.1.ppc.rpm ed682d10ccf7b2482c7039d14f0df04b pcre-6.6-2.el5_0.1.ppc64.rpm 5f66a6d45be57f9207583c3b9e2c554d pcre-debuginfo-6.6-2.el5_0.1.ppc.rpm b53659c8438861bbf715099f22483866 pcre-debuginfo-6.6-2.el5_0.1.ppc64.rpm 967f41898c49b310dcf607729dafff69 pcre-devel-6.6-2.el5_0.1.ppc.rpm 822c7a5c264314d84e70e41353dec898 pcre-devel-6.6-2.el5_0.1.ppc64.rpm s390x: 6190ac263d58d9160457be33764c0bc4 pcre-6.6-2.el5_0.1.s390.rpm a41b40a90da5af04c9ed0a713c7b0ee1 pcre-6.6-2.el5_0.1.s390x.rpm b90a30e868ad358a65d56f151efe590c pcre-debuginfo-6.6-2.el5_0.1.s390.rpm b43a4377d755027344bc84fa24b9de54 pcre-debuginfo-6.6-2.el5_0.1.s390x.rpm f39f311df66ee2a124b7d1ccc482ad08 pcre-devel-6.6-2.el5_0.1.s390.rpm 600e150dfa622a3ca5737223cfbe3eed pcre-devel-6.6-2.el5_0.1.s390x.rpm x86_64: 1e0fe12062836b8838d902f6f13005c4 pcre-6.6-2.el5_0.1.i386.rpm 73869b659e16a5c0c4738780b8dbf54a pcre-6.6-2.el5_0.1.x86_64.rpm 0c6be04f491c5738e28ca227cd083c44 pcre-debuginfo-6.6-2.el5_0.1.i386.rpm 9fe6268f7f099d309a198dbc073484c5 pcre-debuginfo-6.6-2.el5_0.1.x86_64.rpm 55180d96fa4e1b20fcdd580b13c94e76 pcre-devel-6.6-2.el5_0.1.i386.rpm f60b3e0576aeee879d13906ab55519da pcre-devel-6.6-2.el5_0.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1659 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1660 http://www.redhat.com/security/updates/classification/#critical 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHL0gtXlSAg2UNWIIRAq1vAJ0RumhaQH7yQSjFp1bLxYooQ4G/SQCeIubd 7cbVnQUGwH2y6fUhTKek+Hs= =f3ke -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Nov 5 16:44:20 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 5 Nov 2007 11:44:20 -0500 Subject: [RHSA-2007:0968-01] Critical: pcre security update Message-ID: <200711051644.lA5GiKaZ011555@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Critical: pcre security update Advisory ID: RHSA-2007:0968-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0968.html Issue date: 2007-11-05 Updated on: 2007-11-05 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-1660 - --------------------------------------------------------------------- 1. Summary: Updated pcre packages that correct two security flaws are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: PCRE is a Perl-compatible regular expression library. Multiple flaws were found in the way pcre handles certain malformed regular expressions. If an application linked against pcre, such as Konqueror, parses a malicious regular expression, it may be possible to run arbitrary code as the user running the application. (CVE-2007-1660) Users of pcre are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Red Hat would like to thank Tavis Ormandy and Will Drewry for properly disclosing these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 315881 - CVE-2007-1660 pcre regular expression flaws 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/pcre-4.5-4.el4_5.1.src.rpm d2bf1a695fbb25449e583dcdf1c2adc3 pcre-4.5-4.el4_5.1.src.rpm i386: 170f0f43d5605415c654ccbec4272b76 pcre-4.5-4.el4_5.1.i386.rpm 32650c48544f61597d23051c343419a9 pcre-debuginfo-4.5-4.el4_5.1.i386.rpm 25e5f95b21f055328b7f223b82682c18 pcre-devel-4.5-4.el4_5.1.i386.rpm ia64: 170f0f43d5605415c654ccbec4272b76 pcre-4.5-4.el4_5.1.i386.rpm 09735dc1d899a27490fbaefbf801e453 pcre-4.5-4.el4_5.1.ia64.rpm 32650c48544f61597d23051c343419a9 pcre-debuginfo-4.5-4.el4_5.1.i386.rpm b9fd1bfce2d9c0761b0610ddde2c1607 pcre-debuginfo-4.5-4.el4_5.1.ia64.rpm 3e3c83e3a8c1b28b1d5d5a3e2efbf8f0 pcre-devel-4.5-4.el4_5.1.ia64.rpm ppc: 39ceb7698118cfb31004434f6ce39e2f pcre-4.5-4.el4_5.1.ppc.rpm 7a66762a3067ff36eb141d50e2f178c2 pcre-4.5-4.el4_5.1.ppc64.rpm 9db9c301f7ec374a635ec959b4446510 pcre-debuginfo-4.5-4.el4_5.1.ppc.rpm 1ddcaf1d63b2ad06ba199867e910c3f6 pcre-debuginfo-4.5-4.el4_5.1.ppc64.rpm 27c02138dc61651befd584d7564e87c1 pcre-devel-4.5-4.el4_5.1.ppc.rpm s390: d29fff61e69fc677350e8dce17f6dc2d pcre-4.5-4.el4_5.1.s390.rpm 6e4505ff2cab4ef9623efba1301bb291 pcre-debuginfo-4.5-4.el4_5.1.s390.rpm f17dc61991ff18330387a01022878cd1 pcre-devel-4.5-4.el4_5.1.s390.rpm s390x: d29fff61e69fc677350e8dce17f6dc2d pcre-4.5-4.el4_5.1.s390.rpm 233bf6ee5aab5c1394589b35e0a240ac pcre-4.5-4.el4_5.1.s390x.rpm 6e4505ff2cab4ef9623efba1301bb291 pcre-debuginfo-4.5-4.el4_5.1.s390.rpm 4b712a174827d3aa67cfaf73ab583114 pcre-debuginfo-4.5-4.el4_5.1.s390x.rpm 43b1cdaf5aba84efc34b6219a411e1c8 pcre-devel-4.5-4.el4_5.1.s390x.rpm x86_64: 170f0f43d5605415c654ccbec4272b76 pcre-4.5-4.el4_5.1.i386.rpm 96c23c6f94616735252c926308bd5037 pcre-4.5-4.el4_5.1.x86_64.rpm 32650c48544f61597d23051c343419a9 pcre-debuginfo-4.5-4.el4_5.1.i386.rpm 8495cf879c626cb9e9d661cc472ebb0a pcre-debuginfo-4.5-4.el4_5.1.x86_64.rpm 91ace1c63dd58660bd06673252f992d7 pcre-devel-4.5-4.el4_5.1.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/pcre-4.5-4.el4_5.1.src.rpm d2bf1a695fbb25449e583dcdf1c2adc3 pcre-4.5-4.el4_5.1.src.rpm i386: 170f0f43d5605415c654ccbec4272b76 pcre-4.5-4.el4_5.1.i386.rpm 32650c48544f61597d23051c343419a9 pcre-debuginfo-4.5-4.el4_5.1.i386.rpm 25e5f95b21f055328b7f223b82682c18 pcre-devel-4.5-4.el4_5.1.i386.rpm x86_64: 170f0f43d5605415c654ccbec4272b76 pcre-4.5-4.el4_5.1.i386.rpm 96c23c6f94616735252c926308bd5037 pcre-4.5-4.el4_5.1.x86_64.rpm 32650c48544f61597d23051c343419a9 pcre-debuginfo-4.5-4.el4_5.1.i386.rpm 8495cf879c626cb9e9d661cc472ebb0a pcre-debuginfo-4.5-4.el4_5.1.x86_64.rpm 91ace1c63dd58660bd06673252f992d7 pcre-devel-4.5-4.el4_5.1.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/pcre-4.5-4.el4_5.1.src.rpm d2bf1a695fbb25449e583dcdf1c2adc3 pcre-4.5-4.el4_5.1.src.rpm i386: 170f0f43d5605415c654ccbec4272b76 pcre-4.5-4.el4_5.1.i386.rpm 32650c48544f61597d23051c343419a9 pcre-debuginfo-4.5-4.el4_5.1.i386.rpm 25e5f95b21f055328b7f223b82682c18 pcre-devel-4.5-4.el4_5.1.i386.rpm ia64: 170f0f43d5605415c654ccbec4272b76 pcre-4.5-4.el4_5.1.i386.rpm 09735dc1d899a27490fbaefbf801e453 pcre-4.5-4.el4_5.1.ia64.rpm 32650c48544f61597d23051c343419a9 pcre-debuginfo-4.5-4.el4_5.1.i386.rpm b9fd1bfce2d9c0761b0610ddde2c1607 pcre-debuginfo-4.5-4.el4_5.1.ia64.rpm 3e3c83e3a8c1b28b1d5d5a3e2efbf8f0 pcre-devel-4.5-4.el4_5.1.ia64.rpm x86_64: 170f0f43d5605415c654ccbec4272b76 pcre-4.5-4.el4_5.1.i386.rpm 96c23c6f94616735252c926308bd5037 pcre-4.5-4.el4_5.1.x86_64.rpm 32650c48544f61597d23051c343419a9 pcre-debuginfo-4.5-4.el4_5.1.i386.rpm 8495cf879c626cb9e9d661cc472ebb0a pcre-debuginfo-4.5-4.el4_5.1.x86_64.rpm 91ace1c63dd58660bd06673252f992d7 pcre-devel-4.5-4.el4_5.1.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/pcre-4.5-4.el4_5.1.src.rpm d2bf1a695fbb25449e583dcdf1c2adc3 pcre-4.5-4.el4_5.1.src.rpm i386: 170f0f43d5605415c654ccbec4272b76 pcre-4.5-4.el4_5.1.i386.rpm 32650c48544f61597d23051c343419a9 pcre-debuginfo-4.5-4.el4_5.1.i386.rpm 25e5f95b21f055328b7f223b82682c18 pcre-devel-4.5-4.el4_5.1.i386.rpm ia64: 170f0f43d5605415c654ccbec4272b76 pcre-4.5-4.el4_5.1.i386.rpm 09735dc1d899a27490fbaefbf801e453 pcre-4.5-4.el4_5.1.ia64.rpm 32650c48544f61597d23051c343419a9 pcre-debuginfo-4.5-4.el4_5.1.i386.rpm b9fd1bfce2d9c0761b0610ddde2c1607 pcre-debuginfo-4.5-4.el4_5.1.ia64.rpm 3e3c83e3a8c1b28b1d5d5a3e2efbf8f0 pcre-devel-4.5-4.el4_5.1.ia64.rpm x86_64: 170f0f43d5605415c654ccbec4272b76 pcre-4.5-4.el4_5.1.i386.rpm 96c23c6f94616735252c926308bd5037 pcre-4.5-4.el4_5.1.x86_64.rpm 32650c48544f61597d23051c343419a9 pcre-debuginfo-4.5-4.el4_5.1.i386.rpm 8495cf879c626cb9e9d661cc472ebb0a pcre-debuginfo-4.5-4.el4_5.1.x86_64.rpm 91ace1c63dd58660bd06673252f992d7 pcre-devel-4.5-4.el4_5.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1660 http://www.redhat.com/security/updates/classification/#critical 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHL0hcXlSAg2UNWIIRAmfOAJ4mS/RTOAP0/2pr00Zt3SaD9ZrnewCglOsU TjlPLbU4BeEZUsqmcGcBMbo= =BGnk -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 7 16:18:37 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 7 Nov 2007 11:18:37 -0500 Subject: [RHSA-2007:0368-03] Moderate: tcpdump security and bug fix update Message-ID: <200711071618.lA7GIbhm031348@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: tcpdump security and bug fix update Advisory ID: RHSA-2007:0368-03 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0368.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux Keywords: overflow crash 802.11 CVE Names: CVE-2007-1218 CVE-2007-3798 - --------------------------------------------------------------------- 1. Summary: Updated tcpdump packages that fix a security issue and functionality bugs are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: Tcpdump is a command line tool for monitoring network traffic. Moritz Jodeit discovered a denial of service bug in the tcpdump IEEE 802.11 processing code. If a certain link type was explicitly specified, an attacker could inject a carefully crafted frame onto the IEEE 802.11 network that could crash a running tcpdump session. (CVE-2007-1218) An integer overflow flaw was found in tcpdump's BGP processing code. An attacker could execute arbitrary code with the privilege of the pcap user by injecting a crafted frame onto the network. (CVE-2007-3798) In addition, the following bugs have been addressed: * The arpwatch service initialization script would exit prematurely, returning an incorrect successful exit status and preventing the status command from running in case networking is not available. * Tcpdump would not drop root privileges completely when launched with the - -C option. This might have been abused by an attacker to gain root privileges in case a security problem was found in tcpdump. Users of tcpdump are encouraged to specify meaningful arguments to the -Z option in case they want tcpdump to write files with privileges other than of the pcap user. Users of tcpdump are advised to upgrade to these erratum packages, which contain backported patches that correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 232347 - CVE-2007-1218 tcpdump denial of service 237779 - Wrong init script 241677 - tcpdump -Z -C should drop root privileges completely 250275 - CVE-2007-3798 tcpdump BGP integer overflow 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/tcpdump-3.9.4-11.el5.src.rpm 2d8a9b6ce960508362a7f9d80633b3da tcpdump-3.9.4-11.el5.src.rpm i386: bf509e032af93a166ee85eb44fb9806c libpcap-0.9.4-11.el5.i386.rpm e1366b54fb414744f8066cda26ae1cf4 tcpdump-3.9.4-11.el5.i386.rpm 3a3db9efe4f5ba07d092013a88bf5ae4 tcpdump-debuginfo-3.9.4-11.el5.i386.rpm x86_64: bf509e032af93a166ee85eb44fb9806c libpcap-0.9.4-11.el5.i386.rpm 5f5a5af8ab76663a97667d1036ec9668 libpcap-0.9.4-11.el5.x86_64.rpm 230e4421c10064f6b30666894151f545 tcpdump-3.9.4-11.el5.x86_64.rpm 3a3db9efe4f5ba07d092013a88bf5ae4 tcpdump-debuginfo-3.9.4-11.el5.i386.rpm fe81bedaac8d616dd5174aa36ede5261 tcpdump-debuginfo-3.9.4-11.el5.x86_64.rpm RHEL Desktop Workstation (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/tcpdump-3.9.4-11.el5.src.rpm 2d8a9b6ce960508362a7f9d80633b3da tcpdump-3.9.4-11.el5.src.rpm i386: 8a2efa5cde05859090d27899455fd8ea arpwatch-2.1a13-18.el5.i386.rpm e7fc87898e4d015cd6d9e3db48d9ca9f libpcap-devel-0.9.4-11.el5.i386.rpm 3a3db9efe4f5ba07d092013a88bf5ae4 tcpdump-debuginfo-3.9.4-11.el5.i386.rpm x86_64: 01df957f9cf7cf71afdef3649564dbb1 arpwatch-2.1a13-18.el5.x86_64.rpm e7fc87898e4d015cd6d9e3db48d9ca9f libpcap-devel-0.9.4-11.el5.i386.rpm 52d87731d358492ae67ae75ee92794c7 libpcap-devel-0.9.4-11.el5.x86_64.rpm 3a3db9efe4f5ba07d092013a88bf5ae4 tcpdump-debuginfo-3.9.4-11.el5.i386.rpm fe81bedaac8d616dd5174aa36ede5261 tcpdump-debuginfo-3.9.4-11.el5.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/tcpdump-3.9.4-11.el5.src.rpm 2d8a9b6ce960508362a7f9d80633b3da tcpdump-3.9.4-11.el5.src.rpm i386: 8a2efa5cde05859090d27899455fd8ea arpwatch-2.1a13-18.el5.i386.rpm bf509e032af93a166ee85eb44fb9806c libpcap-0.9.4-11.el5.i386.rpm e7fc87898e4d015cd6d9e3db48d9ca9f libpcap-devel-0.9.4-11.el5.i386.rpm e1366b54fb414744f8066cda26ae1cf4 tcpdump-3.9.4-11.el5.i386.rpm 3a3db9efe4f5ba07d092013a88bf5ae4 tcpdump-debuginfo-3.9.4-11.el5.i386.rpm ia64: 4afabd661d6cdc60e129cfd97cc40a9d arpwatch-2.1a13-18.el5.ia64.rpm f4696ab17886456c3106756ed94158da libpcap-0.9.4-11.el5.ia64.rpm ca57b4643c6670b21ad4aa15b277f728 libpcap-devel-0.9.4-11.el5.ia64.rpm 4f844de6d34ff8b4f80c054e78a7088f tcpdump-3.9.4-11.el5.ia64.rpm fe0efc47f60a0b7292a7faa11b6bbe84 tcpdump-debuginfo-3.9.4-11.el5.ia64.rpm ppc: 8f4f509649250ef31e2a75bb5b9ed772 arpwatch-2.1a13-18.el5.ppc.rpm a98d4e12b603d3dda4de51f887c48218 libpcap-0.9.4-11.el5.ppc.rpm 1a1556ff29bf547645be3bbecfccdf36 libpcap-0.9.4-11.el5.ppc64.rpm 1db21646d5ecea38de52ca5210bca741 libpcap-devel-0.9.4-11.el5.ppc.rpm 24182f64ea6d93b6d7905d39fb5dcc41 libpcap-devel-0.9.4-11.el5.ppc64.rpm e671300d796e42688d50d074e0c1b5f1 tcpdump-3.9.4-11.el5.ppc.rpm 31c3146286375aa062ac6c08ffd32fee tcpdump-debuginfo-3.9.4-11.el5.ppc.rpm a5a7c8f13c8102951334387a4b56ca77 tcpdump-debuginfo-3.9.4-11.el5.ppc64.rpm s390x: a1900619ecfb99b2bfb2db7d2b8fda0c arpwatch-2.1a13-18.el5.s390x.rpm e65d46956c9aabb2dc4372e89a773095 libpcap-0.9.4-11.el5.s390.rpm 8d248c1c133eef93c00d12e3e4648cc8 libpcap-0.9.4-11.el5.s390x.rpm 13d1f23310369d5702f1208f9c3d38b4 libpcap-devel-0.9.4-11.el5.s390.rpm d3230eb608c67be9e9090f42b882e6f1 libpcap-devel-0.9.4-11.el5.s390x.rpm e2c3146e79feeea209f2642aaa34fdb6 tcpdump-3.9.4-11.el5.s390x.rpm 3b16d216d6d5567349710f49fed21387 tcpdump-debuginfo-3.9.4-11.el5.s390.rpm ce98f450ecdfdc58669ce05741222081 tcpdump-debuginfo-3.9.4-11.el5.s390x.rpm x86_64: 01df957f9cf7cf71afdef3649564dbb1 arpwatch-2.1a13-18.el5.x86_64.rpm bf509e032af93a166ee85eb44fb9806c libpcap-0.9.4-11.el5.i386.rpm 5f5a5af8ab76663a97667d1036ec9668 libpcap-0.9.4-11.el5.x86_64.rpm e7fc87898e4d015cd6d9e3db48d9ca9f libpcap-devel-0.9.4-11.el5.i386.rpm 52d87731d358492ae67ae75ee92794c7 libpcap-devel-0.9.4-11.el5.x86_64.rpm 230e4421c10064f6b30666894151f545 tcpdump-3.9.4-11.el5.x86_64.rpm 3a3db9efe4f5ba07d092013a88bf5ae4 tcpdump-debuginfo-3.9.4-11.el5.i386.rpm fe81bedaac8d616dd5174aa36ede5261 tcpdump-debuginfo-3.9.4-11.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1218 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3798 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMeUBXlSAg2UNWIIRAtP5AJ9TbdZGXzZxIGcVNxnj0ZbNz6WcRACgtJ/L gcpBNPO8jhuHmsSPiAwQkLM= =Rb2l -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 7 16:19:49 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 7 Nov 2007 11:19:49 -0500 Subject: [RHSA-2007:0540-04] Moderate: openssh security and bug fix update Message-ID: <200711071619.lA7GJnv1031520@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: openssh security and bug fix update Advisory ID: RHSA-2007:0540-04 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0540.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux Keywords: GSSAPI krb5 MLS level role SELinux NSS token audit CVE Names: CVE-2006-5052 CVE-2007-3102 - --------------------------------------------------------------------- 1. Summary: Updated openssh packages that fix a security issue and various bugs are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. These packages include the core files necessary for both the OpenSSH client and server. A flaw was found in the way the ssh server wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages, which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102) A flaw was found in the way the OpenSSH server processes GSSAPI authentication requests. When GSSAPI authentication was enabled in the OpenSSH server, a remote attacker was potentially able to determine if a username is valid. (CVE-2006-5052) The following bugs in SELinux MLS (Multi-Level Security) support has also been fixed in this update: * It was sometimes not possible to select a SELinux role and level when logging in using ssh. * If the user obtained a non-default SELinux role or level, the role change was not recorded in the audit subsystem. * In some cases, on labeled networks, sshd allowed logins from level ranges it should not allow. The updated packages also contain experimental support for using private keys stored in PKCS#11 tokens for client authentication. The support is provided through the NSS (Network Security Services) library. All users of openssh should upgrade to these updated packages, which contain patches to correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 227733 - [LSPP] unable to ssh into a system as root/auditadm_r 229278 - LSPP: ssh-mls allows a level through that it should not 231695 - LSPP: user unable to ssh to system with user/role/level context 234638 - CVE-2006-5052 GSSAPI information leak 234951 - [LSPP] openssh server fails to parse level correctly 248059 - CVE-2007-3102 audit logging of failed logins 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/openssh-4.3p2-24.el5.src.rpm 153a17e8f011bde6d984ce73b92cebff openssh-4.3p2-24.el5.src.rpm i386: ba4d6b70e9de7860b5ebe370ca5cdf53 openssh-4.3p2-24.el5.i386.rpm d7b28f340fe82d28660876ca6bcc0a35 openssh-askpass-4.3p2-24.el5.i386.rpm c4216b9a462e5f0462096f1d9b6b8d5f openssh-clients-4.3p2-24.el5.i386.rpm 0d1b5895334f519631856e593f58cb88 openssh-debuginfo-4.3p2-24.el5.i386.rpm 9f17e3dfe06fbbed05f765abd6b2509a openssh-server-4.3p2-24.el5.i386.rpm x86_64: 67538525ad7cf2f1d310a429b44890c7 openssh-4.3p2-24.el5.x86_64.rpm 37118e168b7a55531459b4743d3522fb openssh-askpass-4.3p2-24.el5.x86_64.rpm 6ce7070b90732f3c837df5cfc9287187 openssh-clients-4.3p2-24.el5.x86_64.rpm 96ae0db5a9a4461f41dad2482e9c0945 openssh-debuginfo-4.3p2-24.el5.x86_64.rpm a7141781bfe5f21f2fc5b192ebf6693e openssh-server-4.3p2-24.el5.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/openssh-4.3p2-24.el5.src.rpm 153a17e8f011bde6d984ce73b92cebff openssh-4.3p2-24.el5.src.rpm i386: ba4d6b70e9de7860b5ebe370ca5cdf53 openssh-4.3p2-24.el5.i386.rpm d7b28f340fe82d28660876ca6bcc0a35 openssh-askpass-4.3p2-24.el5.i386.rpm c4216b9a462e5f0462096f1d9b6b8d5f openssh-clients-4.3p2-24.el5.i386.rpm 0d1b5895334f519631856e593f58cb88 openssh-debuginfo-4.3p2-24.el5.i386.rpm 9f17e3dfe06fbbed05f765abd6b2509a openssh-server-4.3p2-24.el5.i386.rpm ia64: 5a4b28d5af0be02b37e02ae0aed692aa openssh-4.3p2-24.el5.ia64.rpm b2672d6bc6fbbd29414d23523631ac03 openssh-askpass-4.3p2-24.el5.ia64.rpm 2e7e42fd888d7fb1a87531e3f7a58889 openssh-clients-4.3p2-24.el5.ia64.rpm e7fe2def4325a0954c033b07ddae7db9 openssh-debuginfo-4.3p2-24.el5.ia64.rpm e909c8bac59183dfe6f47f1e71c5306e openssh-server-4.3p2-24.el5.ia64.rpm ppc: 7c4fbb3d8e40b083acdbd6a5186e1db3 openssh-4.3p2-24.el5.ppc.rpm 4f878a818e9fd07d16becbf66e35389f openssh-askpass-4.3p2-24.el5.ppc.rpm 9c31ff09ef6ca0a20bba14fb89c3e250 openssh-clients-4.3p2-24.el5.ppc.rpm b36d39426902c394c54cdb0147ced3f7 openssh-debuginfo-4.3p2-24.el5.ppc.rpm 3187b878bf79dc71e226ae8096f07081 openssh-server-4.3p2-24.el5.ppc.rpm s390x: f4c3b2d6c3b170376f0e3fce0b1f38ec openssh-4.3p2-24.el5.s390x.rpm ab38b48be3d112c5aa333296bd9cbc3f openssh-askpass-4.3p2-24.el5.s390x.rpm 03643d364acf47e086c913c95dae8cb2 openssh-clients-4.3p2-24.el5.s390x.rpm 67e1a666b84e7dc73f645dd6d7f1a6a5 openssh-debuginfo-4.3p2-24.el5.s390x.rpm 0d6286527c165d1df00ece5761fcefed openssh-server-4.3p2-24.el5.s390x.rpm x86_64: 67538525ad7cf2f1d310a429b44890c7 openssh-4.3p2-24.el5.x86_64.rpm 37118e168b7a55531459b4743d3522fb openssh-askpass-4.3p2-24.el5.x86_64.rpm 6ce7070b90732f3c837df5cfc9287187 openssh-clients-4.3p2-24.el5.x86_64.rpm 96ae0db5a9a4461f41dad2482e9c0945 openssh-debuginfo-4.3p2-24.el5.x86_64.rpm a7141781bfe5f21f2fc5b192ebf6693e openssh-server-4.3p2-24.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5052 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3102 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMeWbXlSAg2UNWIIRAkOnAJ4rJaVx+hXtuM/lvFUcggBSPLk3QwCfYD0V /P+Rmoil3WmCqWQyIP5RVTE= =rz1h -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 7 16:22:32 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 7 Nov 2007 11:22:32 -0500 Subject: [RHSA-2007:0555-04] Moderate: pam security, bug fix, and enhancement update Message-ID: <200711071622.lA7GMWxR032325@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: pam security, bug fix, and enhancement update Advisory ID: RHSA-2007:0555-04 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0555.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux Keywords: limits namespace LSPP polyinstantiation audit device ownership tty SELinux CVE Names: CVE-2007-1716 CVE-2007-3102 - --------------------------------------------------------------------- 1. Summary: Updated pam packages that fix two security flaws, resolve several bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: Pluggable Authentication Modules (PAM) provide a system whereby administrators can set up authentication policies without having to recompile programs that handle authentication. A flaw was found in the way pam_console set console device permissions. It was possible for various console devices to retain ownership of the console user after logging out, possibly leaking information to another local user. (CVE-2007-1716) A flaw was found in the way the PAM library wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102) As well, these updated packages fix the following bugs: * truncated MD5-hashed passwords in "/etc/shadow" were treated as valid, resulting in insecure and invalid passwords. * the pam_namespace module did not convert context names to raw format and did not unmount polyinstantiated directories in some cases. It also crashed when an unknown user name was used in "/etc/security/namespace.conf", the pam_namespace configuration file. * the pam_selinux module was not relabeling the controlling tty correctly, and in some cases it did not send complete information about user role and level change to the audit subsystem. These updated packages add the following enhancements: * pam_limits module now supports parsing additional config files placed into the /etc/security/limits.d/ directory. These files are read after the main configuration file. * the modules pam_limits, pam_access, and pam_time now send a message to the audit subsystem when a user is denied access based on the number of login sessions, origin of user, and time of login. * pam_unix module security properties were improved. Functionality in the setuid helper binary, unix_chkpwd, which was not required for user authentication, was moved to a new non-setuid helper binary, unix_update. All users of PAM should upgrade to these updated packages, which resolve these issues and add these enhancements. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 227345 - pam_namespace should convert the context names before it uses them as filenames 230120 - LSPP: Not able to log into the machine with large number of categories 232993 - FIPS 200: audit rejection based on number of sessions, origin and time 233581 - CVE-2007-1716 Ownership of devices not returned to root after logout from console 234513 - [LSPP] pam_namespace crashes with non-existent users in namespace.conf 234781 - [LSPP] incorrect information in pam_selinux audit record 236316 - LSPP: Unable to change expired password on ssh login 237163 - namespace.conf: $HOME used in polyinstantiated directory name not being expanded 237249 - LSPP: polyinstantiation behavior correct and documented 243204 - CVE-2007-3102 audit logging of failed logins 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pam-0.99.6.2-3.26.el5.src.rpm 8d551576c99cc43b6ec69d1372bb8d0d pam-0.99.6.2-3.26.el5.src.rpm i386: 84d48c3be0870e9dbfe2dc27395de114 pam-0.99.6.2-3.26.el5.i386.rpm c1b7da6238f60f4debac539d71b53222 pam-debuginfo-0.99.6.2-3.26.el5.i386.rpm x86_64: 84d48c3be0870e9dbfe2dc27395de114 pam-0.99.6.2-3.26.el5.i386.rpm 5372f04b4d5c7e311ccbc470b0ce296a pam-0.99.6.2-3.26.el5.x86_64.rpm c1b7da6238f60f4debac539d71b53222 pam-debuginfo-0.99.6.2-3.26.el5.i386.rpm 296cd65817f32b98dc9f0d6be63e779d pam-debuginfo-0.99.6.2-3.26.el5.x86_64.rpm RHEL Desktop Workstation (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pam-0.99.6.2-3.26.el5.src.rpm 8d551576c99cc43b6ec69d1372bb8d0d pam-0.99.6.2-3.26.el5.src.rpm i386: c1b7da6238f60f4debac539d71b53222 pam-debuginfo-0.99.6.2-3.26.el5.i386.rpm d622f4f24b1022924db60a27c510ac7c pam-devel-0.99.6.2-3.26.el5.i386.rpm x86_64: c1b7da6238f60f4debac539d71b53222 pam-debuginfo-0.99.6.2-3.26.el5.i386.rpm 296cd65817f32b98dc9f0d6be63e779d pam-debuginfo-0.99.6.2-3.26.el5.x86_64.rpm d622f4f24b1022924db60a27c510ac7c pam-devel-0.99.6.2-3.26.el5.i386.rpm 4c244fb63c0f7404ebad4f9b2c8023d9 pam-devel-0.99.6.2-3.26.el5.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/pam-0.99.6.2-3.26.el5.src.rpm 8d551576c99cc43b6ec69d1372bb8d0d pam-0.99.6.2-3.26.el5.src.rpm i386: 84d48c3be0870e9dbfe2dc27395de114 pam-0.99.6.2-3.26.el5.i386.rpm c1b7da6238f60f4debac539d71b53222 pam-debuginfo-0.99.6.2-3.26.el5.i386.rpm d622f4f24b1022924db60a27c510ac7c pam-devel-0.99.6.2-3.26.el5.i386.rpm ia64: 84d48c3be0870e9dbfe2dc27395de114 pam-0.99.6.2-3.26.el5.i386.rpm f1107cda14d5f5e06c34567f4c960ce9 pam-0.99.6.2-3.26.el5.ia64.rpm c1b7da6238f60f4debac539d71b53222 pam-debuginfo-0.99.6.2-3.26.el5.i386.rpm 567b72218dac642e9ab0e211df9aa025 pam-debuginfo-0.99.6.2-3.26.el5.ia64.rpm 71b979597060947cc876725399b9f110 pam-devel-0.99.6.2-3.26.el5.ia64.rpm ppc: b8bdf7f7059ef8b82c48477373db3d9a pam-0.99.6.2-3.26.el5.ppc.rpm d513db5dc35eed0401410bf4bff2bd78 pam-0.99.6.2-3.26.el5.ppc64.rpm 9f11916618717cbd1a58b667ad35beb5 pam-debuginfo-0.99.6.2-3.26.el5.ppc.rpm 8496bc7427358b5f0435b04af8e9c0d6 pam-debuginfo-0.99.6.2-3.26.el5.ppc64.rpm 83b06532e32e2e3f61e52b67af67e1df pam-devel-0.99.6.2-3.26.el5.ppc.rpm 19bc56166f397d5507ee63419c30c425 pam-devel-0.99.6.2-3.26.el5.ppc64.rpm s390x: c9a1ffc67c7eb25e418130f48962f20f pam-0.99.6.2-3.26.el5.s390.rpm b1208395f4bbe301a56fd0d1a263b0cd pam-0.99.6.2-3.26.el5.s390x.rpm 9cb56666c2455672a440b85be60417b3 pam-debuginfo-0.99.6.2-3.26.el5.s390.rpm 0ed494671540c9f78406f3b0b3b64f64 pam-debuginfo-0.99.6.2-3.26.el5.s390x.rpm a63e62356e6ffd4a964212e4da6ec3e2 pam-devel-0.99.6.2-3.26.el5.s390.rpm 9472719bcff3e5d4244da94b32443dbf pam-devel-0.99.6.2-3.26.el5.s390x.rpm x86_64: 84d48c3be0870e9dbfe2dc27395de114 pam-0.99.6.2-3.26.el5.i386.rpm 5372f04b4d5c7e311ccbc470b0ce296a pam-0.99.6.2-3.26.el5.x86_64.rpm c1b7da6238f60f4debac539d71b53222 pam-debuginfo-0.99.6.2-3.26.el5.i386.rpm 296cd65817f32b98dc9f0d6be63e779d pam-debuginfo-0.99.6.2-3.26.el5.x86_64.rpm d622f4f24b1022924db60a27c510ac7c pam-devel-0.99.6.2-3.26.el5.i386.rpm 4c244fb63c0f7404ebad4f9b2c8023d9 pam-devel-0.99.6.2-3.26.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1716 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3102 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMeZEXlSAg2UNWIIRArN+AJ924WLCjL7vPLQPnTwK5TQ1V7JX1QCfemid YSEuuXiGrmKhruTgyiSsiEQ= =8q9E -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 7 16:23:14 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 7 Nov 2007 11:23:14 -0500 Subject: [RHSA-2007:0631-04] Low: coolkey security and bug fix update Message-ID: <200711071623.lA7GNEfR032398@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Low: coolkey security and bug fix update Advisory ID: RHSA-2007:0631-04 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0631.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-4129 - --------------------------------------------------------------------- 1. Summary: Updated coolkey packages that fix a security issue and various bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, x86_64 3. Problem description: coolkey contains the driver support for the CoolKey and Common Access Card (CAC) Smart Card products. The CAC is used by the U.S. Government. Steve Grubb discovered a flaw in the way coolkey created a temporary directory. A local attacker could perform a symlink attack and cause arbitrary files to be overwritten. (CVE-2007-4129) In addition, the updated packages contain fixes for the following bugs in the CAC Smart Card support: * CAC Smart Cards can have from 1 to 3 certificates. The coolkey driver, however, was not recognizing cards if they had less than 3 certificates. * logging into a CAC Smart Card token with a new application would cause other, already authenticated, applications to lose their login status unless the Smart Card was then removed from the reader and re-inserted. All CAC users should upgrade to these updated packages, which resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 200295 - Coolkey does not support CAC cards with less than 3 certs 200316 - Open apps loose the CAC card after a C_logout from another app. 251774 - CVE-2007-4129 coolkey file and directory permission flaw 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/coolkey-1.1.0-5.el5.src.rpm be2b4382d36b1e2d2fa3b7530bbea26b coolkey-1.1.0-5.el5.src.rpm i386: 734a4e94f71f9d8dcadc1b40af734442 coolkey-1.1.0-5.el5.i386.rpm 8809e5388cf1c5bd408a09bc1bf18ba5 coolkey-debuginfo-1.1.0-5.el5.i386.rpm x86_64: 734a4e94f71f9d8dcadc1b40af734442 coolkey-1.1.0-5.el5.i386.rpm a4732c520ce771644185307d2b2dd036 coolkey-1.1.0-5.el5.x86_64.rpm 8809e5388cf1c5bd408a09bc1bf18ba5 coolkey-debuginfo-1.1.0-5.el5.i386.rpm 0182d3bfc759241609e48d731703e699 coolkey-debuginfo-1.1.0-5.el5.x86_64.rpm RHEL Desktop Workstation (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/coolkey-1.1.0-5.el5.src.rpm be2b4382d36b1e2d2fa3b7530bbea26b coolkey-1.1.0-5.el5.src.rpm i386: 8809e5388cf1c5bd408a09bc1bf18ba5 coolkey-debuginfo-1.1.0-5.el5.i386.rpm 420831d4a8b91dfeeed93dca86958264 coolkey-devel-1.1.0-5.el5.i386.rpm x86_64: 8809e5388cf1c5bd408a09bc1bf18ba5 coolkey-debuginfo-1.1.0-5.el5.i386.rpm 0182d3bfc759241609e48d731703e699 coolkey-debuginfo-1.1.0-5.el5.x86_64.rpm 420831d4a8b91dfeeed93dca86958264 coolkey-devel-1.1.0-5.el5.i386.rpm d94108f3f7c7a5b6a91ef5db9c71ec76 coolkey-devel-1.1.0-5.el5.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/coolkey-1.1.0-5.el5.src.rpm be2b4382d36b1e2d2fa3b7530bbea26b coolkey-1.1.0-5.el5.src.rpm i386: 734a4e94f71f9d8dcadc1b40af734442 coolkey-1.1.0-5.el5.i386.rpm 8809e5388cf1c5bd408a09bc1bf18ba5 coolkey-debuginfo-1.1.0-5.el5.i386.rpm 420831d4a8b91dfeeed93dca86958264 coolkey-devel-1.1.0-5.el5.i386.rpm ia64: 03d0815c1d295fcc22338839ccdf5e41 coolkey-1.1.0-5.el5.ia64.rpm d4d59889e20ec28411f8634939fa5eb2 coolkey-debuginfo-1.1.0-5.el5.ia64.rpm 2cb167ef2c9a3fd05dd9a84fe3bcd89b coolkey-devel-1.1.0-5.el5.ia64.rpm ppc: 907006f844462842bbe197a8a1fa3915 coolkey-1.1.0-5.el5.ppc.rpm 47f4e5c0933af668243c6118217e0a74 coolkey-1.1.0-5.el5.ppc64.rpm 4bbb7db44e14714db0615ac9e670e955 coolkey-debuginfo-1.1.0-5.el5.ppc.rpm e98e61cb27db0d1f67aa70cfb80c0aa8 coolkey-debuginfo-1.1.0-5.el5.ppc64.rpm e7cc7de5db3d0bdf8e2edf99e5cbc05a coolkey-devel-1.1.0-5.el5.ppc.rpm cec5f0cdc94054f76734417f179ae395 coolkey-devel-1.1.0-5.el5.ppc64.rpm x86_64: 734a4e94f71f9d8dcadc1b40af734442 coolkey-1.1.0-5.el5.i386.rpm a4732c520ce771644185307d2b2dd036 coolkey-1.1.0-5.el5.x86_64.rpm 8809e5388cf1c5bd408a09bc1bf18ba5 coolkey-debuginfo-1.1.0-5.el5.i386.rpm 0182d3bfc759241609e48d731703e699 coolkey-debuginfo-1.1.0-5.el5.x86_64.rpm 420831d4a8b91dfeeed93dca86958264 coolkey-devel-1.1.0-5.el5.i386.rpm d94108f3f7c7a5b6a91ef5db9c71ec76 coolkey-devel-1.1.0-5.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4129 http://www.redhat.com/security/updates/classification/#low 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMeZuXlSAg2UNWIIRAglkAJ4/wtGR7UEl38/GqhM2ZT+vmzSkAwCeII/S LICVPOa7l5mWAECooRB5l6A= =Zv8t -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 7 16:26:31 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 7 Nov 2007 11:26:31 -0500 Subject: [RHSA-2007:0640-04] Moderate: conga security, bug fix, and enhancement update Message-ID: <200711071626.lA7GQWvB000794@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: conga security, bug fix, and enhancement update Advisory ID: RHSA-2007:0640-04 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0640.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-4136 - --------------------------------------------------------------------- 1. Summary: Updated conga packages that correct a security flaw and provide bug fixes and add enhancements are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: RHEL Clustering (v. 5 server) - i386, ia64, x86_64 3. Problem description: The Conga package is a web-based administration tool for remote cluster and storage management. A flaw was found in ricci during a code audit. A remote attacker who is able to connect to ricci could cause ricci to temporarily refuse additional connections, a denial of service (CVE-2007-4136). Fixes in this updated package include: * The nodename is now set for manual fencing. * The node log no longer displays in random order. * A bug that prevented a node from responding when a cluster was deleted is now fixed. * A PAM configuration that incorrectly called the deprecated module pam_stack was removed. * A bug that prevented some quorum disk configurations from being accepted is now fixed. * Setting multicast addresses now works properly. * rpm -V on luci no longer fails. * The user interface rendering time for storage interface is now faster. * An error message that incorrectly appeared when rebooting nodes during cluster creation was removed. * Cluster snaps configuration (an unsupported feature) has been removed altogether to prevent user confusion. * A user permission bug resulting from a luci code error is now fixed. * luci and ricci init script return codes are now LSB-compliant. * VG creation on cluster nodes now defaults to "clustered". * An SELinux AVC bug that prevented users from setting up shared storage on nodes is now fixed. * An access error that occurred when attempting to access a cluster node after its cluster was deleted is now fixed. * IP addresses can now be used to create clusters. * Attempting to configure a fence device no longer results in an AttributeError. * Attempting to create a new fence device to a valid cluster no longer results in a KeyError. * Several minor user interface validation errors have been fixed, such as enforcing cluster name length and fence port, etc. * A browser lock-up that could occur during storage configuration has been fixed. * Virtual service creation now works without error. * The fence_xvm tag is no longer misspelled in the cluster.conf file. * Luci failover forms are complete and working. * Rebooting a fresh cluster install no longer generates an error message. * A bug that prevented failed cluster services from being started is now fixed. * A bug that caused some cluster operations (e.g., node delete) to fail on clusters with mixed-cased cluster names is now fixed. * Global cluster resources can be reused when constructing cluster services. Enhancements in this updated package include: * Users can now access Conga through Internet Explorer 6. * Dead nodes can now be evicted from a cluster. * Shared storage on new clusters is now enabled by default. * The fence user-interface flow is now simpler. * A port number is now shown in ricci error messages. * The kmod-gfs-xen kernel module is now installed when creating a cluster. * Cluster creation status is now shown visually. * User names are now sorted for display. * The fence_xvmd tag can now be added from the dom0 cluster nodes. * The ampersand character (&) can now be used in fence names. * All packaged files are now installed with proper owners and permissions. * New cluster node members are now properly initialized. * Storage operations can now be completed even if an LVM snapshot is present. * Users are now informed via dialog when nodes are rebooted as part of a cluster operation. * Failover domains are now properly listed for virtual services and traditional clustered services. * Luci can now create and distribute keys for fence_xvmd. All Conga users are advised to upgrade to this update, which applies these fixes and enhancements. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 212006 - create cluster does not show status as cluster is being created 212022 - cannot create cluster using ip addresses 213083 - luci - should display usernames in some logical/sorted order (usability) 218964 - luci - adding node to a cluster - confirm dialog displays cluster name in place of node name (minor) 221899 - Node log displayed in partially random order 222051 - Combining reauthentication/deletion options in one luci display can cause user confusion (usability - post RHEL5 GA) 223162 - Error trying to create a new fence device for a cluster node 224011 - SELinux AVC denied { read } for pid=2390 comm="mdadm" - accessing storage on a node 225164 - Conga allows creation/rename of clusters with name greater than 15 characters 225206 - Cluster cannot be deleted (from 'Manage Systems') - but no error results 225588 - luci web app does not enforce selection of fence port 225747 - Create/delete cluster - then access disk on node = Generic error on host: cluster tools: cman_tool errored 225782 - Need more luci service information on startup - no info written to log about failed start cause 226700 - cman cluster needs restart when going from >=3 to 2 nodes and 2 to >= 3 nodes 227682 - saslauthd[2274]: Deprecated pam_stack module called from service "ricci" 227743 - Intermittent/recurring problem - when cluster is deleted, sometimes a node is not affected 227758 - Entering bad password when creating a new cluster = UnboundLocalError: local variable 'e' referenced before assignment 227852 - Lack of debugging information in logs - support issue 229027 - luci failover domain forms are missing/empty 230447 - fence_xvm is incorrectly listed as "xmv" in virtual cluster 230452 - Advanced options parameters settings don't do anything 230454 - Unable to configure a virtual service 230457 - kmod-gfs-xen not installed with Conga install 230461 - 'enable shared storage' option cleared whenever there is a configuration error 230469 - Must manually edit cluster.conf on the dom0 cluster to add "" 238655 - conga does not set the "nodename" attribute for manual fencing 238726 - Conga provides no way to remove a dead node from a cluster 239327 - Online User Manual needs modification 239388 - conga storage: default VG creation should be clustered if a cluster node 239389 - conga cluster: make 'enable shared storage' the default 240034 - rpm verify fails on luci 240361 - Conga storage UI front-end is too slow rendering storage 241415 - Installation using Conga shows "error" in message during reboot cycle. 241418 - Conga tries to configurage cluster snaps, though they are not available. 241706 - Eliminate confusion in add fence flow 241727 - can't set user permissions in luci 242668 - luci init script can return non-LSB-compliant return codes 243701 - ricci init script can exit with non-LSB-compliant return codes 244146 - Add port number to message when ricci is not started/firewalled on cluster nodes. 244878 - Successful login results in an infinite redirection loop with MSIE 245202 - Conga needs to support Internet Explorer 6.0 and later 248317 - luci sets incorrect permissions on /usr/lib64/luci and /var/lib/luci 249066 - AttributeError when attempting to configure a fence device 249086 - Unable to add a new fence device to cluster 249091 - RFE: tell user they are about to kill all their nodes 249291 - delete node task fails to do all items listed in the help document 249641 - conga is unable to do storage operations if there is an lvm snapshot present 249868 - Use of failover domain not correctly shown 250443 - storage name warning utility produces a storm of warnings which can lock your browser 250834 - ZeroDivisionError when attempting to click an empty lvm volume group 253914 - conga doesn't allow you to reuse nfs export and nfs client resources 253994 - Cannot specify multicast address for a cluster 254038 - Impossible to set many valid quorum disk configurations via conga 336101 - CVE-2007-4136 ricci is vulnerable to a connect DoS attack 6. RPMs required: RHEL Clustering (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/conga-0.10.0-6.el5.src.rpm 533839db60dd93f88e7ec00f0d4ae91d conga-0.10.0-6.el5.src.rpm i386: b2fd36bf216e77eae3b74a99dde1ea38 conga-debuginfo-0.10.0-6.el5.i386.rpm fec2e53d98cb40a8cd72172de6d1e5b7 luci-0.10.0-6.el5.i386.rpm 617d926686f0b74efae83cc0accd99cf ricci-0.10.0-6.el5.i386.rpm ia64: 633a4af70f0ed326d3b0cce2bc1990e1 conga-debuginfo-0.10.0-6.el5.ia64.rpm 1f57552ade9a783a026985ab82295709 luci-0.10.0-6.el5.ia64.rpm 856a84b1011e78644defd836e9fa24f0 ricci-0.10.0-6.el5.ia64.rpm x86_64: b2a92084032dafac79adfd656f88173c conga-debuginfo-0.10.0-6.el5.x86_64.rpm 48ff395dd2205ddb7112bc903cba0d83 luci-0.10.0-6.el5.x86_64.rpm e1aae541e6a564c3f1d1328f93e75708 ricci-0.10.0-6.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4136 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMecyXlSAg2UNWIIRAkAoAKCvfQYmyws/aeG141t8VkJ1MBvjBwCdFvFU UabUAzNRWw+CYUexTev2XAs= =JH75 -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 7 16:27:24 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 7 Nov 2007 11:27:24 -0500 Subject: [RHSA-2007:0710-04] Low: wireshark security update Message-ID: <200711071627.lA7GRODt000918@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Low: wireshark security update Advisory ID: RHSA-2007:0710-04 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0710.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux Keywords: HTTP iSeries DCP ETSI SSL MMS DHCP BOOTP crash loop DoS CVE Names: CVE-2007-3389 CVE-2007-3390 CVE-2007-3391 CVE-2007-3392 CVE-2007-3393 - --------------------------------------------------------------------- 1. Summary: New Wireshark packages that fix various security vulnerabilities are now available for Red Hat Enterprise Linux 5. Wireshark was previously known as Ethereal. This update has been rated as having low security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: Wireshark is a program for monitoring network traffic. Several denial of service bugs were found in Wireshark's HTTP, iSeries, DCP ETSI, SSL, MMS, DHCP and BOOTP protocol dissectors. It was possible for Wireshark to crash or stop responding if it read a malformed packet off the network. (CVE-2007-3389, CVE-2007-3390, CVE-2007-3391, CVE-2007-3392, CVE-2007-3393) Users of Wireshark and Ethereal should upgrade to these updated packages, containing Wireshark version 0.99.6, which is not vulnerable to these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 245796 - CVE-2007-3389 Wireshark crashes when inspecting HTTP traffic 245797 - CVE-2007-3391 Wireshark loops infinitely when inspecting DCP ETSI traffic 245798 - CVE-2007-3392 Wireshark loops infinitely when inspecting SSL traffic 246221 - CVE-2007-3393 Wireshark corrupts the stack when inspecting BOOTP traffic 246225 - CVE-2007-3390 Wireshark crashes when inspecting iSeries traffic 246229 - CVE-2007-3392 Wireshark crashes when inspecting MMS traffic 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/wireshark-0.99.6-1.el5.src.rpm f49fa8d0277d49cd8eaca3cab3d72990 wireshark-0.99.6-1.el5.src.rpm i386: 47debd82ab5bc864a3cdd9dd64484282 wireshark-0.99.6-1.el5.i386.rpm 48c58d3ef97e8cf0f77a9301853c2987 wireshark-debuginfo-0.99.6-1.el5.i386.rpm x86_64: a28ed04bd22158d7cf68bc71589b82c4 wireshark-0.99.6-1.el5.x86_64.rpm 7141bfcf3751bed8454c1b9f3204d8cd wireshark-debuginfo-0.99.6-1.el5.x86_64.rpm RHEL Desktop Workstation (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/wireshark-0.99.6-1.el5.src.rpm f49fa8d0277d49cd8eaca3cab3d72990 wireshark-0.99.6-1.el5.src.rpm i386: 48c58d3ef97e8cf0f77a9301853c2987 wireshark-debuginfo-0.99.6-1.el5.i386.rpm b9b63d2c30c0100d5f573ebc81bd4023 wireshark-gnome-0.99.6-1.el5.i386.rpm x86_64: 7141bfcf3751bed8454c1b9f3204d8cd wireshark-debuginfo-0.99.6-1.el5.x86_64.rpm 8fc46b79d4d74c5434b5a673c38d80d0 wireshark-gnome-0.99.6-1.el5.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/wireshark-0.99.6-1.el5.src.rpm f49fa8d0277d49cd8eaca3cab3d72990 wireshark-0.99.6-1.el5.src.rpm i386: 47debd82ab5bc864a3cdd9dd64484282 wireshark-0.99.6-1.el5.i386.rpm 48c58d3ef97e8cf0f77a9301853c2987 wireshark-debuginfo-0.99.6-1.el5.i386.rpm b9b63d2c30c0100d5f573ebc81bd4023 wireshark-gnome-0.99.6-1.el5.i386.rpm ia64: 9803781c960202e93b07c15edfac733c wireshark-0.99.6-1.el5.ia64.rpm 8e77dc603a06d63b8e53c813d61e607b wireshark-debuginfo-0.99.6-1.el5.ia64.rpm 3711e4d1653c0aac43ee7b08f5149304 wireshark-gnome-0.99.6-1.el5.ia64.rpm ppc: 598a710138caa4c174306ba4930201d4 wireshark-0.99.6-1.el5.ppc.rpm b636439b3c01926fd707162d5c902084 wireshark-debuginfo-0.99.6-1.el5.ppc.rpm 7560565717c181cf210eab9438ae5f29 wireshark-gnome-0.99.6-1.el5.ppc.rpm s390x: 25ac5e44a7a5dcd87c77292999b2501c wireshark-0.99.6-1.el5.s390x.rpm aae09261c552e0c87883df3c155ce2f8 wireshark-debuginfo-0.99.6-1.el5.s390x.rpm 2238fbab472c7f05b7b3ac801f8652dc wireshark-gnome-0.99.6-1.el5.s390x.rpm x86_64: a28ed04bd22158d7cf68bc71589b82c4 wireshark-0.99.6-1.el5.x86_64.rpm 7141bfcf3751bed8454c1b9f3204d8cd wireshark-debuginfo-0.99.6-1.el5.x86_64.rpm 8fc46b79d4d74c5434b5a673c38d80d0 wireshark-gnome-0.99.6-1.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3389 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3390 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3391 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3392 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3393 http://www.wireshark.org/docs/relnotes/wireshark-0.99.6.html http://www.redhat.com/security/updates/classification/#low 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMeddXlSAg2UNWIIRApCRAJ0T5tzQkF53VoziLRZxIaZ3cIAXlwCgpP00 hI0+23jOUk5MK2Sa3wQ8uoM= =73ne -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 7 16:28:01 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 7 Nov 2007 11:28:01 -0500 Subject: [RHSA-2007:0746-04] Moderate: httpd security, bug fix, and enhancement update Message-ID: <200711071628.lA7GS1S1000989@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: httpd security, bug fix, and enhancement update Advisory ID: RHSA-2007:0746-04 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0746.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-3847 - --------------------------------------------------------------------- 1. Summary: Updated httpd packages that fix a security issue, fix various bugs, and add enhancements, are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: The Apache HTTP Server is a popular and freely-available Web server. A flaw was found in the Apache HTTP Server mod_proxy module. On sites where a reverse proxy is configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. On sites where a forward proxy is configured, an attacker could cause a similar crash if a user could be persuaded to visit a malicious site using the proxy. This could lead to a denial of service if using a threaded Multi-Processing Module. (CVE-2007-3847) As well, these updated packages fix the following bugs: * Set-Cookie headers with a status code of 3xx are not forwarded to clients when the "ProxyErrorOverride" directive is enabled. These responses are overridden at the proxy. Only the responses with status codes of 4xx and 5xx are overridden in these updated packages. * the default "/etc/logrotate.d/httpd" script incorrectly invoked the kill command, instead of using the "/sbin/service httpd restart" command. If you configured the httpd PID to be in a location other than "/var/run/httpd.pid", the httpd logs failed to be rotated. This has been resolved in these updated packages. * the "ProxyTimeout" directive was not inherited across virtual host definitions. * the logresolve utility was unable to read lines longer the 1024 bytes. This update adds the following enhancements: * a new configuration option has been added, "ServerTokens Full-Release", which adds the package release to the server version string, which is returned in the "Server" response header. * a new module has been added, mod_version, which allows configuration files to be written containing sections, which are evaluated only if the version of httpd used matches a specified condition. Users of httpd are advised to upgrade to these updated packages, which resolve these issues and add these enhancements. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 240024 - Mod_proxy_http ProxyErrorOverride eating cookies 240857 - [RFE] Apache does not report patch level when scanned 241680 - logrotate.d/httpd postrotate must use initscripts 245719 - mod_proxy configuration inheritance issue 245763 - long lines incorrectly handled by Apache's logresolve 250731 - CVE-2007-3847 httpd out of bounds read 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/httpd-2.2.3-11.el5.src.rpm 3ee6039a6aa2beeb14c55695c48cb6be httpd-2.2.3-11.el5.src.rpm i386: d734aeef038abf88bf4886911c124c7a httpd-2.2.3-11.el5.i386.rpm b16e49ba0ee29fe72b5df11fd928a361 httpd-debuginfo-2.2.3-11.el5.i386.rpm 86a4778fab59148114af83ba1eca224f mod_ssl-2.2.3-11.el5.i386.rpm x86_64: 0030021cc1bc50b7c1d149f7c228d68a httpd-2.2.3-11.el5.x86_64.rpm 04c060ef39947d8a03756456fe013c31 httpd-debuginfo-2.2.3-11.el5.x86_64.rpm fd20a69dc6b00651fae0d0d86511b867 mod_ssl-2.2.3-11.el5.x86_64.rpm RHEL Desktop Workstation (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/httpd-2.2.3-11.el5.src.rpm 3ee6039a6aa2beeb14c55695c48cb6be httpd-2.2.3-11.el5.src.rpm i386: b16e49ba0ee29fe72b5df11fd928a361 httpd-debuginfo-2.2.3-11.el5.i386.rpm 2295f9d39e5e87fa8843f5c6158e2afb httpd-devel-2.2.3-11.el5.i386.rpm c994b3e5b0e2ff8102043792505c91d4 httpd-manual-2.2.3-11.el5.i386.rpm x86_64: b16e49ba0ee29fe72b5df11fd928a361 httpd-debuginfo-2.2.3-11.el5.i386.rpm 04c060ef39947d8a03756456fe013c31 httpd-debuginfo-2.2.3-11.el5.x86_64.rpm 2295f9d39e5e87fa8843f5c6158e2afb httpd-devel-2.2.3-11.el5.i386.rpm 4603c4e041958a602c4bad393c90c6a7 httpd-devel-2.2.3-11.el5.x86_64.rpm 07e2c67b68e178bac107a3e61a929f23 httpd-manual-2.2.3-11.el5.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/httpd-2.2.3-11.el5.src.rpm 3ee6039a6aa2beeb14c55695c48cb6be httpd-2.2.3-11.el5.src.rpm i386: d734aeef038abf88bf4886911c124c7a httpd-2.2.3-11.el5.i386.rpm b16e49ba0ee29fe72b5df11fd928a361 httpd-debuginfo-2.2.3-11.el5.i386.rpm 2295f9d39e5e87fa8843f5c6158e2afb httpd-devel-2.2.3-11.el5.i386.rpm c994b3e5b0e2ff8102043792505c91d4 httpd-manual-2.2.3-11.el5.i386.rpm 86a4778fab59148114af83ba1eca224f mod_ssl-2.2.3-11.el5.i386.rpm ia64: c56a478f241fae66e5a98d9a7160c079 httpd-2.2.3-11.el5.ia64.rpm 384dbc9996ce2fd456639a40a34ac765 httpd-debuginfo-2.2.3-11.el5.ia64.rpm 505c228afa459feb3273e1cea8e2be82 httpd-devel-2.2.3-11.el5.ia64.rpm 401a8cbb5de0e8db47c2ddb0c8373525 httpd-manual-2.2.3-11.el5.ia64.rpm fcec7364955523f2d57ccb51e43ad811 mod_ssl-2.2.3-11.el5.ia64.rpm ppc: 487e19dc73a7f1243fc380ec848c9ed8 httpd-2.2.3-11.el5.ppc.rpm 7a754add4fefa8284bf113f064c0fcc7 httpd-debuginfo-2.2.3-11.el5.ppc.rpm f119c96226df58f9d77a5a8c3c218f1f httpd-debuginfo-2.2.3-11.el5.ppc64.rpm 07427ada748e7b16d2561534a14a02cf httpd-devel-2.2.3-11.el5.ppc.rpm 4997b231b3653909aa8f09dfc4635345 httpd-devel-2.2.3-11.el5.ppc64.rpm 61b181d0f1bd39bbfa7909f1af0f5f12 httpd-manual-2.2.3-11.el5.ppc.rpm 2a9afa90dbde5d937b9c63b02ad86b8c mod_ssl-2.2.3-11.el5.ppc.rpm s390x: 268a9c1257e6630d2630919609defbaf httpd-2.2.3-11.el5.s390x.rpm 1896c36a9bdefb2f024c3daea65673cc httpd-debuginfo-2.2.3-11.el5.s390.rpm 775f81a39195c275e76f6792d68c54a2 httpd-debuginfo-2.2.3-11.el5.s390x.rpm 2cca0b16331ad72d7187f5311e38d919 httpd-devel-2.2.3-11.el5.s390.rpm bfadb9ae50a4f5f9f55a9c486afaf916 httpd-devel-2.2.3-11.el5.s390x.rpm a88989c4b428cf512189c317e16eb70c httpd-manual-2.2.3-11.el5.s390x.rpm 0ada06035539671248eda54a10e4c654 mod_ssl-2.2.3-11.el5.s390x.rpm x86_64: 0030021cc1bc50b7c1d149f7c228d68a httpd-2.2.3-11.el5.x86_64.rpm b16e49ba0ee29fe72b5df11fd928a361 httpd-debuginfo-2.2.3-11.el5.i386.rpm 04c060ef39947d8a03756456fe013c31 httpd-debuginfo-2.2.3-11.el5.x86_64.rpm 2295f9d39e5e87fa8843f5c6158e2afb httpd-devel-2.2.3-11.el5.i386.rpm 4603c4e041958a602c4bad393c90c6a7 httpd-devel-2.2.3-11.el5.x86_64.rpm 07e2c67b68e178bac107a3e61a929f23 httpd-manual-2.2.3-11.el5.x86_64.rpm fd20a69dc6b00651fae0d0d86511b867 mod_ssl-2.2.3-11.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3847 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMeeOXlSAg2UNWIIRAt3CAJ9SzRJ46le8u4PIrBSKJ98BfXex1ACgh5Jz YzFfXAfmtav4AgMh9VMGjrU= =Kh5i -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 7 16:41:33 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 7 Nov 2007 11:41:33 -0500 Subject: [RHSA-2007:0542-05] Low: mcstrans security and bug fix update Message-ID: <200711071641.lA7GfY1p004095@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Low: mcstrans security and bug fix update Advisory ID: RHSA-2007:0542-05 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0542.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-4570 - --------------------------------------------------------------------- 1. Summary: An updated mcstrans package that fixes a security issue and a bug is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: mcstrans is the translation daemon used on SELinux machines to translate program context into human readable form. An algorithmic complexity weakness was found in the way the mcstrans daemon handled ranges of compartments in sensitivity labels. A local user could trigger this flaw causing mctransd to temporarily stop responding to other requests; a partial denial of service. (CVE-2007-4570) This update also fixes a problem where the mcstrans daemon was preventing SSH connections into an SELinux box, that was running a Multi-Level Security (MLS) Policy with multiple categories. Users of mcstrans are advised to upgrade to this updated package, which resolves this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 228398 - LSPP: Not able to ssh into the machine with multiple categories 288201 - CVE-2007-4570 mctransd DoS 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/mcstrans-0.2.6-1.el5.src.rpm 11f10d2f7a344eee82eec893731a4d22 mcstrans-0.2.6-1.el5.src.rpm i386: ade7ed8667b6aa159fa3218c2f842236 mcstrans-0.2.6-1.el5.i386.rpm 6426d76117954de72d832f3912b2e31c mcstrans-debuginfo-0.2.6-1.el5.i386.rpm x86_64: 0db9bf6e576084bb343f826b4f0e6c7b mcstrans-0.2.6-1.el5.x86_64.rpm 23fa93a3b07b1aff4a8348e273168667 mcstrans-debuginfo-0.2.6-1.el5.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/mcstrans-0.2.6-1.el5.src.rpm 11f10d2f7a344eee82eec893731a4d22 mcstrans-0.2.6-1.el5.src.rpm i386: ade7ed8667b6aa159fa3218c2f842236 mcstrans-0.2.6-1.el5.i386.rpm 6426d76117954de72d832f3912b2e31c mcstrans-debuginfo-0.2.6-1.el5.i386.rpm ia64: b798e7bb0c57b63d8537bb49292211d5 mcstrans-0.2.6-1.el5.ia64.rpm 90a599aba629dd033e331d76b5805783 mcstrans-debuginfo-0.2.6-1.el5.ia64.rpm ppc: a0b839b70b33e73d86f7d3d05811fdf5 mcstrans-0.2.6-1.el5.ppc.rpm 79ace618de83151996e3bd3b8cf0ccce mcstrans-debuginfo-0.2.6-1.el5.ppc.rpm s390x: fdc405c2b94baa8de61eedabbe93019b mcstrans-0.2.6-1.el5.s390x.rpm 39eb14688a9d5d4bc06abd64992a3042 mcstrans-debuginfo-0.2.6-1.el5.s390x.rpm x86_64: 0db9bf6e576084bb343f826b4f0e6c7b mcstrans-0.2.6-1.el5.x86_64.rpm 23fa93a3b07b1aff4a8348e273168667 mcstrans-debuginfo-0.2.6-1.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4570 http://www.redhat.com/security/updates/classification/#low 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMeqfXlSAg2UNWIIRAh22AJ4xg6vvXHuSxS8DuPJHlLM63EgdYwCcCw74 1Ls2fmx4BaetrQFfepq2VYM= =KmBt -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 7 17:47:27 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 7 Nov 2007 12:47:27 -0500 Subject: [RHSA-2007:1021-01] Important: cups security update Message-ID: <200711071747.lA7HlRCc018229@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: cups security update Advisory ID: RHSA-2007:1021-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1021.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-4352 CVE-2007-5392 CVE-2007-5393 - --------------------------------------------------------------------- 1. Summary: Updated CUPS packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems. Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause CUPS to crash or potentially execute arbitrary code when printed. (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393) All CUPS users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 345101 - CVE-2007-4352 xpdf memory corruption in DCTStream::readProgressiveDataUnit() 345111 - CVE-2007-5392 xpdf buffer overflow in DCTStream::reset() 345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar() 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/cups-1.2.4-11.14.el5_1.3.src.rpm 0e674156c66a85f4befb25b61ac11219 cups-1.2.4-11.14.el5_1.3.src.rpm i386: 0d1bc137688d648c1a6bb6d723d02131 cups-1.2.4-11.14.el5_1.3.i386.rpm e4e6204901c1baab713b6e9cd47bf3ba cups-debuginfo-1.2.4-11.14.el5_1.3.i386.rpm 9bf17e649f5c0f6c67344279a7dc4d1b cups-libs-1.2.4-11.14.el5_1.3.i386.rpm 725da2778499f0ef3d177ae5de2eac84 cups-lpd-1.2.4-11.14.el5_1.3.i386.rpm x86_64: 8a80ca4d3fb94684b6a157fd0fc03ffc cups-1.2.4-11.14.el5_1.3.x86_64.rpm e4e6204901c1baab713b6e9cd47bf3ba cups-debuginfo-1.2.4-11.14.el5_1.3.i386.rpm 1685646d0d294c5096cb749d994b0ccd cups-debuginfo-1.2.4-11.14.el5_1.3.x86_64.rpm 9bf17e649f5c0f6c67344279a7dc4d1b cups-libs-1.2.4-11.14.el5_1.3.i386.rpm e7122321cb07e24fdea833aeb99fceff cups-libs-1.2.4-11.14.el5_1.3.x86_64.rpm f1d2584267c494a0df96afb0f95cda27 cups-lpd-1.2.4-11.14.el5_1.3.x86_64.rpm RHEL Desktop Workstation (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/cups-1.2.4-11.14.el5_1.3.src.rpm 0e674156c66a85f4befb25b61ac11219 cups-1.2.4-11.14.el5_1.3.src.rpm i386: e4e6204901c1baab713b6e9cd47bf3ba cups-debuginfo-1.2.4-11.14.el5_1.3.i386.rpm ed50e67e5ac81816025b7044a60ff05c cups-devel-1.2.4-11.14.el5_1.3.i386.rpm x86_64: e4e6204901c1baab713b6e9cd47bf3ba cups-debuginfo-1.2.4-11.14.el5_1.3.i386.rpm 1685646d0d294c5096cb749d994b0ccd cups-debuginfo-1.2.4-11.14.el5_1.3.x86_64.rpm ed50e67e5ac81816025b7044a60ff05c cups-devel-1.2.4-11.14.el5_1.3.i386.rpm d6e9593b5bd3da21bfd5a722fd9153a9 cups-devel-1.2.4-11.14.el5_1.3.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/cups-1.2.4-11.14.el5_1.3.src.rpm 0e674156c66a85f4befb25b61ac11219 cups-1.2.4-11.14.el5_1.3.src.rpm i386: 0d1bc137688d648c1a6bb6d723d02131 cups-1.2.4-11.14.el5_1.3.i386.rpm e4e6204901c1baab713b6e9cd47bf3ba cups-debuginfo-1.2.4-11.14.el5_1.3.i386.rpm ed50e67e5ac81816025b7044a60ff05c cups-devel-1.2.4-11.14.el5_1.3.i386.rpm 9bf17e649f5c0f6c67344279a7dc4d1b cups-libs-1.2.4-11.14.el5_1.3.i386.rpm 725da2778499f0ef3d177ae5de2eac84 cups-lpd-1.2.4-11.14.el5_1.3.i386.rpm ia64: 6d6d5b2c9bb192c0221fab51ca406e54 cups-1.2.4-11.14.el5_1.3.ia64.rpm e4e6204901c1baab713b6e9cd47bf3ba cups-debuginfo-1.2.4-11.14.el5_1.3.i386.rpm 1fd9e56a67d23a794bfe4d6f92eb74ac cups-debuginfo-1.2.4-11.14.el5_1.3.ia64.rpm f8993c91631e1cb221053970359a15c3 cups-devel-1.2.4-11.14.el5_1.3.ia64.rpm 9bf17e649f5c0f6c67344279a7dc4d1b cups-libs-1.2.4-11.14.el5_1.3.i386.rpm b563493fa5c9938711246df30849740e cups-libs-1.2.4-11.14.el5_1.3.ia64.rpm fbeff7413bedcb74acd9691ffd34ec16 cups-lpd-1.2.4-11.14.el5_1.3.ia64.rpm ppc: 568c33780523d8934fd44cb8b38572f7 cups-1.2.4-11.14.el5_1.3.ppc.rpm 89302dadc2de2e1fd067c1468244d9d4 cups-debuginfo-1.2.4-11.14.el5_1.3.ppc.rpm b6eba796dede6c33f28887f142ec197b cups-debuginfo-1.2.4-11.14.el5_1.3.ppc64.rpm 8f47bde999fd4a20fdd95df19aa4d348 cups-devel-1.2.4-11.14.el5_1.3.ppc.rpm 904299c55e793be74463ed447d4c7912 cups-devel-1.2.4-11.14.el5_1.3.ppc64.rpm e510688e304707cdc2e69fbb690c105a cups-libs-1.2.4-11.14.el5_1.3.ppc.rpm a46a28e1dd83f550a8f90f76dd5de253 cups-libs-1.2.4-11.14.el5_1.3.ppc64.rpm 22240ec5fb56b681652830c602f6d3ac cups-lpd-1.2.4-11.14.el5_1.3.ppc.rpm s390x: 0600130d9ffbc51fefefe5363161f809 cups-1.2.4-11.14.el5_1.3.s390x.rpm 747bc08e1347512b1250f2065f33ec82 cups-debuginfo-1.2.4-11.14.el5_1.3.s390.rpm 3e9253116a2fc0990fd7fb8df3330c0e cups-debuginfo-1.2.4-11.14.el5_1.3.s390x.rpm 205945b86014307d0351d958a3045bfd cups-devel-1.2.4-11.14.el5_1.3.s390.rpm 4494cce4dc572b50d825343ec9b2cfc1 cups-devel-1.2.4-11.14.el5_1.3.s390x.rpm f58cff49807950fe15a0431d9c0eb0a4 cups-libs-1.2.4-11.14.el5_1.3.s390.rpm 5b1a7f99fb9a376ac9dd6001bfc2400e cups-libs-1.2.4-11.14.el5_1.3.s390x.rpm 8f41c8e4ad65b647974012e97e559050 cups-lpd-1.2.4-11.14.el5_1.3.s390x.rpm x86_64: 8a80ca4d3fb94684b6a157fd0fc03ffc cups-1.2.4-11.14.el5_1.3.x86_64.rpm e4e6204901c1baab713b6e9cd47bf3ba cups-debuginfo-1.2.4-11.14.el5_1.3.i386.rpm 1685646d0d294c5096cb749d994b0ccd cups-debuginfo-1.2.4-11.14.el5_1.3.x86_64.rpm ed50e67e5ac81816025b7044a60ff05c cups-devel-1.2.4-11.14.el5_1.3.i386.rpm d6e9593b5bd3da21bfd5a722fd9153a9 cups-devel-1.2.4-11.14.el5_1.3.x86_64.rpm 9bf17e649f5c0f6c67344279a7dc4d1b cups-libs-1.2.4-11.14.el5_1.3.i386.rpm e7122321cb07e24fdea833aeb99fceff cups-libs-1.2.4-11.14.el5_1.3.x86_64.rpm f1d2584267c494a0df96afb0f95cda27 cups-lpd-1.2.4-11.14.el5_1.3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4352 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5392 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5393 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMfoZXlSAg2UNWIIRArocAJ4qfSAilKdPu6YvnbCb1h/QuxFdZACdFmeI ypqsscJDPG7VSjjYrOsOTf8= =lc2f -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 7 18:00:19 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 7 Nov 2007 13:00:19 -0500 Subject: [RHSA-2007:1022-01] Important: cups security update Message-ID: <200711071800.lA7I0JsA020922@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: cups security update Advisory ID: RHSA-2007:1022-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1022.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-4045 CVE-2007-4351 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393 - --------------------------------------------------------------------- 1. Summary: Updated cups packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems. Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause CUPS to crash or potentially execute arbitrary code when printed. (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393) Alin Rad Pop discovered a flaw in in the way CUPS handles certain IPP tags. A remote attacker who is able to connect to the IPP TCP port could send a malicious request causing the CUPS daemon to crash. (CVE-2007-4351) A flaw was found in the way CUPS handled SSL negotiation. A remote attacker capable of connecting to the CUPS daemon could cause CUPS to crash. (CVE-2007-4045) All CUPS users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 250161 - CVE-2007-4045 Incomplete fix for CVE-2007-0720 CUPS denial of service 345091 - CVE-2007-4351 cups boundary error 345101 - CVE-2007-4352 xpdf memory corruption in DCTStream::readProgressiveDataUnit() 345111 - CVE-2007-5392 xpdf buffer overflow in DCTStream::reset() 345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar() 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/cups-1.1.22-0.rc1.9.20.2.el4_5.2.src.rpm 87d4f1fd6ca6b148140870504f0257b2 cups-1.1.22-0.rc1.9.20.2.el4_5.2.src.rpm i386: 0b2dd80ca58b7fcc5ad84f8e1ecd0e81 cups-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm a0144131175798c92f8f35465f37e115 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm 5c00544011bb0dacb4e41e79104d0f0e cups-devel-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm fced80c7c01ff6db29cbd090bc516b4f cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm ia64: d16b549b7db56a64bcfb1b84d93a4c05 cups-1.1.22-0.rc1.9.20.2.el4_5.2.ia64.rpm a0144131175798c92f8f35465f37e115 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm 3c974d7e4ad72415a93b6e4f663e8982 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.ia64.rpm 8509e970c0d5775aeed6b63052d2b236 cups-devel-1.1.22-0.rc1.9.20.2.el4_5.2.ia64.rpm fced80c7c01ff6db29cbd090bc516b4f cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm 0a90a78354eaabe482197beee1252b65 cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.ia64.rpm ppc: 0d960f2f76cbf3cbf66cb8ba709a6cdc cups-1.1.22-0.rc1.9.20.2.el4_5.2.ppc.rpm 9e4663850f766c1eb7436a481ec35e27 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.ppc.rpm db85f6fc99d3c8e0664886b806bc3831 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.ppc64.rpm db613329c8d17b9768fb036d823a02e9 cups-devel-1.1.22-0.rc1.9.20.2.el4_5.2.ppc.rpm 2156b4fa59f3707f3109f0459486cd81 cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.ppc.rpm 8c37e553d1f4ec9eef4deb92c48247ac cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.ppc64.rpm s390: 591d99417d2ca16cdc119bca9389800b cups-1.1.22-0.rc1.9.20.2.el4_5.2.s390.rpm 37a5965ac05d2cddbd779e200810c7ae cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.s390.rpm 0ba3a1ca70208f3c0659e2439a0a3d67 cups-devel-1.1.22-0.rc1.9.20.2.el4_5.2.s390.rpm aa7ac1b0d5cde56f20aacec0cf1d5d3c cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.s390.rpm s390x: dbc10680046467c823e05ac2724fae50 cups-1.1.22-0.rc1.9.20.2.el4_5.2.s390x.rpm 37a5965ac05d2cddbd779e200810c7ae cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.s390.rpm 4eabb8e617b4b7f40b1ea9957f048c25 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.s390x.rpm a02e3c07a980aa7d59efa690c2dd798d cups-devel-1.1.22-0.rc1.9.20.2.el4_5.2.s390x.rpm aa7ac1b0d5cde56f20aacec0cf1d5d3c cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.s390.rpm ff9d62f4e7b4b3065498ca63f084f71c cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.s390x.rpm x86_64: d4c61974402d4a95ad77bf1eb837350f cups-1.1.22-0.rc1.9.20.2.el4_5.2.x86_64.rpm a0144131175798c92f8f35465f37e115 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm 7f21cd350f2242a960c0736ddff82517 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.x86_64.rpm 7bff3f38344be659b135fae842303ae0 cups-devel-1.1.22-0.rc1.9.20.2.el4_5.2.x86_64.rpm fced80c7c01ff6db29cbd090bc516b4f cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm d328339cf064b6c33a12077ed94c506d cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/cups-1.1.22-0.rc1.9.20.2.el4_5.2.src.rpm 87d4f1fd6ca6b148140870504f0257b2 cups-1.1.22-0.rc1.9.20.2.el4_5.2.src.rpm i386: 0b2dd80ca58b7fcc5ad84f8e1ecd0e81 cups-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm a0144131175798c92f8f35465f37e115 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm 5c00544011bb0dacb4e41e79104d0f0e cups-devel-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm fced80c7c01ff6db29cbd090bc516b4f cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm x86_64: d4c61974402d4a95ad77bf1eb837350f cups-1.1.22-0.rc1.9.20.2.el4_5.2.x86_64.rpm a0144131175798c92f8f35465f37e115 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm 7f21cd350f2242a960c0736ddff82517 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.x86_64.rpm 7bff3f38344be659b135fae842303ae0 cups-devel-1.1.22-0.rc1.9.20.2.el4_5.2.x86_64.rpm fced80c7c01ff6db29cbd090bc516b4f cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm d328339cf064b6c33a12077ed94c506d cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/cups-1.1.22-0.rc1.9.20.2.el4_5.2.src.rpm 87d4f1fd6ca6b148140870504f0257b2 cups-1.1.22-0.rc1.9.20.2.el4_5.2.src.rpm i386: 0b2dd80ca58b7fcc5ad84f8e1ecd0e81 cups-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm a0144131175798c92f8f35465f37e115 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm 5c00544011bb0dacb4e41e79104d0f0e cups-devel-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm fced80c7c01ff6db29cbd090bc516b4f cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm ia64: d16b549b7db56a64bcfb1b84d93a4c05 cups-1.1.22-0.rc1.9.20.2.el4_5.2.ia64.rpm a0144131175798c92f8f35465f37e115 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm 3c974d7e4ad72415a93b6e4f663e8982 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.ia64.rpm 8509e970c0d5775aeed6b63052d2b236 cups-devel-1.1.22-0.rc1.9.20.2.el4_5.2.ia64.rpm fced80c7c01ff6db29cbd090bc516b4f cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm 0a90a78354eaabe482197beee1252b65 cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.ia64.rpm x86_64: d4c61974402d4a95ad77bf1eb837350f cups-1.1.22-0.rc1.9.20.2.el4_5.2.x86_64.rpm a0144131175798c92f8f35465f37e115 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm 7f21cd350f2242a960c0736ddff82517 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.x86_64.rpm 7bff3f38344be659b135fae842303ae0 cups-devel-1.1.22-0.rc1.9.20.2.el4_5.2.x86_64.rpm fced80c7c01ff6db29cbd090bc516b4f cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm d328339cf064b6c33a12077ed94c506d cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/cups-1.1.22-0.rc1.9.20.2.el4_5.2.src.rpm 87d4f1fd6ca6b148140870504f0257b2 cups-1.1.22-0.rc1.9.20.2.el4_5.2.src.rpm i386: 0b2dd80ca58b7fcc5ad84f8e1ecd0e81 cups-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm a0144131175798c92f8f35465f37e115 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm 5c00544011bb0dacb4e41e79104d0f0e cups-devel-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm fced80c7c01ff6db29cbd090bc516b4f cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm ia64: d16b549b7db56a64bcfb1b84d93a4c05 cups-1.1.22-0.rc1.9.20.2.el4_5.2.ia64.rpm a0144131175798c92f8f35465f37e115 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm 3c974d7e4ad72415a93b6e4f663e8982 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.ia64.rpm 8509e970c0d5775aeed6b63052d2b236 cups-devel-1.1.22-0.rc1.9.20.2.el4_5.2.ia64.rpm fced80c7c01ff6db29cbd090bc516b4f cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm 0a90a78354eaabe482197beee1252b65 cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.ia64.rpm x86_64: d4c61974402d4a95ad77bf1eb837350f cups-1.1.22-0.rc1.9.20.2.el4_5.2.x86_64.rpm a0144131175798c92f8f35465f37e115 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm 7f21cd350f2242a960c0736ddff82517 cups-debuginfo-1.1.22-0.rc1.9.20.2.el4_5.2.x86_64.rpm 7bff3f38344be659b135fae842303ae0 cups-devel-1.1.22-0.rc1.9.20.2.el4_5.2.x86_64.rpm fced80c7c01ff6db29cbd090bc516b4f cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.i386.rpm d328339cf064b6c33a12077ed94c506d cups-libs-1.1.22-0.rc1.9.20.2.el4_5.2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4045 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4351 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4352 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5392 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5393 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMf0jXlSAg2UNWIIRAumHAKCBw82krEPk1iVE1I+dWCkDXyAJ1ACgmzuz I8ScorYcJDyTIdhHoaVFmgs= =g+wQ -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 7 18:00:30 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 7 Nov 2007 13:00:30 -0500 Subject: [RHSA-2007:1023-01] Important: cups security update Message-ID: <200711071800.lA7I0UGH020936@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: cups security update Advisory ID: RHSA-2007:1023-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1023.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-4045 CVE-2007-4351 CVE-2007-5393 - --------------------------------------------------------------------- 1. Summary: Updated cups packages that fix several security issues are now available for Red Hat Enterprise Linux 3. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 3. Problem description: The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems. Alin Rad Pop discovered a flaw in the handling of PDF files. An attacker could create a malicious PDF file that would cause CUPS to crash or potentially execute arbitrary code when printed. (CVE-2007-5393) Alin Rad Pop discovered a flaw in in the way CUPS handles certain IPP tags. A remote attacker who is able to connect to the IPP TCP port could send a malicious request causing the CUPS daemon to crash. (CVE-2007-4351) A flaw was found in the way CUPS handled SSL negotiation. A remote attacker capable of connecting to the CUPS daemon could cause CUPS to crash. (CVE-2007-4045) All CUPS users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 250161 - CVE-2007-4045 Incomplete fix for CVE-2007-0720 CUPS denial of service 345091 - CVE-2007-4351 cups boundary error 345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar() 6. RPMs required: Red Hat Enterprise Linux AS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/cups-1.1.17-13.3.46.src.rpm a09f89cd409ee521a73c4a7b0d72e29b cups-1.1.17-13.3.46.src.rpm i386: f55403eca3a9567f06d4f7c23c306aa5 cups-1.1.17-13.3.46.i386.rpm e1ae947c7428c82017b77b69efa8e5cc cups-debuginfo-1.1.17-13.3.46.i386.rpm 0367f3b029e7d2e19026c5de170cc1c1 cups-devel-1.1.17-13.3.46.i386.rpm 6ac644913a17a1ad25d4e9a2cc22067b cups-libs-1.1.17-13.3.46.i386.rpm ia64: 7f71acf2fa6ed3293093d702db16d41f cups-1.1.17-13.3.46.ia64.rpm e1ae947c7428c82017b77b69efa8e5cc cups-debuginfo-1.1.17-13.3.46.i386.rpm d07ac232859f491bf1e0da3a35ec9a57 cups-debuginfo-1.1.17-13.3.46.ia64.rpm 981c9e9d29f188c76f23d517223b62b6 cups-devel-1.1.17-13.3.46.ia64.rpm 6ac644913a17a1ad25d4e9a2cc22067b cups-libs-1.1.17-13.3.46.i386.rpm 9eb3353013c45f36f51898546d6449cb cups-libs-1.1.17-13.3.46.ia64.rpm ppc: 2867471d07abf916a09661e210452eb5 cups-1.1.17-13.3.46.ppc.rpm 136fe0dc122329e8b11cdb566b525f97 cups-debuginfo-1.1.17-13.3.46.ppc.rpm a11bf7e757a8d6150a3cf8bdfdf4da15 cups-debuginfo-1.1.17-13.3.46.ppc64.rpm e9bea7b8a5fbc22c61a6c418d1eb78a2 cups-devel-1.1.17-13.3.46.ppc.rpm 47bfa96ebf919d2d5fb674385567804d cups-libs-1.1.17-13.3.46.ppc.rpm 0995e9aa0e95656b2db64b9488dafae3 cups-libs-1.1.17-13.3.46.ppc64.rpm s390: d89b822fd9c6785cc65716569750ef66 cups-1.1.17-13.3.46.s390.rpm 99235d722639fc075be91f4518bb880f cups-debuginfo-1.1.17-13.3.46.s390.rpm 728e5f195fef201ebce131f1e02b5cc9 cups-devel-1.1.17-13.3.46.s390.rpm d6127b0b5a9854292ca57958363ce74c cups-libs-1.1.17-13.3.46.s390.rpm s390x: 80a32a8329e423361fb417200427f2de cups-1.1.17-13.3.46.s390x.rpm 99235d722639fc075be91f4518bb880f cups-debuginfo-1.1.17-13.3.46.s390.rpm 307df9444ae2a89ac33ad753b87cb2a0 cups-debuginfo-1.1.17-13.3.46.s390x.rpm 6a178fff3a8264aa22e010491ee70cab cups-devel-1.1.17-13.3.46.s390x.rpm d6127b0b5a9854292ca57958363ce74c cups-libs-1.1.17-13.3.46.s390.rpm 5521921be20a245d605c4e85b325163a cups-libs-1.1.17-13.3.46.s390x.rpm x86_64: ae11cae5bf269e1d1169bf7c60325632 cups-1.1.17-13.3.46.x86_64.rpm e1ae947c7428c82017b77b69efa8e5cc cups-debuginfo-1.1.17-13.3.46.i386.rpm abae6e413a7854db0727d50ce87bce9f cups-debuginfo-1.1.17-13.3.46.x86_64.rpm 7a31caefcfee7a387703847925345593 cups-devel-1.1.17-13.3.46.x86_64.rpm 6ac644913a17a1ad25d4e9a2cc22067b cups-libs-1.1.17-13.3.46.i386.rpm 77db48d6d4d4fbe4f7d510384118d62b cups-libs-1.1.17-13.3.46.x86_64.rpm Red Hat Desktop version 3: SRPMS: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/cups-1.1.17-13.3.46.src.rpm a09f89cd409ee521a73c4a7b0d72e29b cups-1.1.17-13.3.46.src.rpm i386: f55403eca3a9567f06d4f7c23c306aa5 cups-1.1.17-13.3.46.i386.rpm e1ae947c7428c82017b77b69efa8e5cc cups-debuginfo-1.1.17-13.3.46.i386.rpm 0367f3b029e7d2e19026c5de170cc1c1 cups-devel-1.1.17-13.3.46.i386.rpm 6ac644913a17a1ad25d4e9a2cc22067b cups-libs-1.1.17-13.3.46.i386.rpm x86_64: ae11cae5bf269e1d1169bf7c60325632 cups-1.1.17-13.3.46.x86_64.rpm e1ae947c7428c82017b77b69efa8e5cc cups-debuginfo-1.1.17-13.3.46.i386.rpm abae6e413a7854db0727d50ce87bce9f cups-debuginfo-1.1.17-13.3.46.x86_64.rpm 7a31caefcfee7a387703847925345593 cups-devel-1.1.17-13.3.46.x86_64.rpm 6ac644913a17a1ad25d4e9a2cc22067b cups-libs-1.1.17-13.3.46.i386.rpm 77db48d6d4d4fbe4f7d510384118d62b cups-libs-1.1.17-13.3.46.x86_64.rpm Red Hat Enterprise Linux ES version 3: SRPMS: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/cups-1.1.17-13.3.46.src.rpm a09f89cd409ee521a73c4a7b0d72e29b cups-1.1.17-13.3.46.src.rpm i386: f55403eca3a9567f06d4f7c23c306aa5 cups-1.1.17-13.3.46.i386.rpm e1ae947c7428c82017b77b69efa8e5cc cups-debuginfo-1.1.17-13.3.46.i386.rpm 0367f3b029e7d2e19026c5de170cc1c1 cups-devel-1.1.17-13.3.46.i386.rpm 6ac644913a17a1ad25d4e9a2cc22067b cups-libs-1.1.17-13.3.46.i386.rpm ia64: 7f71acf2fa6ed3293093d702db16d41f cups-1.1.17-13.3.46.ia64.rpm e1ae947c7428c82017b77b69efa8e5cc cups-debuginfo-1.1.17-13.3.46.i386.rpm d07ac232859f491bf1e0da3a35ec9a57 cups-debuginfo-1.1.17-13.3.46.ia64.rpm 981c9e9d29f188c76f23d517223b62b6 cups-devel-1.1.17-13.3.46.ia64.rpm 6ac644913a17a1ad25d4e9a2cc22067b cups-libs-1.1.17-13.3.46.i386.rpm 9eb3353013c45f36f51898546d6449cb cups-libs-1.1.17-13.3.46.ia64.rpm x86_64: ae11cae5bf269e1d1169bf7c60325632 cups-1.1.17-13.3.46.x86_64.rpm e1ae947c7428c82017b77b69efa8e5cc cups-debuginfo-1.1.17-13.3.46.i386.rpm abae6e413a7854db0727d50ce87bce9f cups-debuginfo-1.1.17-13.3.46.x86_64.rpm 7a31caefcfee7a387703847925345593 cups-devel-1.1.17-13.3.46.x86_64.rpm 6ac644913a17a1ad25d4e9a2cc22067b cups-libs-1.1.17-13.3.46.i386.rpm 77db48d6d4d4fbe4f7d510384118d62b cups-libs-1.1.17-13.3.46.x86_64.rpm Red Hat Enterprise Linux WS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/cups-1.1.17-13.3.46.src.rpm a09f89cd409ee521a73c4a7b0d72e29b cups-1.1.17-13.3.46.src.rpm i386: f55403eca3a9567f06d4f7c23c306aa5 cups-1.1.17-13.3.46.i386.rpm e1ae947c7428c82017b77b69efa8e5cc cups-debuginfo-1.1.17-13.3.46.i386.rpm 0367f3b029e7d2e19026c5de170cc1c1 cups-devel-1.1.17-13.3.46.i386.rpm 6ac644913a17a1ad25d4e9a2cc22067b cups-libs-1.1.17-13.3.46.i386.rpm ia64: 7f71acf2fa6ed3293093d702db16d41f cups-1.1.17-13.3.46.ia64.rpm e1ae947c7428c82017b77b69efa8e5cc cups-debuginfo-1.1.17-13.3.46.i386.rpm d07ac232859f491bf1e0da3a35ec9a57 cups-debuginfo-1.1.17-13.3.46.ia64.rpm 981c9e9d29f188c76f23d517223b62b6 cups-devel-1.1.17-13.3.46.ia64.rpm 6ac644913a17a1ad25d4e9a2cc22067b cups-libs-1.1.17-13.3.46.i386.rpm 9eb3353013c45f36f51898546d6449cb cups-libs-1.1.17-13.3.46.ia64.rpm x86_64: ae11cae5bf269e1d1169bf7c60325632 cups-1.1.17-13.3.46.x86_64.rpm e1ae947c7428c82017b77b69efa8e5cc cups-debuginfo-1.1.17-13.3.46.i386.rpm abae6e413a7854db0727d50ce87bce9f cups-debuginfo-1.1.17-13.3.46.x86_64.rpm 7a31caefcfee7a387703847925345593 cups-devel-1.1.17-13.3.46.x86_64.rpm 6ac644913a17a1ad25d4e9a2cc22067b cups-libs-1.1.17-13.3.46.i386.rpm 77db48d6d4d4fbe4f7d510384118d62b cups-libs-1.1.17-13.3.46.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4045 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4351 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5393 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMf02XlSAg2UNWIIRAurSAKCTTixBE4m91WfBRZ7pBSrUBSo5mACfehEq vPDjBf60QORIQ3m6Lzp2/sg= =34rU -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 7 18:08:13 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 7 Nov 2007 13:08:13 -0500 Subject: [RHSA-2007:1025-01] Important: gpdf security update Message-ID: <200711071808.lA7I8DSm022259@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: gpdf security update Advisory ID: RHSA-2007:1025-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1025.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-4352 CVE-2007-5392 CVE-2007-5393 - --------------------------------------------------------------------- 1. Summary: Updated gpdf packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: gpdf is a GNOME-based viewer for Portable Document Format (PDF) files. Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause gpdf to crash, or potentially execute arbitrary code when opened. (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393) Users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 345101 - CVE-2007-4352 xpdf memory corruption in DCTStream::readProgressiveDataUnit() 345111 - CVE-2007-5392 xpdf buffer overflow in DCTStream::reset() 345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar() 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/gpdf-2.8.2-7.7.1.src.rpm f4f7acbb9f48478834983b75d291de4d gpdf-2.8.2-7.7.1.src.rpm i386: 1b72ecf4d50090e7545c891f79a27903 gpdf-2.8.2-7.7.1.i386.rpm af1afe26edee84377625ba76a224aae8 gpdf-debuginfo-2.8.2-7.7.1.i386.rpm ia64: 79a213a5e41a001b776f8d92284aa658 gpdf-2.8.2-7.7.1.ia64.rpm d5cf5fd3e1345d9c5bda4bdcbfac1fa7 gpdf-debuginfo-2.8.2-7.7.1.ia64.rpm ppc: 54b9638c6ec4dcf40e2ed9399a127c56 gpdf-2.8.2-7.7.1.ppc.rpm 92a06e76972699dcd242b24f30f56987 gpdf-debuginfo-2.8.2-7.7.1.ppc.rpm s390: 8a4e50dc8f5adcda54a25813bba540c5 gpdf-2.8.2-7.7.1.s390.rpm 79a6de142fd15e34df673af511e6eafc gpdf-debuginfo-2.8.2-7.7.1.s390.rpm s390x: 86f6acbeb9e3edc17002663f61666f69 gpdf-2.8.2-7.7.1.s390x.rpm 1e62bdfdd4b48024ca2265fa59678c76 gpdf-debuginfo-2.8.2-7.7.1.s390x.rpm x86_64: 357b7239bf3a6d8fec64605cf2f067aa gpdf-2.8.2-7.7.1.x86_64.rpm 5d5ba42a3326876395e2adc9cdc449c5 gpdf-debuginfo-2.8.2-7.7.1.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/gpdf-2.8.2-7.7.1.src.rpm f4f7acbb9f48478834983b75d291de4d gpdf-2.8.2-7.7.1.src.rpm i386: 1b72ecf4d50090e7545c891f79a27903 gpdf-2.8.2-7.7.1.i386.rpm af1afe26edee84377625ba76a224aae8 gpdf-debuginfo-2.8.2-7.7.1.i386.rpm x86_64: 357b7239bf3a6d8fec64605cf2f067aa gpdf-2.8.2-7.7.1.x86_64.rpm 5d5ba42a3326876395e2adc9cdc449c5 gpdf-debuginfo-2.8.2-7.7.1.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/gpdf-2.8.2-7.7.1.src.rpm f4f7acbb9f48478834983b75d291de4d gpdf-2.8.2-7.7.1.src.rpm i386: 1b72ecf4d50090e7545c891f79a27903 gpdf-2.8.2-7.7.1.i386.rpm af1afe26edee84377625ba76a224aae8 gpdf-debuginfo-2.8.2-7.7.1.i386.rpm ia64: 79a213a5e41a001b776f8d92284aa658 gpdf-2.8.2-7.7.1.ia64.rpm d5cf5fd3e1345d9c5bda4bdcbfac1fa7 gpdf-debuginfo-2.8.2-7.7.1.ia64.rpm x86_64: 357b7239bf3a6d8fec64605cf2f067aa gpdf-2.8.2-7.7.1.x86_64.rpm 5d5ba42a3326876395e2adc9cdc449c5 gpdf-debuginfo-2.8.2-7.7.1.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/gpdf-2.8.2-7.7.1.src.rpm f4f7acbb9f48478834983b75d291de4d gpdf-2.8.2-7.7.1.src.rpm i386: 1b72ecf4d50090e7545c891f79a27903 gpdf-2.8.2-7.7.1.i386.rpm af1afe26edee84377625ba76a224aae8 gpdf-debuginfo-2.8.2-7.7.1.i386.rpm ia64: 79a213a5e41a001b776f8d92284aa658 gpdf-2.8.2-7.7.1.ia64.rpm d5cf5fd3e1345d9c5bda4bdcbfac1fa7 gpdf-debuginfo-2.8.2-7.7.1.ia64.rpm x86_64: 357b7239bf3a6d8fec64605cf2f067aa gpdf-2.8.2-7.7.1.x86_64.rpm 5d5ba42a3326876395e2adc9cdc449c5 gpdf-debuginfo-2.8.2-7.7.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4352 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5392 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5393 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMf7DXlSAg2UNWIIRAll5AJoDsgTuqzsUuEQKtTU3iJGHJUOc6ACglakm XYL66Qo4/whybCH8/a8oCn4= =upjV -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 7 18:10:52 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 7 Nov 2007 13:10:52 -0500 Subject: [RHSA-2007:1026-01] Important: poppler security update Message-ID: <200711071810.lA7IAqeV023036@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: poppler security update Advisory ID: RHSA-2007:1026-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1026.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-4352 CVE-2007-5392 CVE-2007-5393 - --------------------------------------------------------------------- 1. Summary: Updated poppler packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: Poppler is a PDF rendering library, used by applications such as evince. Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause an application linked with poppler to crash, or potentially execute arbitrary code when opened. (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393) Users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 345101 - CVE-2007-4352 xpdf memory corruption in DCTStream::readProgressiveDataUnit() 345111 - CVE-2007-5392 xpdf buffer overflow in DCTStream::reset() 345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar() 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/poppler-0.5.4-4.3.el5_1.src.rpm 69632e7868ae30f5c7511421493a01be poppler-0.5.4-4.3.el5_1.src.rpm i386: 840ac371305da7343736841e554b93e5 poppler-0.5.4-4.3.el5_1.i386.rpm 0f9a1f599941a1ac395dbfaa98d92c98 poppler-debuginfo-0.5.4-4.3.el5_1.i386.rpm b365b83be4738430b7c0e9d4a96f08fd poppler-utils-0.5.4-4.3.el5_1.i386.rpm x86_64: 840ac371305da7343736841e554b93e5 poppler-0.5.4-4.3.el5_1.i386.rpm c4f9253e89bb71a5d4c7a1f4d7e10f63 poppler-0.5.4-4.3.el5_1.x86_64.rpm 0f9a1f599941a1ac395dbfaa98d92c98 poppler-debuginfo-0.5.4-4.3.el5_1.i386.rpm 3a34912d2523ee3181a3238e4a793bf3 poppler-debuginfo-0.5.4-4.3.el5_1.x86_64.rpm 6a27df425f22244009394d770f58fc2c poppler-utils-0.5.4-4.3.el5_1.x86_64.rpm RHEL Desktop Workstation (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/poppler-0.5.4-4.3.el5_1.src.rpm 69632e7868ae30f5c7511421493a01be poppler-0.5.4-4.3.el5_1.src.rpm i386: 0f9a1f599941a1ac395dbfaa98d92c98 poppler-debuginfo-0.5.4-4.3.el5_1.i386.rpm 53b761d6d293af2a3b9cd32f13f2e89a poppler-devel-0.5.4-4.3.el5_1.i386.rpm x86_64: 0f9a1f599941a1ac395dbfaa98d92c98 poppler-debuginfo-0.5.4-4.3.el5_1.i386.rpm 3a34912d2523ee3181a3238e4a793bf3 poppler-debuginfo-0.5.4-4.3.el5_1.x86_64.rpm 53b761d6d293af2a3b9cd32f13f2e89a poppler-devel-0.5.4-4.3.el5_1.i386.rpm a3f589c0d86eb34e982bf1c52ae63ce1 poppler-devel-0.5.4-4.3.el5_1.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/poppler-0.5.4-4.3.el5_1.src.rpm 69632e7868ae30f5c7511421493a01be poppler-0.5.4-4.3.el5_1.src.rpm i386: 840ac371305da7343736841e554b93e5 poppler-0.5.4-4.3.el5_1.i386.rpm 0f9a1f599941a1ac395dbfaa98d92c98 poppler-debuginfo-0.5.4-4.3.el5_1.i386.rpm 53b761d6d293af2a3b9cd32f13f2e89a poppler-devel-0.5.4-4.3.el5_1.i386.rpm b365b83be4738430b7c0e9d4a96f08fd poppler-utils-0.5.4-4.3.el5_1.i386.rpm ia64: 89db64c41392198fa374d3bf30ade381 poppler-0.5.4-4.3.el5_1.ia64.rpm b3d4ccf16dde38ae59deb5620a737131 poppler-debuginfo-0.5.4-4.3.el5_1.ia64.rpm aad3e4d678645b86c9bd77bdd4a504ad poppler-devel-0.5.4-4.3.el5_1.ia64.rpm f6181b9d6b21df64fa2e359c37a61643 poppler-utils-0.5.4-4.3.el5_1.ia64.rpm ppc: 0a47709c4831e6f4e3568ddeed38f118 poppler-0.5.4-4.3.el5_1.ppc.rpm 23983ce4d9ff84f859a2e863b0d86abd poppler-0.5.4-4.3.el5_1.ppc64.rpm e0b0cd09b8576a58a1eb2f3887de5f70 poppler-debuginfo-0.5.4-4.3.el5_1.ppc.rpm d540e137d69684dbb002cfa0cd53ace7 poppler-debuginfo-0.5.4-4.3.el5_1.ppc64.rpm 9f77a5dc7816c09217dd0735d3bc6ded poppler-devel-0.5.4-4.3.el5_1.ppc.rpm f7f8106f4936cc062c9f598d1342fbf7 poppler-devel-0.5.4-4.3.el5_1.ppc64.rpm d8bfb3b5a50b48e003adf4c0cb06dadf poppler-utils-0.5.4-4.3.el5_1.ppc.rpm s390x: fabd0d9a73d044bc6be045570ff7415e poppler-0.5.4-4.3.el5_1.s390.rpm 88f22b3e51c067ef57ba1686e6a6445f poppler-0.5.4-4.3.el5_1.s390x.rpm 5dad2b459b268a1284dd5b67910643ff poppler-debuginfo-0.5.4-4.3.el5_1.s390.rpm c46630b15a1eb965c63375cd2dc1453c poppler-debuginfo-0.5.4-4.3.el5_1.s390x.rpm 1ac050d1a6d423a4fdc3727df4802632 poppler-devel-0.5.4-4.3.el5_1.s390.rpm 20eaefea09f74e92239b66002d4fe895 poppler-devel-0.5.4-4.3.el5_1.s390x.rpm 62f185765cec355ca7b1d8c1ca89aede poppler-utils-0.5.4-4.3.el5_1.s390x.rpm x86_64: 840ac371305da7343736841e554b93e5 poppler-0.5.4-4.3.el5_1.i386.rpm c4f9253e89bb71a5d4c7a1f4d7e10f63 poppler-0.5.4-4.3.el5_1.x86_64.rpm 0f9a1f599941a1ac395dbfaa98d92c98 poppler-debuginfo-0.5.4-4.3.el5_1.i386.rpm 3a34912d2523ee3181a3238e4a793bf3 poppler-debuginfo-0.5.4-4.3.el5_1.x86_64.rpm 53b761d6d293af2a3b9cd32f13f2e89a poppler-devel-0.5.4-4.3.el5_1.i386.rpm a3f589c0d86eb34e982bf1c52ae63ce1 poppler-devel-0.5.4-4.3.el5_1.x86_64.rpm 6a27df425f22244009394d770f58fc2c poppler-utils-0.5.4-4.3.el5_1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4352 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5392 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5393 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMf+pXlSAg2UNWIIRAgShAJ9msQ/Yn38HV/RBqo0r/u7RhhN9TQCfZ09w wQuXjy1IgJpESqg8EBL6zcI= =2zsK -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 7 18:44:26 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 7 Nov 2007 13:44:26 -0500 Subject: [RHSA-2007:1028-01] Important: tetex security update Message-ID: <200711071844.lA7IiQHk030073@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: tetex security update Advisory ID: RHSA-2007:1028-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1028.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-5393 - --------------------------------------------------------------------- 1. Summary: Updated tetex packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 3. Problem description: TeTeX is an implementation of TeX. TeX takes a text file and a set of formatting commands as input, and creates a typesetter-independent DeVice Independent (dvi) file as output. Alin Rad Pop discovered a flaw in the handling of PDF files. An attacker could create a malicious PDF file that would cause TeTeX to crash, or potentially execute arbitrary code when opened. (CVE-2007-5393) Users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar() 6. RPMs required: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 : SRPMS: ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/tetex-1.0.7-38.5E.12.src.rpm a9a330b6cc61c210c8fa38e555cc5109 tetex-1.0.7-38.5E.12.src.rpm i386: cd1bdbe1b8abb51edc4bdad77db33f7b tetex-1.0.7-38.5E.12.i386.rpm 0a20e9a986c097a84fda16e6eff43087 tetex-afm-1.0.7-38.5E.12.i386.rpm e274eeb425bf5f9a0de80d2f864746a7 tetex-doc-1.0.7-38.5E.12.i386.rpm c64a654ae3d47604690790c4b5879f2f tetex-dvilj-1.0.7-38.5E.12.i386.rpm fe7648c4e4304f9ed65fe00038752341 tetex-dvips-1.0.7-38.5E.12.i386.rpm 446cb180d0e909594eb99f7dfa64bc77 tetex-fonts-1.0.7-38.5E.12.i386.rpm b6973422f0f349d9d72d97a038ada611 tetex-latex-1.0.7-38.5E.12.i386.rpm 4140df46de0a89b50d465d1cd9086363 tetex-xdvi-1.0.7-38.5E.12.i386.rpm ia64: 7a5a40f2085ea2091752619040f27de7 tetex-1.0.7-38.5E.12.ia64.rpm e483ac8983a0b446d412aeaa8d429369 tetex-afm-1.0.7-38.5E.12.ia64.rpm 6bcfc102d17b2c50bd31606115ffc9ac tetex-doc-1.0.7-38.5E.12.ia64.rpm c1f55c0de9eb92f00cbaeb328e074c88 tetex-dvilj-1.0.7-38.5E.12.ia64.rpm f040436251a09cc62ac3b2f88cce243e tetex-dvips-1.0.7-38.5E.12.ia64.rpm 1513df82cd2191e5aefbca3a0f1103e0 tetex-fonts-1.0.7-38.5E.12.ia64.rpm 722cf2363da00e1bf627507652c45f55 tetex-latex-1.0.7-38.5E.12.ia64.rpm 4b131e2abf9b590ae8748761032d6970 tetex-xdvi-1.0.7-38.5E.12.ia64.rpm Red Hat Linux Advanced Workstation 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/tetex-1.0.7-38.5E.12.src.rpm a9a330b6cc61c210c8fa38e555cc5109 tetex-1.0.7-38.5E.12.src.rpm ia64: 7a5a40f2085ea2091752619040f27de7 tetex-1.0.7-38.5E.12.ia64.rpm e483ac8983a0b446d412aeaa8d429369 tetex-afm-1.0.7-38.5E.12.ia64.rpm 6bcfc102d17b2c50bd31606115ffc9ac tetex-doc-1.0.7-38.5E.12.ia64.rpm c1f55c0de9eb92f00cbaeb328e074c88 tetex-dvilj-1.0.7-38.5E.12.ia64.rpm f040436251a09cc62ac3b2f88cce243e tetex-dvips-1.0.7-38.5E.12.ia64.rpm 1513df82cd2191e5aefbca3a0f1103e0 tetex-fonts-1.0.7-38.5E.12.ia64.rpm 722cf2363da00e1bf627507652c45f55 tetex-latex-1.0.7-38.5E.12.ia64.rpm 4b131e2abf9b590ae8748761032d6970 tetex-xdvi-1.0.7-38.5E.12.ia64.rpm Red Hat Enterprise Linux ES version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/tetex-1.0.7-38.5E.12.src.rpm a9a330b6cc61c210c8fa38e555cc5109 tetex-1.0.7-38.5E.12.src.rpm i386: cd1bdbe1b8abb51edc4bdad77db33f7b tetex-1.0.7-38.5E.12.i386.rpm 0a20e9a986c097a84fda16e6eff43087 tetex-afm-1.0.7-38.5E.12.i386.rpm e274eeb425bf5f9a0de80d2f864746a7 tetex-doc-1.0.7-38.5E.12.i386.rpm c64a654ae3d47604690790c4b5879f2f tetex-dvilj-1.0.7-38.5E.12.i386.rpm fe7648c4e4304f9ed65fe00038752341 tetex-dvips-1.0.7-38.5E.12.i386.rpm 446cb180d0e909594eb99f7dfa64bc77 tetex-fonts-1.0.7-38.5E.12.i386.rpm b6973422f0f349d9d72d97a038ada611 tetex-latex-1.0.7-38.5E.12.i386.rpm 4140df46de0a89b50d465d1cd9086363 tetex-xdvi-1.0.7-38.5E.12.i386.rpm Red Hat Enterprise Linux WS version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/tetex-1.0.7-38.5E.12.src.rpm a9a330b6cc61c210c8fa38e555cc5109 tetex-1.0.7-38.5E.12.src.rpm i386: cd1bdbe1b8abb51edc4bdad77db33f7b tetex-1.0.7-38.5E.12.i386.rpm 0a20e9a986c097a84fda16e6eff43087 tetex-afm-1.0.7-38.5E.12.i386.rpm e274eeb425bf5f9a0de80d2f864746a7 tetex-doc-1.0.7-38.5E.12.i386.rpm c64a654ae3d47604690790c4b5879f2f tetex-dvilj-1.0.7-38.5E.12.i386.rpm fe7648c4e4304f9ed65fe00038752341 tetex-dvips-1.0.7-38.5E.12.i386.rpm 446cb180d0e909594eb99f7dfa64bc77 tetex-fonts-1.0.7-38.5E.12.i386.rpm b6973422f0f349d9d72d97a038ada611 tetex-latex-1.0.7-38.5E.12.i386.rpm 4140df46de0a89b50d465d1cd9086363 tetex-xdvi-1.0.7-38.5E.12.i386.rpm Red Hat Enterprise Linux AS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/tetex-1.0.7-67.11.src.rpm 9c926f0b59265f222d3a6a92d070c7ab tetex-1.0.7-67.11.src.rpm i386: 258e91388fdacfe82502653c5a48a005 tetex-1.0.7-67.11.i386.rpm 30f0d8f59f69c81cc14ba36a8fd7d370 tetex-afm-1.0.7-67.11.i386.rpm d560c78fa7e348e191ca6cd8cfaf0e97 tetex-debuginfo-1.0.7-67.11.i386.rpm 0ffd7b214e9e94df866c079f6dbb8e03 tetex-dvips-1.0.7-67.11.i386.rpm f3f75f29e7bfb42c734d0c08dcbae419 tetex-fonts-1.0.7-67.11.i386.rpm c7e9566382958a5b60a1be7dc5c9f8ff tetex-latex-1.0.7-67.11.i386.rpm 880b031da9a0d1d0dd862f70b49895d7 tetex-xdvi-1.0.7-67.11.i386.rpm ia64: ae5fbbb76abeaa6d54d346c0faf200e8 tetex-1.0.7-67.11.ia64.rpm 4173b80aa25be5e0305f7b1dd1c3439f tetex-afm-1.0.7-67.11.ia64.rpm 8809c8ce4857c19b829e9a7a06e05ba4 tetex-debuginfo-1.0.7-67.11.ia64.rpm fd8d4b9cd499b1564efd83b0dcbf3441 tetex-dvips-1.0.7-67.11.ia64.rpm 51f9d66ecaba190afa9215cc9a63ac34 tetex-fonts-1.0.7-67.11.ia64.rpm 91e61d93242483f4512f3bba288b2d3f tetex-latex-1.0.7-67.11.ia64.rpm 08c93511d76ff339ec2f9c864c9c8205 tetex-xdvi-1.0.7-67.11.ia64.rpm ppc: fba905be4b16011b872c8ffc0b213a50 tetex-1.0.7-67.11.ppc.rpm 10e9a154cf12630d99b716844c00ca91 tetex-afm-1.0.7-67.11.ppc.rpm c656abb71fcd8ec9a12913e09b605aa5 tetex-debuginfo-1.0.7-67.11.ppc.rpm a5482c9211715866705e215a830738e6 tetex-dvips-1.0.7-67.11.ppc.rpm a10414192f9c526021017138e70ca725 tetex-fonts-1.0.7-67.11.ppc.rpm a4ffc0fa998c219669e068b19cdb1552 tetex-latex-1.0.7-67.11.ppc.rpm cdc07fc8b8ab169299b39b500835817d tetex-xdvi-1.0.7-67.11.ppc.rpm s390: 78cc3f0afc063dfbe6afb09018cba87d tetex-1.0.7-67.11.s390.rpm 72bf0382e1817f2f0f5f3050b42a35f5 tetex-afm-1.0.7-67.11.s390.rpm 29464cdf28c782db83de87d4b89ee0e6 tetex-debuginfo-1.0.7-67.11.s390.rpm 883bea76b18b42b3ef7052e6fcb0fae2 tetex-dvips-1.0.7-67.11.s390.rpm cee97ddea1d562f969b300dec55d8047 tetex-fonts-1.0.7-67.11.s390.rpm b2af293e49a1353abe3f7346c492d435 tetex-latex-1.0.7-67.11.s390.rpm 36a23c2e9cfdfe8abe8236c68b1b7ff3 tetex-xdvi-1.0.7-67.11.s390.rpm s390x: 47bc340dd814ba4aefeb616b5914a9fc tetex-1.0.7-67.11.s390x.rpm f06c85101364e68dae12e423f49c6ae0 tetex-afm-1.0.7-67.11.s390x.rpm 9e441fc9a775fd5af5bdcbac34d57be8 tetex-debuginfo-1.0.7-67.11.s390x.rpm 93ec176639dd1381b8089d259b722971 tetex-dvips-1.0.7-67.11.s390x.rpm 4399413b190538d5ae6eae47fa30daef tetex-fonts-1.0.7-67.11.s390x.rpm 20756ec098a68f83e7ac5d2b6a4e96ff tetex-latex-1.0.7-67.11.s390x.rpm 111bdc122a8dc1d3baa742aa636d8085 tetex-xdvi-1.0.7-67.11.s390x.rpm x86_64: 031f9772ca3dc02bf3c54556dd1f3937 tetex-1.0.7-67.11.x86_64.rpm e40304314a03120ac8446d1dc7741e0c tetex-afm-1.0.7-67.11.x86_64.rpm 3d8409cf75af9fc0d3d91e33bf3b1ca5 tetex-debuginfo-1.0.7-67.11.x86_64.rpm d0ab503ede80d4c9eb0db09db7fa40c3 tetex-dvips-1.0.7-67.11.x86_64.rpm f03a734922e40634670c24ea48f67d37 tetex-fonts-1.0.7-67.11.x86_64.rpm 745531fdc58aa0b1eed829b632970fb7 tetex-latex-1.0.7-67.11.x86_64.rpm 9a5268aeae9f73948011c5d17089ceae tetex-xdvi-1.0.7-67.11.x86_64.rpm Red Hat Desktop version 3: SRPMS: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/tetex-1.0.7-67.11.src.rpm 9c926f0b59265f222d3a6a92d070c7ab tetex-1.0.7-67.11.src.rpm i386: 258e91388fdacfe82502653c5a48a005 tetex-1.0.7-67.11.i386.rpm 30f0d8f59f69c81cc14ba36a8fd7d370 tetex-afm-1.0.7-67.11.i386.rpm d560c78fa7e348e191ca6cd8cfaf0e97 tetex-debuginfo-1.0.7-67.11.i386.rpm 0ffd7b214e9e94df866c079f6dbb8e03 tetex-dvips-1.0.7-67.11.i386.rpm f3f75f29e7bfb42c734d0c08dcbae419 tetex-fonts-1.0.7-67.11.i386.rpm c7e9566382958a5b60a1be7dc5c9f8ff tetex-latex-1.0.7-67.11.i386.rpm 880b031da9a0d1d0dd862f70b49895d7 tetex-xdvi-1.0.7-67.11.i386.rpm x86_64: 031f9772ca3dc02bf3c54556dd1f3937 tetex-1.0.7-67.11.x86_64.rpm e40304314a03120ac8446d1dc7741e0c tetex-afm-1.0.7-67.11.x86_64.rpm 3d8409cf75af9fc0d3d91e33bf3b1ca5 tetex-debuginfo-1.0.7-67.11.x86_64.rpm d0ab503ede80d4c9eb0db09db7fa40c3 tetex-dvips-1.0.7-67.11.x86_64.rpm f03a734922e40634670c24ea48f67d37 tetex-fonts-1.0.7-67.11.x86_64.rpm 745531fdc58aa0b1eed829b632970fb7 tetex-latex-1.0.7-67.11.x86_64.rpm 9a5268aeae9f73948011c5d17089ceae tetex-xdvi-1.0.7-67.11.x86_64.rpm Red Hat Enterprise Linux ES version 3: SRPMS: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/tetex-1.0.7-67.11.src.rpm 9c926f0b59265f222d3a6a92d070c7ab tetex-1.0.7-67.11.src.rpm i386: 258e91388fdacfe82502653c5a48a005 tetex-1.0.7-67.11.i386.rpm 30f0d8f59f69c81cc14ba36a8fd7d370 tetex-afm-1.0.7-67.11.i386.rpm d560c78fa7e348e191ca6cd8cfaf0e97 tetex-debuginfo-1.0.7-67.11.i386.rpm 0ffd7b214e9e94df866c079f6dbb8e03 tetex-dvips-1.0.7-67.11.i386.rpm f3f75f29e7bfb42c734d0c08dcbae419 tetex-fonts-1.0.7-67.11.i386.rpm c7e9566382958a5b60a1be7dc5c9f8ff tetex-latex-1.0.7-67.11.i386.rpm 880b031da9a0d1d0dd862f70b49895d7 tetex-xdvi-1.0.7-67.11.i386.rpm ia64: ae5fbbb76abeaa6d54d346c0faf200e8 tetex-1.0.7-67.11.ia64.rpm 4173b80aa25be5e0305f7b1dd1c3439f tetex-afm-1.0.7-67.11.ia64.rpm 8809c8ce4857c19b829e9a7a06e05ba4 tetex-debuginfo-1.0.7-67.11.ia64.rpm fd8d4b9cd499b1564efd83b0dcbf3441 tetex-dvips-1.0.7-67.11.ia64.rpm 51f9d66ecaba190afa9215cc9a63ac34 tetex-fonts-1.0.7-67.11.ia64.rpm 91e61d93242483f4512f3bba288b2d3f tetex-latex-1.0.7-67.11.ia64.rpm 08c93511d76ff339ec2f9c864c9c8205 tetex-xdvi-1.0.7-67.11.ia64.rpm x86_64: 031f9772ca3dc02bf3c54556dd1f3937 tetex-1.0.7-67.11.x86_64.rpm e40304314a03120ac8446d1dc7741e0c tetex-afm-1.0.7-67.11.x86_64.rpm 3d8409cf75af9fc0d3d91e33bf3b1ca5 tetex-debuginfo-1.0.7-67.11.x86_64.rpm d0ab503ede80d4c9eb0db09db7fa40c3 tetex-dvips-1.0.7-67.11.x86_64.rpm f03a734922e40634670c24ea48f67d37 tetex-fonts-1.0.7-67.11.x86_64.rpm 745531fdc58aa0b1eed829b632970fb7 tetex-latex-1.0.7-67.11.x86_64.rpm 9a5268aeae9f73948011c5d17089ceae tetex-xdvi-1.0.7-67.11.x86_64.rpm Red Hat Enterprise Linux WS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/tetex-1.0.7-67.11.src.rpm 9c926f0b59265f222d3a6a92d070c7ab tetex-1.0.7-67.11.src.rpm i386: 258e91388fdacfe82502653c5a48a005 tetex-1.0.7-67.11.i386.rpm 30f0d8f59f69c81cc14ba36a8fd7d370 tetex-afm-1.0.7-67.11.i386.rpm d560c78fa7e348e191ca6cd8cfaf0e97 tetex-debuginfo-1.0.7-67.11.i386.rpm 0ffd7b214e9e94df866c079f6dbb8e03 tetex-dvips-1.0.7-67.11.i386.rpm f3f75f29e7bfb42c734d0c08dcbae419 tetex-fonts-1.0.7-67.11.i386.rpm c7e9566382958a5b60a1be7dc5c9f8ff tetex-latex-1.0.7-67.11.i386.rpm 880b031da9a0d1d0dd862f70b49895d7 tetex-xdvi-1.0.7-67.11.i386.rpm ia64: ae5fbbb76abeaa6d54d346c0faf200e8 tetex-1.0.7-67.11.ia64.rpm 4173b80aa25be5e0305f7b1dd1c3439f tetex-afm-1.0.7-67.11.ia64.rpm 8809c8ce4857c19b829e9a7a06e05ba4 tetex-debuginfo-1.0.7-67.11.ia64.rpm fd8d4b9cd499b1564efd83b0dcbf3441 tetex-dvips-1.0.7-67.11.ia64.rpm 51f9d66ecaba190afa9215cc9a63ac34 tetex-fonts-1.0.7-67.11.ia64.rpm 91e61d93242483f4512f3bba288b2d3f tetex-latex-1.0.7-67.11.ia64.rpm 08c93511d76ff339ec2f9c864c9c8205 tetex-xdvi-1.0.7-67.11.ia64.rpm x86_64: 031f9772ca3dc02bf3c54556dd1f3937 tetex-1.0.7-67.11.x86_64.rpm e40304314a03120ac8446d1dc7741e0c tetex-afm-1.0.7-67.11.x86_64.rpm 3d8409cf75af9fc0d3d91e33bf3b1ca5 tetex-debuginfo-1.0.7-67.11.x86_64.rpm d0ab503ede80d4c9eb0db09db7fa40c3 tetex-dvips-1.0.7-67.11.x86_64.rpm f03a734922e40634670c24ea48f67d37 tetex-fonts-1.0.7-67.11.x86_64.rpm 745531fdc58aa0b1eed829b632970fb7 tetex-latex-1.0.7-67.11.x86_64.rpm 9a5268aeae9f73948011c5d17089ceae tetex-xdvi-1.0.7-67.11.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5393 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMgdkXlSAg2UNWIIRAo3XAJ4kUhx/k6VSRffZRJLTwOkx7uPCWwCgg0OD OhxpjfcIzWpVM0OYF6HmTCo= =/T4a -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 7 18:51:45 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 7 Nov 2007 13:51:45 -0500 Subject: [RHSA-2007:1029-01] Important: xpdf security update Message-ID: <200711071851.lA7IpjcJ032058@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: xpdf security update Advisory ID: RHSA-2007:1029-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1029.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-4352 CVE-2007-5392 CVE-2007-5393 - --------------------------------------------------------------------- 1. Summary: Updated xpdf packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: Xpdf is an X Window System-based viewer for Portable Document Format (PDF) files. Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause Xpdf to crash, or potentially execute arbitrary code when opened. (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393) Users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 345101 - CVE-2007-4352 xpdf memory corruption in DCTStream::readProgressiveDataUnit() 345111 - CVE-2007-5392 xpdf buffer overflow in DCTStream::reset() 345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar() 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/xpdf-3.00-14.el4.src.rpm 793c0033186cd45a417b9d39fc76978e xpdf-3.00-14.el4.src.rpm i386: fd68f8acce3621be7d97afd31c0107e5 xpdf-3.00-14.el4.i386.rpm 8c5a8df1ab0eeee8cd94629b5bdd1c17 xpdf-debuginfo-3.00-14.el4.i386.rpm ia64: d916a48d75fa4d019ffeed16acad1c07 xpdf-3.00-14.el4.ia64.rpm 1693926617f77c08d1cab3030bae24b9 xpdf-debuginfo-3.00-14.el4.ia64.rpm ppc: f31e73dea80ba445723e0b81ee81cfcf xpdf-3.00-14.el4.ppc.rpm 61d08476e3a18c7a6a3f408490858b91 xpdf-debuginfo-3.00-14.el4.ppc.rpm s390: f95ab2de0b89c9fe3475a728184da0f7 xpdf-3.00-14.el4.s390.rpm 945670ee1d5a4fa223e85809203a62f9 xpdf-debuginfo-3.00-14.el4.s390.rpm s390x: e74e13d3e8ccdd5fd96c9eea45a13a77 xpdf-3.00-14.el4.s390x.rpm fdb10b1102a0dd45432ec03f00a1ea2b xpdf-debuginfo-3.00-14.el4.s390x.rpm x86_64: 50294f8a768117c1c39214ce7a428f8e xpdf-3.00-14.el4.x86_64.rpm 1302e3a72247378de77ee58e1dc1f0fe xpdf-debuginfo-3.00-14.el4.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/xpdf-3.00-14.el4.src.rpm 793c0033186cd45a417b9d39fc76978e xpdf-3.00-14.el4.src.rpm i386: fd68f8acce3621be7d97afd31c0107e5 xpdf-3.00-14.el4.i386.rpm 8c5a8df1ab0eeee8cd94629b5bdd1c17 xpdf-debuginfo-3.00-14.el4.i386.rpm x86_64: 50294f8a768117c1c39214ce7a428f8e xpdf-3.00-14.el4.x86_64.rpm 1302e3a72247378de77ee58e1dc1f0fe xpdf-debuginfo-3.00-14.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/xpdf-3.00-14.el4.src.rpm 793c0033186cd45a417b9d39fc76978e xpdf-3.00-14.el4.src.rpm i386: fd68f8acce3621be7d97afd31c0107e5 xpdf-3.00-14.el4.i386.rpm 8c5a8df1ab0eeee8cd94629b5bdd1c17 xpdf-debuginfo-3.00-14.el4.i386.rpm ia64: d916a48d75fa4d019ffeed16acad1c07 xpdf-3.00-14.el4.ia64.rpm 1693926617f77c08d1cab3030bae24b9 xpdf-debuginfo-3.00-14.el4.ia64.rpm x86_64: 50294f8a768117c1c39214ce7a428f8e xpdf-3.00-14.el4.x86_64.rpm 1302e3a72247378de77ee58e1dc1f0fe xpdf-debuginfo-3.00-14.el4.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/xpdf-3.00-14.el4.src.rpm 793c0033186cd45a417b9d39fc76978e xpdf-3.00-14.el4.src.rpm i386: fd68f8acce3621be7d97afd31c0107e5 xpdf-3.00-14.el4.i386.rpm 8c5a8df1ab0eeee8cd94629b5bdd1c17 xpdf-debuginfo-3.00-14.el4.i386.rpm ia64: d916a48d75fa4d019ffeed16acad1c07 xpdf-3.00-14.el4.ia64.rpm 1693926617f77c08d1cab3030bae24b9 xpdf-debuginfo-3.00-14.el4.ia64.rpm x86_64: 50294f8a768117c1c39214ce7a428f8e xpdf-3.00-14.el4.x86_64.rpm 1302e3a72247378de77ee58e1dc1f0fe xpdf-debuginfo-3.00-14.el4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4352 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5392 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5393 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMgk7XlSAg2UNWIIRAnzjAJ9c0eMk4js0Sl/5PlpppT5eT43kAACgs7VX WdTx5Vr1Al3ngwdl+rRN8xI= =ayMg -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 7 19:04:19 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 7 Nov 2007 14:04:19 -0500 Subject: [RHSA-2007:1030-01] Important: xpdf security update Message-ID: <200711071904.lA7J4JxC001914@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: xpdf security update Advisory ID: RHSA-2007:1030-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1030.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-4033 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393 - --------------------------------------------------------------------- 1. Summary: Updated xpdf packages that fix several security issues are now available for Red Hat Enterprise Linux 3. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 3. Problem description: Xpdf is an X Window System-based viewer for Portable Document Format (PDF) files. Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause Xpdf to crash, or potentially execute arbitrary code when opened. (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393) A flaw was found in the t1lib library, used in the handling of Type 1 fonts. An attacker could create a malicious file that would cause Xpdf to crash, or potentially execute arbitrary code when opened. (CVE-2007-4033) Users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 345101 - CVE-2007-4352 xpdf memory corruption in DCTStream::readProgressiveDataUnit() 345111 - CVE-2007-5392 xpdf buffer overflow in DCTStream::reset() 345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar() 352271 - CVE-2007-4033 t1lib font filename string overflow 6. RPMs required: Red Hat Enterprise Linux AS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/xpdf-2.02-11.el3.src.rpm c7190a0d95f4b3a71fa208dcf97155fc xpdf-2.02-11.el3.src.rpm i386: 25d6805b4e027543da4b7451dc7c1ccc xpdf-2.02-11.el3.i386.rpm 6db545ceafdf849808df99d3e29eef6a xpdf-debuginfo-2.02-11.el3.i386.rpm ia64: 6b9c03d1eadd1eb8875cc099449ae533 xpdf-2.02-11.el3.ia64.rpm 5fe31f9cc0e76b30c545cf9f7ab695e7 xpdf-debuginfo-2.02-11.el3.ia64.rpm ppc: eccd1bcb8b7fda5ae5c21b8791aec769 xpdf-2.02-11.el3.ppc.rpm 108982aa9f679bfa3e7f71d56aefcaec xpdf-debuginfo-2.02-11.el3.ppc.rpm s390: 5893cabe5a5bdb457fd9cb848614afa6 xpdf-2.02-11.el3.s390.rpm 992f1d5e16255bbedc423b21769abde8 xpdf-debuginfo-2.02-11.el3.s390.rpm s390x: 756789a71f09cdcade453fc651b33611 xpdf-2.02-11.el3.s390x.rpm 02d542d1d2898dd678e8e95441a31544 xpdf-debuginfo-2.02-11.el3.s390x.rpm x86_64: 7f907b25b4b172db2c101270f089b3b9 xpdf-2.02-11.el3.x86_64.rpm 8b1a9f3aa41a99570f1e98ab9c2e80c4 xpdf-debuginfo-2.02-11.el3.x86_64.rpm Red Hat Desktop version 3: SRPMS: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/xpdf-2.02-11.el3.src.rpm c7190a0d95f4b3a71fa208dcf97155fc xpdf-2.02-11.el3.src.rpm i386: 25d6805b4e027543da4b7451dc7c1ccc xpdf-2.02-11.el3.i386.rpm 6db545ceafdf849808df99d3e29eef6a xpdf-debuginfo-2.02-11.el3.i386.rpm x86_64: 7f907b25b4b172db2c101270f089b3b9 xpdf-2.02-11.el3.x86_64.rpm 8b1a9f3aa41a99570f1e98ab9c2e80c4 xpdf-debuginfo-2.02-11.el3.x86_64.rpm Red Hat Enterprise Linux ES version 3: SRPMS: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/xpdf-2.02-11.el3.src.rpm c7190a0d95f4b3a71fa208dcf97155fc xpdf-2.02-11.el3.src.rpm i386: 25d6805b4e027543da4b7451dc7c1ccc xpdf-2.02-11.el3.i386.rpm 6db545ceafdf849808df99d3e29eef6a xpdf-debuginfo-2.02-11.el3.i386.rpm ia64: 6b9c03d1eadd1eb8875cc099449ae533 xpdf-2.02-11.el3.ia64.rpm 5fe31f9cc0e76b30c545cf9f7ab695e7 xpdf-debuginfo-2.02-11.el3.ia64.rpm x86_64: 7f907b25b4b172db2c101270f089b3b9 xpdf-2.02-11.el3.x86_64.rpm 8b1a9f3aa41a99570f1e98ab9c2e80c4 xpdf-debuginfo-2.02-11.el3.x86_64.rpm Red Hat Enterprise Linux WS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/xpdf-2.02-11.el3.src.rpm c7190a0d95f4b3a71fa208dcf97155fc xpdf-2.02-11.el3.src.rpm i386: 25d6805b4e027543da4b7451dc7c1ccc xpdf-2.02-11.el3.i386.rpm 6db545ceafdf849808df99d3e29eef6a xpdf-debuginfo-2.02-11.el3.i386.rpm ia64: 6b9c03d1eadd1eb8875cc099449ae533 xpdf-2.02-11.el3.ia64.rpm 5fe31f9cc0e76b30c545cf9f7ab695e7 xpdf-debuginfo-2.02-11.el3.ia64.rpm x86_64: 7f907b25b4b172db2c101270f089b3b9 xpdf-2.02-11.el3.x86_64.rpm 8b1a9f3aa41a99570f1e98ab9c2e80c4 xpdf-debuginfo-2.02-11.el3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4033 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4352 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5392 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5393 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMgwvXlSAg2UNWIIRAp+FAJ9+5mq3pWJoQLD4BqNy1sCRkxI7/wCgl2qq asBt0oHrtkghaUCTotRekcQ= =w3yU -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 7 19:06:05 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 7 Nov 2007 14:06:05 -0500 Subject: [RHSA-2007:1031-01] Important: xpdf security update Message-ID: <200711071906.lA7J65U4002696@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: xpdf security update Advisory ID: RHSA-2007:1031-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1031.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-4033 CVE-2007-5393 - --------------------------------------------------------------------- 1. Summary: Updated xpdf packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 3. Problem description: Xpdf is an X Window System-based viewer for Portable Document Format (PDF) files. Alin Rad Pop discovered a flaw in the handling of PDF files. An attacker could create a malicious PDF file that would cause Xpdf to crash, or potentially execute arbitrary code when opened. (CVE-2007-5393) A flaw was found in the t1lib library, used in the handling of Type 1 fonts. An attacker could create a malicious file that would cause Xpdf to crash, or potentially execute arbitrary code when opened. (CVE-2007-4033) Users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar() 352271 - CVE-2007-4033 t1lib font filename string overflow 6. RPMs required: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 : SRPMS: ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/xpdf-0.92-19.el2.src.rpm 15931b43879524a489914cdf00604fe6 xpdf-0.92-19.el2.src.rpm i386: 8b01cb72b04c342e71b4f6b62f511772 xpdf-0.92-19.el2.i386.rpm ia64: c49e98625b82429e75d6e1c19ebfc55f xpdf-0.92-19.el2.ia64.rpm Red Hat Linux Advanced Workstation 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/xpdf-0.92-19.el2.src.rpm 15931b43879524a489914cdf00604fe6 xpdf-0.92-19.el2.src.rpm ia64: c49e98625b82429e75d6e1c19ebfc55f xpdf-0.92-19.el2.ia64.rpm Red Hat Enterprise Linux ES version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/xpdf-0.92-19.el2.src.rpm 15931b43879524a489914cdf00604fe6 xpdf-0.92-19.el2.src.rpm i386: 8b01cb72b04c342e71b4f6b62f511772 xpdf-0.92-19.el2.i386.rpm Red Hat Enterprise Linux WS version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/xpdf-0.92-19.el2.src.rpm 15931b43879524a489914cdf00604fe6 xpdf-0.92-19.el2.src.rpm i386: 8b01cb72b04c342e71b4f6b62f511772 xpdf-0.92-19.el2.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4033 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5393 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMgyaXlSAg2UNWIIRApFbAJ0QNA0fVTB6CedJkX+uLmhi95nvkwCghcH5 20qBjIA7WoehuI0+xA7owj0= =FT8t -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 8 13:49:07 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 8 Nov 2007 08:49:07 -0500 Subject: [RHSA-2007:1027-02] Important: tetex security update Message-ID: <200711081349.lA8Dn7Wk003848@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: tetex security update Advisory ID: RHSA-2007:1027-02 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1027.html Issue date: 2007-11-08 Updated on: 2007-11-08 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-4033 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393 - --------------------------------------------------------------------- 1. Summary: Updated tetex packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: TeTeX is an implementation of TeX. TeX takes a text file and a set of formatting commands as input, and creates a typesetter-independent DeVice Independent (dvi) file as output. Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause TeTeX to crash or potentially execute arbitrary code when opened. (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393) A flaw was found in the t1lib library, used in the handling of Type 1 fonts. An attacker could create a malicious file that would cause TeTeX to crash, or potentially execute arbitrary code when opened. (CVE-2007-4033) Users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 345101 - CVE-2007-4352 xpdf memory corruption in DCTStream::readProgressiveDataUnit() 345111 - CVE-2007-5392 xpdf buffer overflow in DCTStream::reset() 345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar() 352271 - CVE-2007-4033 t1lib font filename string overflow 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/tetex-2.0.2-22.0.1.EL4.10.src.rpm ee5da4d13ebc89ca506c862e66a58116 tetex-2.0.2-22.0.1.EL4.10.src.rpm i386: 027c2aebbf12ad46978d7790fa33a564 tetex-2.0.2-22.0.1.EL4.10.i386.rpm 2bc6040e0a781e828d6fd6952904b7cd tetex-afm-2.0.2-22.0.1.EL4.10.i386.rpm 66ec2145039024c7fa16088163a51f51 tetex-debuginfo-2.0.2-22.0.1.EL4.10.i386.rpm f7f973c9e4302e1dc454241af599a0c0 tetex-doc-2.0.2-22.0.1.EL4.10.i386.rpm e526a49d653a71963cc4c6ad83d7d025 tetex-dvips-2.0.2-22.0.1.EL4.10.i386.rpm 340652dbb31b4ce1002dec39ddb149ac tetex-fonts-2.0.2-22.0.1.EL4.10.i386.rpm c66a33f1d2ee030179ef30fad803488d tetex-latex-2.0.2-22.0.1.EL4.10.i386.rpm efd73b36456c5327ee1b24ef47e26f34 tetex-xdvi-2.0.2-22.0.1.EL4.10.i386.rpm ia64: e06c955aba563a4be1d2b633e32ae112 tetex-2.0.2-22.0.1.EL4.10.ia64.rpm 597906ed92b23704e8b822a874040272 tetex-afm-2.0.2-22.0.1.EL4.10.ia64.rpm aa1f7bfdcc4bc73bff9a564d43b10e8c tetex-debuginfo-2.0.2-22.0.1.EL4.10.ia64.rpm dbac70370dbf2e15c4cf10a64e0888bd tetex-doc-2.0.2-22.0.1.EL4.10.ia64.rpm 12e9fb0a0d262e17aec53c700147c704 tetex-dvips-2.0.2-22.0.1.EL4.10.ia64.rpm 60a15ffa5d94e10d5d30735474779695 tetex-fonts-2.0.2-22.0.1.EL4.10.ia64.rpm 424e7335434932c91afbb78068e0b6cc tetex-latex-2.0.2-22.0.1.EL4.10.ia64.rpm 7ff7f7760f339077f54454a9b5941905 tetex-xdvi-2.0.2-22.0.1.EL4.10.ia64.rpm ppc: 1362563a88035d1b5e568c3342e4ac27 tetex-2.0.2-22.0.1.EL4.10.ppc.rpm 83244a2db4c8bd99d4cb38cdf4844551 tetex-afm-2.0.2-22.0.1.EL4.10.ppc.rpm f7ff046449533d6e7c3707e238c3de77 tetex-debuginfo-2.0.2-22.0.1.EL4.10.ppc.rpm 4707560e62f573407de9c3f611e06004 tetex-doc-2.0.2-22.0.1.EL4.10.ppc.rpm 1a4a981d8f4d1627207eec38d5b7b23b tetex-dvips-2.0.2-22.0.1.EL4.10.ppc.rpm d8fd2d03c0c02c8f2e7f31560d8ea937 tetex-fonts-2.0.2-22.0.1.EL4.10.ppc.rpm 5820a8afd235502f0a398a689dd6a62d tetex-latex-2.0.2-22.0.1.EL4.10.ppc.rpm 4f3648c6fc71c75e6b86836a98c4866a tetex-xdvi-2.0.2-22.0.1.EL4.10.ppc.rpm s390: a3b525ffbd450b2167e68831c2b55b73 tetex-2.0.2-22.0.1.EL4.10.s390.rpm 4b0d73456a23c998c4ec04fb22c23ddb tetex-afm-2.0.2-22.0.1.EL4.10.s390.rpm 8af45d912827f0cf5963f269d18a52e0 tetex-debuginfo-2.0.2-22.0.1.EL4.10.s390.rpm f29a2b2a4c21c9cf104be216c6a5b0fe tetex-doc-2.0.2-22.0.1.EL4.10.s390.rpm d41e8fd19df69be9e1f34fb1dada735f tetex-dvips-2.0.2-22.0.1.EL4.10.s390.rpm ff2526d5aa53852065ffee38b490cd67 tetex-fonts-2.0.2-22.0.1.EL4.10.s390.rpm baa804414ce7c1a7cdc443dd8e0a0dcd tetex-latex-2.0.2-22.0.1.EL4.10.s390.rpm 0b7943a6d9800d90d4dbacac0302d531 tetex-xdvi-2.0.2-22.0.1.EL4.10.s390.rpm s390x: 43976716352f385d87865db38ea615af tetex-2.0.2-22.0.1.EL4.10.s390x.rpm c644606a45f5a83ef9818973990325ea tetex-afm-2.0.2-22.0.1.EL4.10.s390x.rpm e6316aeb56d2e6153f77bcc5fba3791d tetex-debuginfo-2.0.2-22.0.1.EL4.10.s390x.rpm abacd59736f4169de95bfcf2382afa55 tetex-doc-2.0.2-22.0.1.EL4.10.s390x.rpm f99dbe4de2733668786ee110f4896ed7 tetex-dvips-2.0.2-22.0.1.EL4.10.s390x.rpm b39ab1c0dc6a27c50f1611475402c26a tetex-fonts-2.0.2-22.0.1.EL4.10.s390x.rpm 4ce12256a2a348f11cbfa9e368e2c734 tetex-latex-2.0.2-22.0.1.EL4.10.s390x.rpm 92b7f3c840d5523de4f979f015a3d062 tetex-xdvi-2.0.2-22.0.1.EL4.10.s390x.rpm x86_64: 9256a59442be5e16353c6e80c0c6eeb4 tetex-2.0.2-22.0.1.EL4.10.x86_64.rpm 6382a7e46e5ad3d1e329e3620c0c5cb5 tetex-afm-2.0.2-22.0.1.EL4.10.x86_64.rpm f5dd4fcfcaa58b85e1c8b19793106f96 tetex-debuginfo-2.0.2-22.0.1.EL4.10.x86_64.rpm 75373e789b643c8fa2fc93765e6970cd tetex-doc-2.0.2-22.0.1.EL4.10.x86_64.rpm f23f9a67113c9dc617423782f7f86d0c tetex-dvips-2.0.2-22.0.1.EL4.10.x86_64.rpm 6d9ec577c3ca1a1de2765058437a7176 tetex-fonts-2.0.2-22.0.1.EL4.10.x86_64.rpm 0281b2119f411044713b3681d79672e4 tetex-latex-2.0.2-22.0.1.EL4.10.x86_64.rpm 5adea0e5b6eb555d771445594ca09051 tetex-xdvi-2.0.2-22.0.1.EL4.10.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/tetex-2.0.2-22.0.1.EL4.10.src.rpm ee5da4d13ebc89ca506c862e66a58116 tetex-2.0.2-22.0.1.EL4.10.src.rpm i386: 027c2aebbf12ad46978d7790fa33a564 tetex-2.0.2-22.0.1.EL4.10.i386.rpm 2bc6040e0a781e828d6fd6952904b7cd tetex-afm-2.0.2-22.0.1.EL4.10.i386.rpm 66ec2145039024c7fa16088163a51f51 tetex-debuginfo-2.0.2-22.0.1.EL4.10.i386.rpm f7f973c9e4302e1dc454241af599a0c0 tetex-doc-2.0.2-22.0.1.EL4.10.i386.rpm e526a49d653a71963cc4c6ad83d7d025 tetex-dvips-2.0.2-22.0.1.EL4.10.i386.rpm 340652dbb31b4ce1002dec39ddb149ac tetex-fonts-2.0.2-22.0.1.EL4.10.i386.rpm c66a33f1d2ee030179ef30fad803488d tetex-latex-2.0.2-22.0.1.EL4.10.i386.rpm efd73b36456c5327ee1b24ef47e26f34 tetex-xdvi-2.0.2-22.0.1.EL4.10.i386.rpm x86_64: 9256a59442be5e16353c6e80c0c6eeb4 tetex-2.0.2-22.0.1.EL4.10.x86_64.rpm 6382a7e46e5ad3d1e329e3620c0c5cb5 tetex-afm-2.0.2-22.0.1.EL4.10.x86_64.rpm f5dd4fcfcaa58b85e1c8b19793106f96 tetex-debuginfo-2.0.2-22.0.1.EL4.10.x86_64.rpm 75373e789b643c8fa2fc93765e6970cd tetex-doc-2.0.2-22.0.1.EL4.10.x86_64.rpm f23f9a67113c9dc617423782f7f86d0c tetex-dvips-2.0.2-22.0.1.EL4.10.x86_64.rpm 6d9ec577c3ca1a1de2765058437a7176 tetex-fonts-2.0.2-22.0.1.EL4.10.x86_64.rpm 0281b2119f411044713b3681d79672e4 tetex-latex-2.0.2-22.0.1.EL4.10.x86_64.rpm 5adea0e5b6eb555d771445594ca09051 tetex-xdvi-2.0.2-22.0.1.EL4.10.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/tetex-2.0.2-22.0.1.EL4.10.src.rpm ee5da4d13ebc89ca506c862e66a58116 tetex-2.0.2-22.0.1.EL4.10.src.rpm i386: 027c2aebbf12ad46978d7790fa33a564 tetex-2.0.2-22.0.1.EL4.10.i386.rpm 2bc6040e0a781e828d6fd6952904b7cd tetex-afm-2.0.2-22.0.1.EL4.10.i386.rpm 66ec2145039024c7fa16088163a51f51 tetex-debuginfo-2.0.2-22.0.1.EL4.10.i386.rpm f7f973c9e4302e1dc454241af599a0c0 tetex-doc-2.0.2-22.0.1.EL4.10.i386.rpm e526a49d653a71963cc4c6ad83d7d025 tetex-dvips-2.0.2-22.0.1.EL4.10.i386.rpm 340652dbb31b4ce1002dec39ddb149ac tetex-fonts-2.0.2-22.0.1.EL4.10.i386.rpm c66a33f1d2ee030179ef30fad803488d tetex-latex-2.0.2-22.0.1.EL4.10.i386.rpm efd73b36456c5327ee1b24ef47e26f34 tetex-xdvi-2.0.2-22.0.1.EL4.10.i386.rpm ia64: e06c955aba563a4be1d2b633e32ae112 tetex-2.0.2-22.0.1.EL4.10.ia64.rpm 597906ed92b23704e8b822a874040272 tetex-afm-2.0.2-22.0.1.EL4.10.ia64.rpm aa1f7bfdcc4bc73bff9a564d43b10e8c tetex-debuginfo-2.0.2-22.0.1.EL4.10.ia64.rpm dbac70370dbf2e15c4cf10a64e0888bd tetex-doc-2.0.2-22.0.1.EL4.10.ia64.rpm 12e9fb0a0d262e17aec53c700147c704 tetex-dvips-2.0.2-22.0.1.EL4.10.ia64.rpm 60a15ffa5d94e10d5d30735474779695 tetex-fonts-2.0.2-22.0.1.EL4.10.ia64.rpm 424e7335434932c91afbb78068e0b6cc tetex-latex-2.0.2-22.0.1.EL4.10.ia64.rpm 7ff7f7760f339077f54454a9b5941905 tetex-xdvi-2.0.2-22.0.1.EL4.10.ia64.rpm x86_64: 9256a59442be5e16353c6e80c0c6eeb4 tetex-2.0.2-22.0.1.EL4.10.x86_64.rpm 6382a7e46e5ad3d1e329e3620c0c5cb5 tetex-afm-2.0.2-22.0.1.EL4.10.x86_64.rpm f5dd4fcfcaa58b85e1c8b19793106f96 tetex-debuginfo-2.0.2-22.0.1.EL4.10.x86_64.rpm 75373e789b643c8fa2fc93765e6970cd tetex-doc-2.0.2-22.0.1.EL4.10.x86_64.rpm f23f9a67113c9dc617423782f7f86d0c tetex-dvips-2.0.2-22.0.1.EL4.10.x86_64.rpm 6d9ec577c3ca1a1de2765058437a7176 tetex-fonts-2.0.2-22.0.1.EL4.10.x86_64.rpm 0281b2119f411044713b3681d79672e4 tetex-latex-2.0.2-22.0.1.EL4.10.x86_64.rpm 5adea0e5b6eb555d771445594ca09051 tetex-xdvi-2.0.2-22.0.1.EL4.10.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/tetex-2.0.2-22.0.1.EL4.10.src.rpm ee5da4d13ebc89ca506c862e66a58116 tetex-2.0.2-22.0.1.EL4.10.src.rpm i386: 027c2aebbf12ad46978d7790fa33a564 tetex-2.0.2-22.0.1.EL4.10.i386.rpm 2bc6040e0a781e828d6fd6952904b7cd tetex-afm-2.0.2-22.0.1.EL4.10.i386.rpm 66ec2145039024c7fa16088163a51f51 tetex-debuginfo-2.0.2-22.0.1.EL4.10.i386.rpm f7f973c9e4302e1dc454241af599a0c0 tetex-doc-2.0.2-22.0.1.EL4.10.i386.rpm e526a49d653a71963cc4c6ad83d7d025 tetex-dvips-2.0.2-22.0.1.EL4.10.i386.rpm 340652dbb31b4ce1002dec39ddb149ac tetex-fonts-2.0.2-22.0.1.EL4.10.i386.rpm c66a33f1d2ee030179ef30fad803488d tetex-latex-2.0.2-22.0.1.EL4.10.i386.rpm efd73b36456c5327ee1b24ef47e26f34 tetex-xdvi-2.0.2-22.0.1.EL4.10.i386.rpm ia64: e06c955aba563a4be1d2b633e32ae112 tetex-2.0.2-22.0.1.EL4.10.ia64.rpm 597906ed92b23704e8b822a874040272 tetex-afm-2.0.2-22.0.1.EL4.10.ia64.rpm aa1f7bfdcc4bc73bff9a564d43b10e8c tetex-debuginfo-2.0.2-22.0.1.EL4.10.ia64.rpm dbac70370dbf2e15c4cf10a64e0888bd tetex-doc-2.0.2-22.0.1.EL4.10.ia64.rpm 12e9fb0a0d262e17aec53c700147c704 tetex-dvips-2.0.2-22.0.1.EL4.10.ia64.rpm 60a15ffa5d94e10d5d30735474779695 tetex-fonts-2.0.2-22.0.1.EL4.10.ia64.rpm 424e7335434932c91afbb78068e0b6cc tetex-latex-2.0.2-22.0.1.EL4.10.ia64.rpm 7ff7f7760f339077f54454a9b5941905 tetex-xdvi-2.0.2-22.0.1.EL4.10.ia64.rpm x86_64: 9256a59442be5e16353c6e80c0c6eeb4 tetex-2.0.2-22.0.1.EL4.10.x86_64.rpm 6382a7e46e5ad3d1e329e3620c0c5cb5 tetex-afm-2.0.2-22.0.1.EL4.10.x86_64.rpm f5dd4fcfcaa58b85e1c8b19793106f96 tetex-debuginfo-2.0.2-22.0.1.EL4.10.x86_64.rpm 75373e789b643c8fa2fc93765e6970cd tetex-doc-2.0.2-22.0.1.EL4.10.x86_64.rpm f23f9a67113c9dc617423782f7f86d0c tetex-dvips-2.0.2-22.0.1.EL4.10.x86_64.rpm 6d9ec577c3ca1a1de2765058437a7176 tetex-fonts-2.0.2-22.0.1.EL4.10.x86_64.rpm 0281b2119f411044713b3681d79672e4 tetex-latex-2.0.2-22.0.1.EL4.10.x86_64.rpm 5adea0e5b6eb555d771445594ca09051 tetex-xdvi-2.0.2-22.0.1.EL4.10.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/tetex-3.0-33.2.el5_1.2.src.rpm b1b42ba1708170366ef929542721e792 tetex-3.0-33.2.el5_1.2.src.rpm i386: 1fbc3969e96b466560c90814b25aebe5 tetex-3.0-33.2.el5_1.2.i386.rpm 440c373bdd22150fa5ad4804f078fec6 tetex-afm-3.0-33.2.el5_1.2.i386.rpm 1eb33138cf83a75a380ad06bf50ac645 tetex-debuginfo-3.0-33.2.el5_1.2.i386.rpm b5086ee4832639db57282878a9b4aa4c tetex-doc-3.0-33.2.el5_1.2.i386.rpm 0568b6191a2f33f0b5ea028e419c0194 tetex-dvips-3.0-33.2.el5_1.2.i386.rpm 31fcdbc3370b30c2c665e86b5ca130a5 tetex-fonts-3.0-33.2.el5_1.2.i386.rpm b2aae2adc2955a745774c227e4e335df tetex-latex-3.0-33.2.el5_1.2.i386.rpm 6c708669d258dc905000c1d20d18ad91 tetex-xdvi-3.0-33.2.el5_1.2.i386.rpm x86_64: 7a6307a6176d11dd21ec38a79260d5a1 tetex-3.0-33.2.el5_1.2.x86_64.rpm 3dbdc412d3a9a189af7b62988e984db9 tetex-afm-3.0-33.2.el5_1.2.x86_64.rpm 2e422824056f6c01c354e8c32de5da7e tetex-debuginfo-3.0-33.2.el5_1.2.x86_64.rpm 3b43cf065dbdb05fb6c6114ff73960d2 tetex-doc-3.0-33.2.el5_1.2.x86_64.rpm ed0a4845c96a539aead363cd53eeee14 tetex-dvips-3.0-33.2.el5_1.2.x86_64.rpm b14ed77067e9d92450b98d2bb5e31008 tetex-fonts-3.0-33.2.el5_1.2.x86_64.rpm 291b02f4ab3ce4f51f87bd525b09adef tetex-latex-3.0-33.2.el5_1.2.x86_64.rpm a21bff151a307f6c1124f15fc609f0d4 tetex-xdvi-3.0-33.2.el5_1.2.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/tetex-3.0-33.2.el5_1.2.src.rpm b1b42ba1708170366ef929542721e792 tetex-3.0-33.2.el5_1.2.src.rpm i386: 1fbc3969e96b466560c90814b25aebe5 tetex-3.0-33.2.el5_1.2.i386.rpm 440c373bdd22150fa5ad4804f078fec6 tetex-afm-3.0-33.2.el5_1.2.i386.rpm 1eb33138cf83a75a380ad06bf50ac645 tetex-debuginfo-3.0-33.2.el5_1.2.i386.rpm b5086ee4832639db57282878a9b4aa4c tetex-doc-3.0-33.2.el5_1.2.i386.rpm 0568b6191a2f33f0b5ea028e419c0194 tetex-dvips-3.0-33.2.el5_1.2.i386.rpm 31fcdbc3370b30c2c665e86b5ca130a5 tetex-fonts-3.0-33.2.el5_1.2.i386.rpm b2aae2adc2955a745774c227e4e335df tetex-latex-3.0-33.2.el5_1.2.i386.rpm 6c708669d258dc905000c1d20d18ad91 tetex-xdvi-3.0-33.2.el5_1.2.i386.rpm ia64: f14401b2d2014defb1b54995368948f2 tetex-3.0-33.2.el5_1.2.ia64.rpm 965666eb86b632b64019a082dacd40ba tetex-afm-3.0-33.2.el5_1.2.ia64.rpm 3a2a99f272ac94c40054053d54e54037 tetex-debuginfo-3.0-33.2.el5_1.2.ia64.rpm 8273756d1787fb0fa59c61520e0b13ef tetex-doc-3.0-33.2.el5_1.2.ia64.rpm a98808f0b6242a235086ea8995623dfd tetex-dvips-3.0-33.2.el5_1.2.ia64.rpm 4582e88c285f14755def63dbd7b95d70 tetex-fonts-3.0-33.2.el5_1.2.ia64.rpm 330c602f426255fca1ce4e9bdda1e9d9 tetex-latex-3.0-33.2.el5_1.2.ia64.rpm f781a1659fb4f1edfa733fe478bff0c7 tetex-xdvi-3.0-33.2.el5_1.2.ia64.rpm ppc: 433c7e0dacb9204070eb4e1b91db5a6d tetex-3.0-33.2.el5_1.2.ppc.rpm 51b25740e8c0a82337015af7c8a7a6b4 tetex-afm-3.0-33.2.el5_1.2.ppc.rpm 991d10cdd08bae2e414647faebb91f1b tetex-debuginfo-3.0-33.2.el5_1.2.ppc.rpm 85a01809c690a6684b4d39f589cf78ba tetex-doc-3.0-33.2.el5_1.2.ppc.rpm d36f0865f96879fd8e154d4bb890c092 tetex-dvips-3.0-33.2.el5_1.2.ppc.rpm b2c62aaaa82424cd7c46d39d8d3a7ef2 tetex-fonts-3.0-33.2.el5_1.2.ppc.rpm 6e0e98dd3e06ffe93c0c003466c53ffd tetex-latex-3.0-33.2.el5_1.2.ppc.rpm a7baac84232ddeddd26bc43719676605 tetex-xdvi-3.0-33.2.el5_1.2.ppc.rpm s390x: a06beda8f1884944fd8714337b02e5f8 tetex-3.0-33.2.el5_1.2.s390x.rpm d19f6c8e75e73a1aa3f9a5a7227189e6 tetex-afm-3.0-33.2.el5_1.2.s390x.rpm 937e7a798bb900f93d0e499706313102 tetex-debuginfo-3.0-33.2.el5_1.2.s390x.rpm 314aaf805fa9908c5bd8dd066a78ee69 tetex-doc-3.0-33.2.el5_1.2.s390x.rpm ffeeb98bc3d453d766f6834f681018e2 tetex-dvips-3.0-33.2.el5_1.2.s390x.rpm bc495169336a4193e62573c91ca98e08 tetex-fonts-3.0-33.2.el5_1.2.s390x.rpm 27817f1ec00502caa8ab74c0dea42e8b tetex-latex-3.0-33.2.el5_1.2.s390x.rpm 051531181be471e4afbea3cc76e0087b tetex-xdvi-3.0-33.2.el5_1.2.s390x.rpm x86_64: 7a6307a6176d11dd21ec38a79260d5a1 tetex-3.0-33.2.el5_1.2.x86_64.rpm 3dbdc412d3a9a189af7b62988e984db9 tetex-afm-3.0-33.2.el5_1.2.x86_64.rpm 2e422824056f6c01c354e8c32de5da7e tetex-debuginfo-3.0-33.2.el5_1.2.x86_64.rpm 3b43cf065dbdb05fb6c6114ff73960d2 tetex-doc-3.0-33.2.el5_1.2.x86_64.rpm ed0a4845c96a539aead363cd53eeee14 tetex-dvips-3.0-33.2.el5_1.2.x86_64.rpm b14ed77067e9d92450b98d2bb5e31008 tetex-fonts-3.0-33.2.el5_1.2.x86_64.rpm 291b02f4ab3ce4f51f87bd525b09adef tetex-latex-3.0-33.2.el5_1.2.x86_64.rpm a21bff151a307f6c1124f15fc609f0d4 tetex-xdvi-3.0-33.2.el5_1.2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4033 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4352 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5392 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5393 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMxOrXlSAg2UNWIIRAhM5AJ0aGj+cDCJ6BTYrXUUbSDR0raiQ8QCffXeX zlvUUcz/UJ0gZLsnWuvGwrY= =2oXF -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 8 16:57:29 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 8 Nov 2007 11:57:29 -0500 Subject: [RHSA-2007:1037-01] Important: openldap security and enhancement update Message-ID: <200711081657.lA8GvTne006537@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: openldap security and enhancement update Advisory ID: RHSA-2007:1037-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1037.html Issue date: 2007-11-08 Updated on: 2007-11-08 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-5707 - --------------------------------------------------------------------- 1. Summary: Updated openldap packages that fix a security flaw are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: OpenLDAP is an open source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools. A flaw was found in the way OpenLDAP's slapd daemon handled malformed objectClasses LDAP attributes. A local or remote attacker could create an LDAP request which could cause a denial of service by crashing slapd. (CVE-2007-5707) In addition, the following feature was added: * OpenLDAP client tools now have new option to configure their bind timeout. All users are advised to upgrade to these updated openldap packages, which contain a backported patch to correct this issue and provide this security enhancement. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 359851 - CVE-2007-5707 openldap slapd DoS via objectClasses attribute 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/openldap-2.3.27-8.el5_1.1.src.rpm 29bf968603231319b6ed63fe1829e4b7 openldap-2.3.27-8.el5_1.1.src.rpm i386: a33da7778f862ffb7fc325d2f3f5f8b2 compat-openldap-2.3.27_2.2.29-8.el5_1.1.i386.rpm ff17c8f4052f3237fa199dcef8c64a61 openldap-2.3.27-8.el5_1.1.i386.rpm 9a14674d6c9cabd96c710625143130c3 openldap-clients-2.3.27-8.el5_1.1.i386.rpm 173c953562665cb24f1f34d836f6ea36 openldap-debuginfo-2.3.27-8.el5_1.1.i386.rpm x86_64: a33da7778f862ffb7fc325d2f3f5f8b2 compat-openldap-2.3.27_2.2.29-8.el5_1.1.i386.rpm c34a4bf153b8ada745022313a1a40f0a compat-openldap-2.3.27_2.2.29-8.el5_1.1.x86_64.rpm ff17c8f4052f3237fa199dcef8c64a61 openldap-2.3.27-8.el5_1.1.i386.rpm 690b46cca06173f27e0e052bb25a726e openldap-2.3.27-8.el5_1.1.x86_64.rpm 74179f661375bbba59aa33c24d25201b openldap-clients-2.3.27-8.el5_1.1.x86_64.rpm 173c953562665cb24f1f34d836f6ea36 openldap-debuginfo-2.3.27-8.el5_1.1.i386.rpm 323e5f412738894a2f5246e58cc050cf openldap-debuginfo-2.3.27-8.el5_1.1.x86_64.rpm RHEL Desktop Workstation (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/openldap-2.3.27-8.el5_1.1.src.rpm 29bf968603231319b6ed63fe1829e4b7 openldap-2.3.27-8.el5_1.1.src.rpm i386: 173c953562665cb24f1f34d836f6ea36 openldap-debuginfo-2.3.27-8.el5_1.1.i386.rpm 4cad3c430c370da07ea0eacb5130a984 openldap-devel-2.3.27-8.el5_1.1.i386.rpm 10aa30c19f16402452db01a63822eeda openldap-servers-2.3.27-8.el5_1.1.i386.rpm e17cd90ffb57b2e89784ea739fee01f9 openldap-servers-sql-2.3.27-8.el5_1.1.i386.rpm x86_64: 173c953562665cb24f1f34d836f6ea36 openldap-debuginfo-2.3.27-8.el5_1.1.i386.rpm 323e5f412738894a2f5246e58cc050cf openldap-debuginfo-2.3.27-8.el5_1.1.x86_64.rpm 4cad3c430c370da07ea0eacb5130a984 openldap-devel-2.3.27-8.el5_1.1.i386.rpm 22db8736c7b62aed630a12a13aaeb4a5 openldap-devel-2.3.27-8.el5_1.1.x86_64.rpm 756b6bf4b1b5cf712d8a3a53991504df openldap-servers-2.3.27-8.el5_1.1.x86_64.rpm 7540833a0e9a42bf5c924232acce3289 openldap-servers-sql-2.3.27-8.el5_1.1.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/openldap-2.3.27-8.el5_1.1.src.rpm 29bf968603231319b6ed63fe1829e4b7 openldap-2.3.27-8.el5_1.1.src.rpm i386: a33da7778f862ffb7fc325d2f3f5f8b2 compat-openldap-2.3.27_2.2.29-8.el5_1.1.i386.rpm ff17c8f4052f3237fa199dcef8c64a61 openldap-2.3.27-8.el5_1.1.i386.rpm 9a14674d6c9cabd96c710625143130c3 openldap-clients-2.3.27-8.el5_1.1.i386.rpm 173c953562665cb24f1f34d836f6ea36 openldap-debuginfo-2.3.27-8.el5_1.1.i386.rpm 4cad3c430c370da07ea0eacb5130a984 openldap-devel-2.3.27-8.el5_1.1.i386.rpm 10aa30c19f16402452db01a63822eeda openldap-servers-2.3.27-8.el5_1.1.i386.rpm e17cd90ffb57b2e89784ea739fee01f9 openldap-servers-sql-2.3.27-8.el5_1.1.i386.rpm ia64: a33da7778f862ffb7fc325d2f3f5f8b2 compat-openldap-2.3.27_2.2.29-8.el5_1.1.i386.rpm 1410496cee6ea7b8b5a093eb70c2ea82 compat-openldap-2.3.27_2.2.29-8.el5_1.1.ia64.rpm ff17c8f4052f3237fa199dcef8c64a61 openldap-2.3.27-8.el5_1.1.i386.rpm ca57ced22fa4db209dd97e9124953ca3 openldap-2.3.27-8.el5_1.1.ia64.rpm 8218d683c95451dcd7678fe5c5535f6c openldap-clients-2.3.27-8.el5_1.1.ia64.rpm 173c953562665cb24f1f34d836f6ea36 openldap-debuginfo-2.3.27-8.el5_1.1.i386.rpm 3cd91d198c489382a937363c8e55e8d3 openldap-debuginfo-2.3.27-8.el5_1.1.ia64.rpm 92dfcd0bc1155c240d0f464e1d992b90 openldap-devel-2.3.27-8.el5_1.1.ia64.rpm a29e06d09252e0b24f4e3c46ec9695e9 openldap-servers-2.3.27-8.el5_1.1.ia64.rpm c92b09b6f9fb48ee2c6ab023e0b8931d openldap-servers-sql-2.3.27-8.el5_1.1.ia64.rpm ppc: 853a0b6a9d1898f0a52a56da4b51c535 compat-openldap-2.3.27_2.2.29-8.el5_1.1.ppc.rpm 0f2955d1fbff30d65704e15b44cb8c9a compat-openldap-2.3.27_2.2.29-8.el5_1.1.ppc64.rpm 8450b36491cf6898c176a95daba635b4 openldap-2.3.27-8.el5_1.1.ppc.rpm 978ae45373c0dfb5f9a46711aa41c1ab openldap-2.3.27-8.el5_1.1.ppc64.rpm 51e25efe23ff1ce464e68f8c51f8882b openldap-clients-2.3.27-8.el5_1.1.ppc.rpm f9475ba8372e39e0e37dfe5bf1732c24 openldap-debuginfo-2.3.27-8.el5_1.1.ppc.rpm 2fb01f394f0b82ef0890926f8ecd17d2 openldap-debuginfo-2.3.27-8.el5_1.1.ppc64.rpm fd4ba1cc4f336edc94b1b8d8caa399c2 openldap-devel-2.3.27-8.el5_1.1.ppc.rpm 842e698549089dc1b756612ec51699dc openldap-devel-2.3.27-8.el5_1.1.ppc64.rpm 959047cfa1cfa7799dd976e3b3775456 openldap-servers-2.3.27-8.el5_1.1.ppc.rpm 2f5028b06a4504b951af635cf71c7391 openldap-servers-sql-2.3.27-8.el5_1.1.ppc.rpm s390x: 6e4d344c83258c8248ebe7ef489cf968 compat-openldap-2.3.27_2.2.29-8.el5_1.1.s390.rpm e0d1df373ee917a054c72dab5751bd16 compat-openldap-2.3.27_2.2.29-8.el5_1.1.s390x.rpm dbe6d4f8399099e5414d7379784a3303 openldap-2.3.27-8.el5_1.1.s390.rpm 0f7e80ef9c51cd9d0c9f69f67df5d307 openldap-2.3.27-8.el5_1.1.s390x.rpm 370d2ba76d13bc29b2ed3bed36e10178 openldap-clients-2.3.27-8.el5_1.1.s390x.rpm 125896fbede226eb4ccb875422f21df5 openldap-debuginfo-2.3.27-8.el5_1.1.s390.rpm ab6fb72e92eef8246ea630918eabd7da openldap-debuginfo-2.3.27-8.el5_1.1.s390x.rpm fbff33bbbdc8cdcfb47baf4e51db7446 openldap-devel-2.3.27-8.el5_1.1.s390.rpm 96dc56e05d18ea4951a06302ecde6a58 openldap-devel-2.3.27-8.el5_1.1.s390x.rpm 51c3472db3a88cd90310414212dd905d openldap-servers-2.3.27-8.el5_1.1.s390x.rpm fac283990840fa3a9275d07244d19292 openldap-servers-sql-2.3.27-8.el5_1.1.s390x.rpm x86_64: a33da7778f862ffb7fc325d2f3f5f8b2 compat-openldap-2.3.27_2.2.29-8.el5_1.1.i386.rpm c34a4bf153b8ada745022313a1a40f0a compat-openldap-2.3.27_2.2.29-8.el5_1.1.x86_64.rpm ff17c8f4052f3237fa199dcef8c64a61 openldap-2.3.27-8.el5_1.1.i386.rpm 690b46cca06173f27e0e052bb25a726e openldap-2.3.27-8.el5_1.1.x86_64.rpm 74179f661375bbba59aa33c24d25201b openldap-clients-2.3.27-8.el5_1.1.x86_64.rpm 173c953562665cb24f1f34d836f6ea36 openldap-debuginfo-2.3.27-8.el5_1.1.i386.rpm 323e5f412738894a2f5246e58cc050cf openldap-debuginfo-2.3.27-8.el5_1.1.x86_64.rpm 4cad3c430c370da07ea0eacb5130a984 openldap-devel-2.3.27-8.el5_1.1.i386.rpm 22db8736c7b62aed630a12a13aaeb4a5 openldap-devel-2.3.27-8.el5_1.1.x86_64.rpm 756b6bf4b1b5cf712d8a3a53991504df openldap-servers-2.3.27-8.el5_1.1.x86_64.rpm 7540833a0e9a42bf5c924232acce3289 openldap-servers-sql-2.3.27-8.el5_1.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5707 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHMz+4XlSAg2UNWIIRAujWAJ9/XIVKOP00tknl9Tp7NXsy2Y6xtQCfbo+C BuKwXcZTMbC7Kzwlw+EaKnk= =IH1m -----END PGP SIGNATURE----- From bugzilla at redhat.com Sat Nov 10 04:25:16 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Fri, 9 Nov 2007 23:25:16 -0500 Subject: [RHSA-2007:1052-01] Critical: pcre security update Message-ID: <200711100425.lAA4PGZl020012@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Critical: pcre security update Advisory ID: RHSA-2007:1052-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1052.html Issue date: 2007-11-09 Updated on: 2007-11-09 Product: Red Hat Enterprise Linux CVE Names: CVE-2006-7224 - --------------------------------------------------------------------- 1. Summary: Updated pcre packages that correct security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: PCRE is a Perl-compatible regular expression library. Flaws were found in the way PCRE handles certain malformed regular expressions. If an application linked against PCRE, such as Konqueror, parses a malicious regular expression, it may be possible to run arbitrary code as the user running the application. (CVE-2006-7224) Users of PCRE are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 373021 - CVE-2006-7224 pcre multiple integer overflows 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/pcre-4.5-4.el4_5.4.src.rpm 49236e545db29026eea3109c3fdba5ae pcre-4.5-4.el4_5.4.src.rpm i386: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm db9170f905d681c7b6a0ca283043da41 pcre-devel-4.5-4.el4_5.4.i386.rpm ia64: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm a9f0e8482a18d5c51a736ddb1c2344b5 pcre-4.5-4.el4_5.4.ia64.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm 732379892973afb39c50a375849021cc pcre-debuginfo-4.5-4.el4_5.4.ia64.rpm 2027d9e67ac017b59da16034cc89177c pcre-devel-4.5-4.el4_5.4.ia64.rpm ppc: f551684382e6beee3c585a13dd2bf652 pcre-4.5-4.el4_5.4.ppc.rpm ecb064a62fa97b7b29d73dde82e4f7f4 pcre-4.5-4.el4_5.4.ppc64.rpm 158ecbc3d5e51d0fe2c64651200481b2 pcre-debuginfo-4.5-4.el4_5.4.ppc.rpm 3239b9b56d0ee1892635fd6223a4e99a pcre-debuginfo-4.5-4.el4_5.4.ppc64.rpm c24ca5e4617e57414335b82d77867906 pcre-devel-4.5-4.el4_5.4.ppc.rpm s390: 06e9196587cd01b1ff6fb6dc10247f47 pcre-4.5-4.el4_5.4.s390.rpm bc79fe3e2811bf0bf47cc8a36b358cce pcre-debuginfo-4.5-4.el4_5.4.s390.rpm ea0f4ca567fdddd5ef765ea13eefa98f pcre-devel-4.5-4.el4_5.4.s390.rpm s390x: 06e9196587cd01b1ff6fb6dc10247f47 pcre-4.5-4.el4_5.4.s390.rpm 0bc4bab9367aef27216d568059340d43 pcre-4.5-4.el4_5.4.s390x.rpm bc79fe3e2811bf0bf47cc8a36b358cce pcre-debuginfo-4.5-4.el4_5.4.s390.rpm 5cad83935892bb7a0f9b92df7cd6e8e4 pcre-debuginfo-4.5-4.el4_5.4.s390x.rpm 22218623a862c125c4be76ce819d9705 pcre-devel-4.5-4.el4_5.4.s390x.rpm x86_64: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm 1c9d0bb0a1c176950e0469d92d48748a pcre-4.5-4.el4_5.4.x86_64.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm c383e03fb1d6a1f561751b03030e6cde pcre-debuginfo-4.5-4.el4_5.4.x86_64.rpm cb6ac02502f662374d4de938aa2e19c4 pcre-devel-4.5-4.el4_5.4.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/pcre-4.5-4.el4_5.4.src.rpm 49236e545db29026eea3109c3fdba5ae pcre-4.5-4.el4_5.4.src.rpm i386: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm db9170f905d681c7b6a0ca283043da41 pcre-devel-4.5-4.el4_5.4.i386.rpm x86_64: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm 1c9d0bb0a1c176950e0469d92d48748a pcre-4.5-4.el4_5.4.x86_64.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm c383e03fb1d6a1f561751b03030e6cde pcre-debuginfo-4.5-4.el4_5.4.x86_64.rpm cb6ac02502f662374d4de938aa2e19c4 pcre-devel-4.5-4.el4_5.4.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/pcre-4.5-4.el4_5.4.src.rpm 49236e545db29026eea3109c3fdba5ae pcre-4.5-4.el4_5.4.src.rpm i386: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm db9170f905d681c7b6a0ca283043da41 pcre-devel-4.5-4.el4_5.4.i386.rpm ia64: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm a9f0e8482a18d5c51a736ddb1c2344b5 pcre-4.5-4.el4_5.4.ia64.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm 732379892973afb39c50a375849021cc pcre-debuginfo-4.5-4.el4_5.4.ia64.rpm 2027d9e67ac017b59da16034cc89177c pcre-devel-4.5-4.el4_5.4.ia64.rpm x86_64: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm 1c9d0bb0a1c176950e0469d92d48748a pcre-4.5-4.el4_5.4.x86_64.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm c383e03fb1d6a1f561751b03030e6cde pcre-debuginfo-4.5-4.el4_5.4.x86_64.rpm cb6ac02502f662374d4de938aa2e19c4 pcre-devel-4.5-4.el4_5.4.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/pcre-4.5-4.el4_5.4.src.rpm 49236e545db29026eea3109c3fdba5ae pcre-4.5-4.el4_5.4.src.rpm i386: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm db9170f905d681c7b6a0ca283043da41 pcre-devel-4.5-4.el4_5.4.i386.rpm ia64: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm a9f0e8482a18d5c51a736ddb1c2344b5 pcre-4.5-4.el4_5.4.ia64.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm 732379892973afb39c50a375849021cc pcre-debuginfo-4.5-4.el4_5.4.ia64.rpm 2027d9e67ac017b59da16034cc89177c pcre-devel-4.5-4.el4_5.4.ia64.rpm x86_64: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm 1c9d0bb0a1c176950e0469d92d48748a pcre-4.5-4.el4_5.4.x86_64.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm c383e03fb1d6a1f561751b03030e6cde pcre-debuginfo-4.5-4.el4_5.4.x86_64.rpm cb6ac02502f662374d4de938aa2e19c4 pcre-devel-4.5-4.el4_5.4.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pcre-6.6-2.el5_1.1.src.rpm 230040f3f36e5664ce5a6671334f6ddb pcre-6.6-2.el5_1.1.src.rpm i386: 0bedc083211d95e89d11fbbddc07e968 pcre-6.6-2.el5_1.1.i386.rpm 57892457eef33e35b1fc5528a42bcd94 pcre-debuginfo-6.6-2.el5_1.1.i386.rpm x86_64: 0bedc083211d95e89d11fbbddc07e968 pcre-6.6-2.el5_1.1.i386.rpm 6ce8eee6c331ca63a39e0fe03c7fb985 pcre-6.6-2.el5_1.1.x86_64.rpm 57892457eef33e35b1fc5528a42bcd94 pcre-debuginfo-6.6-2.el5_1.1.i386.rpm 1cac5a613d8b28267e8db6f7cb2afd46 pcre-debuginfo-6.6-2.el5_1.1.x86_64.rpm RHEL Desktop Workstation (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pcre-6.6-2.el5_1.1.src.rpm 230040f3f36e5664ce5a6671334f6ddb pcre-6.6-2.el5_1.1.src.rpm i386: 57892457eef33e35b1fc5528a42bcd94 pcre-debuginfo-6.6-2.el5_1.1.i386.rpm c53d0803d49bf739b59539eb5782f43f pcre-devel-6.6-2.el5_1.1.i386.rpm x86_64: 57892457eef33e35b1fc5528a42bcd94 pcre-debuginfo-6.6-2.el5_1.1.i386.rpm 1cac5a613d8b28267e8db6f7cb2afd46 pcre-debuginfo-6.6-2.el5_1.1.x86_64.rpm c53d0803d49bf739b59539eb5782f43f pcre-devel-6.6-2.el5_1.1.i386.rpm cc64b53c0d0b0d4fac6429baad17fba2 pcre-devel-6.6-2.el5_1.1.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/pcre-6.6-2.el5_1.1.src.rpm 230040f3f36e5664ce5a6671334f6ddb pcre-6.6-2.el5_1.1.src.rpm i386: 0bedc083211d95e89d11fbbddc07e968 pcre-6.6-2.el5_1.1.i386.rpm 57892457eef33e35b1fc5528a42bcd94 pcre-debuginfo-6.6-2.el5_1.1.i386.rpm c53d0803d49bf739b59539eb5782f43f pcre-devel-6.6-2.el5_1.1.i386.rpm ia64: b7ef7d4d91f0425011c348e81140a5f3 pcre-6.6-2.el5_1.1.ia64.rpm 888ea998576acca5a6a8529c2da64f87 pcre-debuginfo-6.6-2.el5_1.1.ia64.rpm a424e60ea30261a2650124df2fe0b914 pcre-devel-6.6-2.el5_1.1.ia64.rpm ppc: 8f903834f10271879e1a08d87987cad1 pcre-6.6-2.el5_1.1.ppc.rpm cea8361d9d14c7fae8a57274ea02b33b pcre-6.6-2.el5_1.1.ppc64.rpm ffec123b0c84c123042501d9511030b5 pcre-debuginfo-6.6-2.el5_1.1.ppc.rpm 30e0adc7d5a7798dec12dbb04cd15e31 pcre-debuginfo-6.6-2.el5_1.1.ppc64.rpm 3423c3eb767d485eb26e6808b2204cf1 pcre-devel-6.6-2.el5_1.1.ppc.rpm d7b38446e64240c6d8e442552e9f5dbb pcre-devel-6.6-2.el5_1.1.ppc64.rpm s390x: b06798c560af2b94f7e7b6448cdeefac pcre-6.6-2.el5_1.1.s390.rpm bf9ec28737e79e899638a08b74f3fbf5 pcre-6.6-2.el5_1.1.s390x.rpm 3e4d44a6ed3dea1629280c91000ff5a5 pcre-debuginfo-6.6-2.el5_1.1.s390.rpm 5e3fef773f0a841bf5c4b2c448a52327 pcre-debuginfo-6.6-2.el5_1.1.s390x.rpm ca23b3b464e301f25229e9d5fd654909 pcre-devel-6.6-2.el5_1.1.s390.rpm bb72d6e9246bbe645dcb9eecef9d6fe6 pcre-devel-6.6-2.el5_1.1.s390x.rpm x86_64: 0bedc083211d95e89d11fbbddc07e968 pcre-6.6-2.el5_1.1.i386.rpm 6ce8eee6c331ca63a39e0fe03c7fb985 pcre-6.6-2.el5_1.1.x86_64.rpm 57892457eef33e35b1fc5528a42bcd94 pcre-debuginfo-6.6-2.el5_1.1.i386.rpm 1cac5a613d8b28267e8db6f7cb2afd46 pcre-debuginfo-6.6-2.el5_1.1.x86_64.rpm c53d0803d49bf739b59539eb5782f43f pcre-devel-6.6-2.el5_1.1.i386.rpm cc64b53c0d0b0d4fac6429baad17fba2 pcre-devel-6.6-2.el5_1.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7224 http://www.redhat.com/security/updates/classification/#critical 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHNTKaXlSAg2UNWIIRAnETAJ9nhgu/uxiLQCJ0MTtN1CW1c2xLiQCcDp8Q puYAPr4eLfQlWJ/YOq0+sSY= =xQM+ -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Nov 12 09:25:48 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 12 Nov 2007 04:25:48 -0500 Subject: [RHSA-2007:1024-01] Important: kdegraphics security update Message-ID: <200711120925.lAC9PopI008921@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: kdegraphics security update Advisory ID: RHSA-2007:1024-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1024.html Issue date: 2007-11-12 Updated on: 2007-11-12 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-4352 CVE-2007-5392 CVE-2007-5393 - --------------------------------------------------------------------- 1. Summary: Updated kdegraphics packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: The kdegraphics packages contain applications for the K Desktop Environment. This includes kpdf, a PDF file viewer. Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause kpdf to crash, or potentially execute arbitrary code when opened. (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393) All kdegraphics users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 345101 - CVE-2007-4352 xpdf memory corruption in DCTStream::readProgressiveDataUnit() 345111 - CVE-2007-5392 xpdf buffer overflow in DCTStream::reset() 345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar() 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/kdegraphics-3.3.1-6.el4_5.src.rpm 2df5cb57275608558ade1c113bea21eb kdegraphics-3.3.1-6.el4_5.src.rpm i386: 089f57bd68cced81dd053dec986addf5 kdegraphics-3.3.1-6.el4_5.i386.rpm 52d5f121bb5d23eff8841ad3a0aad880 kdegraphics-debuginfo-3.3.1-6.el4_5.i386.rpm ec87470f5c8f11f54a55af4a13a99224 kdegraphics-devel-3.3.1-6.el4_5.i386.rpm ia64: 6c00172daefea3c09fa8483abfeea8d5 kdegraphics-3.3.1-6.el4_5.ia64.rpm 2df1cc7ce6363971bff6a19eeeac07e5 kdegraphics-debuginfo-3.3.1-6.el4_5.ia64.rpm 1bf2ac07dd4a58411ed6e2e4ad162460 kdegraphics-devel-3.3.1-6.el4_5.ia64.rpm ppc: c4127e3b4c7f00c0b4afeae24c6d3dfb kdegraphics-3.3.1-6.el4_5.ppc.rpm 808f03850e773ff1bd8258f67196f920 kdegraphics-debuginfo-3.3.1-6.el4_5.ppc.rpm e52b078bfae6a4e1d4987ae2a41ad522 kdegraphics-devel-3.3.1-6.el4_5.ppc.rpm s390: 4202094bcf070daf4840ad2f8120cd42 kdegraphics-3.3.1-6.el4_5.s390.rpm 9341ec45488ac340598b34fb57fb20b7 kdegraphics-debuginfo-3.3.1-6.el4_5.s390.rpm 3ad84173f4d706581ce3dca23087aa0a kdegraphics-devel-3.3.1-6.el4_5.s390.rpm s390x: 794865b11e7b796dde41a1c3a7501de8 kdegraphics-3.3.1-6.el4_5.s390x.rpm 03f5dc0a1f4d075810f039f1eef4a4d1 kdegraphics-debuginfo-3.3.1-6.el4_5.s390x.rpm 0e6c3cb55898231529b7b59bbf9568a7 kdegraphics-devel-3.3.1-6.el4_5.s390x.rpm x86_64: 44d160c654800afa86d092989e956a19 kdegraphics-3.3.1-6.el4_5.x86_64.rpm 47360fdf6f60e09f218c25b252a9c48b kdegraphics-debuginfo-3.3.1-6.el4_5.x86_64.rpm 6f6ec071fca80eca87413503c8f3bec5 kdegraphics-devel-3.3.1-6.el4_5.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/kdegraphics-3.3.1-6.el4_5.src.rpm 2df5cb57275608558ade1c113bea21eb kdegraphics-3.3.1-6.el4_5.src.rpm i386: 089f57bd68cced81dd053dec986addf5 kdegraphics-3.3.1-6.el4_5.i386.rpm 52d5f121bb5d23eff8841ad3a0aad880 kdegraphics-debuginfo-3.3.1-6.el4_5.i386.rpm ec87470f5c8f11f54a55af4a13a99224 kdegraphics-devel-3.3.1-6.el4_5.i386.rpm x86_64: 44d160c654800afa86d092989e956a19 kdegraphics-3.3.1-6.el4_5.x86_64.rpm 47360fdf6f60e09f218c25b252a9c48b kdegraphics-debuginfo-3.3.1-6.el4_5.x86_64.rpm 6f6ec071fca80eca87413503c8f3bec5 kdegraphics-devel-3.3.1-6.el4_5.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/kdegraphics-3.3.1-6.el4_5.src.rpm 2df5cb57275608558ade1c113bea21eb kdegraphics-3.3.1-6.el4_5.src.rpm i386: 089f57bd68cced81dd053dec986addf5 kdegraphics-3.3.1-6.el4_5.i386.rpm 52d5f121bb5d23eff8841ad3a0aad880 kdegraphics-debuginfo-3.3.1-6.el4_5.i386.rpm ec87470f5c8f11f54a55af4a13a99224 kdegraphics-devel-3.3.1-6.el4_5.i386.rpm ia64: 6c00172daefea3c09fa8483abfeea8d5 kdegraphics-3.3.1-6.el4_5.ia64.rpm 2df1cc7ce6363971bff6a19eeeac07e5 kdegraphics-debuginfo-3.3.1-6.el4_5.ia64.rpm 1bf2ac07dd4a58411ed6e2e4ad162460 kdegraphics-devel-3.3.1-6.el4_5.ia64.rpm x86_64: 44d160c654800afa86d092989e956a19 kdegraphics-3.3.1-6.el4_5.x86_64.rpm 47360fdf6f60e09f218c25b252a9c48b kdegraphics-debuginfo-3.3.1-6.el4_5.x86_64.rpm 6f6ec071fca80eca87413503c8f3bec5 kdegraphics-devel-3.3.1-6.el4_5.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/kdegraphics-3.3.1-6.el4_5.src.rpm 2df5cb57275608558ade1c113bea21eb kdegraphics-3.3.1-6.el4_5.src.rpm i386: 089f57bd68cced81dd053dec986addf5 kdegraphics-3.3.1-6.el4_5.i386.rpm 52d5f121bb5d23eff8841ad3a0aad880 kdegraphics-debuginfo-3.3.1-6.el4_5.i386.rpm ec87470f5c8f11f54a55af4a13a99224 kdegraphics-devel-3.3.1-6.el4_5.i386.rpm ia64: 6c00172daefea3c09fa8483abfeea8d5 kdegraphics-3.3.1-6.el4_5.ia64.rpm 2df1cc7ce6363971bff6a19eeeac07e5 kdegraphics-debuginfo-3.3.1-6.el4_5.ia64.rpm 1bf2ac07dd4a58411ed6e2e4ad162460 kdegraphics-devel-3.3.1-6.el4_5.ia64.rpm x86_64: 44d160c654800afa86d092989e956a19 kdegraphics-3.3.1-6.el4_5.x86_64.rpm 47360fdf6f60e09f218c25b252a9c48b kdegraphics-debuginfo-3.3.1-6.el4_5.x86_64.rpm 6f6ec071fca80eca87413503c8f3bec5 kdegraphics-devel-3.3.1-6.el4_5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4352 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5392 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5393 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHOBwQXlSAg2UNWIIRArS1AKDFAm+CzNMQd9i1fBqnwnStWiDf3wCgwaOW tI6H0aJ0RACb7cl3Sh8hdwQ= =wiVQ -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Nov 12 09:25:59 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 12 Nov 2007 04:25:59 -0500 Subject: [RHSA-2007:1051-01] Important: kdegraphics security update Message-ID: <200711120925.lAC9Pxxe008932@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: kdegraphics security update Advisory ID: RHSA-2007:1051-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1051.html Issue date: 2007-11-12 Updated on: 2007-11-12 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-5393 - --------------------------------------------------------------------- 1. Summary: Updated kdegraphics packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64 3. Problem description: The kdegraphics packages contain applications for the K Desktop Environment. This includes kpdf, a PDF file viewer. Alin Rad Pop discovered a flaw in the handling of PDF files. An attacker could create a malicious PDF file that would cause kpdf to crash, or potentially execute arbitrary code when opened. (CVE-2007-5393) All kdegraphics users are advised to upgrade to these updated packages, which contain backported patches to resolve this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar() 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/kdegraphics-3.5.4-5.el5_1.src.rpm c2f340f5b26713accf531bd5c768ec0e kdegraphics-3.5.4-5.el5_1.src.rpm i386: 64c7469c3efac3747f52194d30d60f47 kdegraphics-3.5.4-5.el5_1.i386.rpm 82f606b2b6e34f98d967817f8d439f41 kdegraphics-debuginfo-3.5.4-5.el5_1.i386.rpm x86_64: 189a7bb3a163f0e7f30c5657f24815ad kdegraphics-3.5.4-5.el5_1.x86_64.rpm 31701cc38fe172166a213b5cee0072d1 kdegraphics-debuginfo-3.5.4-5.el5_1.x86_64.rpm RHEL Desktop Workstation (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/kdegraphics-3.5.4-5.el5_1.src.rpm c2f340f5b26713accf531bd5c768ec0e kdegraphics-3.5.4-5.el5_1.src.rpm i386: 82f606b2b6e34f98d967817f8d439f41 kdegraphics-debuginfo-3.5.4-5.el5_1.i386.rpm 482c3ec5a51486e432c245011ce89409 kdegraphics-devel-3.5.4-5.el5_1.i386.rpm x86_64: 82f606b2b6e34f98d967817f8d439f41 kdegraphics-debuginfo-3.5.4-5.el5_1.i386.rpm 31701cc38fe172166a213b5cee0072d1 kdegraphics-debuginfo-3.5.4-5.el5_1.x86_64.rpm 482c3ec5a51486e432c245011ce89409 kdegraphics-devel-3.5.4-5.el5_1.i386.rpm 89749820cf7c3172c6dfd0519112c60d kdegraphics-devel-3.5.4-5.el5_1.x86_64.rpm RHEL Optional Productivity Applications (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/kdegraphics-3.5.4-5.el5_1.src.rpm c2f340f5b26713accf531bd5c768ec0e kdegraphics-3.5.4-5.el5_1.src.rpm i386: 64c7469c3efac3747f52194d30d60f47 kdegraphics-3.5.4-5.el5_1.i386.rpm 82f606b2b6e34f98d967817f8d439f41 kdegraphics-debuginfo-3.5.4-5.el5_1.i386.rpm 482c3ec5a51486e432c245011ce89409 kdegraphics-devel-3.5.4-5.el5_1.i386.rpm x86_64: 189a7bb3a163f0e7f30c5657f24815ad kdegraphics-3.5.4-5.el5_1.x86_64.rpm 82f606b2b6e34f98d967817f8d439f41 kdegraphics-debuginfo-3.5.4-5.el5_1.i386.rpm 31701cc38fe172166a213b5cee0072d1 kdegraphics-debuginfo-3.5.4-5.el5_1.x86_64.rpm 482c3ec5a51486e432c245011ce89409 kdegraphics-devel-3.5.4-5.el5_1.i386.rpm 89749820cf7c3172c6dfd0519112c60d kdegraphics-devel-3.5.4-5.el5_1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5393 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHOBwiXlSAg2UNWIIRAhVSAKCF8ML2wEGii9LplJhwMQol3CXhkACfbz60 T9e21jaRjWAGWApCkriuggA= =DSNt -----END PGP SIGNATURE----- From bugzilla at redhat.com Tue Nov 13 10:00:16 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Tue, 13 Nov 2007 05:00:16 -0500 Subject: [RHSA-2007:0961-01] Moderate: ruby security update Message-ID: <200711131000.lADA0GFO026731@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: ruby security update Advisory ID: RHSA-2007:0961-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0961.html Issue date: 2007-11-13 Updated on: 2007-11-13 Product: Red Hat Enterprise Linux CVE Names: CVE-2006-6303 CVE-2007-5162 CVE-2007-5770 - --------------------------------------------------------------------- 1. Summary: Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: Ruby is an interpreted scripting language for object-oriented programming. A flaw was discovered in the way Ruby's CGI module handles certain HTTP requests. If a remote attacker sends a specially crafted request, it is possible to cause the ruby CGI script to enter an infinite loop, possibly causing a denial of service. (CVE-2006-6303) An SSL certificate validation flaw was discovered in several Ruby Net modules. The libraries were not checking the requested host name against the common name (CN) in the SSL server certificate, possibly allowing a man in the middle attack. (CVE-2007-5162, CVE-2007-5770) Users of Ruby should upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 218287 - CVE-2006-6303 ruby's cgi.rb vulnerable infinite loop DoS 313691 - CVE-2007-5162 ruby Net:HTTP insufficient verification of SSL certificate 362081 - CVE-2007-5770 ruby insufficient verification of SSL certificate in various net::* modules 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/ruby-1.8.1-7.EL4.8.1.src.rpm 106605e96347c6766e83336109ba6ae0 ruby-1.8.1-7.EL4.8.1.src.rpm i386: 765be348e6e5cad8b65f70497d42051d irb-1.8.1-7.EL4.8.1.i386.rpm f73ba45ab88a14158cfa3b85c0ebfe82 ruby-1.8.1-7.EL4.8.1.i386.rpm c3333caf260f1dee91d739a1bccbe7a4 ruby-debuginfo-1.8.1-7.EL4.8.1.i386.rpm 9d605627141ccc78801ae53c364c884e ruby-devel-1.8.1-7.EL4.8.1.i386.rpm 4330a884a43cc05b072db0507185bb94 ruby-docs-1.8.1-7.EL4.8.1.i386.rpm 92278b25f1a1ea86d1b2c18afeb05d27 ruby-libs-1.8.1-7.EL4.8.1.i386.rpm 0360306d3f6166b36c1931aaae8d34b9 ruby-mode-1.8.1-7.EL4.8.1.i386.rpm 5535d1efd33c3cad3ee737d55f6f7681 ruby-tcltk-1.8.1-7.EL4.8.1.i386.rpm ia64: 79afb3c8edf4d65c3a6b07fdf52cb526 irb-1.8.1-7.EL4.8.1.ia64.rpm 224177b4e85cbb98ea816a64dde00633 ruby-1.8.1-7.EL4.8.1.ia64.rpm c3333caf260f1dee91d739a1bccbe7a4 ruby-debuginfo-1.8.1-7.EL4.8.1.i386.rpm 6771ce90dba3304330d9581490092155 ruby-debuginfo-1.8.1-7.EL4.8.1.ia64.rpm 918ccbb91646cd136c081d9ad33d3721 ruby-devel-1.8.1-7.EL4.8.1.ia64.rpm d74490173c8eb515d92e14c0989e3b7e ruby-docs-1.8.1-7.EL4.8.1.ia64.rpm 92278b25f1a1ea86d1b2c18afeb05d27 ruby-libs-1.8.1-7.EL4.8.1.i386.rpm 7541fe15a20e6f4d76e54d4831b7bcf0 ruby-libs-1.8.1-7.EL4.8.1.ia64.rpm f02558e7060950c1e494091870abb917 ruby-mode-1.8.1-7.EL4.8.1.ia64.rpm 65fab944a8c300f774a4bf9bf681e66e ruby-tcltk-1.8.1-7.EL4.8.1.ia64.rpm ppc: 32c8d583b12f0540150728beca98516a irb-1.8.1-7.EL4.8.1.ppc.rpm 253e37299eca96941362fd0da1b905b1 ruby-1.8.1-7.EL4.8.1.ppc.rpm e61050368f7da362d893d421b2030d7b ruby-debuginfo-1.8.1-7.EL4.8.1.ppc.rpm d9d0d602b138b6b49d070f49e1d62095 ruby-debuginfo-1.8.1-7.EL4.8.1.ppc64.rpm d08807158491f3d09240aae131be1577 ruby-devel-1.8.1-7.EL4.8.1.ppc.rpm 9ddf28f5ae0a457e4d2ba9fc7ed4d150 ruby-docs-1.8.1-7.EL4.8.1.ppc.rpm de396a9f2c3808849a666de02482704a ruby-libs-1.8.1-7.EL4.8.1.ppc.rpm af47b978c18c50d0051476bd033d1e50 ruby-libs-1.8.1-7.EL4.8.1.ppc64.rpm ca595a74f2fd54abfb2f91e14d83c84d ruby-mode-1.8.1-7.EL4.8.1.ppc.rpm 8b8d7eb76afedb6662d7f689c49b3258 ruby-tcltk-1.8.1-7.EL4.8.1.ppc.rpm s390: 3dfffafb19d5612dac313a8cdedcaa08 irb-1.8.1-7.EL4.8.1.s390.rpm 01dd2123eaca564e4013feacb073600e ruby-1.8.1-7.EL4.8.1.s390.rpm 3f48142faef520f76b158d9a332b8c76 ruby-debuginfo-1.8.1-7.EL4.8.1.s390.rpm 0577bdd9c31681ec0db944e68ed0a258 ruby-devel-1.8.1-7.EL4.8.1.s390.rpm 37e28a8e01e41e153b58c6365dc5ee20 ruby-docs-1.8.1-7.EL4.8.1.s390.rpm f4b2f51f031fe1b411ba17499399a989 ruby-libs-1.8.1-7.EL4.8.1.s390.rpm 2625c174e9837fecf9c1fe41bc1b9002 ruby-mode-1.8.1-7.EL4.8.1.s390.rpm a5616a339f8d84a3da47eeff25a9aa84 ruby-tcltk-1.8.1-7.EL4.8.1.s390.rpm s390x: 213116e94f9e99f5f9c03043892ffbf3 irb-1.8.1-7.EL4.8.1.s390x.rpm db5a7d26cdfbefe2248a1d54b50f4157 ruby-1.8.1-7.EL4.8.1.s390x.rpm 3f48142faef520f76b158d9a332b8c76 ruby-debuginfo-1.8.1-7.EL4.8.1.s390.rpm 7f328a6c2d9e5c345a3689a7c9b3d420 ruby-debuginfo-1.8.1-7.EL4.8.1.s390x.rpm 657ad52c8465fc84eaee4136d2adeff4 ruby-devel-1.8.1-7.EL4.8.1.s390x.rpm b041f610b1d62a19c10261d6b409eb14 ruby-docs-1.8.1-7.EL4.8.1.s390x.rpm f4b2f51f031fe1b411ba17499399a989 ruby-libs-1.8.1-7.EL4.8.1.s390.rpm 8e7d43c13a8868217377d3d442430358 ruby-libs-1.8.1-7.EL4.8.1.s390x.rpm 0b8c3dc30bb9d932e7176882503c5ac4 ruby-mode-1.8.1-7.EL4.8.1.s390x.rpm 98c1e9130ab7b2d2db4c6f0d9e157ec2 ruby-tcltk-1.8.1-7.EL4.8.1.s390x.rpm x86_64: f2c8d1fca0386f4549afe1eed3b27bfe irb-1.8.1-7.EL4.8.1.x86_64.rpm 1cb537a873061ed0920366a223aa4723 ruby-1.8.1-7.EL4.8.1.x86_64.rpm c3333caf260f1dee91d739a1bccbe7a4 ruby-debuginfo-1.8.1-7.EL4.8.1.i386.rpm 99df3795693b455bd46ec25fc5e19412 ruby-debuginfo-1.8.1-7.EL4.8.1.x86_64.rpm ddd89b3fe0d886afe15d1e56fe9c25b3 ruby-devel-1.8.1-7.EL4.8.1.x86_64.rpm 22ca0c3995245046e85b4f378dc8e83f ruby-docs-1.8.1-7.EL4.8.1.x86_64.rpm 92278b25f1a1ea86d1b2c18afeb05d27 ruby-libs-1.8.1-7.EL4.8.1.i386.rpm 92bde1960d6f6fd7b3c139cb1c27985c ruby-libs-1.8.1-7.EL4.8.1.x86_64.rpm 99bcb06185b20465900cafce0f97a3c0 ruby-mode-1.8.1-7.EL4.8.1.x86_64.rpm 012c233146fe9350713e7ed1f24a577f ruby-tcltk-1.8.1-7.EL4.8.1.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/ruby-1.8.1-7.EL4.8.1.src.rpm 106605e96347c6766e83336109ba6ae0 ruby-1.8.1-7.EL4.8.1.src.rpm i386: 765be348e6e5cad8b65f70497d42051d irb-1.8.1-7.EL4.8.1.i386.rpm f73ba45ab88a14158cfa3b85c0ebfe82 ruby-1.8.1-7.EL4.8.1.i386.rpm c3333caf260f1dee91d739a1bccbe7a4 ruby-debuginfo-1.8.1-7.EL4.8.1.i386.rpm 9d605627141ccc78801ae53c364c884e ruby-devel-1.8.1-7.EL4.8.1.i386.rpm 4330a884a43cc05b072db0507185bb94 ruby-docs-1.8.1-7.EL4.8.1.i386.rpm 92278b25f1a1ea86d1b2c18afeb05d27 ruby-libs-1.8.1-7.EL4.8.1.i386.rpm 0360306d3f6166b36c1931aaae8d34b9 ruby-mode-1.8.1-7.EL4.8.1.i386.rpm 5535d1efd33c3cad3ee737d55f6f7681 ruby-tcltk-1.8.1-7.EL4.8.1.i386.rpm x86_64: f2c8d1fca0386f4549afe1eed3b27bfe irb-1.8.1-7.EL4.8.1.x86_64.rpm 1cb537a873061ed0920366a223aa4723 ruby-1.8.1-7.EL4.8.1.x86_64.rpm c3333caf260f1dee91d739a1bccbe7a4 ruby-debuginfo-1.8.1-7.EL4.8.1.i386.rpm 99df3795693b455bd46ec25fc5e19412 ruby-debuginfo-1.8.1-7.EL4.8.1.x86_64.rpm ddd89b3fe0d886afe15d1e56fe9c25b3 ruby-devel-1.8.1-7.EL4.8.1.x86_64.rpm 22ca0c3995245046e85b4f378dc8e83f ruby-docs-1.8.1-7.EL4.8.1.x86_64.rpm 92278b25f1a1ea86d1b2c18afeb05d27 ruby-libs-1.8.1-7.EL4.8.1.i386.rpm 92bde1960d6f6fd7b3c139cb1c27985c ruby-libs-1.8.1-7.EL4.8.1.x86_64.rpm 99bcb06185b20465900cafce0f97a3c0 ruby-mode-1.8.1-7.EL4.8.1.x86_64.rpm 012c233146fe9350713e7ed1f24a577f ruby-tcltk-1.8.1-7.EL4.8.1.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/ruby-1.8.1-7.EL4.8.1.src.rpm 106605e96347c6766e83336109ba6ae0 ruby-1.8.1-7.EL4.8.1.src.rpm i386: 765be348e6e5cad8b65f70497d42051d irb-1.8.1-7.EL4.8.1.i386.rpm f73ba45ab88a14158cfa3b85c0ebfe82 ruby-1.8.1-7.EL4.8.1.i386.rpm c3333caf260f1dee91d739a1bccbe7a4 ruby-debuginfo-1.8.1-7.EL4.8.1.i386.rpm 9d605627141ccc78801ae53c364c884e ruby-devel-1.8.1-7.EL4.8.1.i386.rpm 4330a884a43cc05b072db0507185bb94 ruby-docs-1.8.1-7.EL4.8.1.i386.rpm 92278b25f1a1ea86d1b2c18afeb05d27 ruby-libs-1.8.1-7.EL4.8.1.i386.rpm 0360306d3f6166b36c1931aaae8d34b9 ruby-mode-1.8.1-7.EL4.8.1.i386.rpm 5535d1efd33c3cad3ee737d55f6f7681 ruby-tcltk-1.8.1-7.EL4.8.1.i386.rpm ia64: 79afb3c8edf4d65c3a6b07fdf52cb526 irb-1.8.1-7.EL4.8.1.ia64.rpm 224177b4e85cbb98ea816a64dde00633 ruby-1.8.1-7.EL4.8.1.ia64.rpm c3333caf260f1dee91d739a1bccbe7a4 ruby-debuginfo-1.8.1-7.EL4.8.1.i386.rpm 6771ce90dba3304330d9581490092155 ruby-debuginfo-1.8.1-7.EL4.8.1.ia64.rpm 918ccbb91646cd136c081d9ad33d3721 ruby-devel-1.8.1-7.EL4.8.1.ia64.rpm d74490173c8eb515d92e14c0989e3b7e ruby-docs-1.8.1-7.EL4.8.1.ia64.rpm 92278b25f1a1ea86d1b2c18afeb05d27 ruby-libs-1.8.1-7.EL4.8.1.i386.rpm 7541fe15a20e6f4d76e54d4831b7bcf0 ruby-libs-1.8.1-7.EL4.8.1.ia64.rpm f02558e7060950c1e494091870abb917 ruby-mode-1.8.1-7.EL4.8.1.ia64.rpm 65fab944a8c300f774a4bf9bf681e66e ruby-tcltk-1.8.1-7.EL4.8.1.ia64.rpm x86_64: f2c8d1fca0386f4549afe1eed3b27bfe irb-1.8.1-7.EL4.8.1.x86_64.rpm 1cb537a873061ed0920366a223aa4723 ruby-1.8.1-7.EL4.8.1.x86_64.rpm c3333caf260f1dee91d739a1bccbe7a4 ruby-debuginfo-1.8.1-7.EL4.8.1.i386.rpm 99df3795693b455bd46ec25fc5e19412 ruby-debuginfo-1.8.1-7.EL4.8.1.x86_64.rpm ddd89b3fe0d886afe15d1e56fe9c25b3 ruby-devel-1.8.1-7.EL4.8.1.x86_64.rpm 22ca0c3995245046e85b4f378dc8e83f ruby-docs-1.8.1-7.EL4.8.1.x86_64.rpm 92278b25f1a1ea86d1b2c18afeb05d27 ruby-libs-1.8.1-7.EL4.8.1.i386.rpm 92bde1960d6f6fd7b3c139cb1c27985c ruby-libs-1.8.1-7.EL4.8.1.x86_64.rpm 99bcb06185b20465900cafce0f97a3c0 ruby-mode-1.8.1-7.EL4.8.1.x86_64.rpm 012c233146fe9350713e7ed1f24a577f ruby-tcltk-1.8.1-7.EL4.8.1.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/ruby-1.8.1-7.EL4.8.1.src.rpm 106605e96347c6766e83336109ba6ae0 ruby-1.8.1-7.EL4.8.1.src.rpm i386: 765be348e6e5cad8b65f70497d42051d irb-1.8.1-7.EL4.8.1.i386.rpm f73ba45ab88a14158cfa3b85c0ebfe82 ruby-1.8.1-7.EL4.8.1.i386.rpm c3333caf260f1dee91d739a1bccbe7a4 ruby-debuginfo-1.8.1-7.EL4.8.1.i386.rpm 9d605627141ccc78801ae53c364c884e ruby-devel-1.8.1-7.EL4.8.1.i386.rpm 4330a884a43cc05b072db0507185bb94 ruby-docs-1.8.1-7.EL4.8.1.i386.rpm 92278b25f1a1ea86d1b2c18afeb05d27 ruby-libs-1.8.1-7.EL4.8.1.i386.rpm 0360306d3f6166b36c1931aaae8d34b9 ruby-mode-1.8.1-7.EL4.8.1.i386.rpm 5535d1efd33c3cad3ee737d55f6f7681 ruby-tcltk-1.8.1-7.EL4.8.1.i386.rpm ia64: 79afb3c8edf4d65c3a6b07fdf52cb526 irb-1.8.1-7.EL4.8.1.ia64.rpm 224177b4e85cbb98ea816a64dde00633 ruby-1.8.1-7.EL4.8.1.ia64.rpm c3333caf260f1dee91d739a1bccbe7a4 ruby-debuginfo-1.8.1-7.EL4.8.1.i386.rpm 6771ce90dba3304330d9581490092155 ruby-debuginfo-1.8.1-7.EL4.8.1.ia64.rpm 918ccbb91646cd136c081d9ad33d3721 ruby-devel-1.8.1-7.EL4.8.1.ia64.rpm d74490173c8eb515d92e14c0989e3b7e ruby-docs-1.8.1-7.EL4.8.1.ia64.rpm 92278b25f1a1ea86d1b2c18afeb05d27 ruby-libs-1.8.1-7.EL4.8.1.i386.rpm 7541fe15a20e6f4d76e54d4831b7bcf0 ruby-libs-1.8.1-7.EL4.8.1.ia64.rpm f02558e7060950c1e494091870abb917 ruby-mode-1.8.1-7.EL4.8.1.ia64.rpm 65fab944a8c300f774a4bf9bf681e66e ruby-tcltk-1.8.1-7.EL4.8.1.ia64.rpm x86_64: f2c8d1fca0386f4549afe1eed3b27bfe irb-1.8.1-7.EL4.8.1.x86_64.rpm 1cb537a873061ed0920366a223aa4723 ruby-1.8.1-7.EL4.8.1.x86_64.rpm c3333caf260f1dee91d739a1bccbe7a4 ruby-debuginfo-1.8.1-7.EL4.8.1.i386.rpm 99df3795693b455bd46ec25fc5e19412 ruby-debuginfo-1.8.1-7.EL4.8.1.x86_64.rpm ddd89b3fe0d886afe15d1e56fe9c25b3 ruby-devel-1.8.1-7.EL4.8.1.x86_64.rpm 22ca0c3995245046e85b4f378dc8e83f ruby-docs-1.8.1-7.EL4.8.1.x86_64.rpm 92278b25f1a1ea86d1b2c18afeb05d27 ruby-libs-1.8.1-7.EL4.8.1.i386.rpm 92bde1960d6f6fd7b3c139cb1c27985c ruby-libs-1.8.1-7.EL4.8.1.x86_64.rpm 99bcb06185b20465900cafce0f97a3c0 ruby-mode-1.8.1-7.EL4.8.1.x86_64.rpm 012c233146fe9350713e7ed1f24a577f ruby-tcltk-1.8.1-7.EL4.8.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6303 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5162 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5770 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHOXV6XlSAg2UNWIIRAgCwAJ9qV6b0L0STxmOFhqwSJT5VKoKClACbBBXQ 8v6N6i8NOQlE/YsuwCxvYRA= =uewW -----END PGP SIGNATURE----- From bugzilla at redhat.com Tue Nov 13 10:00:42 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Tue, 13 Nov 2007 05:00:42 -0500 Subject: [RHSA-2007:0965-01] Moderate: ruby security update Message-ID: <200711131000.lADA0gN4026840@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: ruby security update Advisory ID: RHSA-2007:0965-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0965.html Issue date: 2007-11-13 Updated on: 2007-11-13 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-5162 CVE-2007-5770 - --------------------------------------------------------------------- 1. Summary: Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: Ruby is an interpreted scripting language for object-oriented programming. An SSL certificate validation flaw was discovered in several Ruby Net modules. The libraries were not checking the requested host name against the common name (CN) in the SSL server certificate, possibly allowing a man in the middle attack. (CVE-2007-5162, CVE-2007-5770) Users of Ruby should upgrade to these updated packages, which contain a backported patch to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 313691 - CVE-2007-5162 ruby Net:HTTP insufficient verification of SSL certificate 362081 - CVE-2007-5770 ruby insufficient verification of SSL certificate in various net::* modules 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/ruby-1.8.5-5.el5_1.1.src.rpm bd2ba2ff48194091448b3c7c61fd218f ruby-1.8.5-5.el5_1.1.src.rpm i386: 9a1214c0884a6e4cfa181a693dbf1905 ruby-1.8.5-5.el5_1.1.i386.rpm affda32e3a7fbc2ff7b71820983fa10e ruby-debuginfo-1.8.5-5.el5_1.1.i386.rpm 3f99f3d8b23dbd04830d5b622d9acfbe ruby-docs-1.8.5-5.el5_1.1.i386.rpm fdafed93c351491808f3d787d2e1b967 ruby-irb-1.8.5-5.el5_1.1.i386.rpm 0d59f6f236006e26d2bdb13835adfbe5 ruby-libs-1.8.5-5.el5_1.1.i386.rpm 6a61484d511a539a6f5e51ab2f1b524d ruby-rdoc-1.8.5-5.el5_1.1.i386.rpm 8283e9c796c013c6fec91ebaf0686717 ruby-ri-1.8.5-5.el5_1.1.i386.rpm f57234b3f2b2e62c320cce79633517a2 ruby-tcltk-1.8.5-5.el5_1.1.i386.rpm x86_64: 1727a1e7a24dffd9bcbaf14dd5885e09 ruby-1.8.5-5.el5_1.1.x86_64.rpm affda32e3a7fbc2ff7b71820983fa10e ruby-debuginfo-1.8.5-5.el5_1.1.i386.rpm 5d03ae1d4a04606daa60c2f21452962d ruby-debuginfo-1.8.5-5.el5_1.1.x86_64.rpm b20add781113d1a6c62da9eb4ae5322e ruby-docs-1.8.5-5.el5_1.1.x86_64.rpm 9860b5dcaff839ceac92ad3473474138 ruby-irb-1.8.5-5.el5_1.1.x86_64.rpm 0d59f6f236006e26d2bdb13835adfbe5 ruby-libs-1.8.5-5.el5_1.1.i386.rpm 7cdaed976249c0f131f545adc6d34a19 ruby-libs-1.8.5-5.el5_1.1.x86_64.rpm b9daa1cda45b5c9eb7977162d32932f8 ruby-rdoc-1.8.5-5.el5_1.1.x86_64.rpm 7a97f1f171c16e36bd85abbbadab358b ruby-ri-1.8.5-5.el5_1.1.x86_64.rpm 9e1e70b9dd97366bd2d46a3bd87da52d ruby-tcltk-1.8.5-5.el5_1.1.x86_64.rpm RHEL Desktop Workstation (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/ruby-1.8.5-5.el5_1.1.src.rpm bd2ba2ff48194091448b3c7c61fd218f ruby-1.8.5-5.el5_1.1.src.rpm i386: affda32e3a7fbc2ff7b71820983fa10e ruby-debuginfo-1.8.5-5.el5_1.1.i386.rpm fc9636a5d413c56797e35c13e19445c1 ruby-devel-1.8.5-5.el5_1.1.i386.rpm b71daf9336d1c3ddfd572dd6f42aac3a ruby-mode-1.8.5-5.el5_1.1.i386.rpm x86_64: affda32e3a7fbc2ff7b71820983fa10e ruby-debuginfo-1.8.5-5.el5_1.1.i386.rpm 5d03ae1d4a04606daa60c2f21452962d ruby-debuginfo-1.8.5-5.el5_1.1.x86_64.rpm fc9636a5d413c56797e35c13e19445c1 ruby-devel-1.8.5-5.el5_1.1.i386.rpm c9cfa969d4cff4ba305119184559d59f ruby-devel-1.8.5-5.el5_1.1.x86_64.rpm 42b2fdf9d6d85e4701938042d05da90e ruby-mode-1.8.5-5.el5_1.1.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/ruby-1.8.5-5.el5_1.1.src.rpm bd2ba2ff48194091448b3c7c61fd218f ruby-1.8.5-5.el5_1.1.src.rpm i386: 9a1214c0884a6e4cfa181a693dbf1905 ruby-1.8.5-5.el5_1.1.i386.rpm affda32e3a7fbc2ff7b71820983fa10e ruby-debuginfo-1.8.5-5.el5_1.1.i386.rpm fc9636a5d413c56797e35c13e19445c1 ruby-devel-1.8.5-5.el5_1.1.i386.rpm 3f99f3d8b23dbd04830d5b622d9acfbe ruby-docs-1.8.5-5.el5_1.1.i386.rpm fdafed93c351491808f3d787d2e1b967 ruby-irb-1.8.5-5.el5_1.1.i386.rpm 0d59f6f236006e26d2bdb13835adfbe5 ruby-libs-1.8.5-5.el5_1.1.i386.rpm b71daf9336d1c3ddfd572dd6f42aac3a ruby-mode-1.8.5-5.el5_1.1.i386.rpm 6a61484d511a539a6f5e51ab2f1b524d ruby-rdoc-1.8.5-5.el5_1.1.i386.rpm 8283e9c796c013c6fec91ebaf0686717 ruby-ri-1.8.5-5.el5_1.1.i386.rpm f57234b3f2b2e62c320cce79633517a2 ruby-tcltk-1.8.5-5.el5_1.1.i386.rpm ia64: 833cb4e41f3ce360bffebe58dca7ffed ruby-1.8.5-5.el5_1.1.ia64.rpm f9280d52b11296dede951e4dc546d0e0 ruby-debuginfo-1.8.5-5.el5_1.1.ia64.rpm aa9fc9d56a73ddf69284e15178fd5335 ruby-devel-1.8.5-5.el5_1.1.ia64.rpm 5796d0d2c9bd06e7f15311ff7eb76f95 ruby-docs-1.8.5-5.el5_1.1.ia64.rpm 1cb804cb60fe8cd550d171d522566740 ruby-irb-1.8.5-5.el5_1.1.ia64.rpm 012d3122c4de5507f39eb43b339e8db3 ruby-libs-1.8.5-5.el5_1.1.ia64.rpm b54dd1219ac04bc945265c65f4a2e8a9 ruby-mode-1.8.5-5.el5_1.1.ia64.rpm b3e415994eb42d61e8d9783e40f586dd ruby-rdoc-1.8.5-5.el5_1.1.ia64.rpm 0668bbb175d3fc815ee7c709f1d67e8e ruby-ri-1.8.5-5.el5_1.1.ia64.rpm 03b3bbd6a20b5a570de2571259beb103 ruby-tcltk-1.8.5-5.el5_1.1.ia64.rpm ppc: 8c799e6408b3c0af19cf7bebea3b0ec4 ruby-1.8.5-5.el5_1.1.ppc.rpm a8e8a533efaabacbd9806998beb7bed9 ruby-debuginfo-1.8.5-5.el5_1.1.ppc.rpm 4e5a03c88823942fb923e13ee5e9f652 ruby-debuginfo-1.8.5-5.el5_1.1.ppc64.rpm c65c8ac0c44f5574b2d9e0c946bb1cc0 ruby-devel-1.8.5-5.el5_1.1.ppc.rpm 216d5f434ca5b590361445655cf35546 ruby-devel-1.8.5-5.el5_1.1.ppc64.rpm e7cf922d26f18c948840f2250491b432 ruby-docs-1.8.5-5.el5_1.1.ppc.rpm 6b8ddefd1936ee7eb6f529ffd45f0f56 ruby-irb-1.8.5-5.el5_1.1.ppc.rpm 9bd06a79a8d2144ca0425f64ee5bc052 ruby-libs-1.8.5-5.el5_1.1.ppc.rpm f68509b3bec796e6e35890101422979c ruby-libs-1.8.5-5.el5_1.1.ppc64.rpm cc042ce28dbd9cfca6686b05488cccd2 ruby-mode-1.8.5-5.el5_1.1.ppc.rpm 9f52495edcf1c7241d971a772ec9864b ruby-rdoc-1.8.5-5.el5_1.1.ppc.rpm d4ef2eb938ad8e500c312f5a0112bc17 ruby-ri-1.8.5-5.el5_1.1.ppc.rpm 9b94203c995d9825ea9522d47d2c93b9 ruby-tcltk-1.8.5-5.el5_1.1.ppc.rpm s390x: 466dbec52fbb1b426a05562d4223f1b5 ruby-1.8.5-5.el5_1.1.s390x.rpm 9dab2dee3b0818ee8f512b2378792f8d ruby-debuginfo-1.8.5-5.el5_1.1.s390.rpm ebbc60ecc686cf0b2cf581e7b9bcbeb3 ruby-debuginfo-1.8.5-5.el5_1.1.s390x.rpm 112e2222450789fda4d4aa3ee866f1c0 ruby-devel-1.8.5-5.el5_1.1.s390.rpm 5cf92a394b87428a0fa8dd3b4e4cb1b1 ruby-devel-1.8.5-5.el5_1.1.s390x.rpm f8cb187ff5e57e17a7ad9a956b04dbf3 ruby-docs-1.8.5-5.el5_1.1.s390x.rpm aee78c767a2c33a31927258d90e07cf9 ruby-irb-1.8.5-5.el5_1.1.s390x.rpm 9f539c988f1672d7b7534faf15c889d6 ruby-libs-1.8.5-5.el5_1.1.s390.rpm cfa7ff37d59ffa463d96c1865b6cd7b0 ruby-libs-1.8.5-5.el5_1.1.s390x.rpm 80f07b5abe18be100c69925551695c75 ruby-mode-1.8.5-5.el5_1.1.s390x.rpm 2b1f9972403c4793cd97ef783ba052b7 ruby-rdoc-1.8.5-5.el5_1.1.s390x.rpm 2d551ece5c839f9b241118a140dbbe02 ruby-ri-1.8.5-5.el5_1.1.s390x.rpm 558d87b587fc059bb648a620e91d9506 ruby-tcltk-1.8.5-5.el5_1.1.s390x.rpm x86_64: 1727a1e7a24dffd9bcbaf14dd5885e09 ruby-1.8.5-5.el5_1.1.x86_64.rpm affda32e3a7fbc2ff7b71820983fa10e ruby-debuginfo-1.8.5-5.el5_1.1.i386.rpm 5d03ae1d4a04606daa60c2f21452962d ruby-debuginfo-1.8.5-5.el5_1.1.x86_64.rpm fc9636a5d413c56797e35c13e19445c1 ruby-devel-1.8.5-5.el5_1.1.i386.rpm c9cfa969d4cff4ba305119184559d59f ruby-devel-1.8.5-5.el5_1.1.x86_64.rpm b20add781113d1a6c62da9eb4ae5322e ruby-docs-1.8.5-5.el5_1.1.x86_64.rpm 9860b5dcaff839ceac92ad3473474138 ruby-irb-1.8.5-5.el5_1.1.x86_64.rpm 0d59f6f236006e26d2bdb13835adfbe5 ruby-libs-1.8.5-5.el5_1.1.i386.rpm 7cdaed976249c0f131f545adc6d34a19 ruby-libs-1.8.5-5.el5_1.1.x86_64.rpm 42b2fdf9d6d85e4701938042d05da90e ruby-mode-1.8.5-5.el5_1.1.x86_64.rpm b9daa1cda45b5c9eb7977162d32932f8 ruby-rdoc-1.8.5-5.el5_1.1.x86_64.rpm 7a97f1f171c16e36bd85abbbadab358b ruby-ri-1.8.5-5.el5_1.1.x86_64.rpm 9e1e70b9dd97366bd2d46a3bd87da52d ruby-tcltk-1.8.5-5.el5_1.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5162 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5770 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHOXW1XlSAg2UNWIIRAjfGAJ4hK/7/KqFVYetVhIxsaFicYMO9DQCgtBaX t8gAEpDflWZnbE3ZbSQHXcs= =loqA -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 15 12:30:43 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 15 Nov 2007 07:30:43 -0500 Subject: [RHSA-2007:1052-02] Important: pcre security update Message-ID: <200711151230.lAFCUhFh012662@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: pcre security update Advisory ID: RHSA-2007:1052-02 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1052.html Issue date: 2007-11-09 Updated on: 2007-11-15 Product: Red Hat Enterprise Linux CVE Names: CVE-2005-4872 CVE-2006-7227 - --------------------------------------------------------------------- 1. Summary: Updated pcre packages that correct security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. [Updated 15 November 2007] Further analysis of these flaws in PCRE has led to the single CVE identifier CVE-2006-7224 being split into three separate identifiers and a re-analysis of the risk of each of the flaws. We are therefore updating the text of this advisory to use the correct CVE names for the two flaws fixed by these erratum packages, and downgrading the security impact of this advisory from critical to important. No changes have been made to the packages themselves. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: PCRE is a Perl-compatible regular expression library. Flaws were found in the way PCRE handles certain malformed regular expressions. If an application linked against PCRE, such as Konqueror, parses a malicious regular expression, it may be possible to run arbitrary code as the user running the application. (CVE-2005-4872, CVE-2006-7227) Users of PCRE are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 383341 - CVE-2006-7227 pcre integer overflow 383361 - CVE-2005-4872 pcre incorrect memory requirement computation 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/pcre-4.5-4.el4_5.4.src.rpm 49236e545db29026eea3109c3fdba5ae pcre-4.5-4.el4_5.4.src.rpm i386: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm db9170f905d681c7b6a0ca283043da41 pcre-devel-4.5-4.el4_5.4.i386.rpm ia64: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm a9f0e8482a18d5c51a736ddb1c2344b5 pcre-4.5-4.el4_5.4.ia64.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm 732379892973afb39c50a375849021cc pcre-debuginfo-4.5-4.el4_5.4.ia64.rpm 2027d9e67ac017b59da16034cc89177c pcre-devel-4.5-4.el4_5.4.ia64.rpm ppc: f551684382e6beee3c585a13dd2bf652 pcre-4.5-4.el4_5.4.ppc.rpm ecb064a62fa97b7b29d73dde82e4f7f4 pcre-4.5-4.el4_5.4.ppc64.rpm 158ecbc3d5e51d0fe2c64651200481b2 pcre-debuginfo-4.5-4.el4_5.4.ppc.rpm 3239b9b56d0ee1892635fd6223a4e99a pcre-debuginfo-4.5-4.el4_5.4.ppc64.rpm c24ca5e4617e57414335b82d77867906 pcre-devel-4.5-4.el4_5.4.ppc.rpm s390: 06e9196587cd01b1ff6fb6dc10247f47 pcre-4.5-4.el4_5.4.s390.rpm bc79fe3e2811bf0bf47cc8a36b358cce pcre-debuginfo-4.5-4.el4_5.4.s390.rpm ea0f4ca567fdddd5ef765ea13eefa98f pcre-devel-4.5-4.el4_5.4.s390.rpm s390x: 06e9196587cd01b1ff6fb6dc10247f47 pcre-4.5-4.el4_5.4.s390.rpm 0bc4bab9367aef27216d568059340d43 pcre-4.5-4.el4_5.4.s390x.rpm bc79fe3e2811bf0bf47cc8a36b358cce pcre-debuginfo-4.5-4.el4_5.4.s390.rpm 5cad83935892bb7a0f9b92df7cd6e8e4 pcre-debuginfo-4.5-4.el4_5.4.s390x.rpm 22218623a862c125c4be76ce819d9705 pcre-devel-4.5-4.el4_5.4.s390x.rpm x86_64: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm 1c9d0bb0a1c176950e0469d92d48748a pcre-4.5-4.el4_5.4.x86_64.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm c383e03fb1d6a1f561751b03030e6cde pcre-debuginfo-4.5-4.el4_5.4.x86_64.rpm cb6ac02502f662374d4de938aa2e19c4 pcre-devel-4.5-4.el4_5.4.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/pcre-4.5-4.el4_5.4.src.rpm 49236e545db29026eea3109c3fdba5ae pcre-4.5-4.el4_5.4.src.rpm i386: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm db9170f905d681c7b6a0ca283043da41 pcre-devel-4.5-4.el4_5.4.i386.rpm x86_64: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm 1c9d0bb0a1c176950e0469d92d48748a pcre-4.5-4.el4_5.4.x86_64.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm c383e03fb1d6a1f561751b03030e6cde pcre-debuginfo-4.5-4.el4_5.4.x86_64.rpm cb6ac02502f662374d4de938aa2e19c4 pcre-devel-4.5-4.el4_5.4.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/pcre-4.5-4.el4_5.4.src.rpm 49236e545db29026eea3109c3fdba5ae pcre-4.5-4.el4_5.4.src.rpm i386: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm db9170f905d681c7b6a0ca283043da41 pcre-devel-4.5-4.el4_5.4.i386.rpm ia64: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm a9f0e8482a18d5c51a736ddb1c2344b5 pcre-4.5-4.el4_5.4.ia64.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm 732379892973afb39c50a375849021cc pcre-debuginfo-4.5-4.el4_5.4.ia64.rpm 2027d9e67ac017b59da16034cc89177c pcre-devel-4.5-4.el4_5.4.ia64.rpm x86_64: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm 1c9d0bb0a1c176950e0469d92d48748a pcre-4.5-4.el4_5.4.x86_64.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm c383e03fb1d6a1f561751b03030e6cde pcre-debuginfo-4.5-4.el4_5.4.x86_64.rpm cb6ac02502f662374d4de938aa2e19c4 pcre-devel-4.5-4.el4_5.4.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/pcre-4.5-4.el4_5.4.src.rpm 49236e545db29026eea3109c3fdba5ae pcre-4.5-4.el4_5.4.src.rpm i386: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm db9170f905d681c7b6a0ca283043da41 pcre-devel-4.5-4.el4_5.4.i386.rpm ia64: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm a9f0e8482a18d5c51a736ddb1c2344b5 pcre-4.5-4.el4_5.4.ia64.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm 732379892973afb39c50a375849021cc pcre-debuginfo-4.5-4.el4_5.4.ia64.rpm 2027d9e67ac017b59da16034cc89177c pcre-devel-4.5-4.el4_5.4.ia64.rpm x86_64: 6c4d5d457bdcd8d9d03b1e825077f55e pcre-4.5-4.el4_5.4.i386.rpm 1c9d0bb0a1c176950e0469d92d48748a pcre-4.5-4.el4_5.4.x86_64.rpm f10161895acc6659bb081a51400f6c79 pcre-debuginfo-4.5-4.el4_5.4.i386.rpm c383e03fb1d6a1f561751b03030e6cde pcre-debuginfo-4.5-4.el4_5.4.x86_64.rpm cb6ac02502f662374d4de938aa2e19c4 pcre-devel-4.5-4.el4_5.4.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pcre-6.6-2.el5_1.1.src.rpm 230040f3f36e5664ce5a6671334f6ddb pcre-6.6-2.el5_1.1.src.rpm i386: 0bedc083211d95e89d11fbbddc07e968 pcre-6.6-2.el5_1.1.i386.rpm 57892457eef33e35b1fc5528a42bcd94 pcre-debuginfo-6.6-2.el5_1.1.i386.rpm x86_64: 0bedc083211d95e89d11fbbddc07e968 pcre-6.6-2.el5_1.1.i386.rpm 6ce8eee6c331ca63a39e0fe03c7fb985 pcre-6.6-2.el5_1.1.x86_64.rpm 57892457eef33e35b1fc5528a42bcd94 pcre-debuginfo-6.6-2.el5_1.1.i386.rpm 1cac5a613d8b28267e8db6f7cb2afd46 pcre-debuginfo-6.6-2.el5_1.1.x86_64.rpm RHEL Desktop Workstation (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pcre-6.6-2.el5_1.1.src.rpm 230040f3f36e5664ce5a6671334f6ddb pcre-6.6-2.el5_1.1.src.rpm i386: 57892457eef33e35b1fc5528a42bcd94 pcre-debuginfo-6.6-2.el5_1.1.i386.rpm c53d0803d49bf739b59539eb5782f43f pcre-devel-6.6-2.el5_1.1.i386.rpm x86_64: 57892457eef33e35b1fc5528a42bcd94 pcre-debuginfo-6.6-2.el5_1.1.i386.rpm 1cac5a613d8b28267e8db6f7cb2afd46 pcre-debuginfo-6.6-2.el5_1.1.x86_64.rpm c53d0803d49bf739b59539eb5782f43f pcre-devel-6.6-2.el5_1.1.i386.rpm cc64b53c0d0b0d4fac6429baad17fba2 pcre-devel-6.6-2.el5_1.1.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/pcre-6.6-2.el5_1.1.src.rpm 230040f3f36e5664ce5a6671334f6ddb pcre-6.6-2.el5_1.1.src.rpm i386: 0bedc083211d95e89d11fbbddc07e968 pcre-6.6-2.el5_1.1.i386.rpm 57892457eef33e35b1fc5528a42bcd94 pcre-debuginfo-6.6-2.el5_1.1.i386.rpm c53d0803d49bf739b59539eb5782f43f pcre-devel-6.6-2.el5_1.1.i386.rpm ia64: b7ef7d4d91f0425011c348e81140a5f3 pcre-6.6-2.el5_1.1.ia64.rpm 888ea998576acca5a6a8529c2da64f87 pcre-debuginfo-6.6-2.el5_1.1.ia64.rpm a424e60ea30261a2650124df2fe0b914 pcre-devel-6.6-2.el5_1.1.ia64.rpm ppc: 8f903834f10271879e1a08d87987cad1 pcre-6.6-2.el5_1.1.ppc.rpm cea8361d9d14c7fae8a57274ea02b33b pcre-6.6-2.el5_1.1.ppc64.rpm ffec123b0c84c123042501d9511030b5 pcre-debuginfo-6.6-2.el5_1.1.ppc.rpm 30e0adc7d5a7798dec12dbb04cd15e31 pcre-debuginfo-6.6-2.el5_1.1.ppc64.rpm 3423c3eb767d485eb26e6808b2204cf1 pcre-devel-6.6-2.el5_1.1.ppc.rpm d7b38446e64240c6d8e442552e9f5dbb pcre-devel-6.6-2.el5_1.1.ppc64.rpm s390x: b06798c560af2b94f7e7b6448cdeefac pcre-6.6-2.el5_1.1.s390.rpm bf9ec28737e79e899638a08b74f3fbf5 pcre-6.6-2.el5_1.1.s390x.rpm 3e4d44a6ed3dea1629280c91000ff5a5 pcre-debuginfo-6.6-2.el5_1.1.s390.rpm 5e3fef773f0a841bf5c4b2c448a52327 pcre-debuginfo-6.6-2.el5_1.1.s390x.rpm ca23b3b464e301f25229e9d5fd654909 pcre-devel-6.6-2.el5_1.1.s390.rpm bb72d6e9246bbe645dcb9eecef9d6fe6 pcre-devel-6.6-2.el5_1.1.s390x.rpm x86_64: 0bedc083211d95e89d11fbbddc07e968 pcre-6.6-2.el5_1.1.i386.rpm 6ce8eee6c331ca63a39e0fe03c7fb985 pcre-6.6-2.el5_1.1.x86_64.rpm 57892457eef33e35b1fc5528a42bcd94 pcre-debuginfo-6.6-2.el5_1.1.i386.rpm 1cac5a613d8b28267e8db6f7cb2afd46 pcre-debuginfo-6.6-2.el5_1.1.x86_64.rpm c53d0803d49bf739b59539eb5782f43f pcre-devel-6.6-2.el5_1.1.i386.rpm cc64b53c0d0b0d4fac6429baad17fba2 pcre-devel-6.6-2.el5_1.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4872 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7227 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHPDvxXlSAg2UNWIIRAj+NAJ9iOc/bFA1fLE9qVSsUoZwCjYFFrwCeMGCz IC/iCahfVY63CDvyFzO+6Fw= =nQWq -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 15 14:58:23 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 15 Nov 2007 09:58:23 -0500 Subject: [RHSA-2007:0387-02] Moderate: tcpdump security and bug fix update Message-ID: <200711151458.lAFEwNS5001940@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: tcpdump security and bug fix update Advisory ID: RHSA-2007:0387-02 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0387.html Issue date: 2007-11-15 Updated on: 2007-11-15 Product: Red Hat Enterprise Linux Keywords: overflow crash 802.11 CVE Names: CVE-2007-1218 CVE-2007-3798 - --------------------------------------------------------------------- 1. Summary: Updated tcpdump packages that fix a security issue and functionality bugs are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: Tcpdump is a command line tool for monitoring network traffic. Moritz Jodeit discovered a denial of service bug in the tcpdump IEEE 802.11 processing code. An attacker could inject a carefully crafted frame onto the IEEE 802.11 network that could crash a running tcpdump session if a certain link type was explicitly specified. (CVE-2007-1218) An integer overflow flaw was found in tcpdump's BGP processing code. An attacker could execute arbitrary code with the privilege of the pcap user by injecting a crafted frame onto the network. (CVE-2007-3798) In addition, the following bugs have been addressed: * if called with -C and -W switches, tcpdump would create the first savefile with the privileges of the user that executed tcpdump (usually root), rather than with ones of the pcap user. This could result in the inability to save the complete traffic log file properly without the immediate notice of the user running tcpdump. * the arpwatch service initialization script would exit prematurely, returning a successful exit status incorrectly and preventing the status command from running in case networking is not available. Users of tcpdump are advised to upgrade to these erratum packages, which contain backported patches that correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 214377 - tcpdump gives 'permission denied' at 2nd file when dumping to >1 file 232519 - CVE-2007-1218 tcpdump denial of service 250275 - CVE-2007-3798 tcpdump BGP integer overflow 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/tcpdump-3.8.2-12.el4.src.rpm f7be08ffca0e4e9016a0106e9d9ec7d7 tcpdump-3.8.2-12.el4.src.rpm i386: 31cc2aa0380ab589407bd69b4583fa9f arpwatch-2.1a13-12.el4.i386.rpm 7d15af911b6af912bfde47ae0f24ed03 libpcap-0.8.3-12.el4.i386.rpm e2e78afa8669c2923216d6c435485b51 tcpdump-3.8.2-12.el4.i386.rpm f0590c42228ee75595551b684f849e71 tcpdump-debuginfo-3.8.2-12.el4.i386.rpm ia64: 0b6ff110c5f6618afebb5b4261521ad2 arpwatch-2.1a13-12.el4.ia64.rpm 7d15af911b6af912bfde47ae0f24ed03 libpcap-0.8.3-12.el4.i386.rpm 229a4a3ed5a50863eb46b41474b799c9 libpcap-0.8.3-12.el4.ia64.rpm 65fbd062a98b348574150af9d8c8e089 tcpdump-3.8.2-12.el4.ia64.rpm f0590c42228ee75595551b684f849e71 tcpdump-debuginfo-3.8.2-12.el4.i386.rpm 64a43c69ff1dba0dd3ea9890f8522643 tcpdump-debuginfo-3.8.2-12.el4.ia64.rpm ppc: 8331bda6c2b865318d99831027982cc1 arpwatch-2.1a13-12.el4.ppc.rpm 7b316c410b6f279060e0e97d8b5f4197 libpcap-0.8.3-12.el4.ppc.rpm 96caf4eb96d250977fb214983dcbf5c5 libpcap-0.8.3-12.el4.ppc64.rpm 58db15927962eb1cf5c277a24bdbb9d0 tcpdump-3.8.2-12.el4.ppc.rpm ad78b3eb75598631a1dd08dd13dadab1 tcpdump-debuginfo-3.8.2-12.el4.ppc.rpm 3c25929e867d72e2e5d3a58323817444 tcpdump-debuginfo-3.8.2-12.el4.ppc64.rpm s390: 619c08b19b9064593be99f84494b3e65 arpwatch-2.1a13-12.el4.s390.rpm bd66d2249d81e2fb0b5f501cded22eef libpcap-0.8.3-12.el4.s390.rpm d0751924c7e888c93cb92f49d048c5ad tcpdump-3.8.2-12.el4.s390.rpm 587f46ad986d04bede235bdb4f7286e2 tcpdump-debuginfo-3.8.2-12.el4.s390.rpm s390x: 6ba2ea972f764894e3188ba5d73bd4bc arpwatch-2.1a13-12.el4.s390x.rpm bd66d2249d81e2fb0b5f501cded22eef libpcap-0.8.3-12.el4.s390.rpm dea9023d2c2d44b131ba0199a5866946 libpcap-0.8.3-12.el4.s390x.rpm 5ff26c4b07e19fcdcfc777776c318279 tcpdump-3.8.2-12.el4.s390x.rpm 587f46ad986d04bede235bdb4f7286e2 tcpdump-debuginfo-3.8.2-12.el4.s390.rpm 2812d37ce415aa89e5f9f7159f421fc3 tcpdump-debuginfo-3.8.2-12.el4.s390x.rpm x86_64: 76c0962abea8111c366b6d3c62aba5a1 arpwatch-2.1a13-12.el4.x86_64.rpm 7d15af911b6af912bfde47ae0f24ed03 libpcap-0.8.3-12.el4.i386.rpm 7ccdb2be15622a320bb64d88cfac166a libpcap-0.8.3-12.el4.x86_64.rpm 4e7d428339909b4d778d09ea5e4bf29e tcpdump-3.8.2-12.el4.x86_64.rpm f0590c42228ee75595551b684f849e71 tcpdump-debuginfo-3.8.2-12.el4.i386.rpm 77d35310881aa7e61b2366fe036cf318 tcpdump-debuginfo-3.8.2-12.el4.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/tcpdump-3.8.2-12.el4.src.rpm f7be08ffca0e4e9016a0106e9d9ec7d7 tcpdump-3.8.2-12.el4.src.rpm i386: 31cc2aa0380ab589407bd69b4583fa9f arpwatch-2.1a13-12.el4.i386.rpm 7d15af911b6af912bfde47ae0f24ed03 libpcap-0.8.3-12.el4.i386.rpm e2e78afa8669c2923216d6c435485b51 tcpdump-3.8.2-12.el4.i386.rpm f0590c42228ee75595551b684f849e71 tcpdump-debuginfo-3.8.2-12.el4.i386.rpm x86_64: 76c0962abea8111c366b6d3c62aba5a1 arpwatch-2.1a13-12.el4.x86_64.rpm 7d15af911b6af912bfde47ae0f24ed03 libpcap-0.8.3-12.el4.i386.rpm 7ccdb2be15622a320bb64d88cfac166a libpcap-0.8.3-12.el4.x86_64.rpm 4e7d428339909b4d778d09ea5e4bf29e tcpdump-3.8.2-12.el4.x86_64.rpm f0590c42228ee75595551b684f849e71 tcpdump-debuginfo-3.8.2-12.el4.i386.rpm 77d35310881aa7e61b2366fe036cf318 tcpdump-debuginfo-3.8.2-12.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/tcpdump-3.8.2-12.el4.src.rpm f7be08ffca0e4e9016a0106e9d9ec7d7 tcpdump-3.8.2-12.el4.src.rpm i386: 31cc2aa0380ab589407bd69b4583fa9f arpwatch-2.1a13-12.el4.i386.rpm 7d15af911b6af912bfde47ae0f24ed03 libpcap-0.8.3-12.el4.i386.rpm e2e78afa8669c2923216d6c435485b51 tcpdump-3.8.2-12.el4.i386.rpm f0590c42228ee75595551b684f849e71 tcpdump-debuginfo-3.8.2-12.el4.i386.rpm ia64: 0b6ff110c5f6618afebb5b4261521ad2 arpwatch-2.1a13-12.el4.ia64.rpm 7d15af911b6af912bfde47ae0f24ed03 libpcap-0.8.3-12.el4.i386.rpm 229a4a3ed5a50863eb46b41474b799c9 libpcap-0.8.3-12.el4.ia64.rpm 65fbd062a98b348574150af9d8c8e089 tcpdump-3.8.2-12.el4.ia64.rpm f0590c42228ee75595551b684f849e71 tcpdump-debuginfo-3.8.2-12.el4.i386.rpm 64a43c69ff1dba0dd3ea9890f8522643 tcpdump-debuginfo-3.8.2-12.el4.ia64.rpm x86_64: 76c0962abea8111c366b6d3c62aba5a1 arpwatch-2.1a13-12.el4.x86_64.rpm 7d15af911b6af912bfde47ae0f24ed03 libpcap-0.8.3-12.el4.i386.rpm 7ccdb2be15622a320bb64d88cfac166a libpcap-0.8.3-12.el4.x86_64.rpm 4e7d428339909b4d778d09ea5e4bf29e tcpdump-3.8.2-12.el4.x86_64.rpm f0590c42228ee75595551b684f849e71 tcpdump-debuginfo-3.8.2-12.el4.i386.rpm 77d35310881aa7e61b2366fe036cf318 tcpdump-debuginfo-3.8.2-12.el4.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/tcpdump-3.8.2-12.el4.src.rpm f7be08ffca0e4e9016a0106e9d9ec7d7 tcpdump-3.8.2-12.el4.src.rpm i386: 31cc2aa0380ab589407bd69b4583fa9f arpwatch-2.1a13-12.el4.i386.rpm 7d15af911b6af912bfde47ae0f24ed03 libpcap-0.8.3-12.el4.i386.rpm e2e78afa8669c2923216d6c435485b51 tcpdump-3.8.2-12.el4.i386.rpm f0590c42228ee75595551b684f849e71 tcpdump-debuginfo-3.8.2-12.el4.i386.rpm ia64: 0b6ff110c5f6618afebb5b4261521ad2 arpwatch-2.1a13-12.el4.ia64.rpm 7d15af911b6af912bfde47ae0f24ed03 libpcap-0.8.3-12.el4.i386.rpm 229a4a3ed5a50863eb46b41474b799c9 libpcap-0.8.3-12.el4.ia64.rpm 65fbd062a98b348574150af9d8c8e089 tcpdump-3.8.2-12.el4.ia64.rpm f0590c42228ee75595551b684f849e71 tcpdump-debuginfo-3.8.2-12.el4.i386.rpm 64a43c69ff1dba0dd3ea9890f8522643 tcpdump-debuginfo-3.8.2-12.el4.ia64.rpm x86_64: 76c0962abea8111c366b6d3c62aba5a1 arpwatch-2.1a13-12.el4.x86_64.rpm 7d15af911b6af912bfde47ae0f24ed03 libpcap-0.8.3-12.el4.i386.rpm 7ccdb2be15622a320bb64d88cfac166a libpcap-0.8.3-12.el4.x86_64.rpm 4e7d428339909b4d778d09ea5e4bf29e tcpdump-3.8.2-12.el4.x86_64.rpm f0590c42228ee75595551b684f849e71 tcpdump-debuginfo-3.8.2-12.el4.i386.rpm 77d35310881aa7e61b2366fe036cf318 tcpdump-debuginfo-3.8.2-12.el4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1218 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3798 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHPF6GXlSAg2UNWIIRAisgAKC7ETjA+hbV+zaE+a2dNP1l2Bc7qwCgtdp7 bZKH1fGlDa6ksuceL81ZBGw= =dXAm -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 15 15:03:52 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 15 Nov 2007 10:03:52 -0500 Subject: [RHSA-2007:0701-02] Low: xterm security update Message-ID: <200711151503.lAFF3qqO003137@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Low: xterm security update Advisory ID: RHSA-2007:0701-02 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0701.html Issue date: 2007-11-15 Updated on: 2007-11-15 Product: Red Hat Enterprise Linux Keywords: tty owner group CVE Names: CVE-2007-2797 - --------------------------------------------------------------------- 1. Summary: An updated xterm package that corrects a security issue is now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals for programs that cannot use the window system directly. A bug was found in the way xterm packages were built that caused the pseudo-terminal device files of the xterm emulated terminals to be owned by the incorrect group. This flaw did not affect Red Hat Enterprise Linux 4 Update 4 and earlier. (CVE-2007-2797) All users of xterm are advised to upgrade to this updated package, which contains a patch to correct this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 239070 - CVE-2007-2797 Wrong settings for the tty (mesg: error: tty device is not owned by group `tty') 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/xterm-192-8.el4.src.rpm 1e6bd5c8d2dd4a12405bc8d3442f2c3f xterm-192-8.el4.src.rpm i386: 589caa3f2e0984fd89d65250e377f06f xterm-192-8.el4.i386.rpm fd15d510790d4a2252f26bc79915ea98 xterm-debuginfo-192-8.el4.i386.rpm ia64: bb3af76c6ba12b96192c50673329dd37 xterm-192-8.el4.ia64.rpm b7d930d860f8762b2f52dafd701d295b xterm-debuginfo-192-8.el4.ia64.rpm ppc: 415b26fb6c78f8416eefb10b03254d0d xterm-192-8.el4.ppc.rpm 2d3873ce815c843b934ff93812d41e4e xterm-debuginfo-192-8.el4.ppc.rpm s390: 77d8e2b60ec35da065c7b7b65fc82b46 xterm-192-8.el4.s390.rpm c1e25b6df0c45f0dc84b222d839030c2 xterm-debuginfo-192-8.el4.s390.rpm s390x: 7e2261212daab8efbfe301cee7251be9 xterm-192-8.el4.s390x.rpm 84e6ee329093936d744b095d3c94ba8d xterm-debuginfo-192-8.el4.s390x.rpm x86_64: 98850a2fe869908974bab98456e5c3a3 xterm-192-8.el4.x86_64.rpm 62a5541a4d336fa39f960dea51e31e98 xterm-debuginfo-192-8.el4.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/xterm-192-8.el4.src.rpm 1e6bd5c8d2dd4a12405bc8d3442f2c3f xterm-192-8.el4.src.rpm i386: 589caa3f2e0984fd89d65250e377f06f xterm-192-8.el4.i386.rpm fd15d510790d4a2252f26bc79915ea98 xterm-debuginfo-192-8.el4.i386.rpm x86_64: 98850a2fe869908974bab98456e5c3a3 xterm-192-8.el4.x86_64.rpm 62a5541a4d336fa39f960dea51e31e98 xterm-debuginfo-192-8.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/xterm-192-8.el4.src.rpm 1e6bd5c8d2dd4a12405bc8d3442f2c3f xterm-192-8.el4.src.rpm i386: 589caa3f2e0984fd89d65250e377f06f xterm-192-8.el4.i386.rpm fd15d510790d4a2252f26bc79915ea98 xterm-debuginfo-192-8.el4.i386.rpm ia64: bb3af76c6ba12b96192c50673329dd37 xterm-192-8.el4.ia64.rpm b7d930d860f8762b2f52dafd701d295b xterm-debuginfo-192-8.el4.ia64.rpm x86_64: 98850a2fe869908974bab98456e5c3a3 xterm-192-8.el4.x86_64.rpm 62a5541a4d336fa39f960dea51e31e98 xterm-debuginfo-192-8.el4.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/xterm-192-8.el4.src.rpm 1e6bd5c8d2dd4a12405bc8d3442f2c3f xterm-192-8.el4.src.rpm i386: 589caa3f2e0984fd89d65250e377f06f xterm-192-8.el4.i386.rpm fd15d510790d4a2252f26bc79915ea98 xterm-debuginfo-192-8.el4.i386.rpm ia64: bb3af76c6ba12b96192c50673329dd37 xterm-192-8.el4.ia64.rpm b7d930d860f8762b2f52dafd701d295b xterm-debuginfo-192-8.el4.ia64.rpm x86_64: 98850a2fe869908974bab98456e5c3a3 xterm-192-8.el4.x86_64.rpm 62a5541a4d336fa39f960dea51e31e98 xterm-debuginfo-192-8.el4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2797 http://www.redhat.com/security/updates/classification/#low 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHPF/WXlSAg2UNWIIRAqRTAJ4zT7US2+ikMIHybUajerX901PIFwCgjQcM wAz/atHkTNYuI4QFH5aj684= =lHL0 -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 15 15:04:04 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 15 Nov 2007 10:04:04 -0500 Subject: [RHSA-2007:0703-02] Moderate: openssh security and bug fix update Message-ID: <200711151504.lAFF44fb003155@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: openssh security and bug fix update Advisory ID: RHSA-2007:0703-02 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0703.html Issue date: 2007-11-15 Updated on: 2007-11-15 Product: Red Hat Enterprise Linux Keywords: GSSAPI krb5 audit pam session DNS memory leak restart sftp CVE Names: CVE-2006-5052 CVE-2007-3102 - --------------------------------------------------------------------- 1. Summary: Updated openssh packages that fix two security issues and various bugs are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. These packages include the core files necessary for both the OpenSSH client and server. A flaw was found in the way the ssh server wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102) A flaw was found in the way the OpenSSH server processes GSSAPI authentication requests. When GSSAPI authentication was enabled in OpenSSH server, a remote attacker may have been able to determine if a username is valid. (CVE-2006-5052) The following bugs were also fixed: * the ssh daemon did not generate audit messages when an ssh session was closed. * GSSAPI authentication sometimes failed on clusters using DNS or load-balancing. * the sftp client and server leaked small amounts of memory in some cases. * the sftp client didn't properly exit and return non-zero status in batch mode when the destination disk drive was full. * when restarting the ssh daemon with the initscript, the ssh daemon was sometimes not restarted successfully because the old running ssh daemon was not properly killed. * with challenge/response authentication enabled, the pam sub-process was not terminated if the user authentication timed out. All users of openssh should upgrade to these updated packages, which contain patches to correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 234643 - CVE-2006-5052 Kerberos information leak 240909 - memory leak fixed in RHEL3 but present in RHEL4 244655 - Trying to restart a hung/frozen sshd daemon doesn't show correct status 247802 - sftp problem while transferring files to a partition which is 100% full 248058 - CVE-2007-3102 audit logging of failed logins 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/openssh-3.9p1-8.RHEL4.24.src.rpm 992bd7328b7f1f75dcc8baa55a046af9 openssh-3.9p1-8.RHEL4.24.src.rpm i386: b24a8ab5d98e6228e3481f02a84fdd57 openssh-3.9p1-8.RHEL4.24.i386.rpm 7a95a717c6eddcd4368a36f30e076115 openssh-askpass-3.9p1-8.RHEL4.24.i386.rpm d899419b3a87e60ef5db51c1be9b6912 openssh-askpass-gnome-3.9p1-8.RHEL4.24.i386.rpm 77204f50d001cd7e017b9a93e335f0ae openssh-clients-3.9p1-8.RHEL4.24.i386.rpm 0b9c8a228c828eb6b26beb06cf32deac openssh-debuginfo-3.9p1-8.RHEL4.24.i386.rpm 2872564cd520d3d147bd365889e17482 openssh-server-3.9p1-8.RHEL4.24.i386.rpm ia64: 2345c59f78a78021999fcd5daef96dc5 openssh-3.9p1-8.RHEL4.24.ia64.rpm 6e09634082c89e05c27c367abfe7aa7c openssh-askpass-3.9p1-8.RHEL4.24.ia64.rpm cb0284c7038be47eac7c32cf5570e4e0 openssh-askpass-gnome-3.9p1-8.RHEL4.24.ia64.rpm 3832e1c1a31a65dece2d92e5f7eb16c4 openssh-clients-3.9p1-8.RHEL4.24.ia64.rpm 9d6b2f15e8e50a4a1341b43f2e04935d openssh-debuginfo-3.9p1-8.RHEL4.24.ia64.rpm 3c4f0673cfc98882c232640398b7d7cf openssh-server-3.9p1-8.RHEL4.24.ia64.rpm ppc: 53060528e9229524798a73ca495962c4 openssh-3.9p1-8.RHEL4.24.ppc.rpm b7248560188ece96e961f6f382d27a59 openssh-askpass-3.9p1-8.RHEL4.24.ppc.rpm 4db8fc61fc626078327333fdbb571c90 openssh-askpass-gnome-3.9p1-8.RHEL4.24.ppc.rpm 98a35ed02e08e4454f70cf6b38fb2921 openssh-clients-3.9p1-8.RHEL4.24.ppc.rpm 10fb11956b68a199da8d9dbd014c5d7d openssh-debuginfo-3.9p1-8.RHEL4.24.ppc.rpm c8354a653aa2fe3c199957c4bf953d78 openssh-server-3.9p1-8.RHEL4.24.ppc.rpm s390: 47d7a9c398dbf3c86bbf00d04f07556a openssh-3.9p1-8.RHEL4.24.s390.rpm bd59f3199707bd28b8d95f1aedfa0096 openssh-askpass-3.9p1-8.RHEL4.24.s390.rpm 06b586440d59ec50313dc8ac140add12 openssh-askpass-gnome-3.9p1-8.RHEL4.24.s390.rpm 435b94cbee03fdc33a391df27950093c openssh-clients-3.9p1-8.RHEL4.24.s390.rpm 347bc6e95759ca75c2f98c6fbbdc6049 openssh-debuginfo-3.9p1-8.RHEL4.24.s390.rpm 039cb6762cb9812cd5a9c505e89be8f9 openssh-server-3.9p1-8.RHEL4.24.s390.rpm s390x: 7d0a1fabfb1f10dfa762a1942335cf17 openssh-3.9p1-8.RHEL4.24.s390x.rpm 6a9ebd003cf30248bc118f022821cb97 openssh-askpass-3.9p1-8.RHEL4.24.s390x.rpm 613f9aa103222da201182eb52c7acd48 openssh-askpass-gnome-3.9p1-8.RHEL4.24.s390x.rpm bddb563234253e3ccd3047c0673f86f1 openssh-clients-3.9p1-8.RHEL4.24.s390x.rpm 8c518c15b141e5296f214a774ea73586 openssh-debuginfo-3.9p1-8.RHEL4.24.s390x.rpm 82e73518f9184c9ce6db15fd12109640 openssh-server-3.9p1-8.RHEL4.24.s390x.rpm x86_64: 3f3f36e4d297773f61e3e17ac7f6ed0a openssh-3.9p1-8.RHEL4.24.x86_64.rpm 2612644682ec5352f3fae561c7b44726 openssh-askpass-3.9p1-8.RHEL4.24.x86_64.rpm 591928dbd4758a9154057f3829d6d94c openssh-askpass-gnome-3.9p1-8.RHEL4.24.x86_64.rpm 9badc94b3f376570e0d6950f1745706a openssh-clients-3.9p1-8.RHEL4.24.x86_64.rpm 61cb30043c223fae6b50e69f54364a89 openssh-debuginfo-3.9p1-8.RHEL4.24.x86_64.rpm eb5ab43889ade69fab74eed1e3fbf1bc openssh-server-3.9p1-8.RHEL4.24.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/openssh-3.9p1-8.RHEL4.24.src.rpm 992bd7328b7f1f75dcc8baa55a046af9 openssh-3.9p1-8.RHEL4.24.src.rpm i386: b24a8ab5d98e6228e3481f02a84fdd57 openssh-3.9p1-8.RHEL4.24.i386.rpm 7a95a717c6eddcd4368a36f30e076115 openssh-askpass-3.9p1-8.RHEL4.24.i386.rpm d899419b3a87e60ef5db51c1be9b6912 openssh-askpass-gnome-3.9p1-8.RHEL4.24.i386.rpm 77204f50d001cd7e017b9a93e335f0ae openssh-clients-3.9p1-8.RHEL4.24.i386.rpm 0b9c8a228c828eb6b26beb06cf32deac openssh-debuginfo-3.9p1-8.RHEL4.24.i386.rpm 2872564cd520d3d147bd365889e17482 openssh-server-3.9p1-8.RHEL4.24.i386.rpm x86_64: 3f3f36e4d297773f61e3e17ac7f6ed0a openssh-3.9p1-8.RHEL4.24.x86_64.rpm 2612644682ec5352f3fae561c7b44726 openssh-askpass-3.9p1-8.RHEL4.24.x86_64.rpm 591928dbd4758a9154057f3829d6d94c openssh-askpass-gnome-3.9p1-8.RHEL4.24.x86_64.rpm 9badc94b3f376570e0d6950f1745706a openssh-clients-3.9p1-8.RHEL4.24.x86_64.rpm 61cb30043c223fae6b50e69f54364a89 openssh-debuginfo-3.9p1-8.RHEL4.24.x86_64.rpm eb5ab43889ade69fab74eed1e3fbf1bc openssh-server-3.9p1-8.RHEL4.24.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/openssh-3.9p1-8.RHEL4.24.src.rpm 992bd7328b7f1f75dcc8baa55a046af9 openssh-3.9p1-8.RHEL4.24.src.rpm i386: b24a8ab5d98e6228e3481f02a84fdd57 openssh-3.9p1-8.RHEL4.24.i386.rpm 7a95a717c6eddcd4368a36f30e076115 openssh-askpass-3.9p1-8.RHEL4.24.i386.rpm d899419b3a87e60ef5db51c1be9b6912 openssh-askpass-gnome-3.9p1-8.RHEL4.24.i386.rpm 77204f50d001cd7e017b9a93e335f0ae openssh-clients-3.9p1-8.RHEL4.24.i386.rpm 0b9c8a228c828eb6b26beb06cf32deac openssh-debuginfo-3.9p1-8.RHEL4.24.i386.rpm 2872564cd520d3d147bd365889e17482 openssh-server-3.9p1-8.RHEL4.24.i386.rpm ia64: 2345c59f78a78021999fcd5daef96dc5 openssh-3.9p1-8.RHEL4.24.ia64.rpm 6e09634082c89e05c27c367abfe7aa7c openssh-askpass-3.9p1-8.RHEL4.24.ia64.rpm cb0284c7038be47eac7c32cf5570e4e0 openssh-askpass-gnome-3.9p1-8.RHEL4.24.ia64.rpm 3832e1c1a31a65dece2d92e5f7eb16c4 openssh-clients-3.9p1-8.RHEL4.24.ia64.rpm 9d6b2f15e8e50a4a1341b43f2e04935d openssh-debuginfo-3.9p1-8.RHEL4.24.ia64.rpm 3c4f0673cfc98882c232640398b7d7cf openssh-server-3.9p1-8.RHEL4.24.ia64.rpm x86_64: 3f3f36e4d297773f61e3e17ac7f6ed0a openssh-3.9p1-8.RHEL4.24.x86_64.rpm 2612644682ec5352f3fae561c7b44726 openssh-askpass-3.9p1-8.RHEL4.24.x86_64.rpm 591928dbd4758a9154057f3829d6d94c openssh-askpass-gnome-3.9p1-8.RHEL4.24.x86_64.rpm 9badc94b3f376570e0d6950f1745706a openssh-clients-3.9p1-8.RHEL4.24.x86_64.rpm 61cb30043c223fae6b50e69f54364a89 openssh-debuginfo-3.9p1-8.RHEL4.24.x86_64.rpm eb5ab43889ade69fab74eed1e3fbf1bc openssh-server-3.9p1-8.RHEL4.24.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/openssh-3.9p1-8.RHEL4.24.src.rpm 992bd7328b7f1f75dcc8baa55a046af9 openssh-3.9p1-8.RHEL4.24.src.rpm i386: b24a8ab5d98e6228e3481f02a84fdd57 openssh-3.9p1-8.RHEL4.24.i386.rpm 7a95a717c6eddcd4368a36f30e076115 openssh-askpass-3.9p1-8.RHEL4.24.i386.rpm d899419b3a87e60ef5db51c1be9b6912 openssh-askpass-gnome-3.9p1-8.RHEL4.24.i386.rpm 77204f50d001cd7e017b9a93e335f0ae openssh-clients-3.9p1-8.RHEL4.24.i386.rpm 0b9c8a228c828eb6b26beb06cf32deac openssh-debuginfo-3.9p1-8.RHEL4.24.i386.rpm 2872564cd520d3d147bd365889e17482 openssh-server-3.9p1-8.RHEL4.24.i386.rpm ia64: 2345c59f78a78021999fcd5daef96dc5 openssh-3.9p1-8.RHEL4.24.ia64.rpm 6e09634082c89e05c27c367abfe7aa7c openssh-askpass-3.9p1-8.RHEL4.24.ia64.rpm cb0284c7038be47eac7c32cf5570e4e0 openssh-askpass-gnome-3.9p1-8.RHEL4.24.ia64.rpm 3832e1c1a31a65dece2d92e5f7eb16c4 openssh-clients-3.9p1-8.RHEL4.24.ia64.rpm 9d6b2f15e8e50a4a1341b43f2e04935d openssh-debuginfo-3.9p1-8.RHEL4.24.ia64.rpm 3c4f0673cfc98882c232640398b7d7cf openssh-server-3.9p1-8.RHEL4.24.ia64.rpm x86_64: 3f3f36e4d297773f61e3e17ac7f6ed0a openssh-3.9p1-8.RHEL4.24.x86_64.rpm 2612644682ec5352f3fae561c7b44726 openssh-askpass-3.9p1-8.RHEL4.24.x86_64.rpm 591928dbd4758a9154057f3829d6d94c openssh-askpass-gnome-3.9p1-8.RHEL4.24.x86_64.rpm 9badc94b3f376570e0d6950f1745706a openssh-clients-3.9p1-8.RHEL4.24.x86_64.rpm 61cb30043c223fae6b50e69f54364a89 openssh-debuginfo-3.9p1-8.RHEL4.24.x86_64.rpm eb5ab43889ade69fab74eed1e3fbf1bc openssh-server-3.9p1-8.RHEL4.24.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5052 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3102 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHPF/gXlSAg2UNWIIRAtd8AJ49C3J1A0pKENMuf8pd/cLX8QcTMgCgtaqk Td7ZXx2ezO8q5/ynyFoLqtM= =vhLG -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 15 15:04:13 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 15 Nov 2007 10:04:13 -0500 Subject: [RHSA-2007:0709-02] Low: wireshark security and bug fix update Message-ID: <200711151504.lAFF4Deg003158@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Low: wireshark security and bug fix update Advisory ID: RHSA-2007:0709-02 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0709.html Issue date: 2007-11-15 Updated on: 2007-11-15 Product: Red Hat Enterprise Linux Keywords: HTTP iSeries DCP ETSI SSL MMS DHCP BOOTP crash loop DoS IPMI CVE Names: CVE-2007-3389 CVE-2007-3390 CVE-2007-3391 CVE-2007-3392 CVE-2007-3393 - --------------------------------------------------------------------- 1. Summary: New Wireshark packages that fix various security vulnerabilities and functionality bugs are now available for Red Hat Enterprise Linux 4. Wireshark was previously known as Ethereal. This update has been rated as having low security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: Wireshark is a program for monitoring network traffic. Several denial of service bugs were found in Wireshark's HTTP, iSeries, DCP ETSI, SSL, MMS, DHCP and BOOTP protocol dissectors. It was possible for Wireshark to crash or stop responding if it read a malformed packet off the network. (CVE-2007-3389, CVE-2007-3390, CVE-2007-3391, CVE-2007-3392, CVE-2007-3393) Wireshark would interpret certain completion codes incorrectly when dissecting IPMI traffic. Additionally, IPMI 2.0 packets would be reported as malformed IPMI traffic. Users of Wireshark should upgrade to these updated packages containing Wireshark version 0.99.6, which correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 245796 - CVE-2007-3389 Wireshark crashes when inspecting HTTP traffic 245797 - CVE-2007-3391 Wireshark loops infinitely when inspecting DCP ETSI traffic 245798 - CVE-2007-3392 Wireshark loops infinitely when inspecting SSL traffic 246221 - CVE-2007-3393 Wireshark corrupts the stack when inspecting BOOTP traffic 246225 - CVE-2007-3390 Wireshark crashes when inspecting iSeries traffic 246229 - CVE-2007-3392 Wireshark crashes when inspecting MMS traffic 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/wireshark-0.99.6-EL4.1.src.rpm 2d8ad27725033ac2bbadd5a385b6ae76 wireshark-0.99.6-EL4.1.src.rpm i386: 3c6c77126ea4b1999f75a18a283d6499 wireshark-0.99.6-EL4.1.i386.rpm 8ac66efd8177234af75cf8af1bed2706 wireshark-debuginfo-0.99.6-EL4.1.i386.rpm ce5d1420de890fab97bb8c84617d1f25 wireshark-gnome-0.99.6-EL4.1.i386.rpm ia64: 1db9e6a01562b42162772472433ec40c wireshark-0.99.6-EL4.1.ia64.rpm 4602cc3474ca776e4b8a3340664fa308 wireshark-debuginfo-0.99.6-EL4.1.ia64.rpm 2be1f400717544434423277057fb8a6a wireshark-gnome-0.99.6-EL4.1.ia64.rpm ppc: 851e28e735d2cca81f036e84c10592de wireshark-0.99.6-EL4.1.ppc.rpm c1aa1b3e309e1246d2b2067811b759fe wireshark-debuginfo-0.99.6-EL4.1.ppc.rpm ca38499152427371121737fcfe545a1a wireshark-gnome-0.99.6-EL4.1.ppc.rpm s390: deaa06304c3926eed158bed8a15b2e2b wireshark-0.99.6-EL4.1.s390.rpm c63f46b2598583595ca4d4d38d7e44b0 wireshark-debuginfo-0.99.6-EL4.1.s390.rpm 2020932bacbcdbbad055735ac0b0100e wireshark-gnome-0.99.6-EL4.1.s390.rpm s390x: dc81c1505a3040328ab53cd449b388cd wireshark-0.99.6-EL4.1.s390x.rpm a22957a9c7bdf4976edcd2f6d7c0c5d2 wireshark-debuginfo-0.99.6-EL4.1.s390x.rpm 88a5ef4d0cf176f18fcf0381c8e80d2e wireshark-gnome-0.99.6-EL4.1.s390x.rpm x86_64: a42ab0969e973cdab74c439427e21cfe wireshark-0.99.6-EL4.1.x86_64.rpm 6d12a229024b47a7ad5b6efcf71cb1d7 wireshark-debuginfo-0.99.6-EL4.1.x86_64.rpm 0c41fb92a893e0e031be4be98d54db3d wireshark-gnome-0.99.6-EL4.1.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/wireshark-0.99.6-EL4.1.src.rpm 2d8ad27725033ac2bbadd5a385b6ae76 wireshark-0.99.6-EL4.1.src.rpm i386: 3c6c77126ea4b1999f75a18a283d6499 wireshark-0.99.6-EL4.1.i386.rpm 8ac66efd8177234af75cf8af1bed2706 wireshark-debuginfo-0.99.6-EL4.1.i386.rpm ce5d1420de890fab97bb8c84617d1f25 wireshark-gnome-0.99.6-EL4.1.i386.rpm x86_64: a42ab0969e973cdab74c439427e21cfe wireshark-0.99.6-EL4.1.x86_64.rpm 6d12a229024b47a7ad5b6efcf71cb1d7 wireshark-debuginfo-0.99.6-EL4.1.x86_64.rpm 0c41fb92a893e0e031be4be98d54db3d wireshark-gnome-0.99.6-EL4.1.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/wireshark-0.99.6-EL4.1.src.rpm 2d8ad27725033ac2bbadd5a385b6ae76 wireshark-0.99.6-EL4.1.src.rpm i386: 3c6c77126ea4b1999f75a18a283d6499 wireshark-0.99.6-EL4.1.i386.rpm 8ac66efd8177234af75cf8af1bed2706 wireshark-debuginfo-0.99.6-EL4.1.i386.rpm ce5d1420de890fab97bb8c84617d1f25 wireshark-gnome-0.99.6-EL4.1.i386.rpm ia64: 1db9e6a01562b42162772472433ec40c wireshark-0.99.6-EL4.1.ia64.rpm 4602cc3474ca776e4b8a3340664fa308 wireshark-debuginfo-0.99.6-EL4.1.ia64.rpm 2be1f400717544434423277057fb8a6a wireshark-gnome-0.99.6-EL4.1.ia64.rpm x86_64: a42ab0969e973cdab74c439427e21cfe wireshark-0.99.6-EL4.1.x86_64.rpm 6d12a229024b47a7ad5b6efcf71cb1d7 wireshark-debuginfo-0.99.6-EL4.1.x86_64.rpm 0c41fb92a893e0e031be4be98d54db3d wireshark-gnome-0.99.6-EL4.1.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/wireshark-0.99.6-EL4.1.src.rpm 2d8ad27725033ac2bbadd5a385b6ae76 wireshark-0.99.6-EL4.1.src.rpm i386: 3c6c77126ea4b1999f75a18a283d6499 wireshark-0.99.6-EL4.1.i386.rpm 8ac66efd8177234af75cf8af1bed2706 wireshark-debuginfo-0.99.6-EL4.1.i386.rpm ce5d1420de890fab97bb8c84617d1f25 wireshark-gnome-0.99.6-EL4.1.i386.rpm ia64: 1db9e6a01562b42162772472433ec40c wireshark-0.99.6-EL4.1.ia64.rpm 4602cc3474ca776e4b8a3340664fa308 wireshark-debuginfo-0.99.6-EL4.1.ia64.rpm 2be1f400717544434423277057fb8a6a wireshark-gnome-0.99.6-EL4.1.ia64.rpm x86_64: a42ab0969e973cdab74c439427e21cfe wireshark-0.99.6-EL4.1.x86_64.rpm 6d12a229024b47a7ad5b6efcf71cb1d7 wireshark-debuginfo-0.99.6-EL4.1.x86_64.rpm 0c41fb92a893e0e031be4be98d54db3d wireshark-gnome-0.99.6-EL4.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3389 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3390 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3391 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3392 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3393 http://www.wireshark.org/docs/relnotes/wireshark-0.99.6.html http://www.redhat.com/security/updates/classification/#low 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHPF/rXlSAg2UNWIIRAoyzAJ9K/9B3CENYFAyN3PqCV08IxqkCnQCfWV2p GVjI6MegPzphK0NEzD+n/6U= =6t+M -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 15 15:04:31 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 15 Nov 2007 10:04:31 -0500 Subject: [RHSA-2007:0737-02] Moderate: pam security, bug fix, and enhancement update Message-ID: <200711151504.lAFF4VSG003181@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: pam security, bug fix, and enhancement update Advisory ID: RHSA-2007:0737-02 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0737.html Issue date: 2007-11-15 Updated on: 2007-11-15 Product: Red Hat Enterprise Linux Keywords: limits audit device ownership xauthority priority tally CVE Names: CVE-2007-1716 CVE-2007-3102 - --------------------------------------------------------------------- 1. Summary: Updated pam packages that fix two security flaws, resolve two bugs, and add an enhancement are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: Pluggable Authentication Modules (PAM) provide a system whereby administrators can set up authentication policies without having to recompile programs that handle authentication. A flaw was found in the way pam_console set console device permissions. It was possible for various console devices to retain ownership of the console user after logging out, possibly leaking information to another local user. (CVE-2007-1716) A flaw was found in the way the PAM library wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages, which could possibly mislead or confuse audit log parsing tools. (CVE-2007-3102) As well, these updated packages fix the following bugs: * the pam_xauth module, which is used for copying the X11 authentication cookie, did not reset the "XAUTHORITY" variable in certain circumstances, causing unnecessary delays when using su command. * when calculating password similarity, pam_cracklib disregarded changes to the last character in passwords when "difok=x" (where "x" is the number of characters required to change) was configured in "/etc/pam.d/system-auth". This resulted in password changes that should have been successful to fail with the following error: BAD PASSWORD: is too similar to the old one This issue has been resolved in these updated packages. * the pam_limits module, which provides setting up system resources limits for user sessions, reset the nice priority of the user session to "0" if it was not configured otherwise in the "/etc/security/limits.conf" configuration file. These updated packages add the following enhancement: * a new PAM module, pam_tally2, which allows accounts to be locked after a maximum number of failed log in attempts. All users of PAM should upgrade to these updated packages, which resolve these issues and add this enhancement. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 228980 - XAUTHORITY env var not reset on 'su -' 230823 - CVE-2007-1716 Ownership of devices not returned to root after logout from console 247797 - CVE-2007-3102 audit logging of failed logins 267201 - pam_cracklib.so disregards changes to last char when calculating similarity 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/pam-0.77-66.23.src.rpm 280fdb2b65b60c9f4289efbf9362f246 pam-0.77-66.23.src.rpm i386: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 7568bb0d75d41951a3956e1128787e78 pam-devel-0.77-66.23.i386.rpm ia64: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm c23638544883ca4eccc5ac7a34af78bc pam-0.77-66.23.ia64.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 90fcc91636557a9c70a721e4d836f8dd pam-debuginfo-0.77-66.23.ia64.rpm e707127a2b6748373f521654333018e7 pam-devel-0.77-66.23.ia64.rpm ppc: edb7fe8063315a76ef42285ec758fc49 pam-0.77-66.23.ppc.rpm a20e6dd507568b4e4d78734772d48013 pam-0.77-66.23.ppc64.rpm 45d2d248fbc8ffa2d8cbdaa232904b87 pam-debuginfo-0.77-66.23.ppc.rpm 331bdef816b228635bb5831343d4d03f pam-debuginfo-0.77-66.23.ppc64.rpm dff686e760e6db61bcd5e526dbc37415 pam-devel-0.77-66.23.ppc.rpm d60805d695d5f00b15dd61a2f4547fb4 pam-devel-0.77-66.23.ppc64.rpm s390: 7e14ae2d5fae071fdc976b59d0bd7503 pam-0.77-66.23.s390.rpm 81b0d2a8642fda0e80109e9bcd93d981 pam-debuginfo-0.77-66.23.s390.rpm 1e69ba88bb46d7b087c65330b26140fa pam-devel-0.77-66.23.s390.rpm s390x: 7e14ae2d5fae071fdc976b59d0bd7503 pam-0.77-66.23.s390.rpm 37d92cc5118f527d7257be350edc8934 pam-0.77-66.23.s390x.rpm 81b0d2a8642fda0e80109e9bcd93d981 pam-debuginfo-0.77-66.23.s390.rpm 0f3d8a73291ad04c89cce34f32a1589c pam-debuginfo-0.77-66.23.s390x.rpm 1e69ba88bb46d7b087c65330b26140fa pam-devel-0.77-66.23.s390.rpm 5e7853af7d8905b4375f68bca57da149 pam-devel-0.77-66.23.s390x.rpm x86_64: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm 03ec1abab5c5ab9395d59b70c7f4ec36 pam-0.77-66.23.x86_64.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 0a8738a21ed748b168cc9f55a61ab423 pam-debuginfo-0.77-66.23.x86_64.rpm 7568bb0d75d41951a3956e1128787e78 pam-devel-0.77-66.23.i386.rpm 1e5df76e71f24d346b4bd55e00cdaf0c pam-devel-0.77-66.23.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/pam-0.77-66.23.src.rpm 280fdb2b65b60c9f4289efbf9362f246 pam-0.77-66.23.src.rpm i386: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 7568bb0d75d41951a3956e1128787e78 pam-devel-0.77-66.23.i386.rpm x86_64: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm 03ec1abab5c5ab9395d59b70c7f4ec36 pam-0.77-66.23.x86_64.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 0a8738a21ed748b168cc9f55a61ab423 pam-debuginfo-0.77-66.23.x86_64.rpm 7568bb0d75d41951a3956e1128787e78 pam-devel-0.77-66.23.i386.rpm 1e5df76e71f24d346b4bd55e00cdaf0c pam-devel-0.77-66.23.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/pam-0.77-66.23.src.rpm 280fdb2b65b60c9f4289efbf9362f246 pam-0.77-66.23.src.rpm i386: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 7568bb0d75d41951a3956e1128787e78 pam-devel-0.77-66.23.i386.rpm ia64: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm c23638544883ca4eccc5ac7a34af78bc pam-0.77-66.23.ia64.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 90fcc91636557a9c70a721e4d836f8dd pam-debuginfo-0.77-66.23.ia64.rpm e707127a2b6748373f521654333018e7 pam-devel-0.77-66.23.ia64.rpm x86_64: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm 03ec1abab5c5ab9395d59b70c7f4ec36 pam-0.77-66.23.x86_64.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 0a8738a21ed748b168cc9f55a61ab423 pam-debuginfo-0.77-66.23.x86_64.rpm 7568bb0d75d41951a3956e1128787e78 pam-devel-0.77-66.23.i386.rpm 1e5df76e71f24d346b4bd55e00cdaf0c pam-devel-0.77-66.23.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/pam-0.77-66.23.src.rpm 280fdb2b65b60c9f4289efbf9362f246 pam-0.77-66.23.src.rpm i386: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 7568bb0d75d41951a3956e1128787e78 pam-devel-0.77-66.23.i386.rpm ia64: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm c23638544883ca4eccc5ac7a34af78bc pam-0.77-66.23.ia64.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 90fcc91636557a9c70a721e4d836f8dd pam-debuginfo-0.77-66.23.ia64.rpm e707127a2b6748373f521654333018e7 pam-devel-0.77-66.23.ia64.rpm x86_64: f83fa911b83700f7767907e20d7c4d45 pam-0.77-66.23.i386.rpm 03ec1abab5c5ab9395d59b70c7f4ec36 pam-0.77-66.23.x86_64.rpm e9c41fa27b60845f56e15d63ac1335d0 pam-debuginfo-0.77-66.23.i386.rpm 0a8738a21ed748b168cc9f55a61ab423 pam-debuginfo-0.77-66.23.x86_64.rpm 7568bb0d75d41951a3956e1128787e78 pam-devel-0.77-66.23.i386.rpm 1e5df76e71f24d346b4bd55e00cdaf0c pam-devel-0.77-66.23.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1716 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3102 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHPF/9XlSAg2UNWIIRAp2LAJ9OzqPN5lZxZhET8rNjtFouY7NMhgCeNhfI 1dWo2BA6LfeDCtRzF0ip8/M= =PAKR -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 15 15:06:49 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 15 Nov 2007 10:06:49 -0500 Subject: [RHSA-2007:0747-02] Moderate: httpd security, bug fix, and enhancement update Message-ID: <200711151506.lAFF6nAg003905@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: httpd security, bug fix, and enhancement update Advisory ID: RHSA-2007:0747-02 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0747.html Issue date: 2007-11-15 Updated on: 2007-11-15 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-3847 - --------------------------------------------------------------------- 1. Summary: Updated httpd packages that fix a security issue, various bugs, and add enhancements are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: The Apache HTTP Server is a popular and freely-available Web server. A flaw was found in the Apache HTTP Server mod_proxy module. On sites where a reverse proxy is configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. On sites where a forward proxy is configured, an attacker could cause a similar crash if a user could be persuaded to visit a malicious site using the proxy. This could lead to a denial of service if using a threaded Multi-Processing Module. (CVE-2007-3847) As well, these updated packages fix the following bugs: * the default "/etc/logrotate.d/httpd" script incorrectly invoked the kill command, instead of using the "/sbin/service httpd restart" command. If you configured the httpd PID to be in a location other than "/var/run/httpd.pid", the httpd logs failed to be rotated. This has been resolved in these updated packages. * Set-Cookie headers with a status code of 3xx are not forwarded to clients when the "ProxyErrorOverride" directive is enabled. These responses are overridden at the proxy. Only the responses with status codes of 4xx and 5xx are overridden in these updated packages. * mod_proxy did not correctly handle percent-encoded characters (ie %20) when configured as a reverse proxy. * invalid HTTP status codes could be logged if output filters returned errors. * the "ProxyTimeout" directive was not inherited across virtual host definitions. * in some cases the Content-Length header was dropped from HEAD responses. This resulted in certain sites not working correctly with mod_proxy, such as www.windowsupdate.com. This update adds the following enhancements: * a new configuration option has been added, "ServerTokens Full-Release", which adds the package release to the server version string, which is returned in the "Server" response header. * a new module has been added, mod_version, which allows configuration files to be written containing sections, which are evaluated only if the version of httpd used matches a specified condition. Users of httpd are advised to upgrade to these updated packages, which resolve these issues and add these enhancements. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 173467 - windowsupdate.microsoft.com does not work with mod_proxy 197915 - %>s incorrectly logs status code as 70007 - default handler returns output filter apr_status_t value 233254 - mod_proxy not handling percent chars in URLs correctly 240022 - Mod_proxy_http ProxyErrorOverride eating cookies 241407 - logrotate.d/httpd postrotate must use initscripts 242920 - Reverse Proxy Unexpected Timeout 248696 - Identify httpd version to configuration 250731 - CVE-2007-3847 httpd out of bounds read 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/httpd-2.0.52-38.ent.src.rpm 30f125952a08e957d2f346c30ef7e7e7 httpd-2.0.52-38.ent.src.rpm i386: f95b69b489d295ef96739a29757f55f2 httpd-2.0.52-38.ent.i386.rpm 42d59887a92689c9f81ff10cf626793d httpd-debuginfo-2.0.52-38.ent.i386.rpm f2fff3fd377adc85d0bed311e2e0f45c httpd-devel-2.0.52-38.ent.i386.rpm af796b5d498e912c27879906f0d7b9a1 httpd-manual-2.0.52-38.ent.i386.rpm 22c3deae4f0d49aa0051df04ce787de4 httpd-suexec-2.0.52-38.ent.i386.rpm 098b7c0ec963fd46a9db7aa43c7641a7 mod_ssl-2.0.52-38.ent.i386.rpm ia64: cdce256cd1151d5d3e6b4bc7b8e52780 httpd-2.0.52-38.ent.ia64.rpm 0f15a50cebaf5efbc523419eee3e4f18 httpd-debuginfo-2.0.52-38.ent.ia64.rpm 405b21207461558c006ae8536cd27ef4 httpd-devel-2.0.52-38.ent.ia64.rpm e94df07dab0db9d976c7970e6ced9583 httpd-manual-2.0.52-38.ent.ia64.rpm 75646a0496eda2196eff7529f983c538 httpd-suexec-2.0.52-38.ent.ia64.rpm 58ab32351e3ecf0e0fd93d1ea4d86c85 mod_ssl-2.0.52-38.ent.ia64.rpm ppc: e210ee818047bab954d1edd66f5b6a86 httpd-2.0.52-38.ent.ppc.rpm fd817e6b5cc96496bc567201ef8a8572 httpd-debuginfo-2.0.52-38.ent.ppc.rpm 79ebbe88ca05c2118bc170597b47ec66 httpd-devel-2.0.52-38.ent.ppc.rpm 64edf3e07c9b4c44e25c3b32cdd2c7a6 httpd-manual-2.0.52-38.ent.ppc.rpm 59434fe63aaa50b78081328a42d0a3cb httpd-suexec-2.0.52-38.ent.ppc.rpm 7b1aa9ff784abc0505463a51c7cc7a3e mod_ssl-2.0.52-38.ent.ppc.rpm s390: 8e051d2f7eb66e09b656b9027aa4107a httpd-2.0.52-38.ent.s390.rpm e0b951a481fd759b9ab800c9b9cf11fb httpd-debuginfo-2.0.52-38.ent.s390.rpm 2b70fcfe40d17f7cd8ef27dade54bb3e httpd-devel-2.0.52-38.ent.s390.rpm 4ec9ca1ba9713993fed46a7eaba5a0a3 httpd-manual-2.0.52-38.ent.s390.rpm a2e67e1c60caa12e64614bf6d159d95f httpd-suexec-2.0.52-38.ent.s390.rpm 0853b38c906c53890871865dd4023aef mod_ssl-2.0.52-38.ent.s390.rpm s390x: f8e62317f8fdfb09d3c31be388bd5d12 httpd-2.0.52-38.ent.s390x.rpm ba701e454dc885d7f3f775f70e1c7752 httpd-debuginfo-2.0.52-38.ent.s390x.rpm c9cdf84dfd5066a7d6d8752c160ecdc0 httpd-devel-2.0.52-38.ent.s390x.rpm b93c030074049ca4cd7a1f46c0f14485 httpd-manual-2.0.52-38.ent.s390x.rpm c4b00eefd718d03c324a4d6cd4ceb82a httpd-suexec-2.0.52-38.ent.s390x.rpm f2e5fffbceb41ba8921789b84454164c mod_ssl-2.0.52-38.ent.s390x.rpm x86_64: 55c8b892978b926e42afd60af24b3749 httpd-2.0.52-38.ent.x86_64.rpm 6b4d6a9e4fd6c159596891743d0ccfe0 httpd-debuginfo-2.0.52-38.ent.x86_64.rpm cc62fc81c664900fd66a4b25f30d1046 httpd-devel-2.0.52-38.ent.x86_64.rpm 2574c6993386378b9dd9c1f033c0830f httpd-manual-2.0.52-38.ent.x86_64.rpm c901932e63e90f060a13bcaff5dbe665 httpd-suexec-2.0.52-38.ent.x86_64.rpm d5abe5155f7e86d6c3551358da6659e9 mod_ssl-2.0.52-38.ent.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/httpd-2.0.52-38.ent.src.rpm 30f125952a08e957d2f346c30ef7e7e7 httpd-2.0.52-38.ent.src.rpm i386: f95b69b489d295ef96739a29757f55f2 httpd-2.0.52-38.ent.i386.rpm 42d59887a92689c9f81ff10cf626793d httpd-debuginfo-2.0.52-38.ent.i386.rpm f2fff3fd377adc85d0bed311e2e0f45c httpd-devel-2.0.52-38.ent.i386.rpm af796b5d498e912c27879906f0d7b9a1 httpd-manual-2.0.52-38.ent.i386.rpm 22c3deae4f0d49aa0051df04ce787de4 httpd-suexec-2.0.52-38.ent.i386.rpm 098b7c0ec963fd46a9db7aa43c7641a7 mod_ssl-2.0.52-38.ent.i386.rpm x86_64: 55c8b892978b926e42afd60af24b3749 httpd-2.0.52-38.ent.x86_64.rpm 6b4d6a9e4fd6c159596891743d0ccfe0 httpd-debuginfo-2.0.52-38.ent.x86_64.rpm cc62fc81c664900fd66a4b25f30d1046 httpd-devel-2.0.52-38.ent.x86_64.rpm 2574c6993386378b9dd9c1f033c0830f httpd-manual-2.0.52-38.ent.x86_64.rpm c901932e63e90f060a13bcaff5dbe665 httpd-suexec-2.0.52-38.ent.x86_64.rpm d5abe5155f7e86d6c3551358da6659e9 mod_ssl-2.0.52-38.ent.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/httpd-2.0.52-38.ent.src.rpm 30f125952a08e957d2f346c30ef7e7e7 httpd-2.0.52-38.ent.src.rpm i386: f95b69b489d295ef96739a29757f55f2 httpd-2.0.52-38.ent.i386.rpm 42d59887a92689c9f81ff10cf626793d httpd-debuginfo-2.0.52-38.ent.i386.rpm f2fff3fd377adc85d0bed311e2e0f45c httpd-devel-2.0.52-38.ent.i386.rpm af796b5d498e912c27879906f0d7b9a1 httpd-manual-2.0.52-38.ent.i386.rpm 22c3deae4f0d49aa0051df04ce787de4 httpd-suexec-2.0.52-38.ent.i386.rpm 098b7c0ec963fd46a9db7aa43c7641a7 mod_ssl-2.0.52-38.ent.i386.rpm ia64: cdce256cd1151d5d3e6b4bc7b8e52780 httpd-2.0.52-38.ent.ia64.rpm 0f15a50cebaf5efbc523419eee3e4f18 httpd-debuginfo-2.0.52-38.ent.ia64.rpm 405b21207461558c006ae8536cd27ef4 httpd-devel-2.0.52-38.ent.ia64.rpm e94df07dab0db9d976c7970e6ced9583 httpd-manual-2.0.52-38.ent.ia64.rpm 75646a0496eda2196eff7529f983c538 httpd-suexec-2.0.52-38.ent.ia64.rpm 58ab32351e3ecf0e0fd93d1ea4d86c85 mod_ssl-2.0.52-38.ent.ia64.rpm x86_64: 55c8b892978b926e42afd60af24b3749 httpd-2.0.52-38.ent.x86_64.rpm 6b4d6a9e4fd6c159596891743d0ccfe0 httpd-debuginfo-2.0.52-38.ent.x86_64.rpm cc62fc81c664900fd66a4b25f30d1046 httpd-devel-2.0.52-38.ent.x86_64.rpm 2574c6993386378b9dd9c1f033c0830f httpd-manual-2.0.52-38.ent.x86_64.rpm c901932e63e90f060a13bcaff5dbe665 httpd-suexec-2.0.52-38.ent.x86_64.rpm d5abe5155f7e86d6c3551358da6659e9 mod_ssl-2.0.52-38.ent.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/httpd-2.0.52-38.ent.src.rpm 30f125952a08e957d2f346c30ef7e7e7 httpd-2.0.52-38.ent.src.rpm i386: f95b69b489d295ef96739a29757f55f2 httpd-2.0.52-38.ent.i386.rpm 42d59887a92689c9f81ff10cf626793d httpd-debuginfo-2.0.52-38.ent.i386.rpm f2fff3fd377adc85d0bed311e2e0f45c httpd-devel-2.0.52-38.ent.i386.rpm af796b5d498e912c27879906f0d7b9a1 httpd-manual-2.0.52-38.ent.i386.rpm 22c3deae4f0d49aa0051df04ce787de4 httpd-suexec-2.0.52-38.ent.i386.rpm 098b7c0ec963fd46a9db7aa43c7641a7 mod_ssl-2.0.52-38.ent.i386.rpm ia64: cdce256cd1151d5d3e6b4bc7b8e52780 httpd-2.0.52-38.ent.ia64.rpm 0f15a50cebaf5efbc523419eee3e4f18 httpd-debuginfo-2.0.52-38.ent.ia64.rpm 405b21207461558c006ae8536cd27ef4 httpd-devel-2.0.52-38.ent.ia64.rpm e94df07dab0db9d976c7970e6ced9583 httpd-manual-2.0.52-38.ent.ia64.rpm 75646a0496eda2196eff7529f983c538 httpd-suexec-2.0.52-38.ent.ia64.rpm 58ab32351e3ecf0e0fd93d1ea4d86c85 mod_ssl-2.0.52-38.ent.ia64.rpm x86_64: 55c8b892978b926e42afd60af24b3749 httpd-2.0.52-38.ent.x86_64.rpm 6b4d6a9e4fd6c159596891743d0ccfe0 httpd-debuginfo-2.0.52-38.ent.x86_64.rpm cc62fc81c664900fd66a4b25f30d1046 httpd-devel-2.0.52-38.ent.x86_64.rpm 2574c6993386378b9dd9c1f033c0830f httpd-manual-2.0.52-38.ent.x86_64.rpm c901932e63e90f060a13bcaff5dbe665 httpd-suexec-2.0.52-38.ent.x86_64.rpm d5abe5155f7e86d6c3551358da6659e9 mod_ssl-2.0.52-38.ent.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3847 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHPGCDXlSAg2UNWIIRAmkCAJ4l5qrEN/JgZFf3Z5OPs56nAqYWlACgrwm6 dbX4aTfmevBEGAkI2H0QCzE= =eIln -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 15 15:07:02 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 15 Nov 2007 10:07:02 -0500 Subject: [RHSA-2007:0779-02] Low: mailman security and bug fix update Message-ID: <200711151507.lAFF72mf003921@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Low: mailman security and bug fix update Advisory ID: RHSA-2007:0779-02 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0779.html Issue date: 2007-11-15 Updated on: 2007-11-15 Product: Red Hat Enterprise Linux CVE Names: CVE-2006-4624 - --------------------------------------------------------------------- 1. Summary: Updated mailman packages that fix a security issue and various bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: Mailman is a program used to help manage email discussion lists. A flaw was found in Mailman. A remote attacker could spoof messages in the error log, and possibly trick the administrator into visiting malicious URLs via a carriage return/line feed sequence in the URI. (CVE-2006-4624) As well, these updated packages fix the following bugs: * canceling a subscription on the confirm subscription request page caused mailman to crash. * editing the sender filter caused all spam filter rules to be deleted. * the migrate-fhs script was not included. * the mailman init script returned a zero (success) exit code even when an incorrect command was given. For example, the "mailman foo" command returned a zero exit code. In these updated packages the mailmain init script returns the correct exit codes. Users of Mailman are advised to upgrade to these updated packages, which resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 200036 - Canceling subscription confirmation crashes mailman 205651 - CVE-2006-4624 mailman logfile CRLF injection 223191 - Spam filters gets deleted when sender filter is edited 230939 - mailman-2.1.5.1-34.rhel4.5 is missing migrate-fhs script 242677 - Wrong init script 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/mailman-2.1.5.1-34.rhel4.6.src.rpm cc98584c023f60a7b82b75ad32746ded mailman-2.1.5.1-34.rhel4.6.src.rpm i386: abd6759ac2f46e50d9de6c6fffc9117a mailman-2.1.5.1-34.rhel4.6.i386.rpm 8307354db23c68be6826122af40bdeea mailman-debuginfo-2.1.5.1-34.rhel4.6.i386.rpm ia64: 413aba0280251a5ad3da4bd35c235f8b mailman-2.1.5.1-34.rhel4.6.ia64.rpm 92664a65306e390b3d2f2cfa4946b0a6 mailman-debuginfo-2.1.5.1-34.rhel4.6.ia64.rpm ppc: c9cfb9aa11a5c281b3a82313d2ea233a mailman-2.1.5.1-34.rhel4.6.ppc.rpm aa933b2d2a4b5062bcfac412d199ce46 mailman-debuginfo-2.1.5.1-34.rhel4.6.ppc.rpm s390: 0130bfcf79c1bb852ee1a57664e0318d mailman-2.1.5.1-34.rhel4.6.s390.rpm ddd5c59638d686af3afb285a4dd1bc7e mailman-debuginfo-2.1.5.1-34.rhel4.6.s390.rpm s390x: 05f6bc35d89b64f54ea98e94962c79fc mailman-2.1.5.1-34.rhel4.6.s390x.rpm fd90039a9b1bc188234a04efb1703945 mailman-debuginfo-2.1.5.1-34.rhel4.6.s390x.rpm x86_64: 5f00ffd062da99497e20e27ae0b3fd2e mailman-2.1.5.1-34.rhel4.6.x86_64.rpm a79b911550a27718cf95a926113f968e mailman-debuginfo-2.1.5.1-34.rhel4.6.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/mailman-2.1.5.1-34.rhel4.6.src.rpm cc98584c023f60a7b82b75ad32746ded mailman-2.1.5.1-34.rhel4.6.src.rpm i386: abd6759ac2f46e50d9de6c6fffc9117a mailman-2.1.5.1-34.rhel4.6.i386.rpm 8307354db23c68be6826122af40bdeea mailman-debuginfo-2.1.5.1-34.rhel4.6.i386.rpm x86_64: 5f00ffd062da99497e20e27ae0b3fd2e mailman-2.1.5.1-34.rhel4.6.x86_64.rpm a79b911550a27718cf95a926113f968e mailman-debuginfo-2.1.5.1-34.rhel4.6.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/mailman-2.1.5.1-34.rhel4.6.src.rpm cc98584c023f60a7b82b75ad32746ded mailman-2.1.5.1-34.rhel4.6.src.rpm i386: abd6759ac2f46e50d9de6c6fffc9117a mailman-2.1.5.1-34.rhel4.6.i386.rpm 8307354db23c68be6826122af40bdeea mailman-debuginfo-2.1.5.1-34.rhel4.6.i386.rpm ia64: 413aba0280251a5ad3da4bd35c235f8b mailman-2.1.5.1-34.rhel4.6.ia64.rpm 92664a65306e390b3d2f2cfa4946b0a6 mailman-debuginfo-2.1.5.1-34.rhel4.6.ia64.rpm x86_64: 5f00ffd062da99497e20e27ae0b3fd2e mailman-2.1.5.1-34.rhel4.6.x86_64.rpm a79b911550a27718cf95a926113f968e mailman-debuginfo-2.1.5.1-34.rhel4.6.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/mailman-2.1.5.1-34.rhel4.6.src.rpm cc98584c023f60a7b82b75ad32746ded mailman-2.1.5.1-34.rhel4.6.src.rpm i386: abd6759ac2f46e50d9de6c6fffc9117a mailman-2.1.5.1-34.rhel4.6.i386.rpm 8307354db23c68be6826122af40bdeea mailman-debuginfo-2.1.5.1-34.rhel4.6.i386.rpm ia64: 413aba0280251a5ad3da4bd35c235f8b mailman-2.1.5.1-34.rhel4.6.ia64.rpm 92664a65306e390b3d2f2cfa4946b0a6 mailman-debuginfo-2.1.5.1-34.rhel4.6.ia64.rpm x86_64: 5f00ffd062da99497e20e27ae0b3fd2e mailman-2.1.5.1-34.rhel4.6.x86_64.rpm a79b911550a27718cf95a926113f968e mailman-debuginfo-2.1.5.1-34.rhel4.6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4624 http://www.redhat.com/security/updates/classification/#low 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHPGCOXlSAg2UNWIIRAkUmAJ9taRfEL3B9U8ICLLJ+itYHe2oiZgCfS1IP A4bwjHX2pMmxmTEDGsi1Qxw= =Nu9N -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 15 15:07:14 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 15 Nov 2007 10:07:14 -0500 Subject: [RHSA-2007:1003-02] Moderate: openssl security and bug fix update Message-ID: <200711151507.lAFF7Eqe003936@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: openssl security and bug fix update Advisory ID: RHSA-2007:1003-02 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1003.html Issue date: 2007-11-15 Updated on: 2007-11-15 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-3108 CVE-2007-5135 - --------------------------------------------------------------------- 1. Summary: Updated OpenSSL packages that correct a security issue and various bugs are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, and is also a full-strength general-purpose cryptography library. A flaw was found in the SSL_get_shared_ciphers() utility function. An attacker could send a list of ciphers to an application that used this function and overrun a buffer by a single byte (CVE-2007-5135). Few applications make use of this vulnerable function and generally it is used only when applications are compiled for debugging. A number of possible side-channel attacks were discovered affecting OpenSSL. A local attacker could possibly obtain RSA private keys being used on a system. In practice these attacks would be difficult to perform outside of a lab environment. This update contains backported patches to mitigate these issues. (CVE-2007-3108) As well, these updated packages fix the following bugs: * multithreaded applications could cause a segmentation fault or deadlock when calling the random number generator initialization (RAND_poll) in the OpenSSL library, for a large number of threads simultaneously. * in certain circumstances, if an application using the OpenSSL library reused the SSL session cache for multiple purposes (with various parameters of the SSL protocol), the session parameters could be mismatched. * a segmentation fault could occur when a corrupted pkcs12 file was being loaded using the "openssl pkcs12 -in [pkcs12-file]" command, where [pkcs12-file] is the pkcs12 file. Users of OpenSSL should upgrade to these updated packages, which contain backported patches to resolve these issues. Note: After installing this update, users are advised to either restart all services that use OpenSSL or restart their system. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 236164 - openssl RAND_poll segfault when fd >= FD_SETSIZE (affects apache2 startup with many SSL vhosts) 245083 - openssl crashes on pkcs12 file 245732 - CVE-2007-3108 RSA side-channel attack 250573 - CVE-NONE openssl branch prediction attacks 309801 - CVE-2007-5135 openssl SSL_get_shared_ciphers() off-by-one 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/openssl-0.9.7a-43.17.el4_6.1.src.rpm 24eb7d12df6c625ceb6a5d01dd9e3b7a openssl-0.9.7a-43.17.el4_6.1.src.rpm i386: fd17a9420a5012ba93862a9a785ac1e0 openssl-0.9.7a-43.17.el4_6.1.i386.rpm 384f5dd17ec619fec8b6727fb773c0aa openssl-0.9.7a-43.17.el4_6.1.i686.rpm a3b6fe86736b2c49063e73eff9f978aa openssl-debuginfo-0.9.7a-43.17.el4_6.1.i386.rpm 097cb4b0e0b64a770820372065008eab openssl-debuginfo-0.9.7a-43.17.el4_6.1.i686.rpm 920a1e4eb366cc194c7e8bc8da2a279e openssl-devel-0.9.7a-43.17.el4_6.1.i386.rpm bd87b8543e562481507f76e9d39a30af openssl-perl-0.9.7a-43.17.el4_6.1.i386.rpm ia64: 384f5dd17ec619fec8b6727fb773c0aa openssl-0.9.7a-43.17.el4_6.1.i686.rpm 7494f244f411ddd69a04a6be8fecdd6e openssl-0.9.7a-43.17.el4_6.1.ia64.rpm 097cb4b0e0b64a770820372065008eab openssl-debuginfo-0.9.7a-43.17.el4_6.1.i686.rpm c7f04480bae34438eeaa40750333541f openssl-debuginfo-0.9.7a-43.17.el4_6.1.ia64.rpm 45ba765aa724aa8903258de650b09a67 openssl-devel-0.9.7a-43.17.el4_6.1.ia64.rpm 11a2d7783be7bf8ee99460c3dea98152 openssl-perl-0.9.7a-43.17.el4_6.1.ia64.rpm ppc: f46b7594ad94d2959824740e5cc1019f openssl-0.9.7a-43.17.el4_6.1.ppc.rpm 56f0751c6d7008bff1c3edb5dbae8ef1 openssl-0.9.7a-43.17.el4_6.1.ppc64.rpm 53227a7bfe399de66c4f21899e53277c openssl-debuginfo-0.9.7a-43.17.el4_6.1.ppc.rpm 8a33ce0535a7d04b99741ac958890160 openssl-debuginfo-0.9.7a-43.17.el4_6.1.ppc64.rpm f6cc5a6ff2fb59d713bf8d7129be6095 openssl-devel-0.9.7a-43.17.el4_6.1.ppc.rpm cf1a26c9d95194b011a2c8c64d0611ed openssl-devel-0.9.7a-43.17.el4_6.1.ppc64.rpm b93fedadd62fc26f6c16149f4e461b4a openssl-perl-0.9.7a-43.17.el4_6.1.ppc.rpm s390: c4e724db694b6baed8c65a7d52fe200f openssl-0.9.7a-43.17.el4_6.1.s390.rpm f569fad3350ced5ac213595c37097bf2 openssl-debuginfo-0.9.7a-43.17.el4_6.1.s390.rpm be7f333822693113787699531afe2821 openssl-devel-0.9.7a-43.17.el4_6.1.s390.rpm 49b29af00069eebd4fd9c86088b518d7 openssl-perl-0.9.7a-43.17.el4_6.1.s390.rpm s390x: c4e724db694b6baed8c65a7d52fe200f openssl-0.9.7a-43.17.el4_6.1.s390.rpm f53091e139d2532d1afd09b1bf779775 openssl-0.9.7a-43.17.el4_6.1.s390x.rpm f569fad3350ced5ac213595c37097bf2 openssl-debuginfo-0.9.7a-43.17.el4_6.1.s390.rpm bf73ac21cd478966f4a97661d0289502 openssl-debuginfo-0.9.7a-43.17.el4_6.1.s390x.rpm be7f333822693113787699531afe2821 openssl-devel-0.9.7a-43.17.el4_6.1.s390.rpm 63315885d2cab16cf820fb8f7481a135 openssl-devel-0.9.7a-43.17.el4_6.1.s390x.rpm 86d405ec8c36ab8388a5c1ae00485ce2 openssl-perl-0.9.7a-43.17.el4_6.1.s390x.rpm x86_64: 384f5dd17ec619fec8b6727fb773c0aa openssl-0.9.7a-43.17.el4_6.1.i686.rpm 69fdfac019661e46b64212e3a11b25e6 openssl-0.9.7a-43.17.el4_6.1.x86_64.rpm a3b6fe86736b2c49063e73eff9f978aa openssl-debuginfo-0.9.7a-43.17.el4_6.1.i386.rpm 097cb4b0e0b64a770820372065008eab openssl-debuginfo-0.9.7a-43.17.el4_6.1.i686.rpm af2aa462bdfaf66d473f38a8a2163826 openssl-debuginfo-0.9.7a-43.17.el4_6.1.x86_64.rpm 920a1e4eb366cc194c7e8bc8da2a279e openssl-devel-0.9.7a-43.17.el4_6.1.i386.rpm c4bf62475096f6654c0b52933d1fd474 openssl-devel-0.9.7a-43.17.el4_6.1.x86_64.rpm 1ec9148af0f209d40f4683c2c846ff84 openssl-perl-0.9.7a-43.17.el4_6.1.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/openssl-0.9.7a-43.17.el4_6.1.src.rpm 24eb7d12df6c625ceb6a5d01dd9e3b7a openssl-0.9.7a-43.17.el4_6.1.src.rpm i386: fd17a9420a5012ba93862a9a785ac1e0 openssl-0.9.7a-43.17.el4_6.1.i386.rpm 384f5dd17ec619fec8b6727fb773c0aa openssl-0.9.7a-43.17.el4_6.1.i686.rpm a3b6fe86736b2c49063e73eff9f978aa openssl-debuginfo-0.9.7a-43.17.el4_6.1.i386.rpm 097cb4b0e0b64a770820372065008eab openssl-debuginfo-0.9.7a-43.17.el4_6.1.i686.rpm 920a1e4eb366cc194c7e8bc8da2a279e openssl-devel-0.9.7a-43.17.el4_6.1.i386.rpm bd87b8543e562481507f76e9d39a30af openssl-perl-0.9.7a-43.17.el4_6.1.i386.rpm x86_64: 384f5dd17ec619fec8b6727fb773c0aa openssl-0.9.7a-43.17.el4_6.1.i686.rpm 69fdfac019661e46b64212e3a11b25e6 openssl-0.9.7a-43.17.el4_6.1.x86_64.rpm a3b6fe86736b2c49063e73eff9f978aa openssl-debuginfo-0.9.7a-43.17.el4_6.1.i386.rpm 097cb4b0e0b64a770820372065008eab openssl-debuginfo-0.9.7a-43.17.el4_6.1.i686.rpm af2aa462bdfaf66d473f38a8a2163826 openssl-debuginfo-0.9.7a-43.17.el4_6.1.x86_64.rpm 920a1e4eb366cc194c7e8bc8da2a279e openssl-devel-0.9.7a-43.17.el4_6.1.i386.rpm c4bf62475096f6654c0b52933d1fd474 openssl-devel-0.9.7a-43.17.el4_6.1.x86_64.rpm 1ec9148af0f209d40f4683c2c846ff84 openssl-perl-0.9.7a-43.17.el4_6.1.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/openssl-0.9.7a-43.17.el4_6.1.src.rpm 24eb7d12df6c625ceb6a5d01dd9e3b7a openssl-0.9.7a-43.17.el4_6.1.src.rpm i386: fd17a9420a5012ba93862a9a785ac1e0 openssl-0.9.7a-43.17.el4_6.1.i386.rpm 384f5dd17ec619fec8b6727fb773c0aa openssl-0.9.7a-43.17.el4_6.1.i686.rpm a3b6fe86736b2c49063e73eff9f978aa openssl-debuginfo-0.9.7a-43.17.el4_6.1.i386.rpm 097cb4b0e0b64a770820372065008eab openssl-debuginfo-0.9.7a-43.17.el4_6.1.i686.rpm 920a1e4eb366cc194c7e8bc8da2a279e openssl-devel-0.9.7a-43.17.el4_6.1.i386.rpm bd87b8543e562481507f76e9d39a30af openssl-perl-0.9.7a-43.17.el4_6.1.i386.rpm ia64: 384f5dd17ec619fec8b6727fb773c0aa openssl-0.9.7a-43.17.el4_6.1.i686.rpm 7494f244f411ddd69a04a6be8fecdd6e openssl-0.9.7a-43.17.el4_6.1.ia64.rpm 097cb4b0e0b64a770820372065008eab openssl-debuginfo-0.9.7a-43.17.el4_6.1.i686.rpm c7f04480bae34438eeaa40750333541f openssl-debuginfo-0.9.7a-43.17.el4_6.1.ia64.rpm 45ba765aa724aa8903258de650b09a67 openssl-devel-0.9.7a-43.17.el4_6.1.ia64.rpm 11a2d7783be7bf8ee99460c3dea98152 openssl-perl-0.9.7a-43.17.el4_6.1.ia64.rpm x86_64: 384f5dd17ec619fec8b6727fb773c0aa openssl-0.9.7a-43.17.el4_6.1.i686.rpm 69fdfac019661e46b64212e3a11b25e6 openssl-0.9.7a-43.17.el4_6.1.x86_64.rpm a3b6fe86736b2c49063e73eff9f978aa openssl-debuginfo-0.9.7a-43.17.el4_6.1.i386.rpm 097cb4b0e0b64a770820372065008eab openssl-debuginfo-0.9.7a-43.17.el4_6.1.i686.rpm af2aa462bdfaf66d473f38a8a2163826 openssl-debuginfo-0.9.7a-43.17.el4_6.1.x86_64.rpm 920a1e4eb366cc194c7e8bc8da2a279e openssl-devel-0.9.7a-43.17.el4_6.1.i386.rpm c4bf62475096f6654c0b52933d1fd474 openssl-devel-0.9.7a-43.17.el4_6.1.x86_64.rpm 1ec9148af0f209d40f4683c2c846ff84 openssl-perl-0.9.7a-43.17.el4_6.1.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/openssl-0.9.7a-43.17.el4_6.1.src.rpm 24eb7d12df6c625ceb6a5d01dd9e3b7a openssl-0.9.7a-43.17.el4_6.1.src.rpm i386: fd17a9420a5012ba93862a9a785ac1e0 openssl-0.9.7a-43.17.el4_6.1.i386.rpm 384f5dd17ec619fec8b6727fb773c0aa openssl-0.9.7a-43.17.el4_6.1.i686.rpm a3b6fe86736b2c49063e73eff9f978aa openssl-debuginfo-0.9.7a-43.17.el4_6.1.i386.rpm 097cb4b0e0b64a770820372065008eab openssl-debuginfo-0.9.7a-43.17.el4_6.1.i686.rpm 920a1e4eb366cc194c7e8bc8da2a279e openssl-devel-0.9.7a-43.17.el4_6.1.i386.rpm bd87b8543e562481507f76e9d39a30af openssl-perl-0.9.7a-43.17.el4_6.1.i386.rpm ia64: 384f5dd17ec619fec8b6727fb773c0aa openssl-0.9.7a-43.17.el4_6.1.i686.rpm 7494f244f411ddd69a04a6be8fecdd6e openssl-0.9.7a-43.17.el4_6.1.ia64.rpm 097cb4b0e0b64a770820372065008eab openssl-debuginfo-0.9.7a-43.17.el4_6.1.i686.rpm c7f04480bae34438eeaa40750333541f openssl-debuginfo-0.9.7a-43.17.el4_6.1.ia64.rpm 45ba765aa724aa8903258de650b09a67 openssl-devel-0.9.7a-43.17.el4_6.1.ia64.rpm 11a2d7783be7bf8ee99460c3dea98152 openssl-perl-0.9.7a-43.17.el4_6.1.ia64.rpm x86_64: 384f5dd17ec619fec8b6727fb773c0aa openssl-0.9.7a-43.17.el4_6.1.i686.rpm 69fdfac019661e46b64212e3a11b25e6 openssl-0.9.7a-43.17.el4_6.1.x86_64.rpm a3b6fe86736b2c49063e73eff9f978aa openssl-debuginfo-0.9.7a-43.17.el4_6.1.i386.rpm 097cb4b0e0b64a770820372065008eab openssl-debuginfo-0.9.7a-43.17.el4_6.1.i686.rpm af2aa462bdfaf66d473f38a8a2163826 openssl-debuginfo-0.9.7a-43.17.el4_6.1.x86_64.rpm 920a1e4eb366cc194c7e8bc8da2a279e openssl-devel-0.9.7a-43.17.el4_6.1.i386.rpm c4bf62475096f6654c0b52933d1fd474 openssl-devel-0.9.7a-43.17.el4_6.1.x86_64.rpm 1ec9148af0f209d40f4683c2c846ff84 openssl-perl-0.9.7a-43.17.el4_6.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3108 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5135 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHPGCaXlSAg2UNWIIRAqcHAKClSXhLaxLzMuZsYWTaj93gZuTOpwCgp+dB FxhlekFUu49nOgVPujcjA3Q= =h8t5 -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 15 16:11:28 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 15 Nov 2007 11:11:28 -0500 Subject: [RHSA-2007:0969-01] Moderate: util-linux security update Message-ID: <200711151611.lAFGBS8b015546@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: util-linux security update Advisory ID: RHSA-2007:0969-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0969.html Issue date: 2007-11-15 Updated on: 2007-11-15 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-5191 - --------------------------------------------------------------------- 1. Summary: Updated util-linux packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function. A flaw was discovered in the way that the mount and umount utilities used the setuid and setgid functions, which could lead to privileges being dropped improperly. A local user could use this flaw to run mount helper applications such as, mount.nfs, with additional privileges (CVE-2007-5191). Users are advised to update to these erratum packages which contain a backported patch to correct this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 320041 - CVE-2007-5191 util-linux (u)mount doesn't drop privileges properly when calling helpers 6. RPMs required: Red Hat Enterprise Linux AS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/util-linux-2.11y-31.24.src.rpm c8dca6be176c354618c990807ff3fc66 util-linux-2.11y-31.24.src.rpm i386: 3abbd4266aa3f7864fa4aed635599240 losetup-2.11y-31.24.i386.rpm 40ba72beac226a61aa4cf31a291e6830 mount-2.11y-31.24.i386.rpm 2d59da433560a41a7ae93ccfd07e71b2 util-linux-2.11y-31.24.i386.rpm 9d0d4566f7c1c5aaa5ad9b6bcd91e16c util-linux-debuginfo-2.11y-31.24.i386.rpm ia64: 74cc943862f2a0f799d8a6ef23f607ea losetup-2.11y-31.24.ia64.rpm b6de13019680ea1d206707c044c01477 mount-2.11y-31.24.ia64.rpm 10de76e9f049b44862894505db6b24d1 util-linux-2.11y-31.24.ia64.rpm 20f167343fba9a2b94c5a374b68ae495 util-linux-debuginfo-2.11y-31.24.ia64.rpm ppc: 80dc38a98cadd1dff47e65a35db982f6 losetup-2.11y-31.24.ppc.rpm c5521b6183e456ab4c01d749d0a5e4f6 mount-2.11y-31.24.ppc.rpm e6ed9283185c25e063642649485c99c8 util-linux-2.11y-31.24.ppc.rpm 690bce292df43f62dcd5e8e554251cfe util-linux-debuginfo-2.11y-31.24.ppc.rpm s390: 2cd8b888ed5b0c2328e88daaf75afa22 losetup-2.11y-31.24.s390.rpm 68363c1e2f2c1d6b91634fbc65f5cf77 mount-2.11y-31.24.s390.rpm d6bcd2dafa3b637f8509eeac35bd3db6 util-linux-2.11y-31.24.s390.rpm c8044273c992b56f54c876858572907d util-linux-debuginfo-2.11y-31.24.s390.rpm s390x: e4c97ad371e73a8ef52e85e24efd9458 losetup-2.11y-31.24.s390x.rpm e22bf20509d377006a63d56ebf38d03f mount-2.11y-31.24.s390x.rpm 660318e6e24ef3817332394bb253f63c util-linux-2.11y-31.24.s390x.rpm d08dcc0b15ba2293ed6f0bd0b649745f util-linux-debuginfo-2.11y-31.24.s390x.rpm x86_64: 4ad59d5036259f929da43ba69c34738d losetup-2.11y-31.24.x86_64.rpm 0e15083a039d371d5192a2c8096c10d2 mount-2.11y-31.24.x86_64.rpm e091b661b1b72d58103025bc32624e23 util-linux-2.11y-31.24.x86_64.rpm 7fa6546a84388b13d32bd0bef0189867 util-linux-debuginfo-2.11y-31.24.x86_64.rpm Red Hat Desktop version 3: SRPMS: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/util-linux-2.11y-31.24.src.rpm c8dca6be176c354618c990807ff3fc66 util-linux-2.11y-31.24.src.rpm i386: 3abbd4266aa3f7864fa4aed635599240 losetup-2.11y-31.24.i386.rpm 40ba72beac226a61aa4cf31a291e6830 mount-2.11y-31.24.i386.rpm 2d59da433560a41a7ae93ccfd07e71b2 util-linux-2.11y-31.24.i386.rpm 9d0d4566f7c1c5aaa5ad9b6bcd91e16c util-linux-debuginfo-2.11y-31.24.i386.rpm x86_64: 4ad59d5036259f929da43ba69c34738d losetup-2.11y-31.24.x86_64.rpm 0e15083a039d371d5192a2c8096c10d2 mount-2.11y-31.24.x86_64.rpm e091b661b1b72d58103025bc32624e23 util-linux-2.11y-31.24.x86_64.rpm 7fa6546a84388b13d32bd0bef0189867 util-linux-debuginfo-2.11y-31.24.x86_64.rpm Red Hat Enterprise Linux ES version 3: SRPMS: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/util-linux-2.11y-31.24.src.rpm c8dca6be176c354618c990807ff3fc66 util-linux-2.11y-31.24.src.rpm i386: 3abbd4266aa3f7864fa4aed635599240 losetup-2.11y-31.24.i386.rpm 40ba72beac226a61aa4cf31a291e6830 mount-2.11y-31.24.i386.rpm 2d59da433560a41a7ae93ccfd07e71b2 util-linux-2.11y-31.24.i386.rpm 9d0d4566f7c1c5aaa5ad9b6bcd91e16c util-linux-debuginfo-2.11y-31.24.i386.rpm ia64: 74cc943862f2a0f799d8a6ef23f607ea losetup-2.11y-31.24.ia64.rpm b6de13019680ea1d206707c044c01477 mount-2.11y-31.24.ia64.rpm 10de76e9f049b44862894505db6b24d1 util-linux-2.11y-31.24.ia64.rpm 20f167343fba9a2b94c5a374b68ae495 util-linux-debuginfo-2.11y-31.24.ia64.rpm x86_64: 4ad59d5036259f929da43ba69c34738d losetup-2.11y-31.24.x86_64.rpm 0e15083a039d371d5192a2c8096c10d2 mount-2.11y-31.24.x86_64.rpm e091b661b1b72d58103025bc32624e23 util-linux-2.11y-31.24.x86_64.rpm 7fa6546a84388b13d32bd0bef0189867 util-linux-debuginfo-2.11y-31.24.x86_64.rpm Red Hat Enterprise Linux WS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/util-linux-2.11y-31.24.src.rpm c8dca6be176c354618c990807ff3fc66 util-linux-2.11y-31.24.src.rpm i386: 3abbd4266aa3f7864fa4aed635599240 losetup-2.11y-31.24.i386.rpm 40ba72beac226a61aa4cf31a291e6830 mount-2.11y-31.24.i386.rpm 2d59da433560a41a7ae93ccfd07e71b2 util-linux-2.11y-31.24.i386.rpm 9d0d4566f7c1c5aaa5ad9b6bcd91e16c util-linux-debuginfo-2.11y-31.24.i386.rpm ia64: 74cc943862f2a0f799d8a6ef23f607ea losetup-2.11y-31.24.ia64.rpm b6de13019680ea1d206707c044c01477 mount-2.11y-31.24.ia64.rpm 10de76e9f049b44862894505db6b24d1 util-linux-2.11y-31.24.ia64.rpm 20f167343fba9a2b94c5a374b68ae495 util-linux-debuginfo-2.11y-31.24.ia64.rpm x86_64: 4ad59d5036259f929da43ba69c34738d losetup-2.11y-31.24.x86_64.rpm 0e15083a039d371d5192a2c8096c10d2 mount-2.11y-31.24.x86_64.rpm e091b661b1b72d58103025bc32624e23 util-linux-2.11y-31.24.x86_64.rpm 7fa6546a84388b13d32bd0bef0189867 util-linux-debuginfo-2.11y-31.24.x86_64.rpm Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/util-linux-2.12a-17.el4_6.1.src.rpm 4286e43dacfd8a817477e7f84e03d453 util-linux-2.12a-17.el4_6.1.src.rpm i386: 65ea34354b8231e4450a9612100e571b util-linux-2.12a-17.el4_6.1.i386.rpm 2cf8ad85b80bb9a286159adedd69482a util-linux-debuginfo-2.12a-17.el4_6.1.i386.rpm ia64: 2e63367f64bded552f69a14a3139d6db util-linux-2.12a-17.el4_6.1.ia64.rpm b389ff3f84af0ba18b11d33c9fd34a78 util-linux-debuginfo-2.12a-17.el4_6.1.ia64.rpm ppc: 206359916ef9906ac3094e8b73dc6717 util-linux-2.12a-17.el4_6.1.ppc.rpm 590031bbdd86787e78c059405ac1f5f7 util-linux-debuginfo-2.12a-17.el4_6.1.ppc.rpm s390: 973c18aa91f600e389531a9a38ce5a5f util-linux-2.12a-17.el4_6.1.s390.rpm 98df259c596db663aa6b0bd7daba1137 util-linux-debuginfo-2.12a-17.el4_6.1.s390.rpm s390x: 2a9eec5e0618573c654f0a036aacc65b util-linux-2.12a-17.el4_6.1.s390x.rpm 146daa6a3a8e4ae2bff2b6884acdc8dc util-linux-debuginfo-2.12a-17.el4_6.1.s390x.rpm x86_64: b9d00ce643a33f03703024f1a26893b7 util-linux-2.12a-17.el4_6.1.x86_64.rpm 70a7b6deaf23574c713c5f5ab82f1b06 util-linux-debuginfo-2.12a-17.el4_6.1.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/util-linux-2.12a-17.el4_6.1.src.rpm 4286e43dacfd8a817477e7f84e03d453 util-linux-2.12a-17.el4_6.1.src.rpm i386: 65ea34354b8231e4450a9612100e571b util-linux-2.12a-17.el4_6.1.i386.rpm 2cf8ad85b80bb9a286159adedd69482a util-linux-debuginfo-2.12a-17.el4_6.1.i386.rpm x86_64: b9d00ce643a33f03703024f1a26893b7 util-linux-2.12a-17.el4_6.1.x86_64.rpm 70a7b6deaf23574c713c5f5ab82f1b06 util-linux-debuginfo-2.12a-17.el4_6.1.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/util-linux-2.12a-17.el4_6.1.src.rpm 4286e43dacfd8a817477e7f84e03d453 util-linux-2.12a-17.el4_6.1.src.rpm i386: 65ea34354b8231e4450a9612100e571b util-linux-2.12a-17.el4_6.1.i386.rpm 2cf8ad85b80bb9a286159adedd69482a util-linux-debuginfo-2.12a-17.el4_6.1.i386.rpm ia64: 2e63367f64bded552f69a14a3139d6db util-linux-2.12a-17.el4_6.1.ia64.rpm b389ff3f84af0ba18b11d33c9fd34a78 util-linux-debuginfo-2.12a-17.el4_6.1.ia64.rpm x86_64: b9d00ce643a33f03703024f1a26893b7 util-linux-2.12a-17.el4_6.1.x86_64.rpm 70a7b6deaf23574c713c5f5ab82f1b06 util-linux-debuginfo-2.12a-17.el4_6.1.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/util-linux-2.12a-17.el4_6.1.src.rpm 4286e43dacfd8a817477e7f84e03d453 util-linux-2.12a-17.el4_6.1.src.rpm i386: 65ea34354b8231e4450a9612100e571b util-linux-2.12a-17.el4_6.1.i386.rpm 2cf8ad85b80bb9a286159adedd69482a util-linux-debuginfo-2.12a-17.el4_6.1.i386.rpm ia64: 2e63367f64bded552f69a14a3139d6db util-linux-2.12a-17.el4_6.1.ia64.rpm b389ff3f84af0ba18b11d33c9fd34a78 util-linux-debuginfo-2.12a-17.el4_6.1.ia64.rpm x86_64: b9d00ce643a33f03703024f1a26893b7 util-linux-2.12a-17.el4_6.1.x86_64.rpm 70a7b6deaf23574c713c5f5ab82f1b06 util-linux-debuginfo-2.12a-17.el4_6.1.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/util-linux-2.13-0.45.el5_1.1.src.rpm a05c05b42aa2e25741a1f456c4277fc1 util-linux-2.13-0.45.el5_1.1.src.rpm i386: 3ca3123bb60a84d87d3b388ea3fb371b util-linux-2.13-0.45.el5_1.1.i386.rpm e676773f8a6b7924b27e305ee61c4507 util-linux-debuginfo-2.13-0.45.el5_1.1.i386.rpm x86_64: 538da8fbecb1c218cbc91b25e64fe90a util-linux-2.13-0.45.el5_1.1.x86_64.rpm 1782480e7964512bec20cc79d601b440 util-linux-debuginfo-2.13-0.45.el5_1.1.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/util-linux-2.13-0.45.el5_1.1.src.rpm a05c05b42aa2e25741a1f456c4277fc1 util-linux-2.13-0.45.el5_1.1.src.rpm i386: 3ca3123bb60a84d87d3b388ea3fb371b util-linux-2.13-0.45.el5_1.1.i386.rpm e676773f8a6b7924b27e305ee61c4507 util-linux-debuginfo-2.13-0.45.el5_1.1.i386.rpm ia64: f296fb66f3ad252cf2fdbf89ea48a130 util-linux-2.13-0.45.el5_1.1.ia64.rpm df8c46f3cfe02b197c74da4cb986895a util-linux-debuginfo-2.13-0.45.el5_1.1.ia64.rpm ppc: 037c563ef84fc50cbfcfcca5901d24c4 util-linux-2.13-0.45.el5_1.1.ppc.rpm d6990f8c5b7006d6fd2977dda2a6015c util-linux-debuginfo-2.13-0.45.el5_1.1.ppc.rpm s390x: eb59f687c6d8cea4ae281ba6d24698e5 util-linux-2.13-0.45.el5_1.1.s390x.rpm db9d2c2267d4c8c27237b3b418cacc5a util-linux-debuginfo-2.13-0.45.el5_1.1.s390x.rpm x86_64: 538da8fbecb1c218cbc91b25e64fe90a util-linux-2.13-0.45.el5_1.1.x86_64.rpm 1782480e7964512bec20cc79d601b440 util-linux-debuginfo-2.13-0.45.el5_1.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5191 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHPG+gXlSAg2UNWIIRAqCGAJ9J6lg21c1D9516Gu+N/koyKuIl2gCfQHr0 i/Y6WsmLn3bPWKeXs51JMng= =dtzy -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 15 16:11:39 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 15 Nov 2007 11:11:39 -0500 Subject: [RHSA-2007:1013-01] Critical: samba security update Message-ID: <200711151611.lAFGBdeb015563@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Critical: samba security update Advisory ID: RHSA-2007:1013-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1013.html Issue date: 2007-11-15 Updated on: 2007-11-15 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-4572 CVE-2007-5398 - --------------------------------------------------------------------- 1. Summary: Updated samba packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having critical security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 3. Problem description: Samba is a suite of programs used by machines to share files, printers, and other information. A buffer overflow flaw was found in the way Samba creates NetBIOS replies. If a Samba server is configured to run as a WINS server, a remote unauthenticated user could cause the Samba server to crash or execute arbitrary code. (CVE-2007-5398) A heap-based buffer overflow flaw was found in the way Samba authenticates users. A remote unauthenticated user could trigger this flaw to cause the Samba server to crash. Careful analysis of this flaw has determined that arbitrary code execution is not possible, and under most circumstances will not result in a crash of the Samba server. (CVE-2007-4572) Red Hat would like to thank Alin Rad Pop of Secunia Research, and the Samba developers for responsibly disclosing these issues. Users of Samba are advised to ugprade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 294631 - CVE-2007-4572 samba buffer overflow 358831 - CVE-2007-5398 Samba "reply_netbios_packet()" Buffer Overflow Vulnerability 6. RPMs required: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 : SRPMS: ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/samba-2.2.12-1.21as.8.1.src.rpm c256e2c91c123f1832f52acd841c723e samba-2.2.12-1.21as.8.1.src.rpm i386: 3668a9e0f562d8f90cc663a0d4947511 samba-2.2.12-1.21as.8.1.i386.rpm 7ad1f876f07f3350ed11e08cd2dfd048 samba-client-2.2.12-1.21as.8.1.i386.rpm b9b6703ad46f5e07a2c353c4f3213bbd samba-common-2.2.12-1.21as.8.1.i386.rpm 1b096bad8e57d2f8312d8b5481693594 samba-swat-2.2.12-1.21as.8.1.i386.rpm ia64: a63a1829e8d3585e0f9598cbb585ff95 samba-2.2.12-1.21as.8.1.ia64.rpm 139643a501d501a38a9841537bbff295 samba-client-2.2.12-1.21as.8.1.ia64.rpm ed8b98dbb27211c6f40e0d91726082fa samba-common-2.2.12-1.21as.8.1.ia64.rpm 4f070a66e6afd76da95e0c7c7a9b1251 samba-swat-2.2.12-1.21as.8.1.ia64.rpm Red Hat Linux Advanced Workstation 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/samba-2.2.12-1.21as.8.1.src.rpm c256e2c91c123f1832f52acd841c723e samba-2.2.12-1.21as.8.1.src.rpm ia64: a63a1829e8d3585e0f9598cbb585ff95 samba-2.2.12-1.21as.8.1.ia64.rpm 139643a501d501a38a9841537bbff295 samba-client-2.2.12-1.21as.8.1.ia64.rpm ed8b98dbb27211c6f40e0d91726082fa samba-common-2.2.12-1.21as.8.1.ia64.rpm 4f070a66e6afd76da95e0c7c7a9b1251 samba-swat-2.2.12-1.21as.8.1.ia64.rpm Red Hat Enterprise Linux ES version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/samba-2.2.12-1.21as.8.1.src.rpm c256e2c91c123f1832f52acd841c723e samba-2.2.12-1.21as.8.1.src.rpm i386: 3668a9e0f562d8f90cc663a0d4947511 samba-2.2.12-1.21as.8.1.i386.rpm 7ad1f876f07f3350ed11e08cd2dfd048 samba-client-2.2.12-1.21as.8.1.i386.rpm b9b6703ad46f5e07a2c353c4f3213bbd samba-common-2.2.12-1.21as.8.1.i386.rpm 1b096bad8e57d2f8312d8b5481693594 samba-swat-2.2.12-1.21as.8.1.i386.rpm Red Hat Enterprise Linux WS version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/samba-2.2.12-1.21as.8.1.src.rpm c256e2c91c123f1832f52acd841c723e samba-2.2.12-1.21as.8.1.src.rpm i386: 3668a9e0f562d8f90cc663a0d4947511 samba-2.2.12-1.21as.8.1.i386.rpm 7ad1f876f07f3350ed11e08cd2dfd048 samba-client-2.2.12-1.21as.8.1.i386.rpm b9b6703ad46f5e07a2c353c4f3213bbd samba-common-2.2.12-1.21as.8.1.i386.rpm 1b096bad8e57d2f8312d8b5481693594 samba-swat-2.2.12-1.21as.8.1.i386.rpm Red Hat Enterprise Linux AS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/samba-3.0.9-1.3E.14.1.src.rpm 109ff11f7bae2ea32001733dfcb494a4 samba-3.0.9-1.3E.14.1.src.rpm i386: 4de0c6d2dae246e46a56db2cec7b64de samba-3.0.9-1.3E.14.1.i386.rpm bfb5a0569b61135deb3f9364fa36da1b samba-client-3.0.9-1.3E.14.1.i386.rpm e7b6b04bdf7d0051d2c49272c155fd08 samba-common-3.0.9-1.3E.14.1.i386.rpm f37ccac147eed9566c04e0b4a21b7531 samba-debuginfo-3.0.9-1.3E.14.1.i386.rpm ae11744aa2d5e3acb6005049376645d1 samba-swat-3.0.9-1.3E.14.1.i386.rpm ia64: 4de0c6d2dae246e46a56db2cec7b64de samba-3.0.9-1.3E.14.1.i386.rpm e199d3394b047493501054854becba95 samba-3.0.9-1.3E.14.1.ia64.rpm 7683498f19d4dc2457c94c2b2c383c5c samba-client-3.0.9-1.3E.14.1.ia64.rpm e7b6b04bdf7d0051d2c49272c155fd08 samba-common-3.0.9-1.3E.14.1.i386.rpm 072b014b104dd5c3e47cb7ff95f49c19 samba-common-3.0.9-1.3E.14.1.ia64.rpm f37ccac147eed9566c04e0b4a21b7531 samba-debuginfo-3.0.9-1.3E.14.1.i386.rpm dcefead38a15b5045623c062b62f93cb samba-debuginfo-3.0.9-1.3E.14.1.ia64.rpm 90d018a6319715a6ebaa8ec589d6a5ed samba-swat-3.0.9-1.3E.14.1.ia64.rpm ppc: 2d19e0c0dd38a67a58f7554ed1813960 samba-3.0.9-1.3E.14.1.ppc.rpm 7220d706da598f65fb2034c59436ca39 samba-3.0.9-1.3E.14.1.ppc64.rpm e0b4f4c3d2b1a0110e4cd854ee4b5d63 samba-client-3.0.9-1.3E.14.1.ppc.rpm bb761b0be35251a3271fe517485b73fc samba-common-3.0.9-1.3E.14.1.ppc.rpm fa3ebbb6aff8c03433d314fdf7907eda samba-common-3.0.9-1.3E.14.1.ppc64.rpm 040a878f51d0628cc81fc509f8241b61 samba-debuginfo-3.0.9-1.3E.14.1.ppc.rpm 94e7a01b31e73b9779df25a97b8b8588 samba-debuginfo-3.0.9-1.3E.14.1.ppc64.rpm ea9388a3ef700197148af7217cab23e7 samba-swat-3.0.9-1.3E.14.1.ppc.rpm s390: 442c0489b0b6e47c30d29920d86ad1c6 samba-3.0.9-1.3E.14.1.s390.rpm 8fd814d9aaf60d506c00458f046e135f samba-client-3.0.9-1.3E.14.1.s390.rpm ad59ab1c42546e3713d8e2fa06ca5dcf samba-common-3.0.9-1.3E.14.1.s390.rpm ddd8aac31875f86285765f449464b9b6 samba-debuginfo-3.0.9-1.3E.14.1.s390.rpm ff6c34142632863ceeba2b51ee6ab63d samba-swat-3.0.9-1.3E.14.1.s390.rpm s390x: 442c0489b0b6e47c30d29920d86ad1c6 samba-3.0.9-1.3E.14.1.s390.rpm 4631bddcfdea1831b9e710788663b2f3 samba-3.0.9-1.3E.14.1.s390x.rpm 4ed24e0dc5a06239b696b7ca3f0299af samba-client-3.0.9-1.3E.14.1.s390x.rpm ad59ab1c42546e3713d8e2fa06ca5dcf samba-common-3.0.9-1.3E.14.1.s390.rpm 4e802689c31db058065f7899f2fcc0c9 samba-common-3.0.9-1.3E.14.1.s390x.rpm ddd8aac31875f86285765f449464b9b6 samba-debuginfo-3.0.9-1.3E.14.1.s390.rpm efbf689c8e0baae4a2c4bc6f9be95e69 samba-debuginfo-3.0.9-1.3E.14.1.s390x.rpm 1314e87a446697fe5b76a621b5cfff58 samba-swat-3.0.9-1.3E.14.1.s390x.rpm x86_64: 4de0c6d2dae246e46a56db2cec7b64de samba-3.0.9-1.3E.14.1.i386.rpm 27c811b470b7350b3139448d74f2de27 samba-3.0.9-1.3E.14.1.x86_64.rpm 63cc1e310310586bbeff693cd5353a49 samba-client-3.0.9-1.3E.14.1.x86_64.rpm e7b6b04bdf7d0051d2c49272c155fd08 samba-common-3.0.9-1.3E.14.1.i386.rpm 689ce45d04eba3215f144691815ab8bb samba-common-3.0.9-1.3E.14.1.x86_64.rpm f37ccac147eed9566c04e0b4a21b7531 samba-debuginfo-3.0.9-1.3E.14.1.i386.rpm f18185d69a5ba27b86fa99f2d20d0048 samba-debuginfo-3.0.9-1.3E.14.1.x86_64.rpm 984deb53f02277f5cb4e7aac5c44ea0a samba-swat-3.0.9-1.3E.14.1.x86_64.rpm Red Hat Desktop version 3: SRPMS: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/samba-3.0.9-1.3E.14.1.src.rpm 109ff11f7bae2ea32001733dfcb494a4 samba-3.0.9-1.3E.14.1.src.rpm i386: 4de0c6d2dae246e46a56db2cec7b64de samba-3.0.9-1.3E.14.1.i386.rpm bfb5a0569b61135deb3f9364fa36da1b samba-client-3.0.9-1.3E.14.1.i386.rpm e7b6b04bdf7d0051d2c49272c155fd08 samba-common-3.0.9-1.3E.14.1.i386.rpm f37ccac147eed9566c04e0b4a21b7531 samba-debuginfo-3.0.9-1.3E.14.1.i386.rpm ae11744aa2d5e3acb6005049376645d1 samba-swat-3.0.9-1.3E.14.1.i386.rpm x86_64: 4de0c6d2dae246e46a56db2cec7b64de samba-3.0.9-1.3E.14.1.i386.rpm 27c811b470b7350b3139448d74f2de27 samba-3.0.9-1.3E.14.1.x86_64.rpm 63cc1e310310586bbeff693cd5353a49 samba-client-3.0.9-1.3E.14.1.x86_64.rpm e7b6b04bdf7d0051d2c49272c155fd08 samba-common-3.0.9-1.3E.14.1.i386.rpm 689ce45d04eba3215f144691815ab8bb samba-common-3.0.9-1.3E.14.1.x86_64.rpm f37ccac147eed9566c04e0b4a21b7531 samba-debuginfo-3.0.9-1.3E.14.1.i386.rpm f18185d69a5ba27b86fa99f2d20d0048 samba-debuginfo-3.0.9-1.3E.14.1.x86_64.rpm 984deb53f02277f5cb4e7aac5c44ea0a samba-swat-3.0.9-1.3E.14.1.x86_64.rpm Red Hat Enterprise Linux ES version 3: SRPMS: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/samba-3.0.9-1.3E.14.1.src.rpm 109ff11f7bae2ea32001733dfcb494a4 samba-3.0.9-1.3E.14.1.src.rpm i386: 4de0c6d2dae246e46a56db2cec7b64de samba-3.0.9-1.3E.14.1.i386.rpm bfb5a0569b61135deb3f9364fa36da1b samba-client-3.0.9-1.3E.14.1.i386.rpm e7b6b04bdf7d0051d2c49272c155fd08 samba-common-3.0.9-1.3E.14.1.i386.rpm f37ccac147eed9566c04e0b4a21b7531 samba-debuginfo-3.0.9-1.3E.14.1.i386.rpm ae11744aa2d5e3acb6005049376645d1 samba-swat-3.0.9-1.3E.14.1.i386.rpm ia64: 4de0c6d2dae246e46a56db2cec7b64de samba-3.0.9-1.3E.14.1.i386.rpm e199d3394b047493501054854becba95 samba-3.0.9-1.3E.14.1.ia64.rpm 7683498f19d4dc2457c94c2b2c383c5c samba-client-3.0.9-1.3E.14.1.ia64.rpm e7b6b04bdf7d0051d2c49272c155fd08 samba-common-3.0.9-1.3E.14.1.i386.rpm 072b014b104dd5c3e47cb7ff95f49c19 samba-common-3.0.9-1.3E.14.1.ia64.rpm f37ccac147eed9566c04e0b4a21b7531 samba-debuginfo-3.0.9-1.3E.14.1.i386.rpm dcefead38a15b5045623c062b62f93cb samba-debuginfo-3.0.9-1.3E.14.1.ia64.rpm 90d018a6319715a6ebaa8ec589d6a5ed samba-swat-3.0.9-1.3E.14.1.ia64.rpm x86_64: 4de0c6d2dae246e46a56db2cec7b64de samba-3.0.9-1.3E.14.1.i386.rpm 27c811b470b7350b3139448d74f2de27 samba-3.0.9-1.3E.14.1.x86_64.rpm 63cc1e310310586bbeff693cd5353a49 samba-client-3.0.9-1.3E.14.1.x86_64.rpm e7b6b04bdf7d0051d2c49272c155fd08 samba-common-3.0.9-1.3E.14.1.i386.rpm 689ce45d04eba3215f144691815ab8bb samba-common-3.0.9-1.3E.14.1.x86_64.rpm f37ccac147eed9566c04e0b4a21b7531 samba-debuginfo-3.0.9-1.3E.14.1.i386.rpm f18185d69a5ba27b86fa99f2d20d0048 samba-debuginfo-3.0.9-1.3E.14.1.x86_64.rpm 984deb53f02277f5cb4e7aac5c44ea0a samba-swat-3.0.9-1.3E.14.1.x86_64.rpm Red Hat Enterprise Linux WS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/samba-3.0.9-1.3E.14.1.src.rpm 109ff11f7bae2ea32001733dfcb494a4 samba-3.0.9-1.3E.14.1.src.rpm i386: 4de0c6d2dae246e46a56db2cec7b64de samba-3.0.9-1.3E.14.1.i386.rpm bfb5a0569b61135deb3f9364fa36da1b samba-client-3.0.9-1.3E.14.1.i386.rpm e7b6b04bdf7d0051d2c49272c155fd08 samba-common-3.0.9-1.3E.14.1.i386.rpm f37ccac147eed9566c04e0b4a21b7531 samba-debuginfo-3.0.9-1.3E.14.1.i386.rpm ae11744aa2d5e3acb6005049376645d1 samba-swat-3.0.9-1.3E.14.1.i386.rpm ia64: 4de0c6d2dae246e46a56db2cec7b64de samba-3.0.9-1.3E.14.1.i386.rpm e199d3394b047493501054854becba95 samba-3.0.9-1.3E.14.1.ia64.rpm 7683498f19d4dc2457c94c2b2c383c5c samba-client-3.0.9-1.3E.14.1.ia64.rpm e7b6b04bdf7d0051d2c49272c155fd08 samba-common-3.0.9-1.3E.14.1.i386.rpm 072b014b104dd5c3e47cb7ff95f49c19 samba-common-3.0.9-1.3E.14.1.ia64.rpm f37ccac147eed9566c04e0b4a21b7531 samba-debuginfo-3.0.9-1.3E.14.1.i386.rpm dcefead38a15b5045623c062b62f93cb samba-debuginfo-3.0.9-1.3E.14.1.ia64.rpm 90d018a6319715a6ebaa8ec589d6a5ed samba-swat-3.0.9-1.3E.14.1.ia64.rpm x86_64: 4de0c6d2dae246e46a56db2cec7b64de samba-3.0.9-1.3E.14.1.i386.rpm 27c811b470b7350b3139448d74f2de27 samba-3.0.9-1.3E.14.1.x86_64.rpm 63cc1e310310586bbeff693cd5353a49 samba-client-3.0.9-1.3E.14.1.x86_64.rpm e7b6b04bdf7d0051d2c49272c155fd08 samba-common-3.0.9-1.3E.14.1.i386.rpm 689ce45d04eba3215f144691815ab8bb samba-common-3.0.9-1.3E.14.1.x86_64.rpm f37ccac147eed9566c04e0b4a21b7531 samba-debuginfo-3.0.9-1.3E.14.1.i386.rpm f18185d69a5ba27b86fa99f2d20d0048 samba-debuginfo-3.0.9-1.3E.14.1.x86_64.rpm 984deb53f02277f5cb4e7aac5c44ea0a samba-swat-3.0.9-1.3E.14.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4572 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5398 http://www.redhat.com/security/updates/classification/#critical 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHPG+4XlSAg2UNWIIRAvxRAKCrLhjl9hQXPHYUx6xLAV4efn989wCeIijT UEIPfmbRDbmuorXM4r2USao= =3dsq -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 15 16:25:49 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 15 Nov 2007 11:25:49 -0500 Subject: [RHSA-2007:1016-01] Critical: samba security update Message-ID: <200711151625.lAFGPnL2019069@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Critical: samba security update Advisory ID: RHSA-2007:1016-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1016.html Issue date: 2007-11-15 Updated on: 2007-11-15 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-4572 CVE-2007-4138 CVE-2007-5398 - --------------------------------------------------------------------- 1. Summary: Updated samba packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: Samba is a suite of programs used by machines to share files, printers, and other information. A buffer overflow flaw was found in the way Samba creates NetBIOS replies. If a Samba server is configured to run as a WINS server, a remote unauthenticated user could cause the Samba server to crash or execute arbitrary code. (CVE-2007-5398) A heap-based buffer overflow flaw was found in the way Samba authenticates users. A remote unauthenticated user could trigger this flaw to cause the Samba server to crash. Careful analysis of this flaw has determined that arbitrary code execution is not possible, and under most circumstances will not result in a crash of the Samba server. (CVE-2007-4572) A flaw was found in the way Samba assigned group IDs under certain conditions. If the "winbind nss info" parameter in smb.conf is set to either "sfu" or "rfc2307", Samba users are incorrectly assigned the group ID of 0. (CVE-2007-4138) Red Hat would like to thank Alin Rad Pop of Secunia Research, Rick King, and the Samba developers for responsibly disclosing these issues. All Samba users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 286271 - CVE-2007-4138 samba incorrect primary group assignment for domain users using the rfc2307 or sfu winbind nss info plugin 294631 - CVE-2007-4572 samba buffer overflow 358831 - CVE-2007-5398 Samba "reply_netbios_packet()" Buffer Overflow Vulnerability 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/samba-3.0.25b-1.el4_6.2.src.rpm ff91ab4fccfce54bcdbdce280a86ffb8 samba-3.0.25b-1.el4_6.2.src.rpm i386: 4216ae32c49cb1fc295793c7a5c2d988 samba-3.0.25b-1.el4_6.2.i386.rpm a8c97c2b627a84bf5d128ea8210fd9ea samba-client-3.0.25b-1.el4_6.2.i386.rpm 4afd587d8a1d2283834597627ae3a5bb samba-common-3.0.25b-1.el4_6.2.i386.rpm 31bd306cec8360b27ffef6a40cf51e7f samba-debuginfo-3.0.25b-1.el4_6.2.i386.rpm 7c64cf3d7adb64abdd767ef5b2661f59 samba-swat-3.0.25b-1.el4_6.2.i386.rpm ia64: 7cdad59ef473db7055e028cee445e9d0 samba-3.0.25b-1.el4_6.2.ia64.rpm 18b89b1efbfe7c6baa1510a4d2e79e92 samba-client-3.0.25b-1.el4_6.2.ia64.rpm 4afd587d8a1d2283834597627ae3a5bb samba-common-3.0.25b-1.el4_6.2.i386.rpm b1724aed7110c7d8b1210f4dcaa7bf27 samba-common-3.0.25b-1.el4_6.2.ia64.rpm 31bd306cec8360b27ffef6a40cf51e7f samba-debuginfo-3.0.25b-1.el4_6.2.i386.rpm a9a97c765005aa7b756fbc271f9195e0 samba-debuginfo-3.0.25b-1.el4_6.2.ia64.rpm 3bb4435264e5bbb86ce99fe82010b4b0 samba-swat-3.0.25b-1.el4_6.2.ia64.rpm ppc: ec4d93c74e2740c293545b04d5a3492c samba-3.0.25b-1.el4_6.2.ppc.rpm 5d00edd7648100a3646aad3f43a83f8d samba-client-3.0.25b-1.el4_6.2.ppc.rpm 95d55e7d9e12e3a12731c1cbaafe0461 samba-common-3.0.25b-1.el4_6.2.ppc.rpm ebedc087ac45ca25f4de994cd5c72332 samba-common-3.0.25b-1.el4_6.2.ppc64.rpm 58c79eced8b8796b05391f0ed2eca937 samba-debuginfo-3.0.25b-1.el4_6.2.ppc.rpm 402476d354c9a3ba7f9085abfd76ebf4 samba-debuginfo-3.0.25b-1.el4_6.2.ppc64.rpm c3f9af4c6c081d655802fbfc4620a388 samba-swat-3.0.25b-1.el4_6.2.ppc.rpm s390: 492d04550073c30a0fdd00c9ef692ec7 samba-3.0.25b-1.el4_6.2.s390.rpm 1dad6fee42fea753838f56a84a4c9cde samba-client-3.0.25b-1.el4_6.2.s390.rpm b0c8633218688eb3a0f8867a067d0b93 samba-common-3.0.25b-1.el4_6.2.s390.rpm 73f5ac67f0c97a47d150768af0a52a66 samba-debuginfo-3.0.25b-1.el4_6.2.s390.rpm 0e71566da615b9c2a16964e80bf5539f samba-swat-3.0.25b-1.el4_6.2.s390.rpm s390x: 70a1b475ca0b9e55f026f6fa6474b0eb samba-3.0.25b-1.el4_6.2.s390x.rpm 3de9cc76f1a6ce318fbb6fd271de7445 samba-client-3.0.25b-1.el4_6.2.s390x.rpm b0c8633218688eb3a0f8867a067d0b93 samba-common-3.0.25b-1.el4_6.2.s390.rpm c6d811a8a5393dc66fc40dd0e6303995 samba-common-3.0.25b-1.el4_6.2.s390x.rpm 73f5ac67f0c97a47d150768af0a52a66 samba-debuginfo-3.0.25b-1.el4_6.2.s390.rpm 2d9034a0e0f1004afc1b1d4c78488dad samba-debuginfo-3.0.25b-1.el4_6.2.s390x.rpm efc2ab206d72a473f560a15cfc22a0c2 samba-swat-3.0.25b-1.el4_6.2.s390x.rpm x86_64: 23c8d08613b43016da4ed487be1d4634 samba-3.0.25b-1.el4_6.2.x86_64.rpm 434546ba4e5f0f821f01e3388f6676de samba-client-3.0.25b-1.el4_6.2.x86_64.rpm 4afd587d8a1d2283834597627ae3a5bb samba-common-3.0.25b-1.el4_6.2.i386.rpm ce2caf512315daeb433147ba23878dfb samba-common-3.0.25b-1.el4_6.2.x86_64.rpm 31bd306cec8360b27ffef6a40cf51e7f samba-debuginfo-3.0.25b-1.el4_6.2.i386.rpm e8185573524a937476c5e40c86330155 samba-debuginfo-3.0.25b-1.el4_6.2.x86_64.rpm 463be2d8eec8004dee74d3dbbd5828d3 samba-swat-3.0.25b-1.el4_6.2.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/samba-3.0.25b-1.el4_6.2.src.rpm ff91ab4fccfce54bcdbdce280a86ffb8 samba-3.0.25b-1.el4_6.2.src.rpm i386: 4216ae32c49cb1fc295793c7a5c2d988 samba-3.0.25b-1.el4_6.2.i386.rpm a8c97c2b627a84bf5d128ea8210fd9ea samba-client-3.0.25b-1.el4_6.2.i386.rpm 4afd587d8a1d2283834597627ae3a5bb samba-common-3.0.25b-1.el4_6.2.i386.rpm 31bd306cec8360b27ffef6a40cf51e7f samba-debuginfo-3.0.25b-1.el4_6.2.i386.rpm 7c64cf3d7adb64abdd767ef5b2661f59 samba-swat-3.0.25b-1.el4_6.2.i386.rpm x86_64: 23c8d08613b43016da4ed487be1d4634 samba-3.0.25b-1.el4_6.2.x86_64.rpm 434546ba4e5f0f821f01e3388f6676de samba-client-3.0.25b-1.el4_6.2.x86_64.rpm 4afd587d8a1d2283834597627ae3a5bb samba-common-3.0.25b-1.el4_6.2.i386.rpm ce2caf512315daeb433147ba23878dfb samba-common-3.0.25b-1.el4_6.2.x86_64.rpm 31bd306cec8360b27ffef6a40cf51e7f samba-debuginfo-3.0.25b-1.el4_6.2.i386.rpm e8185573524a937476c5e40c86330155 samba-debuginfo-3.0.25b-1.el4_6.2.x86_64.rpm 463be2d8eec8004dee74d3dbbd5828d3 samba-swat-3.0.25b-1.el4_6.2.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/samba-3.0.25b-1.el4_6.2.src.rpm ff91ab4fccfce54bcdbdce280a86ffb8 samba-3.0.25b-1.el4_6.2.src.rpm i386: 4216ae32c49cb1fc295793c7a5c2d988 samba-3.0.25b-1.el4_6.2.i386.rpm a8c97c2b627a84bf5d128ea8210fd9ea samba-client-3.0.25b-1.el4_6.2.i386.rpm 4afd587d8a1d2283834597627ae3a5bb samba-common-3.0.25b-1.el4_6.2.i386.rpm 31bd306cec8360b27ffef6a40cf51e7f samba-debuginfo-3.0.25b-1.el4_6.2.i386.rpm 7c64cf3d7adb64abdd767ef5b2661f59 samba-swat-3.0.25b-1.el4_6.2.i386.rpm ia64: 7cdad59ef473db7055e028cee445e9d0 samba-3.0.25b-1.el4_6.2.ia64.rpm 18b89b1efbfe7c6baa1510a4d2e79e92 samba-client-3.0.25b-1.el4_6.2.ia64.rpm 4afd587d8a1d2283834597627ae3a5bb samba-common-3.0.25b-1.el4_6.2.i386.rpm b1724aed7110c7d8b1210f4dcaa7bf27 samba-common-3.0.25b-1.el4_6.2.ia64.rpm 31bd306cec8360b27ffef6a40cf51e7f samba-debuginfo-3.0.25b-1.el4_6.2.i386.rpm a9a97c765005aa7b756fbc271f9195e0 samba-debuginfo-3.0.25b-1.el4_6.2.ia64.rpm 3bb4435264e5bbb86ce99fe82010b4b0 samba-swat-3.0.25b-1.el4_6.2.ia64.rpm x86_64: 23c8d08613b43016da4ed487be1d4634 samba-3.0.25b-1.el4_6.2.x86_64.rpm 434546ba4e5f0f821f01e3388f6676de samba-client-3.0.25b-1.el4_6.2.x86_64.rpm 4afd587d8a1d2283834597627ae3a5bb samba-common-3.0.25b-1.el4_6.2.i386.rpm ce2caf512315daeb433147ba23878dfb samba-common-3.0.25b-1.el4_6.2.x86_64.rpm 31bd306cec8360b27ffef6a40cf51e7f samba-debuginfo-3.0.25b-1.el4_6.2.i386.rpm e8185573524a937476c5e40c86330155 samba-debuginfo-3.0.25b-1.el4_6.2.x86_64.rpm 463be2d8eec8004dee74d3dbbd5828d3 samba-swat-3.0.25b-1.el4_6.2.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/samba-3.0.25b-1.el4_6.2.src.rpm ff91ab4fccfce54bcdbdce280a86ffb8 samba-3.0.25b-1.el4_6.2.src.rpm i386: 4216ae32c49cb1fc295793c7a5c2d988 samba-3.0.25b-1.el4_6.2.i386.rpm a8c97c2b627a84bf5d128ea8210fd9ea samba-client-3.0.25b-1.el4_6.2.i386.rpm 4afd587d8a1d2283834597627ae3a5bb samba-common-3.0.25b-1.el4_6.2.i386.rpm 31bd306cec8360b27ffef6a40cf51e7f samba-debuginfo-3.0.25b-1.el4_6.2.i386.rpm 7c64cf3d7adb64abdd767ef5b2661f59 samba-swat-3.0.25b-1.el4_6.2.i386.rpm ia64: 7cdad59ef473db7055e028cee445e9d0 samba-3.0.25b-1.el4_6.2.ia64.rpm 18b89b1efbfe7c6baa1510a4d2e79e92 samba-client-3.0.25b-1.el4_6.2.ia64.rpm 4afd587d8a1d2283834597627ae3a5bb samba-common-3.0.25b-1.el4_6.2.i386.rpm b1724aed7110c7d8b1210f4dcaa7bf27 samba-common-3.0.25b-1.el4_6.2.ia64.rpm 31bd306cec8360b27ffef6a40cf51e7f samba-debuginfo-3.0.25b-1.el4_6.2.i386.rpm a9a97c765005aa7b756fbc271f9195e0 samba-debuginfo-3.0.25b-1.el4_6.2.ia64.rpm 3bb4435264e5bbb86ce99fe82010b4b0 samba-swat-3.0.25b-1.el4_6.2.ia64.rpm x86_64: 23c8d08613b43016da4ed487be1d4634 samba-3.0.25b-1.el4_6.2.x86_64.rpm 434546ba4e5f0f821f01e3388f6676de samba-client-3.0.25b-1.el4_6.2.x86_64.rpm 4afd587d8a1d2283834597627ae3a5bb samba-common-3.0.25b-1.el4_6.2.i386.rpm ce2caf512315daeb433147ba23878dfb samba-common-3.0.25b-1.el4_6.2.x86_64.rpm 31bd306cec8360b27ffef6a40cf51e7f samba-debuginfo-3.0.25b-1.el4_6.2.i386.rpm e8185573524a937476c5e40c86330155 samba-debuginfo-3.0.25b-1.el4_6.2.x86_64.rpm 463be2d8eec8004dee74d3dbbd5828d3 samba-swat-3.0.25b-1.el4_6.2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4572 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4138 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5398 http://www.redhat.com/security/updates/classification/#critical 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHPHMKXlSAg2UNWIIRAk2QAKCvtZJe8l/YZoPKe6cAH5yyK4DSpQCgvnDP /gXuNccDuVZfEqeUV2zrmqo= =yRgt -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 15 16:30:27 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 15 Nov 2007 11:30:27 -0500 Subject: [RHSA-2007:1017-01] Critical: samba security update Message-ID: <200711151630.lAFGURtR020038@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Critical: samba security update Advisory ID: RHSA-2007:1017-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1017.html Issue date: 2007-11-15 Updated on: 2007-11-15 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-4572 CVE-2007-4138 CVE-2007-5398 - --------------------------------------------------------------------- 1. Summary: Updated samba packages that fix security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: Samba is a suite of programs used by machines to share files, printers, and other information. A buffer overflow flaw was found in the way Samba creates NetBIOS replies. If a Samba server is configured to run as a WINS server, a remote unauthenticated user could cause the Samba server to crash or execute arbitrary code. (CVE-2007-5398) A heap based buffer overflow flaw was found in the way Samba authenticates users. A remote unauthenticated user could trigger this flaw to cause the Samba server to crash. Careful analysis of this flaw has determined that arbitrary code execution is not possible, and under most circumstances will not result in a crash of the Samba server. (CVE-2007-4572) A flaw was found in the way Samba assigned group IDs under certain conditions. If the "winbind nss info" parameter in smb.conf is set to either "sfu" or "rfc2307", Samba users are incorrectly assigned the group ID of 0. (CVE-2007-4138) Red Hat would like to thank Alin Rad Pop of Secunia Research, Rick King, and the Samba developers for responsibly disclosing these issues. All Samba users are advised to upgrade to these updated packages, which contain a backported patch to correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To do so, run the following command (as root): pup Alternatively, for a command-line interface, run the following command: yum update To register your system to RHN, use the following command: rhn_register For information on how to manually install or remove packages, refer to the following link: http://kbase.redhat.com/faq/FAQ_80_11223.shtm 5. Bug IDs fixed (http://bugzilla.redhat.com/): 286271 - CVE-2007-4138 samba incorrect primary group assignment for domain users using the rfc2307 or sfu winbind nss info plugin 294631 - CVE-2007-4572 samba buffer overflow 358831 - CVE-2007-5398 Samba "reply_netbios_packet()" Buffer Overflow Vulnerability 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/samba-3.0.25b-1.el5_1.2.src.rpm a614dd8ab1961b7c8a92a170f9bb0036 samba-3.0.25b-1.el5_1.2.src.rpm i386: f582807333fffc7cfda3f048ad61497a samba-3.0.25b-1.el5_1.2.i386.rpm c0c45a2fb546b2c2dd4274a3a88fa234 samba-client-3.0.25b-1.el5_1.2.i386.rpm 56b33f69aebac9bd6654a0ab6ba1a03e samba-common-3.0.25b-1.el5_1.2.i386.rpm 51e6fd0037e1ae54d8842436002da8c4 samba-debuginfo-3.0.25b-1.el5_1.2.i386.rpm 5d32128d7fd5545a6684fd8e1e0055e0 samba-swat-3.0.25b-1.el5_1.2.i386.rpm x86_64: 2940397a447ae38809c5661e3c6e9e9f samba-3.0.25b-1.el5_1.2.x86_64.rpm 4bd8bf5a6d39844c291e67af9debef55 samba-client-3.0.25b-1.el5_1.2.x86_64.rpm 56b33f69aebac9bd6654a0ab6ba1a03e samba-common-3.0.25b-1.el5_1.2.i386.rpm bf460a8a6d2338be4bd83884ca5934a7 samba-common-3.0.25b-1.el5_1.2.x86_64.rpm 51e6fd0037e1ae54d8842436002da8c4 samba-debuginfo-3.0.25b-1.el5_1.2.i386.rpm 053a2c84cf6353a6a8a79ea5e4e1feb7 samba-debuginfo-3.0.25b-1.el5_1.2.x86_64.rpm 7ffd3a287260c93478549f0bff913297 samba-swat-3.0.25b-1.el5_1.2.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/samba-3.0.25b-1.el5_1.2.src.rpm a614dd8ab1961b7c8a92a170f9bb0036 samba-3.0.25b-1.el5_1.2.src.rpm i386: f582807333fffc7cfda3f048ad61497a samba-3.0.25b-1.el5_1.2.i386.rpm c0c45a2fb546b2c2dd4274a3a88fa234 samba-client-3.0.25b-1.el5_1.2.i386.rpm 56b33f69aebac9bd6654a0ab6ba1a03e samba-common-3.0.25b-1.el5_1.2.i386.rpm 51e6fd0037e1ae54d8842436002da8c4 samba-debuginfo-3.0.25b-1.el5_1.2.i386.rpm 5d32128d7fd5545a6684fd8e1e0055e0 samba-swat-3.0.25b-1.el5_1.2.i386.rpm ia64: b5c0f25eb34772868f06587ef82f55fc samba-3.0.25b-1.el5_1.2.ia64.rpm 33c027d28143b365aa2be7f1e4bc157f samba-client-3.0.25b-1.el5_1.2.ia64.rpm 9026a5f1367f3f0bddbecdd9c6e40799 samba-common-3.0.25b-1.el5_1.2.ia64.rpm c70dd804f46dc812c719f1756e0ac14a samba-debuginfo-3.0.25b-1.el5_1.2.ia64.rpm e79f8e34a2c8e9f3f3f6b18d2e06aa69 samba-swat-3.0.25b-1.el5_1.2.ia64.rpm ppc: bd4ce92708ef4da5a2b2f6d3d7152e97 samba-3.0.25b-1.el5_1.2.ppc.rpm 94b414b78ff56c6f1b03dd60eb2763af samba-client-3.0.25b-1.el5_1.2.ppc.rpm b499aa2e2743c7599faa9966faa3ba01 samba-common-3.0.25b-1.el5_1.2.ppc.rpm 19b1d28cd1c92e24dc929c7fc077f7a2 samba-common-3.0.25b-1.el5_1.2.ppc64.rpm 0615bdb665e801307a286131ad817335 samba-debuginfo-3.0.25b-1.el5_1.2.ppc.rpm 6f394dbea521283a6694a741f3643f85 samba-debuginfo-3.0.25b-1.el5_1.2.ppc64.rpm 0b83aa72e83102bde6ee6ab6f1b64c5e samba-swat-3.0.25b-1.el5_1.2.ppc.rpm s390x: fc14df09d7e01a24901161d5579545ed samba-3.0.25b-1.el5_1.2.s390x.rpm d667ac073503416baabae3c862e87eb3 samba-client-3.0.25b-1.el5_1.2.s390x.rpm 352f6a60a34508f56884f762d6ad3193 samba-common-3.0.25b-1.el5_1.2.s390.rpm de3cb0008e9801aa7c7f8d7de7fbd6e2 samba-common-3.0.25b-1.el5_1.2.s390x.rpm 0c04d0efff05111233283ee13115bac5 samba-debuginfo-3.0.25b-1.el5_1.2.s390.rpm e2390cd50eaa87d4509a9711c1c392de samba-debuginfo-3.0.25b-1.el5_1.2.s390x.rpm cc836ca1eaf90d2afe6a979d80d0b446 samba-swat-3.0.25b-1.el5_1.2.s390x.rpm x86_64: 2940397a447ae38809c5661e3c6e9e9f samba-3.0.25b-1.el5_1.2.x86_64.rpm 4bd8bf5a6d39844c291e67af9debef55 samba-client-3.0.25b-1.el5_1.2.x86_64.rpm 56b33f69aebac9bd6654a0ab6ba1a03e samba-common-3.0.25b-1.el5_1.2.i386.rpm bf460a8a6d2338be4bd83884ca5934a7 samba-common-3.0.25b-1.el5_1.2.x86_64.rpm 51e6fd0037e1ae54d8842436002da8c4 samba-debuginfo-3.0.25b-1.el5_1.2.i386.rpm 053a2c84cf6353a6a8a79ea5e4e1feb7 samba-debuginfo-3.0.25b-1.el5_1.2.x86_64.rpm 7ffd3a287260c93478549f0bff913297 samba-swat-3.0.25b-1.el5_1.2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4572 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4138 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5398 http://www.redhat.com/security/updates/classification/#critical 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHPHQdXlSAg2UNWIIRAv6aAKCQgvBVsSnZNSFTbl3PZxL/hQeCswCgl84/ pwzn75Ab59FjzAxlbJiWbHM= =WTjd -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 15 16:46:37 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 15 Nov 2007 11:46:37 -0500 Subject: [RHSA-2007:1038-01] Moderate: openldap security and enhancement update Message-ID: <200711151646.lAFGkb5c023020@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: openldap security and enhancement update Advisory ID: RHSA-2007:1038-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1038.html Issue date: 2007-11-15 Updated on: 2007-11-15 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-5707 - --------------------------------------------------------------------- 1. Summary: Updated openldap packages that fix a security flaw are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: OpenLDAP is an open source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools. A flaw was found in the way OpenLDAP's slapd daemon handled malformed objectClasses LDAP attributes. An authenticated local or remote attacker could create an LDAP request which could cause a denial of service by crashing slapd. (CVE-2007-5707) In addition, the following feature was added: * OpenLDAP client tools now have new option to configure their bind timeout. All users are advised to upgrade to these updated openldap packages, which contain a backported patch to correct this issue and provide this security enhancement. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 359851 - CVE-2007-5707 openldap slapd DoS via objectClasses attribute 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/openldap-2.2.13-8.el4_6.1.src.rpm d83f67fe727e11d6cf1160b024b1f9a2 openldap-2.2.13-8.el4_6.1.src.rpm i386: b2c433fe08be943cb34d7ae75d29f022 compat-openldap-2.1.30-8.el4_6.1.i386.rpm 6ddb8c954ba2f85aa11850541d09f2f1 openldap-2.2.13-8.el4_6.1.i386.rpm 219c613cf348abaaebc4c4f9f018ed9d openldap-clients-2.2.13-8.el4_6.1.i386.rpm 3a5d6b07337958bdfdf7528abcd0ffb2 openldap-debuginfo-2.2.13-8.el4_6.1.i386.rpm 7f40d96252d441fe7614a9beef25e0af openldap-devel-2.2.13-8.el4_6.1.i386.rpm 4c19ad7c8b3adc537463852e1eba0233 openldap-servers-2.2.13-8.el4_6.1.i386.rpm 66e950a723214043bbe5b214b6bae217 openldap-servers-sql-2.2.13-8.el4_6.1.i386.rpm ia64: b2c433fe08be943cb34d7ae75d29f022 compat-openldap-2.1.30-8.el4_6.1.i386.rpm 6b8aaa38dfbca517ebc8c2eeab072225 compat-openldap-2.1.30-8.el4_6.1.ia64.rpm 6ddb8c954ba2f85aa11850541d09f2f1 openldap-2.2.13-8.el4_6.1.i386.rpm e48a6a25b291ebe73a1e500a51d5752c openldap-2.2.13-8.el4_6.1.ia64.rpm 42ab2e4a1af25c108f86b231af51321d openldap-clients-2.2.13-8.el4_6.1.ia64.rpm 3a5d6b07337958bdfdf7528abcd0ffb2 openldap-debuginfo-2.2.13-8.el4_6.1.i386.rpm f016210f44503358b516cca1e9602042 openldap-debuginfo-2.2.13-8.el4_6.1.ia64.rpm ebdf2edb9e264227f5877905afef97ee openldap-devel-2.2.13-8.el4_6.1.ia64.rpm 817e4e1f9963c90506ec40817cb9a311 openldap-servers-2.2.13-8.el4_6.1.ia64.rpm 3a85b2d97f872c32929a36379b09ac65 openldap-servers-sql-2.2.13-8.el4_6.1.ia64.rpm ppc: 15008c36556193ddd7107d59f319f706 compat-openldap-2.1.30-8.el4_6.1.ppc.rpm 0934b07a1e5daef1715a5905fb3298ff compat-openldap-2.1.30-8.el4_6.1.ppc64.rpm 8ea26adb6a6c9c8d993f69d06e0c13b8 openldap-2.2.13-8.el4_6.1.ppc.rpm dc6666f0c29108215a50e3042ec3f1f6 openldap-2.2.13-8.el4_6.1.ppc64.rpm 63be6242af95535f973448e04be6001c openldap-clients-2.2.13-8.el4_6.1.ppc.rpm 7f3c6b841561748c440c9d5594ab10bb openldap-debuginfo-2.2.13-8.el4_6.1.ppc.rpm d70cd5cb7911fc0fef4c2ec82e450c11 openldap-debuginfo-2.2.13-8.el4_6.1.ppc64.rpm 62ed6b0c6972a93067b0ae7b5050fde1 openldap-devel-2.2.13-8.el4_6.1.ppc.rpm addded6b3675c6fbd1fff79de7c9fd7a openldap-servers-2.2.13-8.el4_6.1.ppc.rpm 86611366034b049e10e31120f23071ea openldap-servers-sql-2.2.13-8.el4_6.1.ppc.rpm s390: d10bae9f186810046b7c1f303d2b5275 compat-openldap-2.1.30-8.el4_6.1.s390.rpm f6a5eb8f946114440c247a61ff3d39ad openldap-2.2.13-8.el4_6.1.s390.rpm 19cd9d96abfaf4ae90c7c5c56d1963c5 openldap-clients-2.2.13-8.el4_6.1.s390.rpm 9e2f2f3537e2a78814cdbf681e4276c3 openldap-debuginfo-2.2.13-8.el4_6.1.s390.rpm 9cf8b1ccb6fcd9d15ff6bc204f06b4dc openldap-devel-2.2.13-8.el4_6.1.s390.rpm f25b8d09c7d36275569c1bd00d23d220 openldap-servers-2.2.13-8.el4_6.1.s390.rpm 349d84c877e0f870fa98e9830fc67454 openldap-servers-sql-2.2.13-8.el4_6.1.s390.rpm s390x: d10bae9f186810046b7c1f303d2b5275 compat-openldap-2.1.30-8.el4_6.1.s390.rpm 70801a51bef304886178af6806f9dbcb compat-openldap-2.1.30-8.el4_6.1.s390x.rpm f6a5eb8f946114440c247a61ff3d39ad openldap-2.2.13-8.el4_6.1.s390.rpm c7359a128c0d74e49a063578606bdaa8 openldap-2.2.13-8.el4_6.1.s390x.rpm f9b40d30955a1db4f70e6b2cce3ac577 openldap-clients-2.2.13-8.el4_6.1.s390x.rpm 9e2f2f3537e2a78814cdbf681e4276c3 openldap-debuginfo-2.2.13-8.el4_6.1.s390.rpm 36e98eb7d5f13afb6efe38f3f1f13bba openldap-debuginfo-2.2.13-8.el4_6.1.s390x.rpm c82e16b66ac226d5263d7d1b7a5f57a8 openldap-devel-2.2.13-8.el4_6.1.s390x.rpm 4b5f38cbdec79291593221a66125e45e openldap-servers-2.2.13-8.el4_6.1.s390x.rpm d3c79b08b668917d1156f366c320bce2 openldap-servers-sql-2.2.13-8.el4_6.1.s390x.rpm x86_64: b2c433fe08be943cb34d7ae75d29f022 compat-openldap-2.1.30-8.el4_6.1.i386.rpm a4a32d858eb9289ca447bea8513cfe1d compat-openldap-2.1.30-8.el4_6.1.x86_64.rpm 6ddb8c954ba2f85aa11850541d09f2f1 openldap-2.2.13-8.el4_6.1.i386.rpm 49aa0f91ab6af3df095e47f5aaafa4b0 openldap-2.2.13-8.el4_6.1.x86_64.rpm c4dc861ca1240793966e707a8f4a7cd3 openldap-clients-2.2.13-8.el4_6.1.x86_64.rpm 3a5d6b07337958bdfdf7528abcd0ffb2 openldap-debuginfo-2.2.13-8.el4_6.1.i386.rpm be99b06e1dbeeec8e5259e1385a368c2 openldap-debuginfo-2.2.13-8.el4_6.1.x86_64.rpm 48d7db553ba4c337e776005170b61d80 openldap-devel-2.2.13-8.el4_6.1.x86_64.rpm 59dce9ed46d0f6661fca7c2d1141da35 openldap-servers-2.2.13-8.el4_6.1.x86_64.rpm 6e64d976439bdacd8200ac3a2197c409 openldap-servers-sql-2.2.13-8.el4_6.1.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/openldap-2.2.13-8.el4_6.1.src.rpm d83f67fe727e11d6cf1160b024b1f9a2 openldap-2.2.13-8.el4_6.1.src.rpm i386: b2c433fe08be943cb34d7ae75d29f022 compat-openldap-2.1.30-8.el4_6.1.i386.rpm 6ddb8c954ba2f85aa11850541d09f2f1 openldap-2.2.13-8.el4_6.1.i386.rpm 219c613cf348abaaebc4c4f9f018ed9d openldap-clients-2.2.13-8.el4_6.1.i386.rpm 3a5d6b07337958bdfdf7528abcd0ffb2 openldap-debuginfo-2.2.13-8.el4_6.1.i386.rpm 7f40d96252d441fe7614a9beef25e0af openldap-devel-2.2.13-8.el4_6.1.i386.rpm 4c19ad7c8b3adc537463852e1eba0233 openldap-servers-2.2.13-8.el4_6.1.i386.rpm 66e950a723214043bbe5b214b6bae217 openldap-servers-sql-2.2.13-8.el4_6.1.i386.rpm x86_64: b2c433fe08be943cb34d7ae75d29f022 compat-openldap-2.1.30-8.el4_6.1.i386.rpm a4a32d858eb9289ca447bea8513cfe1d compat-openldap-2.1.30-8.el4_6.1.x86_64.rpm 6ddb8c954ba2f85aa11850541d09f2f1 openldap-2.2.13-8.el4_6.1.i386.rpm 49aa0f91ab6af3df095e47f5aaafa4b0 openldap-2.2.13-8.el4_6.1.x86_64.rpm c4dc861ca1240793966e707a8f4a7cd3 openldap-clients-2.2.13-8.el4_6.1.x86_64.rpm 3a5d6b07337958bdfdf7528abcd0ffb2 openldap-debuginfo-2.2.13-8.el4_6.1.i386.rpm be99b06e1dbeeec8e5259e1385a368c2 openldap-debuginfo-2.2.13-8.el4_6.1.x86_64.rpm 48d7db553ba4c337e776005170b61d80 openldap-devel-2.2.13-8.el4_6.1.x86_64.rpm 59dce9ed46d0f6661fca7c2d1141da35 openldap-servers-2.2.13-8.el4_6.1.x86_64.rpm 6e64d976439bdacd8200ac3a2197c409 openldap-servers-sql-2.2.13-8.el4_6.1.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/openldap-2.2.13-8.el4_6.1.src.rpm d83f67fe727e11d6cf1160b024b1f9a2 openldap-2.2.13-8.el4_6.1.src.rpm i386: b2c433fe08be943cb34d7ae75d29f022 compat-openldap-2.1.30-8.el4_6.1.i386.rpm 6ddb8c954ba2f85aa11850541d09f2f1 openldap-2.2.13-8.el4_6.1.i386.rpm 219c613cf348abaaebc4c4f9f018ed9d openldap-clients-2.2.13-8.el4_6.1.i386.rpm 3a5d6b07337958bdfdf7528abcd0ffb2 openldap-debuginfo-2.2.13-8.el4_6.1.i386.rpm 7f40d96252d441fe7614a9beef25e0af openldap-devel-2.2.13-8.el4_6.1.i386.rpm 4c19ad7c8b3adc537463852e1eba0233 openldap-servers-2.2.13-8.el4_6.1.i386.rpm 66e950a723214043bbe5b214b6bae217 openldap-servers-sql-2.2.13-8.el4_6.1.i386.rpm ia64: b2c433fe08be943cb34d7ae75d29f022 compat-openldap-2.1.30-8.el4_6.1.i386.rpm 6b8aaa38dfbca517ebc8c2eeab072225 compat-openldap-2.1.30-8.el4_6.1.ia64.rpm 6ddb8c954ba2f85aa11850541d09f2f1 openldap-2.2.13-8.el4_6.1.i386.rpm e48a6a25b291ebe73a1e500a51d5752c openldap-2.2.13-8.el4_6.1.ia64.rpm 42ab2e4a1af25c108f86b231af51321d openldap-clients-2.2.13-8.el4_6.1.ia64.rpm 3a5d6b07337958bdfdf7528abcd0ffb2 openldap-debuginfo-2.2.13-8.el4_6.1.i386.rpm f016210f44503358b516cca1e9602042 openldap-debuginfo-2.2.13-8.el4_6.1.ia64.rpm ebdf2edb9e264227f5877905afef97ee openldap-devel-2.2.13-8.el4_6.1.ia64.rpm 817e4e1f9963c90506ec40817cb9a311 openldap-servers-2.2.13-8.el4_6.1.ia64.rpm 3a85b2d97f872c32929a36379b09ac65 openldap-servers-sql-2.2.13-8.el4_6.1.ia64.rpm x86_64: b2c433fe08be943cb34d7ae75d29f022 compat-openldap-2.1.30-8.el4_6.1.i386.rpm a4a32d858eb9289ca447bea8513cfe1d compat-openldap-2.1.30-8.el4_6.1.x86_64.rpm 6ddb8c954ba2f85aa11850541d09f2f1 openldap-2.2.13-8.el4_6.1.i386.rpm 49aa0f91ab6af3df095e47f5aaafa4b0 openldap-2.2.13-8.el4_6.1.x86_64.rpm c4dc861ca1240793966e707a8f4a7cd3 openldap-clients-2.2.13-8.el4_6.1.x86_64.rpm 3a5d6b07337958bdfdf7528abcd0ffb2 openldap-debuginfo-2.2.13-8.el4_6.1.i386.rpm be99b06e1dbeeec8e5259e1385a368c2 openldap-debuginfo-2.2.13-8.el4_6.1.x86_64.rpm 48d7db553ba4c337e776005170b61d80 openldap-devel-2.2.13-8.el4_6.1.x86_64.rpm 59dce9ed46d0f6661fca7c2d1141da35 openldap-servers-2.2.13-8.el4_6.1.x86_64.rpm 6e64d976439bdacd8200ac3a2197c409 openldap-servers-sql-2.2.13-8.el4_6.1.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/openldap-2.2.13-8.el4_6.1.src.rpm d83f67fe727e11d6cf1160b024b1f9a2 openldap-2.2.13-8.el4_6.1.src.rpm i386: b2c433fe08be943cb34d7ae75d29f022 compat-openldap-2.1.30-8.el4_6.1.i386.rpm 6ddb8c954ba2f85aa11850541d09f2f1 openldap-2.2.13-8.el4_6.1.i386.rpm 219c613cf348abaaebc4c4f9f018ed9d openldap-clients-2.2.13-8.el4_6.1.i386.rpm 3a5d6b07337958bdfdf7528abcd0ffb2 openldap-debuginfo-2.2.13-8.el4_6.1.i386.rpm 7f40d96252d441fe7614a9beef25e0af openldap-devel-2.2.13-8.el4_6.1.i386.rpm 4c19ad7c8b3adc537463852e1eba0233 openldap-servers-2.2.13-8.el4_6.1.i386.rpm 66e950a723214043bbe5b214b6bae217 openldap-servers-sql-2.2.13-8.el4_6.1.i386.rpm ia64: b2c433fe08be943cb34d7ae75d29f022 compat-openldap-2.1.30-8.el4_6.1.i386.rpm 6b8aaa38dfbca517ebc8c2eeab072225 compat-openldap-2.1.30-8.el4_6.1.ia64.rpm 6ddb8c954ba2f85aa11850541d09f2f1 openldap-2.2.13-8.el4_6.1.i386.rpm e48a6a25b291ebe73a1e500a51d5752c openldap-2.2.13-8.el4_6.1.ia64.rpm 42ab2e4a1af25c108f86b231af51321d openldap-clients-2.2.13-8.el4_6.1.ia64.rpm 3a5d6b07337958bdfdf7528abcd0ffb2 openldap-debuginfo-2.2.13-8.el4_6.1.i386.rpm f016210f44503358b516cca1e9602042 openldap-debuginfo-2.2.13-8.el4_6.1.ia64.rpm ebdf2edb9e264227f5877905afef97ee openldap-devel-2.2.13-8.el4_6.1.ia64.rpm 817e4e1f9963c90506ec40817cb9a311 openldap-servers-2.2.13-8.el4_6.1.ia64.rpm 3a85b2d97f872c32929a36379b09ac65 openldap-servers-sql-2.2.13-8.el4_6.1.ia64.rpm x86_64: b2c433fe08be943cb34d7ae75d29f022 compat-openldap-2.1.30-8.el4_6.1.i386.rpm a4a32d858eb9289ca447bea8513cfe1d compat-openldap-2.1.30-8.el4_6.1.x86_64.rpm 6ddb8c954ba2f85aa11850541d09f2f1 openldap-2.2.13-8.el4_6.1.i386.rpm 49aa0f91ab6af3df095e47f5aaafa4b0 openldap-2.2.13-8.el4_6.1.x86_64.rpm c4dc861ca1240793966e707a8f4a7cd3 openldap-clients-2.2.13-8.el4_6.1.x86_64.rpm 3a5d6b07337958bdfdf7528abcd0ffb2 openldap-debuginfo-2.2.13-8.el4_6.1.i386.rpm be99b06e1dbeeec8e5259e1385a368c2 openldap-debuginfo-2.2.13-8.el4_6.1.x86_64.rpm 48d7db553ba4c337e776005170b61d80 openldap-devel-2.2.13-8.el4_6.1.x86_64.rpm 59dce9ed46d0f6661fca7c2d1141da35 openldap-servers-2.2.13-8.el4_6.1.x86_64.rpm 6e64d976439bdacd8200ac3a2197c409 openldap-servers-sql-2.2.13-8.el4_6.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5707 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHPHfpXlSAg2UNWIIRAg5ZAJ9O3WasZApIh4oqZsheqyt2blLxJwCfTPch db+zv5iKjFzwxOgBYZgatSA= =Iq6r -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 15 17:10:44 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 15 Nov 2007 12:10:44 -0500 Subject: [RHSA-2007:1045-01] Moderate: net-snmp security update Message-ID: <200711151710.lAFHAihd027237@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: net-snmp security update Advisory ID: RHSA-2007:1045-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1045.html Issue date: 2007-11-15 Updated on: 2007-11-15 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-5846 - --------------------------------------------------------------------- 1. Summary: Updated net-snmp packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: Simple Network Management Protocol (SNMP) is a protocol used for network management. A flaw was discovered in the way net-snmp handled certain requests. A remote attacker who can connect to the snmpd UDP port (161 by default) could send a malicious packet causing snmpd to crash, resulting in a denial of service. (CVE-2007-5846) All users of net-snmp are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 363631 - CVE-2007-5846 net-snmp remote DoS via udp packet 6. RPMs required: Red Hat Enterprise Linux AS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/net-snmp-5.0.9-2.30E.23.src.rpm f1c253d5a6182de9ff418875a07480f6 net-snmp-5.0.9-2.30E.23.src.rpm i386: 295f910474da709513adc8bdc7f1413d net-snmp-5.0.9-2.30E.23.i386.rpm 98dc3b6f97d087e86ce3499249bc3546 net-snmp-debuginfo-5.0.9-2.30E.23.i386.rpm 195fb8dd47c1d8dbdb1e0a42dd6f3e17 net-snmp-devel-5.0.9-2.30E.23.i386.rpm 4d87c2ca5c4388d0b51e913f244f7d70 net-snmp-libs-5.0.9-2.30E.23.i386.rpm e8ac794939198ff2fac5bd1ebe49600b net-snmp-perl-5.0.9-2.30E.23.i386.rpm 6d5a4078eda75957a26285b53b4b6c53 net-snmp-utils-5.0.9-2.30E.23.i386.rpm ia64: 50bdba5c20653cf959a9b60eff0b1298 net-snmp-5.0.9-2.30E.23.ia64.rpm 98dc3b6f97d087e86ce3499249bc3546 net-snmp-debuginfo-5.0.9-2.30E.23.i386.rpm d39229bffb79289555501a2ffec5af21 net-snmp-debuginfo-5.0.9-2.30E.23.ia64.rpm efc4fc8bcd8a9cf419e5d81ccdb6aac9 net-snmp-devel-5.0.9-2.30E.23.ia64.rpm 4d87c2ca5c4388d0b51e913f244f7d70 net-snmp-libs-5.0.9-2.30E.23.i386.rpm 10d7cf9c8f65010bcf37e1ebc134f106 net-snmp-libs-5.0.9-2.30E.23.ia64.rpm 6a2aaa7f958197969b5b9b3b6bd34f3a net-snmp-perl-5.0.9-2.30E.23.ia64.rpm 72970a340c6c31b1aacdbfb7802d0696 net-snmp-utils-5.0.9-2.30E.23.ia64.rpm ppc: 5c33e3cd150143f20a0fe03fe3e892e7 net-snmp-5.0.9-2.30E.23.ppc.rpm 4b743acfbb159585488df98b9c43967d net-snmp-debuginfo-5.0.9-2.30E.23.ppc.rpm b8133d38824b21a083be0c8882ed8371 net-snmp-debuginfo-5.0.9-2.30E.23.ppc64.rpm f0748df572a36bcc102075a16f5d5815 net-snmp-devel-5.0.9-2.30E.23.ppc.rpm ac6bae49a4d911692281c2fb1cc4fff1 net-snmp-libs-5.0.9-2.30E.23.ppc.rpm 982503aed19c17070f9a07ce893714e3 net-snmp-libs-5.0.9-2.30E.23.ppc64.rpm 45e373ca84669b377697324096a8b7c6 net-snmp-perl-5.0.9-2.30E.23.ppc.rpm 0d8e1cace5456e4dbf8097842fc90ef4 net-snmp-utils-5.0.9-2.30E.23.ppc.rpm s390: a039718d5292d76999afaec2a8cf482b net-snmp-5.0.9-2.30E.23.s390.rpm 26efae70256737623e55ca4d71af2ed0 net-snmp-debuginfo-5.0.9-2.30E.23.s390.rpm cd621613a423b9b10c07bafa290c8b1e net-snmp-devel-5.0.9-2.30E.23.s390.rpm 4efa3c083c50d935c881fd194dd5a1e9 net-snmp-libs-5.0.9-2.30E.23.s390.rpm 130895b1041b658cfac4bd419ca1edac net-snmp-perl-5.0.9-2.30E.23.s390.rpm 9121a6a2f8acbc027c05ebb6b99a763b net-snmp-utils-5.0.9-2.30E.23.s390.rpm s390x: 771b6637beafccfe850ad29dfcecab11 net-snmp-5.0.9-2.30E.23.s390x.rpm 26efae70256737623e55ca4d71af2ed0 net-snmp-debuginfo-5.0.9-2.30E.23.s390.rpm 780d56dc46426bcb72abb5d85c33139b net-snmp-debuginfo-5.0.9-2.30E.23.s390x.rpm 982ee566413184e3adf226452a7bf319 net-snmp-devel-5.0.9-2.30E.23.s390x.rpm 4efa3c083c50d935c881fd194dd5a1e9 net-snmp-libs-5.0.9-2.30E.23.s390.rpm 00fac2289ab3915fa9716575508a6355 net-snmp-libs-5.0.9-2.30E.23.s390x.rpm 345366e8fda8975a8461796b7ceb6433 net-snmp-perl-5.0.9-2.30E.23.s390x.rpm ed53b24dd773c84fd380313e9e98fb22 net-snmp-utils-5.0.9-2.30E.23.s390x.rpm x86_64: 295a728de5f083d11fa53a0d3e65364b net-snmp-5.0.9-2.30E.23.x86_64.rpm 98dc3b6f97d087e86ce3499249bc3546 net-snmp-debuginfo-5.0.9-2.30E.23.i386.rpm 3fe6fb49d4de86c83633755c8b949e30 net-snmp-debuginfo-5.0.9-2.30E.23.x86_64.rpm ca521aa755e6911449c454dd6c0b56bd net-snmp-devel-5.0.9-2.30E.23.x86_64.rpm 4d87c2ca5c4388d0b51e913f244f7d70 net-snmp-libs-5.0.9-2.30E.23.i386.rpm 0230cf2ece30c1763c60606dc977f3b7 net-snmp-libs-5.0.9-2.30E.23.x86_64.rpm ce50e96081336d0fa523bb9858e54660 net-snmp-perl-5.0.9-2.30E.23.x86_64.rpm 5e6af2928497a974455ffee2f721d56f net-snmp-utils-5.0.9-2.30E.23.x86_64.rpm Red Hat Desktop version 3: SRPMS: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/net-snmp-5.0.9-2.30E.23.src.rpm f1c253d5a6182de9ff418875a07480f6 net-snmp-5.0.9-2.30E.23.src.rpm i386: 295f910474da709513adc8bdc7f1413d net-snmp-5.0.9-2.30E.23.i386.rpm 98dc3b6f97d087e86ce3499249bc3546 net-snmp-debuginfo-5.0.9-2.30E.23.i386.rpm 195fb8dd47c1d8dbdb1e0a42dd6f3e17 net-snmp-devel-5.0.9-2.30E.23.i386.rpm 4d87c2ca5c4388d0b51e913f244f7d70 net-snmp-libs-5.0.9-2.30E.23.i386.rpm e8ac794939198ff2fac5bd1ebe49600b net-snmp-perl-5.0.9-2.30E.23.i386.rpm 6d5a4078eda75957a26285b53b4b6c53 net-snmp-utils-5.0.9-2.30E.23.i386.rpm x86_64: 295a728de5f083d11fa53a0d3e65364b net-snmp-5.0.9-2.30E.23.x86_64.rpm 98dc3b6f97d087e86ce3499249bc3546 net-snmp-debuginfo-5.0.9-2.30E.23.i386.rpm 3fe6fb49d4de86c83633755c8b949e30 net-snmp-debuginfo-5.0.9-2.30E.23.x86_64.rpm ca521aa755e6911449c454dd6c0b56bd net-snmp-devel-5.0.9-2.30E.23.x86_64.rpm 4d87c2ca5c4388d0b51e913f244f7d70 net-snmp-libs-5.0.9-2.30E.23.i386.rpm 0230cf2ece30c1763c60606dc977f3b7 net-snmp-libs-5.0.9-2.30E.23.x86_64.rpm ce50e96081336d0fa523bb9858e54660 net-snmp-perl-5.0.9-2.30E.23.x86_64.rpm 5e6af2928497a974455ffee2f721d56f net-snmp-utils-5.0.9-2.30E.23.x86_64.rpm Red Hat Enterprise Linux ES version 3: SRPMS: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/net-snmp-5.0.9-2.30E.23.src.rpm f1c253d5a6182de9ff418875a07480f6 net-snmp-5.0.9-2.30E.23.src.rpm i386: 295f910474da709513adc8bdc7f1413d net-snmp-5.0.9-2.30E.23.i386.rpm 98dc3b6f97d087e86ce3499249bc3546 net-snmp-debuginfo-5.0.9-2.30E.23.i386.rpm 195fb8dd47c1d8dbdb1e0a42dd6f3e17 net-snmp-devel-5.0.9-2.30E.23.i386.rpm 4d87c2ca5c4388d0b51e913f244f7d70 net-snmp-libs-5.0.9-2.30E.23.i386.rpm e8ac794939198ff2fac5bd1ebe49600b net-snmp-perl-5.0.9-2.30E.23.i386.rpm 6d5a4078eda75957a26285b53b4b6c53 net-snmp-utils-5.0.9-2.30E.23.i386.rpm ia64: 50bdba5c20653cf959a9b60eff0b1298 net-snmp-5.0.9-2.30E.23.ia64.rpm 98dc3b6f97d087e86ce3499249bc3546 net-snmp-debuginfo-5.0.9-2.30E.23.i386.rpm d39229bffb79289555501a2ffec5af21 net-snmp-debuginfo-5.0.9-2.30E.23.ia64.rpm efc4fc8bcd8a9cf419e5d81ccdb6aac9 net-snmp-devel-5.0.9-2.30E.23.ia64.rpm 4d87c2ca5c4388d0b51e913f244f7d70 net-snmp-libs-5.0.9-2.30E.23.i386.rpm 10d7cf9c8f65010bcf37e1ebc134f106 net-snmp-libs-5.0.9-2.30E.23.ia64.rpm 6a2aaa7f958197969b5b9b3b6bd34f3a net-snmp-perl-5.0.9-2.30E.23.ia64.rpm 72970a340c6c31b1aacdbfb7802d0696 net-snmp-utils-5.0.9-2.30E.23.ia64.rpm x86_64: 295a728de5f083d11fa53a0d3e65364b net-snmp-5.0.9-2.30E.23.x86_64.rpm 98dc3b6f97d087e86ce3499249bc3546 net-snmp-debuginfo-5.0.9-2.30E.23.i386.rpm 3fe6fb49d4de86c83633755c8b949e30 net-snmp-debuginfo-5.0.9-2.30E.23.x86_64.rpm ca521aa755e6911449c454dd6c0b56bd net-snmp-devel-5.0.9-2.30E.23.x86_64.rpm 4d87c2ca5c4388d0b51e913f244f7d70 net-snmp-libs-5.0.9-2.30E.23.i386.rpm 0230cf2ece30c1763c60606dc977f3b7 net-snmp-libs-5.0.9-2.30E.23.x86_64.rpm ce50e96081336d0fa523bb9858e54660 net-snmp-perl-5.0.9-2.30E.23.x86_64.rpm 5e6af2928497a974455ffee2f721d56f net-snmp-utils-5.0.9-2.30E.23.x86_64.rpm Red Hat Enterprise Linux WS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/net-snmp-5.0.9-2.30E.23.src.rpm f1c253d5a6182de9ff418875a07480f6 net-snmp-5.0.9-2.30E.23.src.rpm i386: 295f910474da709513adc8bdc7f1413d net-snmp-5.0.9-2.30E.23.i386.rpm 98dc3b6f97d087e86ce3499249bc3546 net-snmp-debuginfo-5.0.9-2.30E.23.i386.rpm 195fb8dd47c1d8dbdb1e0a42dd6f3e17 net-snmp-devel-5.0.9-2.30E.23.i386.rpm 4d87c2ca5c4388d0b51e913f244f7d70 net-snmp-libs-5.0.9-2.30E.23.i386.rpm e8ac794939198ff2fac5bd1ebe49600b net-snmp-perl-5.0.9-2.30E.23.i386.rpm 6d5a4078eda75957a26285b53b4b6c53 net-snmp-utils-5.0.9-2.30E.23.i386.rpm ia64: 50bdba5c20653cf959a9b60eff0b1298 net-snmp-5.0.9-2.30E.23.ia64.rpm 98dc3b6f97d087e86ce3499249bc3546 net-snmp-debuginfo-5.0.9-2.30E.23.i386.rpm d39229bffb79289555501a2ffec5af21 net-snmp-debuginfo-5.0.9-2.30E.23.ia64.rpm efc4fc8bcd8a9cf419e5d81ccdb6aac9 net-snmp-devel-5.0.9-2.30E.23.ia64.rpm 4d87c2ca5c4388d0b51e913f244f7d70 net-snmp-libs-5.0.9-2.30E.23.i386.rpm 10d7cf9c8f65010bcf37e1ebc134f106 net-snmp-libs-5.0.9-2.30E.23.ia64.rpm 6a2aaa7f958197969b5b9b3b6bd34f3a net-snmp-perl-5.0.9-2.30E.23.ia64.rpm 72970a340c6c31b1aacdbfb7802d0696 net-snmp-utils-5.0.9-2.30E.23.ia64.rpm x86_64: 295a728de5f083d11fa53a0d3e65364b net-snmp-5.0.9-2.30E.23.x86_64.rpm 98dc3b6f97d087e86ce3499249bc3546 net-snmp-debuginfo-5.0.9-2.30E.23.i386.rpm 3fe6fb49d4de86c83633755c8b949e30 net-snmp-debuginfo-5.0.9-2.30E.23.x86_64.rpm ca521aa755e6911449c454dd6c0b56bd net-snmp-devel-5.0.9-2.30E.23.x86_64.rpm 4d87c2ca5c4388d0b51e913f244f7d70 net-snmp-libs-5.0.9-2.30E.23.i386.rpm 0230cf2ece30c1763c60606dc977f3b7 net-snmp-libs-5.0.9-2.30E.23.x86_64.rpm ce50e96081336d0fa523bb9858e54660 net-snmp-perl-5.0.9-2.30E.23.x86_64.rpm 5e6af2928497a974455ffee2f721d56f net-snmp-utils-5.0.9-2.30E.23.x86_64.rpm Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/net-snmp-5.1.2-11.el4_6.11.1.src.rpm 59d0295b17be750dfa5f4462cb9923a6 net-snmp-5.1.2-11.el4_6.11.1.src.rpm i386: 585e216f36c15d58c11b77fbb4a777ab net-snmp-5.1.2-11.el4_6.11.1.i386.rpm c66bb30e802195ac4cc6919a77c22479 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.i386.rpm 136e1b480ccf85c35ec4a7b853787983 net-snmp-devel-5.1.2-11.el4_6.11.1.i386.rpm cfd6d231799e126e8368cfc7aa7cf6b9 net-snmp-libs-5.1.2-11.el4_6.11.1.i386.rpm 92c5a6dc100117574a2294fc9eeb34d2 net-snmp-perl-5.1.2-11.el4_6.11.1.i386.rpm a566a1a1ecbbdac649734a2d9b4ac4fa net-snmp-utils-5.1.2-11.el4_6.11.1.i386.rpm ia64: e8d95b75d55f951f3663665619ee6a05 net-snmp-5.1.2-11.el4_6.11.1.ia64.rpm c66bb30e802195ac4cc6919a77c22479 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.i386.rpm cc76c435d5964f5d084f703d8ee3c5a9 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.ia64.rpm 8f47c6d867fc21cf3b6ea6b975adc5b4 net-snmp-devel-5.1.2-11.el4_6.11.1.ia64.rpm cfd6d231799e126e8368cfc7aa7cf6b9 net-snmp-libs-5.1.2-11.el4_6.11.1.i386.rpm a89984810134f0498f80bbe19d526406 net-snmp-libs-5.1.2-11.el4_6.11.1.ia64.rpm 2a5d69196e67f61ca29d36c1d03314f9 net-snmp-perl-5.1.2-11.el4_6.11.1.ia64.rpm 76e29a9d15c9d4f72e9035a383b9ba4e net-snmp-utils-5.1.2-11.el4_6.11.1.ia64.rpm ppc: 61279869beca152f220623b51fe49a04 net-snmp-5.1.2-11.el4_6.11.1.ppc.rpm 6cf5834290ace078e931f55b7ef8f2b6 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.ppc.rpm 49ccde31d37ec46dee89f6aedc0b900a net-snmp-debuginfo-5.1.2-11.el4_6.11.1.ppc64.rpm a4c64508530b0272af7f1e8c82104071 net-snmp-devel-5.1.2-11.el4_6.11.1.ppc.rpm 19e41987a99d23740d9a3fec8a43e01f net-snmp-libs-5.1.2-11.el4_6.11.1.ppc.rpm 8d8f878d32bbab6f197e0223701e8400 net-snmp-libs-5.1.2-11.el4_6.11.1.ppc64.rpm e56c2f70577a0b1de2f6f1baf649806b net-snmp-perl-5.1.2-11.el4_6.11.1.ppc.rpm 2a33ac0344d3f4bb74800a04cc984c59 net-snmp-utils-5.1.2-11.el4_6.11.1.ppc.rpm s390: 19ed2919760d8bd4eaced7320a5be26b net-snmp-5.1.2-11.el4_6.11.1.s390.rpm 40064bcb9f80f8cfd69943f5f1a5e875 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.s390.rpm 9339c7b8443a6fa42bd656f3c0ea142c net-snmp-devel-5.1.2-11.el4_6.11.1.s390.rpm e86b1d94461c779a6b05ee2269a7b7ff net-snmp-libs-5.1.2-11.el4_6.11.1.s390.rpm 90bbb93521481782deeb481875a8fb2a net-snmp-perl-5.1.2-11.el4_6.11.1.s390.rpm 9ea5b19c2a7df240e83c22b36ee035c3 net-snmp-utils-5.1.2-11.el4_6.11.1.s390.rpm s390x: d70d3fb2567f5d5af5c321887f4764fd net-snmp-5.1.2-11.el4_6.11.1.s390x.rpm 40064bcb9f80f8cfd69943f5f1a5e875 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.s390.rpm ccafec114dd918d4473a53c822d5d69d net-snmp-debuginfo-5.1.2-11.el4_6.11.1.s390x.rpm 956f2683776bc1c97587b1ccfe13ea71 net-snmp-devel-5.1.2-11.el4_6.11.1.s390x.rpm e86b1d94461c779a6b05ee2269a7b7ff net-snmp-libs-5.1.2-11.el4_6.11.1.s390.rpm f52979a4fca379e279e9cd45d0b91bce net-snmp-libs-5.1.2-11.el4_6.11.1.s390x.rpm d9c6943b28d0cfa82da1c9cd3a15564b net-snmp-perl-5.1.2-11.el4_6.11.1.s390x.rpm f7f875280676c1d17bd2b739bf0fe4ac net-snmp-utils-5.1.2-11.el4_6.11.1.s390x.rpm x86_64: bfb5791ccdc46e758fc92099d61d746c net-snmp-5.1.2-11.el4_6.11.1.x86_64.rpm c66bb30e802195ac4cc6919a77c22479 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.i386.rpm 94e5e0e9c511aaefd406a0424fca1626 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.x86_64.rpm da9413781f7e26b2603ccbb52fbc8552 net-snmp-devel-5.1.2-11.el4_6.11.1.x86_64.rpm cfd6d231799e126e8368cfc7aa7cf6b9 net-snmp-libs-5.1.2-11.el4_6.11.1.i386.rpm fc8e512797de19ca272d60a668c356e8 net-snmp-libs-5.1.2-11.el4_6.11.1.x86_64.rpm 2b3b93df756c4e34b8c4b75452f83b58 net-snmp-perl-5.1.2-11.el4_6.11.1.x86_64.rpm 1da28c2ac3b6a9f4fbce2d4811b38e77 net-snmp-utils-5.1.2-11.el4_6.11.1.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/net-snmp-5.1.2-11.el4_6.11.1.src.rpm 59d0295b17be750dfa5f4462cb9923a6 net-snmp-5.1.2-11.el4_6.11.1.src.rpm i386: 585e216f36c15d58c11b77fbb4a777ab net-snmp-5.1.2-11.el4_6.11.1.i386.rpm c66bb30e802195ac4cc6919a77c22479 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.i386.rpm 136e1b480ccf85c35ec4a7b853787983 net-snmp-devel-5.1.2-11.el4_6.11.1.i386.rpm cfd6d231799e126e8368cfc7aa7cf6b9 net-snmp-libs-5.1.2-11.el4_6.11.1.i386.rpm 92c5a6dc100117574a2294fc9eeb34d2 net-snmp-perl-5.1.2-11.el4_6.11.1.i386.rpm a566a1a1ecbbdac649734a2d9b4ac4fa net-snmp-utils-5.1.2-11.el4_6.11.1.i386.rpm x86_64: bfb5791ccdc46e758fc92099d61d746c net-snmp-5.1.2-11.el4_6.11.1.x86_64.rpm c66bb30e802195ac4cc6919a77c22479 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.i386.rpm 94e5e0e9c511aaefd406a0424fca1626 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.x86_64.rpm da9413781f7e26b2603ccbb52fbc8552 net-snmp-devel-5.1.2-11.el4_6.11.1.x86_64.rpm cfd6d231799e126e8368cfc7aa7cf6b9 net-snmp-libs-5.1.2-11.el4_6.11.1.i386.rpm fc8e512797de19ca272d60a668c356e8 net-snmp-libs-5.1.2-11.el4_6.11.1.x86_64.rpm 2b3b93df756c4e34b8c4b75452f83b58 net-snmp-perl-5.1.2-11.el4_6.11.1.x86_64.rpm 1da28c2ac3b6a9f4fbce2d4811b38e77 net-snmp-utils-5.1.2-11.el4_6.11.1.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/net-snmp-5.1.2-11.el4_6.11.1.src.rpm 59d0295b17be750dfa5f4462cb9923a6 net-snmp-5.1.2-11.el4_6.11.1.src.rpm i386: 585e216f36c15d58c11b77fbb4a777ab net-snmp-5.1.2-11.el4_6.11.1.i386.rpm c66bb30e802195ac4cc6919a77c22479 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.i386.rpm 136e1b480ccf85c35ec4a7b853787983 net-snmp-devel-5.1.2-11.el4_6.11.1.i386.rpm cfd6d231799e126e8368cfc7aa7cf6b9 net-snmp-libs-5.1.2-11.el4_6.11.1.i386.rpm 92c5a6dc100117574a2294fc9eeb34d2 net-snmp-perl-5.1.2-11.el4_6.11.1.i386.rpm a566a1a1ecbbdac649734a2d9b4ac4fa net-snmp-utils-5.1.2-11.el4_6.11.1.i386.rpm ia64: e8d95b75d55f951f3663665619ee6a05 net-snmp-5.1.2-11.el4_6.11.1.ia64.rpm c66bb30e802195ac4cc6919a77c22479 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.i386.rpm cc76c435d5964f5d084f703d8ee3c5a9 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.ia64.rpm 8f47c6d867fc21cf3b6ea6b975adc5b4 net-snmp-devel-5.1.2-11.el4_6.11.1.ia64.rpm cfd6d231799e126e8368cfc7aa7cf6b9 net-snmp-libs-5.1.2-11.el4_6.11.1.i386.rpm a89984810134f0498f80bbe19d526406 net-snmp-libs-5.1.2-11.el4_6.11.1.ia64.rpm 2a5d69196e67f61ca29d36c1d03314f9 net-snmp-perl-5.1.2-11.el4_6.11.1.ia64.rpm 76e29a9d15c9d4f72e9035a383b9ba4e net-snmp-utils-5.1.2-11.el4_6.11.1.ia64.rpm x86_64: bfb5791ccdc46e758fc92099d61d746c net-snmp-5.1.2-11.el4_6.11.1.x86_64.rpm c66bb30e802195ac4cc6919a77c22479 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.i386.rpm 94e5e0e9c511aaefd406a0424fca1626 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.x86_64.rpm da9413781f7e26b2603ccbb52fbc8552 net-snmp-devel-5.1.2-11.el4_6.11.1.x86_64.rpm cfd6d231799e126e8368cfc7aa7cf6b9 net-snmp-libs-5.1.2-11.el4_6.11.1.i386.rpm fc8e512797de19ca272d60a668c356e8 net-snmp-libs-5.1.2-11.el4_6.11.1.x86_64.rpm 2b3b93df756c4e34b8c4b75452f83b58 net-snmp-perl-5.1.2-11.el4_6.11.1.x86_64.rpm 1da28c2ac3b6a9f4fbce2d4811b38e77 net-snmp-utils-5.1.2-11.el4_6.11.1.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/net-snmp-5.1.2-11.el4_6.11.1.src.rpm 59d0295b17be750dfa5f4462cb9923a6 net-snmp-5.1.2-11.el4_6.11.1.src.rpm i386: 585e216f36c15d58c11b77fbb4a777ab net-snmp-5.1.2-11.el4_6.11.1.i386.rpm c66bb30e802195ac4cc6919a77c22479 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.i386.rpm 136e1b480ccf85c35ec4a7b853787983 net-snmp-devel-5.1.2-11.el4_6.11.1.i386.rpm cfd6d231799e126e8368cfc7aa7cf6b9 net-snmp-libs-5.1.2-11.el4_6.11.1.i386.rpm 92c5a6dc100117574a2294fc9eeb34d2 net-snmp-perl-5.1.2-11.el4_6.11.1.i386.rpm a566a1a1ecbbdac649734a2d9b4ac4fa net-snmp-utils-5.1.2-11.el4_6.11.1.i386.rpm ia64: e8d95b75d55f951f3663665619ee6a05 net-snmp-5.1.2-11.el4_6.11.1.ia64.rpm c66bb30e802195ac4cc6919a77c22479 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.i386.rpm cc76c435d5964f5d084f703d8ee3c5a9 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.ia64.rpm 8f47c6d867fc21cf3b6ea6b975adc5b4 net-snmp-devel-5.1.2-11.el4_6.11.1.ia64.rpm cfd6d231799e126e8368cfc7aa7cf6b9 net-snmp-libs-5.1.2-11.el4_6.11.1.i386.rpm a89984810134f0498f80bbe19d526406 net-snmp-libs-5.1.2-11.el4_6.11.1.ia64.rpm 2a5d69196e67f61ca29d36c1d03314f9 net-snmp-perl-5.1.2-11.el4_6.11.1.ia64.rpm 76e29a9d15c9d4f72e9035a383b9ba4e net-snmp-utils-5.1.2-11.el4_6.11.1.ia64.rpm x86_64: bfb5791ccdc46e758fc92099d61d746c net-snmp-5.1.2-11.el4_6.11.1.x86_64.rpm c66bb30e802195ac4cc6919a77c22479 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.i386.rpm 94e5e0e9c511aaefd406a0424fca1626 net-snmp-debuginfo-5.1.2-11.el4_6.11.1.x86_64.rpm da9413781f7e26b2603ccbb52fbc8552 net-snmp-devel-5.1.2-11.el4_6.11.1.x86_64.rpm cfd6d231799e126e8368cfc7aa7cf6b9 net-snmp-libs-5.1.2-11.el4_6.11.1.i386.rpm fc8e512797de19ca272d60a668c356e8 net-snmp-libs-5.1.2-11.el4_6.11.1.x86_64.rpm 2b3b93df756c4e34b8c4b75452f83b58 net-snmp-perl-5.1.2-11.el4_6.11.1.x86_64.rpm 1da28c2ac3b6a9f4fbce2d4811b38e77 net-snmp-utils-5.1.2-11.el4_6.11.1.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/net-snmp-5.3.1-19.el5_1.1.src.rpm 664666de8fb679b8664616ad43e7a598 net-snmp-5.3.1-19.el5_1.1.src.rpm i386: 5880bc9e2097ace889a1697800bf2b59 net-snmp-5.3.1-19.el5_1.1.i386.rpm 7062e95c9a6f9e57df8965a05c0f9dc9 net-snmp-debuginfo-5.3.1-19.el5_1.1.i386.rpm 91c519849e54f3000bcaa679801a9ebc net-snmp-libs-5.3.1-19.el5_1.1.i386.rpm a303a7eba5138db181332534b262256d net-snmp-perl-5.3.1-19.el5_1.1.i386.rpm 626d35a2c345c373b90a1b41ea4c3991 net-snmp-utils-5.3.1-19.el5_1.1.i386.rpm x86_64: f646bd8429e51258e49d65437ac3c6c2 net-snmp-5.3.1-19.el5_1.1.x86_64.rpm 7062e95c9a6f9e57df8965a05c0f9dc9 net-snmp-debuginfo-5.3.1-19.el5_1.1.i386.rpm 8e04bc332ab89dbd465a1d6d41f04561 net-snmp-debuginfo-5.3.1-19.el5_1.1.x86_64.rpm 91c519849e54f3000bcaa679801a9ebc net-snmp-libs-5.3.1-19.el5_1.1.i386.rpm f4a39d88918fce124d9269581b80d197 net-snmp-libs-5.3.1-19.el5_1.1.x86_64.rpm 829b744316589fe931b3053786155fcd net-snmp-perl-5.3.1-19.el5_1.1.x86_64.rpm c6ad55d9371980081fcd7e14b6118125 net-snmp-utils-5.3.1-19.el5_1.1.x86_64.rpm RHEL Desktop Workstation (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/net-snmp-5.3.1-19.el5_1.1.src.rpm 664666de8fb679b8664616ad43e7a598 net-snmp-5.3.1-19.el5_1.1.src.rpm i386: 7062e95c9a6f9e57df8965a05c0f9dc9 net-snmp-debuginfo-5.3.1-19.el5_1.1.i386.rpm cd49daf1fe629ae833d5c8edb5a1d2d0 net-snmp-devel-5.3.1-19.el5_1.1.i386.rpm x86_64: 7062e95c9a6f9e57df8965a05c0f9dc9 net-snmp-debuginfo-5.3.1-19.el5_1.1.i386.rpm 8e04bc332ab89dbd465a1d6d41f04561 net-snmp-debuginfo-5.3.1-19.el5_1.1.x86_64.rpm cd49daf1fe629ae833d5c8edb5a1d2d0 net-snmp-devel-5.3.1-19.el5_1.1.i386.rpm 92462c484371821a95087a38ab97f25e net-snmp-devel-5.3.1-19.el5_1.1.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/net-snmp-5.3.1-19.el5_1.1.src.rpm 664666de8fb679b8664616ad43e7a598 net-snmp-5.3.1-19.el5_1.1.src.rpm i386: 5880bc9e2097ace889a1697800bf2b59 net-snmp-5.3.1-19.el5_1.1.i386.rpm 7062e95c9a6f9e57df8965a05c0f9dc9 net-snmp-debuginfo-5.3.1-19.el5_1.1.i386.rpm cd49daf1fe629ae833d5c8edb5a1d2d0 net-snmp-devel-5.3.1-19.el5_1.1.i386.rpm 91c519849e54f3000bcaa679801a9ebc net-snmp-libs-5.3.1-19.el5_1.1.i386.rpm a303a7eba5138db181332534b262256d net-snmp-perl-5.3.1-19.el5_1.1.i386.rpm 626d35a2c345c373b90a1b41ea4c3991 net-snmp-utils-5.3.1-19.el5_1.1.i386.rpm ia64: 7f5fec9f4d5bc690fb5824b917db97c4 net-snmp-5.3.1-19.el5_1.1.ia64.rpm dadcbf4d77c8a10df9af24eefaa24a3c net-snmp-debuginfo-5.3.1-19.el5_1.1.ia64.rpm 8360479bd6d8747eea5dbe09d4f1c268 net-snmp-devel-5.3.1-19.el5_1.1.ia64.rpm cca66fb9fe5bcfc582a77823880ab216 net-snmp-libs-5.3.1-19.el5_1.1.ia64.rpm 7ebab28ae055526d341c8401beaddc51 net-snmp-perl-5.3.1-19.el5_1.1.ia64.rpm c431be2943f4c8a37ec988a8fba41bab net-snmp-utils-5.3.1-19.el5_1.1.ia64.rpm ppc: 852f7ba63a2e3118a13a2a14ebdcee07 net-snmp-5.3.1-19.el5_1.1.ppc.rpm 87c72cc7d15df97ae555d64eddef05eb net-snmp-debuginfo-5.3.1-19.el5_1.1.ppc.rpm d087518a2135d4369dfa57f64e90a59d net-snmp-debuginfo-5.3.1-19.el5_1.1.ppc64.rpm ab5ebab6275da7d4fcecee4217cd0ef3 net-snmp-devel-5.3.1-19.el5_1.1.ppc.rpm ab3bdf97fd6e45431dea89409e8c555b net-snmp-devel-5.3.1-19.el5_1.1.ppc64.rpm 3270575aa388db4f96d1b4c04a3c7fc9 net-snmp-libs-5.3.1-19.el5_1.1.ppc.rpm 8baf341f694f7303bb27b1a5071cadef net-snmp-libs-5.3.1-19.el5_1.1.ppc64.rpm abb0bb19d7a7cc34ab7009e767350846 net-snmp-perl-5.3.1-19.el5_1.1.ppc.rpm 6d7166f69e04e501706776e57361e426 net-snmp-utils-5.3.1-19.el5_1.1.ppc.rpm s390x: c9b9b131470084319cffc7d734ff08b9 net-snmp-5.3.1-19.el5_1.1.s390x.rpm f43517cb9a351329d2525dd1574bca9f net-snmp-debuginfo-5.3.1-19.el5_1.1.s390.rpm 76edc0d86228f2ae670312115de1bbe8 net-snmp-debuginfo-5.3.1-19.el5_1.1.s390x.rpm 03896c35c51d432fcf169de448a48d93 net-snmp-devel-5.3.1-19.el5_1.1.s390.rpm d9fde24480d96a64fc7bea1439341cfd net-snmp-devel-5.3.1-19.el5_1.1.s390x.rpm 2a103fa6f6fe73109df06f9dece7cd2a net-snmp-libs-5.3.1-19.el5_1.1.s390.rpm 20b2b726a7211d71f8265d526b0af1a3 net-snmp-libs-5.3.1-19.el5_1.1.s390x.rpm 79944498a780e4252eec3e696087a2ce net-snmp-perl-5.3.1-19.el5_1.1.s390x.rpm 6cf7d18bf82194e74444450f11613bc9 net-snmp-utils-5.3.1-19.el5_1.1.s390x.rpm x86_64: f646bd8429e51258e49d65437ac3c6c2 net-snmp-5.3.1-19.el5_1.1.x86_64.rpm 7062e95c9a6f9e57df8965a05c0f9dc9 net-snmp-debuginfo-5.3.1-19.el5_1.1.i386.rpm 8e04bc332ab89dbd465a1d6d41f04561 net-snmp-debuginfo-5.3.1-19.el5_1.1.x86_64.rpm cd49daf1fe629ae833d5c8edb5a1d2d0 net-snmp-devel-5.3.1-19.el5_1.1.i386.rpm 92462c484371821a95087a38ab97f25e net-snmp-devel-5.3.1-19.el5_1.1.x86_64.rpm 91c519849e54f3000bcaa679801a9ebc net-snmp-libs-5.3.1-19.el5_1.1.i386.rpm f4a39d88918fce124d9269581b80d197 net-snmp-libs-5.3.1-19.el5_1.1.x86_64.rpm 829b744316589fe931b3053786155fcd net-snmp-perl-5.3.1-19.el5_1.1.x86_64.rpm c6ad55d9371980081fcd7e14b6118125 net-snmp-utils-5.3.1-19.el5_1.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5846 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHPH2QXlSAg2UNWIIRAtDUAJ9/ij+JKzMq2Zwr/43S4TVhEAbUbQCgoRHq sE1ZanUnDjm7IdVyA8Inp9c= =leoU -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 22 08:39:07 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 22 Nov 2007 03:39:07 -0500 Subject: [RHSA-2007:0983-01] Moderate: conga security, bug fix, and enhancement update Message-ID: <200711220839.lAM8d71N015434@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: conga security, bug fix, and enhancement update Advisory ID: RHSA-2007:0983-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0983.html Issue date: 2007-11-21 Updated on: 2007-11-21 Product: Red Hat Cluster Suite CVE Names: CVE-2007-4136 - --------------------------------------------------------------------- 1. Summary: Updated conga packages that fix a security flaw, several bugs, and add enhancements are now available for Red Hat Cluster Suite. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Cluster Suite 4AS - i386, ia64, x86_64 Red Hat Cluster Suite 4ES - i386, ia64, x86_64 Red Hat Cluster Suite 4WS - i386, ia64, x86_64 3. Problem description: The Conga package is a web-based administration tool for remote cluster and storage management. A flaw was found in ricci during a code audit. A remote attacker who is able to connect to ricci could cause ricci to temporarily refuse additional connections, resulting in a denial of service. (CVE-2007-4136) Additionally, these updated packages fix the following bugs: * entering an invalid password when creating a new cluster with the luci web application caused a "UnboundLocalError" error. * conga did not set the the "nodename" attribute for instances of manual fencing, resulting in manual fencing being non-functional. * conga did not provide a way to remove a dead node from a cluster. Attempting to remove a dead node from a cluster resulted in an error, reporting that that the node name cannot be reached. * during cluster formation Conga reboots the cluster nodes. During reboot errors about not being able to communicate with nodes are displayed. These errors can safely be ignored, and have been removed in these updated packages. * when building a new cluster on Red Hat Enterprise Linux 4, Conga did not generate node ID attributes for clusternode tags. The node ID attributes are needed by programs such as qdisk. * during Quorum Partition Configuration, a "TypeError" error occurred if you did not configure heuristics. * when passing arguments to fence_scsi, Conga used the "nodename" attribute instead of the "node" attribute, resulting in an invalid XML file being passed to fence_scsi. The "nodename" attribute is now supported. * conga did not handle the restart operation correctly. In certain situations this resulted in nodes not being started, stopped, and restarted correctly. These issues were caused by clusters starting while others were still in the process of stopping. This has been resolved in these updated packages. * probing storage using luci and the Mozilla Firefox 2 web browser on Microsoft Windows XP appeared to never finish, when in fact it had. After probing, clicking the node name in the storage list correctly showed the storage for that node. As well, these updated packages add the following enhancements: * the Conga web interface now supports the Microsoft Internet Explorer web browser, versions 6.0 and later. * in previous packages, Conga required a minimum score to be configured even when heuristics were not being used. A minimum score is no longer required. All Conga users are advised to upgrade to these updated packages, which fix this vulnerability, resolve these issues, and add these enhancements. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 227723 - Entering bad password when creating a new cluster = UnboundLocalError: local variable 'e' referenced before assignment 238656 - conga does not set the "nodename" attribute for manual fencing 238727 - Conga provides no way to remove a dead node from a cluster 241414 - Installation using Conga shows "error" in message during reboot cycle. 245200 - Conga needs to support Internet Explorer 6.0 and later 253901 - No node IDs generated on new RHEL4 / DLM cluster 253905 - Quorum disk page: Minimum score does not need to be required 253906 - Quorum disk page: Error when trying to continue w/o a heuristic 286951 - conga passes fence_scsi nodename, where as it accepts only node 325501 - conga doesn't handle the cluster restart operation properly 336101 - CVE-2007-4136 ricci is vulnerable to a connect DoS attack 340101 - Storage redirection after probe does not work on WinXP with FF2 6. RPMs required: Red Hat Cluster Suite 4AS: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/RHCS/SRPMS/conga-0.11.0-3.src.rpm b992c3a5173d7712bbfc342dc8b28414 conga-0.11.0-3.src.rpm i386: f54f296e498593ff0f0bb26333083217 conga-debuginfo-0.11.0-3.i386.rpm aba9489bb5e5b33891f42afa30c1f6b8 luci-0.11.0-3.i386.rpm 2c414b9df48969dbe46423fa68f43599 ricci-0.11.0-3.i386.rpm ia64: b4124d5f5825535d25c6649c16344efb conga-debuginfo-0.11.0-3.ia64.rpm d7fe494639979615ac1927f3421294bf luci-0.11.0-3.ia64.rpm 5eb8e073a575c78729217ea6f9a2d939 ricci-0.11.0-3.ia64.rpm x86_64: a7288c6eb4e9667f495bbe2be78f2372 conga-debuginfo-0.11.0-3.x86_64.rpm 2c657c9aaffd6b546d943d6b6a093260 luci-0.11.0-3.x86_64.rpm 21492794c454d2903645c4a808131dce ricci-0.11.0-3.x86_64.rpm Red Hat Cluster Suite 4ES: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/RHCS/SRPMS/conga-0.11.0-3.src.rpm b992c3a5173d7712bbfc342dc8b28414 conga-0.11.0-3.src.rpm i386: f54f296e498593ff0f0bb26333083217 conga-debuginfo-0.11.0-3.i386.rpm aba9489bb5e5b33891f42afa30c1f6b8 luci-0.11.0-3.i386.rpm 2c414b9df48969dbe46423fa68f43599 ricci-0.11.0-3.i386.rpm ia64: b4124d5f5825535d25c6649c16344efb conga-debuginfo-0.11.0-3.ia64.rpm d7fe494639979615ac1927f3421294bf luci-0.11.0-3.ia64.rpm 5eb8e073a575c78729217ea6f9a2d939 ricci-0.11.0-3.ia64.rpm x86_64: a7288c6eb4e9667f495bbe2be78f2372 conga-debuginfo-0.11.0-3.x86_64.rpm 2c657c9aaffd6b546d943d6b6a093260 luci-0.11.0-3.x86_64.rpm 21492794c454d2903645c4a808131dce ricci-0.11.0-3.x86_64.rpm Red Hat Cluster Suite 4WS: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/RHCS/SRPMS/conga-0.11.0-3.src.rpm b992c3a5173d7712bbfc342dc8b28414 conga-0.11.0-3.src.rpm i386: f54f296e498593ff0f0bb26333083217 conga-debuginfo-0.11.0-3.i386.rpm aba9489bb5e5b33891f42afa30c1f6b8 luci-0.11.0-3.i386.rpm 2c414b9df48969dbe46423fa68f43599 ricci-0.11.0-3.i386.rpm ia64: b4124d5f5825535d25c6649c16344efb conga-debuginfo-0.11.0-3.ia64.rpm d7fe494639979615ac1927f3421294bf luci-0.11.0-3.ia64.rpm 5eb8e073a575c78729217ea6f9a2d939 ricci-0.11.0-3.ia64.rpm x86_64: a7288c6eb4e9667f495bbe2be78f2372 conga-debuginfo-0.11.0-3.x86_64.rpm 2c657c9aaffd6b546d943d6b6a093260 luci-0.11.0-3.x86_64.rpm 21492794c454d2903645c4a808131dce ricci-0.11.0-3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4136 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHRUAdXlSAg2UNWIIRAqrnAKDEGdaYoe6W14DrJnG/qW+BKSVgegCgoxnj jJ++aTQhAumThDfTEYq+9w0= =8ymP -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Nov 26 16:37:51 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 26 Nov 2007 11:37:51 -0500 Subject: [RHSA-2007:1041-01] Important: java-1.5.0-ibm security update Message-ID: <200711261637.lAQGbpQ7007102@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: java-1.5.0-ibm security update Advisory ID: RHSA-2007:1041-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1041.html Issue date: 2007-11-26 Updated on: 2007-11-26 Product: Red Hat Enterprise Linux Extras CVE Names: CVE-2007-5232 CVE-2007-5238 CVE-2007-5240 CVE-2007-5239 CVE-2007-5273 CVE-2007-5274 - --------------------------------------------------------------------- 1. Summary: Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 Extras - i386, ppc, s390, s390x, x86_64 Red Hat Desktop version 4 Extras - i386, x86_64 Red Hat Enterprise Linux ES version 4 Extras - i386, x86_64 Red Hat Enterprise Linux WS version 4 Extras - i386, x86_64 RHEL Desktop Supplementary (v. 5 client) - i386, x86_64 RHEL Supplementary (v. 5 server) - i386, ppc, s390x, x86_64 3. Problem description: IBM's 1.5.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit. The applet caching mechanism of the Java Runtime Environment (JRE) did not correctly process the creation of network connections. A remote attacker could use this flaw to create connections to services on machines other than the one that the applet was downloaded from. (CVE-2007-5232) Multiple vulnerabilities existed in Java Web Start allowing an untrusted application to determine the location of the Java Web Start cache. (CVE-2007-5238) Untrusted Java Web Start Applications or Java Applets were able to drag and drop a file to a Desktop Application. A user-assisted remote attacker could use this flaw to move or copy arbitrary files. (CVE-2007-5239) The Java Runtime Environment allowed untrusted Java Applets or applications to display oversized Windows. This could be used by remote attackers to hide security warning banners. (CVE-2007-5240) Unsigned Java Applets communicating via a HTTP proxy could allow a remote attacker to violate the Java security model. A cached malicious Applet could create network connections to services on other machines. (CVE-2007-5273) Unsigned Applets loaded with Mozilla Firefox or Opera browsers allowed remote attackers to violate the Java security model. A cached malicious Applet could create network connections to services on other machines. (CVE-2007-5274) All users of java-ibm-1.5.0 are advised to upgrade to these updated packages, that contain IBM's 1.5.0 SR6 Java release which resolves these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 321951 - CVE-2007-5232 Security Vulnerability in Java Runtime Environment With Applet Caching 321961 - CVE-2007-5238 Vulnerabilities in Java Web Start allow to determine the location of the Java Web Start cache 321981 - CVE-2007-5239 Untrusted Application or Applet May Move or Copy Arbitrary Files 321991 - CVE-2007-5240 Applets or Applications are allowed to display an oversized window 324351 - CVE-2007-5273 Anti-DNS Pinning and Java Applets with HTTP proxy 324361 - CVE-2007-5274 Anti-DNS Pinning and Java Applets with Opera and Firefox 6. RPMs required: Red Hat Enterprise Linux AS version 4 Extras: i386: e15067ac99dcad64abcadcbedb96a84e java-1.5.0-ibm-1.5.0.6-1jpp.2.el4.i386.rpm ce939bbc0a3e0f3c4a9a6037ea761d2d java-1.5.0-ibm-demo-1.5.0.6-1jpp.2.el4.i386.rpm 86f2c3208e20de2760e8e8ca680087ea java-1.5.0-ibm-devel-1.5.0.6-1jpp.2.el4.i386.rpm 20ca5a3a1477ce8c65b5bf2c3e0c6ccf java-1.5.0-ibm-javacomm-1.5.0.6-1jpp.2.el4.i386.rpm c64612a75c3e0599ad493654993f60d4 java-1.5.0-ibm-jdbc-1.5.0.6-1jpp.2.el4.i386.rpm d80af924a9953699a3dff9324ce7954c java-1.5.0-ibm-plugin-1.5.0.6-1jpp.2.el4.i386.rpm c8c4177d09a8b72078093ad110b3931b java-1.5.0-ibm-src-1.5.0.6-1jpp.2.el4.i386.rpm ppc: 241b6c22fdf49184eec8fc268815a8f0 java-1.5.0-ibm-1.5.0.6-1jpp.2.el4.ppc.rpm 049eaf2704ea1fd0842a9f344eeeab13 java-1.5.0-ibm-demo-1.5.0.6-1jpp.2.el4.ppc.rpm 9e9af52a7bc14b53bb0ccf42b28de62f java-1.5.0-ibm-devel-1.5.0.6-1jpp.2.el4.ppc.rpm 35cd47c0a7003c59bfcf0f18d080e35d java-1.5.0-ibm-javacomm-1.5.0.6-1jpp.2.el4.ppc.rpm 27747c7a33314ad97bfb4dfbc6c48941 java-1.5.0-ibm-jdbc-1.5.0.6-1jpp.2.el4.ppc.rpm 613c10ef388afb5a1b3b68713597591d java-1.5.0-ibm-plugin-1.5.0.6-1jpp.2.el4.ppc.rpm 39993b5da04fd4f9a0d749f25645ca06 java-1.5.0-ibm-src-1.5.0.6-1jpp.2.el4.ppc.rpm s390: 7b8012b41585b018725afd72037c1978 java-1.5.0-ibm-1.5.0.6-1jpp.2.el4.s390.rpm 0b146db1c1a1baa7586c663ab90d9293 java-1.5.0-ibm-demo-1.5.0.6-1jpp.2.el4.s390.rpm e25e60c8b431d56e8d8c8d01ebe17ee0 java-1.5.0-ibm-devel-1.5.0.6-1jpp.2.el4.s390.rpm 73173158d64b9abafd158c2589e04e95 java-1.5.0-ibm-jdbc-1.5.0.6-1jpp.2.el4.s390.rpm 18818bc7a267daf7041751f5b6a0012b java-1.5.0-ibm-src-1.5.0.6-1jpp.2.el4.s390.rpm s390x: 991a9758c6326d8d8b1120e537d781e0 java-1.5.0-ibm-1.5.0.6-1jpp.2.el4.s390x.rpm ff20b1f8c0bea378eabccd74dc45022f java-1.5.0-ibm-demo-1.5.0.6-1jpp.2.el4.s390x.rpm ee9de2d3068702fec31200637dfef9c3 java-1.5.0-ibm-devel-1.5.0.6-1jpp.2.el4.s390x.rpm 455f843de5999f28da0cd59f58740c65 java-1.5.0-ibm-src-1.5.0.6-1jpp.2.el4.s390x.rpm x86_64: 3057d92c6e393dc072333afa9664f6f6 java-1.5.0-ibm-1.5.0.6-1jpp.2.el4.x86_64.rpm 071b359355b6f3db5eead5e1a7814fed java-1.5.0-ibm-demo-1.5.0.6-1jpp.2.el4.x86_64.rpm 69ae9391bbe240b756a46a9db6936413 java-1.5.0-ibm-devel-1.5.0.6-1jpp.2.el4.x86_64.rpm 85719eba249505b867522b5c5a148a91 java-1.5.0-ibm-javacomm-1.5.0.6-1jpp.2.el4.x86_64.rpm 1de416d967b6ffc1bd95cae97eb3d039 java-1.5.0-ibm-src-1.5.0.6-1jpp.2.el4.x86_64.rpm Red Hat Desktop version 4 Extras: i386: e15067ac99dcad64abcadcbedb96a84e java-1.5.0-ibm-1.5.0.6-1jpp.2.el4.i386.rpm ce939bbc0a3e0f3c4a9a6037ea761d2d java-1.5.0-ibm-demo-1.5.0.6-1jpp.2.el4.i386.rpm 86f2c3208e20de2760e8e8ca680087ea java-1.5.0-ibm-devel-1.5.0.6-1jpp.2.el4.i386.rpm 20ca5a3a1477ce8c65b5bf2c3e0c6ccf java-1.5.0-ibm-javacomm-1.5.0.6-1jpp.2.el4.i386.rpm c64612a75c3e0599ad493654993f60d4 java-1.5.0-ibm-jdbc-1.5.0.6-1jpp.2.el4.i386.rpm d80af924a9953699a3dff9324ce7954c java-1.5.0-ibm-plugin-1.5.0.6-1jpp.2.el4.i386.rpm c8c4177d09a8b72078093ad110b3931b java-1.5.0-ibm-src-1.5.0.6-1jpp.2.el4.i386.rpm x86_64: 3057d92c6e393dc072333afa9664f6f6 java-1.5.0-ibm-1.5.0.6-1jpp.2.el4.x86_64.rpm 071b359355b6f3db5eead5e1a7814fed java-1.5.0-ibm-demo-1.5.0.6-1jpp.2.el4.x86_64.rpm 69ae9391bbe240b756a46a9db6936413 java-1.5.0-ibm-devel-1.5.0.6-1jpp.2.el4.x86_64.rpm 85719eba249505b867522b5c5a148a91 java-1.5.0-ibm-javacomm-1.5.0.6-1jpp.2.el4.x86_64.rpm 1de416d967b6ffc1bd95cae97eb3d039 java-1.5.0-ibm-src-1.5.0.6-1jpp.2.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4 Extras: i386: e15067ac99dcad64abcadcbedb96a84e java-1.5.0-ibm-1.5.0.6-1jpp.2.el4.i386.rpm ce939bbc0a3e0f3c4a9a6037ea761d2d java-1.5.0-ibm-demo-1.5.0.6-1jpp.2.el4.i386.rpm 86f2c3208e20de2760e8e8ca680087ea java-1.5.0-ibm-devel-1.5.0.6-1jpp.2.el4.i386.rpm 20ca5a3a1477ce8c65b5bf2c3e0c6ccf java-1.5.0-ibm-javacomm-1.5.0.6-1jpp.2.el4.i386.rpm c64612a75c3e0599ad493654993f60d4 java-1.5.0-ibm-jdbc-1.5.0.6-1jpp.2.el4.i386.rpm d80af924a9953699a3dff9324ce7954c java-1.5.0-ibm-plugin-1.5.0.6-1jpp.2.el4.i386.rpm c8c4177d09a8b72078093ad110b3931b java-1.5.0-ibm-src-1.5.0.6-1jpp.2.el4.i386.rpm x86_64: 3057d92c6e393dc072333afa9664f6f6 java-1.5.0-ibm-1.5.0.6-1jpp.2.el4.x86_64.rpm 071b359355b6f3db5eead5e1a7814fed java-1.5.0-ibm-demo-1.5.0.6-1jpp.2.el4.x86_64.rpm 69ae9391bbe240b756a46a9db6936413 java-1.5.0-ibm-devel-1.5.0.6-1jpp.2.el4.x86_64.rpm 85719eba249505b867522b5c5a148a91 java-1.5.0-ibm-javacomm-1.5.0.6-1jpp.2.el4.x86_64.rpm 1de416d967b6ffc1bd95cae97eb3d039 java-1.5.0-ibm-src-1.5.0.6-1jpp.2.el4.x86_64.rpm Red Hat Enterprise Linux WS version 4 Extras: i386: e15067ac99dcad64abcadcbedb96a84e java-1.5.0-ibm-1.5.0.6-1jpp.2.el4.i386.rpm ce939bbc0a3e0f3c4a9a6037ea761d2d java-1.5.0-ibm-demo-1.5.0.6-1jpp.2.el4.i386.rpm 86f2c3208e20de2760e8e8ca680087ea java-1.5.0-ibm-devel-1.5.0.6-1jpp.2.el4.i386.rpm 20ca5a3a1477ce8c65b5bf2c3e0c6ccf java-1.5.0-ibm-javacomm-1.5.0.6-1jpp.2.el4.i386.rpm c64612a75c3e0599ad493654993f60d4 java-1.5.0-ibm-jdbc-1.5.0.6-1jpp.2.el4.i386.rpm d80af924a9953699a3dff9324ce7954c java-1.5.0-ibm-plugin-1.5.0.6-1jpp.2.el4.i386.rpm c8c4177d09a8b72078093ad110b3931b java-1.5.0-ibm-src-1.5.0.6-1jpp.2.el4.i386.rpm x86_64: 3057d92c6e393dc072333afa9664f6f6 java-1.5.0-ibm-1.5.0.6-1jpp.2.el4.x86_64.rpm 071b359355b6f3db5eead5e1a7814fed java-1.5.0-ibm-demo-1.5.0.6-1jpp.2.el4.x86_64.rpm 69ae9391bbe240b756a46a9db6936413 java-1.5.0-ibm-devel-1.5.0.6-1jpp.2.el4.x86_64.rpm 85719eba249505b867522b5c5a148a91 java-1.5.0-ibm-javacomm-1.5.0.6-1jpp.2.el4.x86_64.rpm 1de416d967b6ffc1bd95cae97eb3d039 java-1.5.0-ibm-src-1.5.0.6-1jpp.2.el4.x86_64.rpm RHEL Desktop Supplementary (v. 5 client): i386: 26d45b0a4fa12aa64f0aa2e8e51b11f2 java-1.5.0-ibm-1.5.0.6-1jpp.1.el5.i386.rpm 89be591c9676566fda41e19d11ccf0bf java-1.5.0-ibm-accessibility-1.5.0.6-1jpp.1.el5.i386.rpm 4eba0802cb69e5c63e90112cfad9baaa java-1.5.0-ibm-demo-1.5.0.6-1jpp.1.el5.i386.rpm 3dbbf8d74e8534ae4bab682529a27ca8 java-1.5.0-ibm-devel-1.5.0.6-1jpp.1.el5.i386.rpm 0f679221f1728de9d02ccb695418c488 java-1.5.0-ibm-javacomm-1.5.0.6-1jpp.1.el5.i386.rpm 3f98f883a6d539cf722c6460cc00e6d2 java-1.5.0-ibm-jdbc-1.5.0.6-1jpp.1.el5.i386.rpm 4f9239ab211e64a3c84159d8b2597f14 java-1.5.0-ibm-plugin-1.5.0.6-1jpp.1.el5.i386.rpm 278b234d0406b3446e6adaff24f232df java-1.5.0-ibm-src-1.5.0.6-1jpp.1.el5.i386.rpm x86_64: 26d45b0a4fa12aa64f0aa2e8e51b11f2 java-1.5.0-ibm-1.5.0.6-1jpp.1.el5.i386.rpm d3c4978d1b9b0238a8093fa013f1c1bb java-1.5.0-ibm-1.5.0.6-1jpp.1.el5.x86_64.rpm 2fdd16e46466b718785d1c52ef1d0201 java-1.5.0-ibm-accessibility-1.5.0.6-1jpp.1.el5.x86_64.rpm 4eba0802cb69e5c63e90112cfad9baaa java-1.5.0-ibm-demo-1.5.0.6-1jpp.1.el5.i386.rpm bf90231176791bf5d281105fa4f52d00 java-1.5.0-ibm-demo-1.5.0.6-1jpp.1.el5.x86_64.rpm 3dbbf8d74e8534ae4bab682529a27ca8 java-1.5.0-ibm-devel-1.5.0.6-1jpp.1.el5.i386.rpm 0205b7ed64d4f6f6965b4b9e91a7ade6 java-1.5.0-ibm-devel-1.5.0.6-1jpp.1.el5.x86_64.rpm 0f679221f1728de9d02ccb695418c488 java-1.5.0-ibm-javacomm-1.5.0.6-1jpp.1.el5.i386.rpm f6518b5042342fa398507e50ea0b9bac java-1.5.0-ibm-javacomm-1.5.0.6-1jpp.1.el5.x86_64.rpm 3f98f883a6d539cf722c6460cc00e6d2 java-1.5.0-ibm-jdbc-1.5.0.6-1jpp.1.el5.i386.rpm 4f9239ab211e64a3c84159d8b2597f14 java-1.5.0-ibm-plugin-1.5.0.6-1jpp.1.el5.i386.rpm 278b234d0406b3446e6adaff24f232df java-1.5.0-ibm-src-1.5.0.6-1jpp.1.el5.i386.rpm 7e198f6586130a0322082eaec54e34b7 java-1.5.0-ibm-src-1.5.0.6-1jpp.1.el5.x86_64.rpm RHEL Supplementary (v. 5 server): i386: 26d45b0a4fa12aa64f0aa2e8e51b11f2 java-1.5.0-ibm-1.5.0.6-1jpp.1.el5.i386.rpm 89be591c9676566fda41e19d11ccf0bf java-1.5.0-ibm-accessibility-1.5.0.6-1jpp.1.el5.i386.rpm 4eba0802cb69e5c63e90112cfad9baaa java-1.5.0-ibm-demo-1.5.0.6-1jpp.1.el5.i386.rpm 3dbbf8d74e8534ae4bab682529a27ca8 java-1.5.0-ibm-devel-1.5.0.6-1jpp.1.el5.i386.rpm 0f679221f1728de9d02ccb695418c488 java-1.5.0-ibm-javacomm-1.5.0.6-1jpp.1.el5.i386.rpm 3f98f883a6d539cf722c6460cc00e6d2 java-1.5.0-ibm-jdbc-1.5.0.6-1jpp.1.el5.i386.rpm 4f9239ab211e64a3c84159d8b2597f14 java-1.5.0-ibm-plugin-1.5.0.6-1jpp.1.el5.i386.rpm 278b234d0406b3446e6adaff24f232df java-1.5.0-ibm-src-1.5.0.6-1jpp.1.el5.i386.rpm ppc: 71b4a848eaa3073df7b92d9eedc328d9 java-1.5.0-ibm-1.5.0.6-1jpp.1.el5.ppc.rpm f770236366a4cf297f7b1e7b6f42a560 java-1.5.0-ibm-accessibility-1.5.0.6-1jpp.1.el5.ppc.rpm f619eaafe26bb9a253dc7a409eb1c945 java-1.5.0-ibm-demo-1.5.0.6-1jpp.1.el5.ppc.rpm dd5094d526aec736c6046d359a184cbe java-1.5.0-ibm-devel-1.5.0.6-1jpp.1.el5.ppc.rpm 538153c1bf443c3a74292498f05d33de java-1.5.0-ibm-javacomm-1.5.0.6-1jpp.1.el5.ppc.rpm ee1caaa70e1c74c9c686b500008ee0d9 java-1.5.0-ibm-jdbc-1.5.0.6-1jpp.1.el5.ppc.rpm f3ec864a414ca442a232d222d7b2f25b java-1.5.0-ibm-plugin-1.5.0.6-1jpp.1.el5.ppc.rpm eb9e7fc6b8b219940dc8e475646ca57c java-1.5.0-ibm-src-1.5.0.6-1jpp.1.el5.ppc.rpm s390x: 63e8974ecb1575b7dcf618edd4da0c9e java-1.5.0-ibm-1.5.0.6-1jpp.1.el5.s390.rpm 3282cda4fb2a564ae32b87f16ed25102 java-1.5.0-ibm-1.5.0.6-1jpp.1.el5.s390x.rpm 1fa0a224fbb3d89e2040ac03fe436ce7 java-1.5.0-ibm-accessibility-1.5.0.6-1jpp.1.el5.s390x.rpm ceae02ae20672f342fdeb1d040aa739b java-1.5.0-ibm-demo-1.5.0.6-1jpp.1.el5.s390.rpm 870d72af0b72e9f130c1e6ed3b5c3292 java-1.5.0-ibm-demo-1.5.0.6-1jpp.1.el5.s390x.rpm d10e165aa54cf7ed3cd00543f92512cb java-1.5.0-ibm-devel-1.5.0.6-1jpp.1.el5.s390.rpm 39da8c3516113e827bcdbd5b586bc043 java-1.5.0-ibm-devel-1.5.0.6-1jpp.1.el5.s390x.rpm 1a017c89956c354a13816e787ab0d557 java-1.5.0-ibm-jdbc-1.5.0.6-1jpp.1.el5.s390.rpm f06637ef211e408a2743de580b88feb4 java-1.5.0-ibm-src-1.5.0.6-1jpp.1.el5.s390.rpm 96de763d2a75d7d863e7da8b94b77aa4 java-1.5.0-ibm-src-1.5.0.6-1jpp.1.el5.s390x.rpm x86_64: 26d45b0a4fa12aa64f0aa2e8e51b11f2 java-1.5.0-ibm-1.5.0.6-1jpp.1.el5.i386.rpm d3c4978d1b9b0238a8093fa013f1c1bb java-1.5.0-ibm-1.5.0.6-1jpp.1.el5.x86_64.rpm 2fdd16e46466b718785d1c52ef1d0201 java-1.5.0-ibm-accessibility-1.5.0.6-1jpp.1.el5.x86_64.rpm 4eba0802cb69e5c63e90112cfad9baaa java-1.5.0-ibm-demo-1.5.0.6-1jpp.1.el5.i386.rpm bf90231176791bf5d281105fa4f52d00 java-1.5.0-ibm-demo-1.5.0.6-1jpp.1.el5.x86_64.rpm 3dbbf8d74e8534ae4bab682529a27ca8 java-1.5.0-ibm-devel-1.5.0.6-1jpp.1.el5.i386.rpm 0205b7ed64d4f6f6965b4b9e91a7ade6 java-1.5.0-ibm-devel-1.5.0.6-1jpp.1.el5.x86_64.rpm 0f679221f1728de9d02ccb695418c488 java-1.5.0-ibm-javacomm-1.5.0.6-1jpp.1.el5.i386.rpm f6518b5042342fa398507e50ea0b9bac java-1.5.0-ibm-javacomm-1.5.0.6-1jpp.1.el5.x86_64.rpm 3f98f883a6d539cf722c6460cc00e6d2 java-1.5.0-ibm-jdbc-1.5.0.6-1jpp.1.el5.i386.rpm 4f9239ab211e64a3c84159d8b2597f14 java-1.5.0-ibm-plugin-1.5.0.6-1jpp.1.el5.i386.rpm 278b234d0406b3446e6adaff24f232df java-1.5.0-ibm-src-1.5.0.6-1jpp.1.el5.i386.rpm 7e198f6586130a0322082eaec54e34b7 java-1.5.0-ibm-src-1.5.0.6-1jpp.1.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5232 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5238 http://cve.mitre.org/cgi-bin/cvename.cgi?name= http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5240 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5239 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5273 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5274 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHSvZbXlSAg2UNWIIRAkcZAKCF11TDSKLkOYbeNk6tCV4utUSdeACff9AD tQPoGlc+4qvd3iigdHwGUxA= =3Z2U -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Nov 26 23:38:25 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 26 Nov 2007 18:38:25 -0500 Subject: [RHSA-2007:1082-01] Critical: firefox security update Message-ID: <200711262338.lAQNcPIX009019@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Critical: firefox security update Advisory ID: RHSA-2007:1082-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1082.html Issue date: 2007-11-26 Updated on: 2007-11-26 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-5947 CVE-2007-5959 CVE-2007-5960 - --------------------------------------------------------------------- 1. Summary: Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux AS version 4.5.z - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux ES version 4.5.z - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: Mozilla Firefox is an open source Web browser. A cross-site scripting flaw was found in the way Firefox handled the jar: URI scheme. It was possible for a malicious website to leverage this flaw and conduct a cross-site scripting attack against a user running Firefox. (CVE-2007-5947) Several flaws were found in the way Firefox processed certain malformed web content. A webpage containing malicious content could cause Firefox to crash, or potentially execute arbitrary code as the user running Firefox. (CVE-2007-5959) A race condition existed when Firefox set the "window.location" property for a webpage. This flaw could allow a webpage to set an arbitrary Referer header, which may lead to a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header for protection. (CVE-2007-5960) Users of Firefox are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 394211 - CVE-2007-5947 Mozilla jar: protocol XSS 394241 - CVE-2007-5959 Multiple flaws in Firefox 394261 - CVE-2007-5960 Mozilla Cross-site Request Forgery flaw 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/firefox-1.5.0.12-0.8.el4.src.rpm e2c978d4b14f9cf19a8e39de02583008 firefox-1.5.0.12-0.8.el4.src.rpm i386: 7c65767dfdaed3f752ff8d2432bbbb87 firefox-1.5.0.12-0.8.el4.i386.rpm f370caeea0a992722a3856d63da52b1f firefox-debuginfo-1.5.0.12-0.8.el4.i386.rpm ia64: 1cf6f4a4b1555f8da1c9f6a69ad7f51a firefox-1.5.0.12-0.8.el4.ia64.rpm 82eb56cadb11007f53a485bb4278f13a firefox-debuginfo-1.5.0.12-0.8.el4.ia64.rpm ppc: 2849e6a776fe9d7427f373d2634051bd firefox-1.5.0.12-0.8.el4.ppc.rpm 20e0e2ef9266025221beca008d75eaa0 firefox-debuginfo-1.5.0.12-0.8.el4.ppc.rpm s390: 39c83103495fb726421799de80f8553d firefox-1.5.0.12-0.8.el4.s390.rpm d899e6879dbae602227a1326a78d92d2 firefox-debuginfo-1.5.0.12-0.8.el4.s390.rpm s390x: 719c9da1a4d6c07b5ffa970859d687bf firefox-1.5.0.12-0.8.el4.s390x.rpm baa53ea0dd0d4e423acbdbbf06eb9363 firefox-debuginfo-1.5.0.12-0.8.el4.s390x.rpm x86_64: 07ae1640a44aed479a5d6afb668ed6ee firefox-1.5.0.12-0.8.el4.x86_64.rpm bf2c92230f3dcd965145c900eac0e803 firefox-debuginfo-1.5.0.12-0.8.el4.x86_64.rpm Red Hat Enterprise Linux AS version 4.5.z: SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/4AS-4.5.z/en/os/SRPMS/firefox-1.5.0.12-0.8.el4.src.rpm e2c978d4b14f9cf19a8e39de02583008 firefox-1.5.0.12-0.8.el4.src.rpm i386: 7c65767dfdaed3f752ff8d2432bbbb87 firefox-1.5.0.12-0.8.el4.i386.rpm f370caeea0a992722a3856d63da52b1f firefox-debuginfo-1.5.0.12-0.8.el4.i386.rpm ia64: 1cf6f4a4b1555f8da1c9f6a69ad7f51a firefox-1.5.0.12-0.8.el4.ia64.rpm 82eb56cadb11007f53a485bb4278f13a firefox-debuginfo-1.5.0.12-0.8.el4.ia64.rpm ppc: 2849e6a776fe9d7427f373d2634051bd firefox-1.5.0.12-0.8.el4.ppc.rpm 20e0e2ef9266025221beca008d75eaa0 firefox-debuginfo-1.5.0.12-0.8.el4.ppc.rpm s390: 39c83103495fb726421799de80f8553d firefox-1.5.0.12-0.8.el4.s390.rpm d899e6879dbae602227a1326a78d92d2 firefox-debuginfo-1.5.0.12-0.8.el4.s390.rpm s390x: 719c9da1a4d6c07b5ffa970859d687bf firefox-1.5.0.12-0.8.el4.s390x.rpm baa53ea0dd0d4e423acbdbbf06eb9363 firefox-debuginfo-1.5.0.12-0.8.el4.s390x.rpm x86_64: 07ae1640a44aed479a5d6afb668ed6ee firefox-1.5.0.12-0.8.el4.x86_64.rpm bf2c92230f3dcd965145c900eac0e803 firefox-debuginfo-1.5.0.12-0.8.el4.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/firefox-1.5.0.12-0.8.el4.src.rpm e2c978d4b14f9cf19a8e39de02583008 firefox-1.5.0.12-0.8.el4.src.rpm i386: 7c65767dfdaed3f752ff8d2432bbbb87 firefox-1.5.0.12-0.8.el4.i386.rpm f370caeea0a992722a3856d63da52b1f firefox-debuginfo-1.5.0.12-0.8.el4.i386.rpm x86_64: 07ae1640a44aed479a5d6afb668ed6ee firefox-1.5.0.12-0.8.el4.x86_64.rpm bf2c92230f3dcd965145c900eac0e803 firefox-debuginfo-1.5.0.12-0.8.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/firefox-1.5.0.12-0.8.el4.src.rpm e2c978d4b14f9cf19a8e39de02583008 firefox-1.5.0.12-0.8.el4.src.rpm i386: 7c65767dfdaed3f752ff8d2432bbbb87 firefox-1.5.0.12-0.8.el4.i386.rpm f370caeea0a992722a3856d63da52b1f firefox-debuginfo-1.5.0.12-0.8.el4.i386.rpm ia64: 1cf6f4a4b1555f8da1c9f6a69ad7f51a firefox-1.5.0.12-0.8.el4.ia64.rpm 82eb56cadb11007f53a485bb4278f13a firefox-debuginfo-1.5.0.12-0.8.el4.ia64.rpm x86_64: 07ae1640a44aed479a5d6afb668ed6ee firefox-1.5.0.12-0.8.el4.x86_64.rpm bf2c92230f3dcd965145c900eac0e803 firefox-debuginfo-1.5.0.12-0.8.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4.5.z: SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/4ES-4.5.z/en/os/SRPMS/firefox-1.5.0.12-0.8.el4.src.rpm e2c978d4b14f9cf19a8e39de02583008 firefox-1.5.0.12-0.8.el4.src.rpm i386: 7c65767dfdaed3f752ff8d2432bbbb87 firefox-1.5.0.12-0.8.el4.i386.rpm f370caeea0a992722a3856d63da52b1f firefox-debuginfo-1.5.0.12-0.8.el4.i386.rpm ia64: 1cf6f4a4b1555f8da1c9f6a69ad7f51a firefox-1.5.0.12-0.8.el4.ia64.rpm 82eb56cadb11007f53a485bb4278f13a firefox-debuginfo-1.5.0.12-0.8.el4.ia64.rpm x86_64: 07ae1640a44aed479a5d6afb668ed6ee firefox-1.5.0.12-0.8.el4.x86_64.rpm bf2c92230f3dcd965145c900eac0e803 firefox-debuginfo-1.5.0.12-0.8.el4.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/firefox-1.5.0.12-0.8.el4.src.rpm e2c978d4b14f9cf19a8e39de02583008 firefox-1.5.0.12-0.8.el4.src.rpm i386: 7c65767dfdaed3f752ff8d2432bbbb87 firefox-1.5.0.12-0.8.el4.i386.rpm f370caeea0a992722a3856d63da52b1f firefox-debuginfo-1.5.0.12-0.8.el4.i386.rpm ia64: 1cf6f4a4b1555f8da1c9f6a69ad7f51a firefox-1.5.0.12-0.8.el4.ia64.rpm 82eb56cadb11007f53a485bb4278f13a firefox-debuginfo-1.5.0.12-0.8.el4.ia64.rpm x86_64: 07ae1640a44aed479a5d6afb668ed6ee firefox-1.5.0.12-0.8.el4.x86_64.rpm bf2c92230f3dcd965145c900eac0e803 firefox-debuginfo-1.5.0.12-0.8.el4.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/firefox-1.5.0.12-7.el5.src.rpm 9e6f9f8659b25e6420a1f395bbe09896 firefox-1.5.0.12-7.el5.src.rpm i386: e1b690ba4dfdd41e20aacfbb9d8fbb9a firefox-1.5.0.12-7.el5.i386.rpm e576368db6ed9eb70c65a596d5d684aa firefox-debuginfo-1.5.0.12-7.el5.i386.rpm x86_64: e1b690ba4dfdd41e20aacfbb9d8fbb9a firefox-1.5.0.12-7.el5.i386.rpm 88f3e7c170437da320696055350436dc firefox-1.5.0.12-7.el5.x86_64.rpm e576368db6ed9eb70c65a596d5d684aa firefox-debuginfo-1.5.0.12-7.el5.i386.rpm bdddabfbc73567c7537291b931abee4c firefox-debuginfo-1.5.0.12-7.el5.x86_64.rpm RHEL Desktop Workstation (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/firefox-1.5.0.12-7.el5.src.rpm 9e6f9f8659b25e6420a1f395bbe09896 firefox-1.5.0.12-7.el5.src.rpm i386: e576368db6ed9eb70c65a596d5d684aa firefox-debuginfo-1.5.0.12-7.el5.i386.rpm 06509ba586d9f37e71483107137f7843 firefox-devel-1.5.0.12-7.el5.i386.rpm x86_64: e576368db6ed9eb70c65a596d5d684aa firefox-debuginfo-1.5.0.12-7.el5.i386.rpm bdddabfbc73567c7537291b931abee4c firefox-debuginfo-1.5.0.12-7.el5.x86_64.rpm 06509ba586d9f37e71483107137f7843 firefox-devel-1.5.0.12-7.el5.i386.rpm ca90b71f3c70b0543a91cea11aec9b08 firefox-devel-1.5.0.12-7.el5.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/firefox-1.5.0.12-7.el5.src.rpm 9e6f9f8659b25e6420a1f395bbe09896 firefox-1.5.0.12-7.el5.src.rpm i386: e1b690ba4dfdd41e20aacfbb9d8fbb9a firefox-1.5.0.12-7.el5.i386.rpm e576368db6ed9eb70c65a596d5d684aa firefox-debuginfo-1.5.0.12-7.el5.i386.rpm 06509ba586d9f37e71483107137f7843 firefox-devel-1.5.0.12-7.el5.i386.rpm ia64: 695649f81669a4bafb978c88c642a39d firefox-1.5.0.12-7.el5.ia64.rpm ca793f2ebcfc331a8e268959ee4d6eb4 firefox-debuginfo-1.5.0.12-7.el5.ia64.rpm e83a2c4bbf2b8a8047eff54a92c73cf0 firefox-devel-1.5.0.12-7.el5.ia64.rpm ppc: 2cd4f2936f18ce3aadc7738dcd1f64a5 firefox-1.5.0.12-7.el5.ppc.rpm 07bde30423e53504cac2c903b98f166d firefox-debuginfo-1.5.0.12-7.el5.ppc.rpm f974e753a4a1406e0f2c765bd1c6a903 firefox-devel-1.5.0.12-7.el5.ppc.rpm s390x: 275ec90ac2e5119ef3a368f3635a6bed firefox-1.5.0.12-7.el5.s390.rpm f555a92ba6d9ccdab5b4f02dc6e0d486 firefox-1.5.0.12-7.el5.s390x.rpm 801eeef24bc79972ffeac00345bc4826 firefox-debuginfo-1.5.0.12-7.el5.s390.rpm ddeb88632059d8fde675a8bbcb81bb0f firefox-debuginfo-1.5.0.12-7.el5.s390x.rpm 6047f5e8ba382cca4e49bd203382ff33 firefox-devel-1.5.0.12-7.el5.s390.rpm 9ecba47676489b65b5975f32c3332d0f firefox-devel-1.5.0.12-7.el5.s390x.rpm x86_64: e1b690ba4dfdd41e20aacfbb9d8fbb9a firefox-1.5.0.12-7.el5.i386.rpm 88f3e7c170437da320696055350436dc firefox-1.5.0.12-7.el5.x86_64.rpm e576368db6ed9eb70c65a596d5d684aa firefox-debuginfo-1.5.0.12-7.el5.i386.rpm bdddabfbc73567c7537291b931abee4c firefox-debuginfo-1.5.0.12-7.el5.x86_64.rpm 06509ba586d9f37e71483107137f7843 firefox-devel-1.5.0.12-7.el5.i386.rpm ca90b71f3c70b0543a91cea11aec9b08 firefox-devel-1.5.0.12-7.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5947 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5959 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5960 http://www.redhat.com/security/updates/classification/#critical 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHS1juXlSAg2UNWIIRAoInAJ40qomr+lUcuk9bAMCHrznL2mnLMgCfYO2s 5B1V7B+O62KTYbKE9vMkCWE= =xxN3 -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Nov 26 23:38:31 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 26 Nov 2007 18:38:31 -0500 Subject: [RHSA-2007:1084-01] Critical: seamonkey security update Message-ID: <200711262338.lAQNcVC8009030@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Critical: seamonkey security update Advisory ID: RHSA-2007:1084-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1084.html Issue date: 2007-11-26 Updated on: 2007-11-26 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-5947 CVE-2007-5959 CVE-2007-5960 - --------------------------------------------------------------------- 1. Summary: Updated seamonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux AS version 4.5.z - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux ES version 4.5.z - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. A cross-site scripting flaw was found in the way SeaMonkey handled the jar: URI scheme. It was possible for a malicious website to leverage this flaw and conduct a cross-site scripting attack against a user running SeaMonkey. (CVE-2007-5947) Several flaws were found in the way SeaMonkey processed certain malformed web content. A webpage containing malicious content could cause SeaMonkey to crash, or potentially execute arbitrary code as the user running SeaMonkey. (CVE-2007-5959) A race condition existed when Seamonkey set the "window.location" property for a webpage. This flaw could allow a webpage to set an arbitrary Referer header, which may lead to a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header for protection. (CVE-2007-5960) Users of SeaMonkey are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 394211 - CVE-2007-5947 Mozilla jar: protocol XSS 394241 - CVE-2007-5959 Multiple flaws in Firefox 394261 - CVE-2007-5960 Mozilla Cross-site Request Forgery flaw 6. RPMs required: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 : SRPMS: ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/seamonkey-1.0.9-0.7.el2.src.rpm b912d533646c8703a482eef801a4b5fc seamonkey-1.0.9-0.7.el2.src.rpm i386: 520f5e21449de9fc5ab38bb783ae9ed7 seamonkey-1.0.9-0.7.el2.i386.rpm c7dfa804769bb02c0f05931ac5dc70b4 seamonkey-chat-1.0.9-0.7.el2.i386.rpm 6a57ae6ac78b9acff2ea1cb467ffa49a seamonkey-devel-1.0.9-0.7.el2.i386.rpm 88e302a64d768049031bafecd5c15311 seamonkey-dom-inspector-1.0.9-0.7.el2.i386.rpm bfa7270acacce6ff415a5c0e0191a7c2 seamonkey-js-debugger-1.0.9-0.7.el2.i386.rpm b27200ea97bcfe686ed4e3c1442a9f62 seamonkey-mail-1.0.9-0.7.el2.i386.rpm 8c3b4b7c927af3e3bc0e8b5b1776f24d seamonkey-nspr-1.0.9-0.7.el2.i386.rpm cc7bec92ad5e06a94a19697db9e99361 seamonkey-nspr-devel-1.0.9-0.7.el2.i386.rpm 6663d9fe56bb4a98e2735f4bdeebe1fc seamonkey-nss-1.0.9-0.7.el2.i386.rpm d4d15e69b6f47c6dd511d0534ed8d29e seamonkey-nss-devel-1.0.9-0.7.el2.i386.rpm ia64: 7406a507e63346669ab3fa683c085b56 seamonkey-1.0.9-0.7.el2.ia64.rpm ca50b4b214102de8234ccc002b56f69f seamonkey-chat-1.0.9-0.7.el2.ia64.rpm 20b219de14683592dcb6ef0c1b5eaf39 seamonkey-devel-1.0.9-0.7.el2.ia64.rpm ece83067d962a956d7848ea5a3470054 seamonkey-dom-inspector-1.0.9-0.7.el2.ia64.rpm f4d3bb0a287051482a2d42e847d08cd6 seamonkey-js-debugger-1.0.9-0.7.el2.ia64.rpm e941959949f2a1378c5e433725fd9425 seamonkey-mail-1.0.9-0.7.el2.ia64.rpm fb50d54e8a64b1f43a2a59ea8f8fd060 seamonkey-nspr-1.0.9-0.7.el2.ia64.rpm a9e1a0a56aa34062786fcac1ee080735 seamonkey-nspr-devel-1.0.9-0.7.el2.ia64.rpm 31f8c9ef4aa9609d6998a855161b0d85 seamonkey-nss-1.0.9-0.7.el2.ia64.rpm 8a06a970dd2df512c153800490b1b3b5 seamonkey-nss-devel-1.0.9-0.7.el2.ia64.rpm Red Hat Linux Advanced Workstation 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/seamonkey-1.0.9-0.7.el2.src.rpm b912d533646c8703a482eef801a4b5fc seamonkey-1.0.9-0.7.el2.src.rpm ia64: 7406a507e63346669ab3fa683c085b56 seamonkey-1.0.9-0.7.el2.ia64.rpm ca50b4b214102de8234ccc002b56f69f seamonkey-chat-1.0.9-0.7.el2.ia64.rpm 20b219de14683592dcb6ef0c1b5eaf39 seamonkey-devel-1.0.9-0.7.el2.ia64.rpm ece83067d962a956d7848ea5a3470054 seamonkey-dom-inspector-1.0.9-0.7.el2.ia64.rpm f4d3bb0a287051482a2d42e847d08cd6 seamonkey-js-debugger-1.0.9-0.7.el2.ia64.rpm e941959949f2a1378c5e433725fd9425 seamonkey-mail-1.0.9-0.7.el2.ia64.rpm fb50d54e8a64b1f43a2a59ea8f8fd060 seamonkey-nspr-1.0.9-0.7.el2.ia64.rpm a9e1a0a56aa34062786fcac1ee080735 seamonkey-nspr-devel-1.0.9-0.7.el2.ia64.rpm 31f8c9ef4aa9609d6998a855161b0d85 seamonkey-nss-1.0.9-0.7.el2.ia64.rpm 8a06a970dd2df512c153800490b1b3b5 seamonkey-nss-devel-1.0.9-0.7.el2.ia64.rpm Red Hat Enterprise Linux ES version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/seamonkey-1.0.9-0.7.el2.src.rpm b912d533646c8703a482eef801a4b5fc seamonkey-1.0.9-0.7.el2.src.rpm i386: 520f5e21449de9fc5ab38bb783ae9ed7 seamonkey-1.0.9-0.7.el2.i386.rpm c7dfa804769bb02c0f05931ac5dc70b4 seamonkey-chat-1.0.9-0.7.el2.i386.rpm 6a57ae6ac78b9acff2ea1cb467ffa49a seamonkey-devel-1.0.9-0.7.el2.i386.rpm 88e302a64d768049031bafecd5c15311 seamonkey-dom-inspector-1.0.9-0.7.el2.i386.rpm bfa7270acacce6ff415a5c0e0191a7c2 seamonkey-js-debugger-1.0.9-0.7.el2.i386.rpm b27200ea97bcfe686ed4e3c1442a9f62 seamonkey-mail-1.0.9-0.7.el2.i386.rpm 8c3b4b7c927af3e3bc0e8b5b1776f24d seamonkey-nspr-1.0.9-0.7.el2.i386.rpm cc7bec92ad5e06a94a19697db9e99361 seamonkey-nspr-devel-1.0.9-0.7.el2.i386.rpm 6663d9fe56bb4a98e2735f4bdeebe1fc seamonkey-nss-1.0.9-0.7.el2.i386.rpm d4d15e69b6f47c6dd511d0534ed8d29e seamonkey-nss-devel-1.0.9-0.7.el2.i386.rpm Red Hat Enterprise Linux WS version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/seamonkey-1.0.9-0.7.el2.src.rpm b912d533646c8703a482eef801a4b5fc seamonkey-1.0.9-0.7.el2.src.rpm i386: 520f5e21449de9fc5ab38bb783ae9ed7 seamonkey-1.0.9-0.7.el2.i386.rpm c7dfa804769bb02c0f05931ac5dc70b4 seamonkey-chat-1.0.9-0.7.el2.i386.rpm 6a57ae6ac78b9acff2ea1cb467ffa49a seamonkey-devel-1.0.9-0.7.el2.i386.rpm 88e302a64d768049031bafecd5c15311 seamonkey-dom-inspector-1.0.9-0.7.el2.i386.rpm bfa7270acacce6ff415a5c0e0191a7c2 seamonkey-js-debugger-1.0.9-0.7.el2.i386.rpm b27200ea97bcfe686ed4e3c1442a9f62 seamonkey-mail-1.0.9-0.7.el2.i386.rpm 8c3b4b7c927af3e3bc0e8b5b1776f24d seamonkey-nspr-1.0.9-0.7.el2.i386.rpm cc7bec92ad5e06a94a19697db9e99361 seamonkey-nspr-devel-1.0.9-0.7.el2.i386.rpm 6663d9fe56bb4a98e2735f4bdeebe1fc seamonkey-nss-1.0.9-0.7.el2.i386.rpm d4d15e69b6f47c6dd511d0534ed8d29e seamonkey-nss-devel-1.0.9-0.7.el2.i386.rpm Red Hat Enterprise Linux AS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/seamonkey-1.0.9-0.7.el3.src.rpm 150f676d49a99ce4f8447357b6be3215 seamonkey-1.0.9-0.7.el3.src.rpm i386: 9a8aa961ed6f29720e15b09a5c4c38e1 seamonkey-1.0.9-0.7.el3.i386.rpm 2e2b9158351e44581b6d284e66ecf09f seamonkey-chat-1.0.9-0.7.el3.i386.rpm 7ee13cf204109c619f0dabbc90e79ca4 seamonkey-debuginfo-1.0.9-0.7.el3.i386.rpm 023fa64536ea661a42b90d617cc42c76 seamonkey-devel-1.0.9-0.7.el3.i386.rpm 469d47d79f36e02f07d172d15c77582b seamonkey-dom-inspector-1.0.9-0.7.el3.i386.rpm 5e63b9a65cb4bdce5d9f0dce2a36c7ae seamonkey-js-debugger-1.0.9-0.7.el3.i386.rpm 2321d1af2e5bf03513074850723a66df seamonkey-mail-1.0.9-0.7.el3.i386.rpm 8e47f7229d9a3dc2f6b5e942f03d2c7a seamonkey-nspr-1.0.9-0.7.el3.i386.rpm a6a612150a333061c7cddaa46beb849c seamonkey-nspr-devel-1.0.9-0.7.el3.i386.rpm c05c87ae811f0f3d8d12a853c4cd9bf5 seamonkey-nss-1.0.9-0.7.el3.i386.rpm d8d95eceb819cc2232e649f125b65009 seamonkey-nss-devel-1.0.9-0.7.el3.i386.rpm ia64: 8be6a28953f2624ff8145b5572b01a75 seamonkey-1.0.9-0.7.el3.ia64.rpm 6e39f2fb35a9617855def0a06ab7440e seamonkey-chat-1.0.9-0.7.el3.ia64.rpm 7ee13cf204109c619f0dabbc90e79ca4 seamonkey-debuginfo-1.0.9-0.7.el3.i386.rpm 9189e9fb27cfe69d00f9fcf62cdf2b9e seamonkey-debuginfo-1.0.9-0.7.el3.ia64.rpm aa36d21ba81163ef79344216f8006507 seamonkey-devel-1.0.9-0.7.el3.ia64.rpm 2b63aa0603bde48c77b5e05dc1af5c18 seamonkey-dom-inspector-1.0.9-0.7.el3.ia64.rpm 1a6f45e9e0fee8b07e2e3cb5a36d83fe seamonkey-js-debugger-1.0.9-0.7.el3.ia64.rpm 03dacacb60b2c18bf4d6fc41113282fd seamonkey-mail-1.0.9-0.7.el3.ia64.rpm 8e47f7229d9a3dc2f6b5e942f03d2c7a seamonkey-nspr-1.0.9-0.7.el3.i386.rpm f77b2452de18260129bd3265cdb74a4c seamonkey-nspr-1.0.9-0.7.el3.ia64.rpm a212fc72072927ad79e2a7ec8aecad47 seamonkey-nspr-devel-1.0.9-0.7.el3.ia64.rpm c05c87ae811f0f3d8d12a853c4cd9bf5 seamonkey-nss-1.0.9-0.7.el3.i386.rpm c6c00be9a575eebdc8a9a4283bf334cb seamonkey-nss-1.0.9-0.7.el3.ia64.rpm 3f2fcd5226a3a336fc2efbf5d5d72de6 seamonkey-nss-devel-1.0.9-0.7.el3.ia64.rpm ppc: 9f06f4b017ce794a62661f2d226e5f6d seamonkey-1.0.9-0.7.el3.ppc.rpm 94b0d9b023a7b8aace535c8261dac660 seamonkey-chat-1.0.9-0.7.el3.ppc.rpm 2499d59268e5a347ca9092f685dfccae seamonkey-debuginfo-1.0.9-0.7.el3.ppc.rpm 59869acb1545c01a67fff68d4ab6213b seamonkey-devel-1.0.9-0.7.el3.ppc.rpm 184d2b93c025a846f193dfd0dd888c01 seamonkey-dom-inspector-1.0.9-0.7.el3.ppc.rpm a9d20f962e7c566e3d51890390a1106b seamonkey-js-debugger-1.0.9-0.7.el3.ppc.rpm bb1d873e6fee7f569bb9e2f6904ed58a seamonkey-mail-1.0.9-0.7.el3.ppc.rpm fb1f98755d0ec3affab386ae9ee0a773 seamonkey-nspr-1.0.9-0.7.el3.ppc.rpm 5c559b4d1811d78441763b1872d9af01 seamonkey-nspr-devel-1.0.9-0.7.el3.ppc.rpm b4c9042d7c8fdf50e60c03969ce12190 seamonkey-nss-1.0.9-0.7.el3.ppc.rpm 809a0b265917a9ee6a3e561fb948a1da seamonkey-nss-devel-1.0.9-0.7.el3.ppc.rpm s390: 36282ca3d6411f999bee90e4f0947085 seamonkey-1.0.9-0.7.el3.s390.rpm bd033ab9385e56a889f96279ce43ca86 seamonkey-chat-1.0.9-0.7.el3.s390.rpm ec25bbd557688233b4ba3f5accf7920b seamonkey-debuginfo-1.0.9-0.7.el3.s390.rpm 0f527f6cd234d935d01532e16739c166 seamonkey-devel-1.0.9-0.7.el3.s390.rpm bc41d511eaabc5eb10c08690e4a992c1 seamonkey-dom-inspector-1.0.9-0.7.el3.s390.rpm 1306372aeb98444223627d504113fd1b seamonkey-js-debugger-1.0.9-0.7.el3.s390.rpm f6f62f06d3f0e56851064beead86bd6a seamonkey-mail-1.0.9-0.7.el3.s390.rpm 81008dbc23238018a70d6a8ee1ea6423 seamonkey-nspr-1.0.9-0.7.el3.s390.rpm 07c10a27b8139bf3810022013de301ec seamonkey-nspr-devel-1.0.9-0.7.el3.s390.rpm 75a1aabce6c65129347f89b88988d443 seamonkey-nss-1.0.9-0.7.el3.s390.rpm f05f47dddcca888988050470a88cf0ae seamonkey-nss-devel-1.0.9-0.7.el3.s390.rpm s390x: 3e4cb0f4aa5e53d797617342028e257f seamonkey-1.0.9-0.7.el3.s390x.rpm 85acfc155d1c3d3ef16687e236e2f27c seamonkey-chat-1.0.9-0.7.el3.s390x.rpm ec25bbd557688233b4ba3f5accf7920b seamonkey-debuginfo-1.0.9-0.7.el3.s390.rpm 5b721fbb6dec71e1a9daaec3dbde13bd seamonkey-debuginfo-1.0.9-0.7.el3.s390x.rpm d717d1d689bcd53388c8f0154f9a0147 seamonkey-devel-1.0.9-0.7.el3.s390x.rpm 5613f30426d70bbd3041f3bfb5f1e7fa seamonkey-dom-inspector-1.0.9-0.7.el3.s390x.rpm d20fe24f39f0de58a7e70882054e0220 seamonkey-js-debugger-1.0.9-0.7.el3.s390x.rpm 58e9820822ab881885b8d4fb3f4dcc82 seamonkey-mail-1.0.9-0.7.el3.s390x.rpm 81008dbc23238018a70d6a8ee1ea6423 seamonkey-nspr-1.0.9-0.7.el3.s390.rpm e8812819ffb1cbe3fdc609c1854bdbc3 seamonkey-nspr-1.0.9-0.7.el3.s390x.rpm 19f2cc98bc6ffa857f760e6f0801b06e seamonkey-nspr-devel-1.0.9-0.7.el3.s390x.rpm 75a1aabce6c65129347f89b88988d443 seamonkey-nss-1.0.9-0.7.el3.s390.rpm 4b6cbad6ce5f049f8d2ae312e0d298fb seamonkey-nss-1.0.9-0.7.el3.s390x.rpm 8bf818c15daf8d332a33a7402a4222db seamonkey-nss-devel-1.0.9-0.7.el3.s390x.rpm x86_64: 9a8aa961ed6f29720e15b09a5c4c38e1 seamonkey-1.0.9-0.7.el3.i386.rpm d6de65c5743016d407c0115cf21b038f seamonkey-1.0.9-0.7.el3.x86_64.rpm 8082ba52d40e7335f03faf90b66230fa seamonkey-chat-1.0.9-0.7.el3.x86_64.rpm 7ee13cf204109c619f0dabbc90e79ca4 seamonkey-debuginfo-1.0.9-0.7.el3.i386.rpm 463a350143c1beeb51995587a9c77a82 seamonkey-debuginfo-1.0.9-0.7.el3.x86_64.rpm 1b2e8979ea6bb9e7a4f8682ac36665ff seamonkey-devel-1.0.9-0.7.el3.x86_64.rpm 8e3fc5924d0072d054c9726c088d15ab seamonkey-dom-inspector-1.0.9-0.7.el3.x86_64.rpm d79d123afcc1cb1837c0a0e045539489 seamonkey-js-debugger-1.0.9-0.7.el3.x86_64.rpm 03112e323fda6fc7b3ae0faa564fda9d seamonkey-mail-1.0.9-0.7.el3.x86_64.rpm 8e47f7229d9a3dc2f6b5e942f03d2c7a seamonkey-nspr-1.0.9-0.7.el3.i386.rpm 7eedced44f310615dde442268c880215 seamonkey-nspr-1.0.9-0.7.el3.x86_64.rpm 69945ae848ea8b751ce0e56edfe99a79 seamonkey-nspr-devel-1.0.9-0.7.el3.x86_64.rpm c05c87ae811f0f3d8d12a853c4cd9bf5 seamonkey-nss-1.0.9-0.7.el3.i386.rpm 40c23b118b4ea4aa4f9740c6977d8876 seamonkey-nss-1.0.9-0.7.el3.x86_64.rpm b738e33b7bb6e412466167be226c54c3 seamonkey-nss-devel-1.0.9-0.7.el3.x86_64.rpm Red Hat Desktop version 3: SRPMS: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/seamonkey-1.0.9-0.7.el3.src.rpm 150f676d49a99ce4f8447357b6be3215 seamonkey-1.0.9-0.7.el3.src.rpm i386: 9a8aa961ed6f29720e15b09a5c4c38e1 seamonkey-1.0.9-0.7.el3.i386.rpm 2e2b9158351e44581b6d284e66ecf09f seamonkey-chat-1.0.9-0.7.el3.i386.rpm 7ee13cf204109c619f0dabbc90e79ca4 seamonkey-debuginfo-1.0.9-0.7.el3.i386.rpm 023fa64536ea661a42b90d617cc42c76 seamonkey-devel-1.0.9-0.7.el3.i386.rpm 469d47d79f36e02f07d172d15c77582b seamonkey-dom-inspector-1.0.9-0.7.el3.i386.rpm 5e63b9a65cb4bdce5d9f0dce2a36c7ae seamonkey-js-debugger-1.0.9-0.7.el3.i386.rpm 2321d1af2e5bf03513074850723a66df seamonkey-mail-1.0.9-0.7.el3.i386.rpm 8e47f7229d9a3dc2f6b5e942f03d2c7a seamonkey-nspr-1.0.9-0.7.el3.i386.rpm a6a612150a333061c7cddaa46beb849c seamonkey-nspr-devel-1.0.9-0.7.el3.i386.rpm c05c87ae811f0f3d8d12a853c4cd9bf5 seamonkey-nss-1.0.9-0.7.el3.i386.rpm d8d95eceb819cc2232e649f125b65009 seamonkey-nss-devel-1.0.9-0.7.el3.i386.rpm x86_64: 9a8aa961ed6f29720e15b09a5c4c38e1 seamonkey-1.0.9-0.7.el3.i386.rpm d6de65c5743016d407c0115cf21b038f seamonkey-1.0.9-0.7.el3.x86_64.rpm 8082ba52d40e7335f03faf90b66230fa seamonkey-chat-1.0.9-0.7.el3.x86_64.rpm 7ee13cf204109c619f0dabbc90e79ca4 seamonkey-debuginfo-1.0.9-0.7.el3.i386.rpm 463a350143c1beeb51995587a9c77a82 seamonkey-debuginfo-1.0.9-0.7.el3.x86_64.rpm 1b2e8979ea6bb9e7a4f8682ac36665ff seamonkey-devel-1.0.9-0.7.el3.x86_64.rpm 8e3fc5924d0072d054c9726c088d15ab seamonkey-dom-inspector-1.0.9-0.7.el3.x86_64.rpm d79d123afcc1cb1837c0a0e045539489 seamonkey-js-debugger-1.0.9-0.7.el3.x86_64.rpm 03112e323fda6fc7b3ae0faa564fda9d seamonkey-mail-1.0.9-0.7.el3.x86_64.rpm 8e47f7229d9a3dc2f6b5e942f03d2c7a seamonkey-nspr-1.0.9-0.7.el3.i386.rpm 7eedced44f310615dde442268c880215 seamonkey-nspr-1.0.9-0.7.el3.x86_64.rpm 69945ae848ea8b751ce0e56edfe99a79 seamonkey-nspr-devel-1.0.9-0.7.el3.x86_64.rpm c05c87ae811f0f3d8d12a853c4cd9bf5 seamonkey-nss-1.0.9-0.7.el3.i386.rpm 40c23b118b4ea4aa4f9740c6977d8876 seamonkey-nss-1.0.9-0.7.el3.x86_64.rpm b738e33b7bb6e412466167be226c54c3 seamonkey-nss-devel-1.0.9-0.7.el3.x86_64.rpm Red Hat Enterprise Linux ES version 3: SRPMS: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/seamonkey-1.0.9-0.7.el3.src.rpm 150f676d49a99ce4f8447357b6be3215 seamonkey-1.0.9-0.7.el3.src.rpm i386: 9a8aa961ed6f29720e15b09a5c4c38e1 seamonkey-1.0.9-0.7.el3.i386.rpm 2e2b9158351e44581b6d284e66ecf09f seamonkey-chat-1.0.9-0.7.el3.i386.rpm 7ee13cf204109c619f0dabbc90e79ca4 seamonkey-debuginfo-1.0.9-0.7.el3.i386.rpm 023fa64536ea661a42b90d617cc42c76 seamonkey-devel-1.0.9-0.7.el3.i386.rpm 469d47d79f36e02f07d172d15c77582b seamonkey-dom-inspector-1.0.9-0.7.el3.i386.rpm 5e63b9a65cb4bdce5d9f0dce2a36c7ae seamonkey-js-debugger-1.0.9-0.7.el3.i386.rpm 2321d1af2e5bf03513074850723a66df seamonkey-mail-1.0.9-0.7.el3.i386.rpm 8e47f7229d9a3dc2f6b5e942f03d2c7a seamonkey-nspr-1.0.9-0.7.el3.i386.rpm a6a612150a333061c7cddaa46beb849c seamonkey-nspr-devel-1.0.9-0.7.el3.i386.rpm c05c87ae811f0f3d8d12a853c4cd9bf5 seamonkey-nss-1.0.9-0.7.el3.i386.rpm d8d95eceb819cc2232e649f125b65009 seamonkey-nss-devel-1.0.9-0.7.el3.i386.rpm ia64: 8be6a28953f2624ff8145b5572b01a75 seamonkey-1.0.9-0.7.el3.ia64.rpm 6e39f2fb35a9617855def0a06ab7440e seamonkey-chat-1.0.9-0.7.el3.ia64.rpm 7ee13cf204109c619f0dabbc90e79ca4 seamonkey-debuginfo-1.0.9-0.7.el3.i386.rpm 9189e9fb27cfe69d00f9fcf62cdf2b9e seamonkey-debuginfo-1.0.9-0.7.el3.ia64.rpm aa36d21ba81163ef79344216f8006507 seamonkey-devel-1.0.9-0.7.el3.ia64.rpm 2b63aa0603bde48c77b5e05dc1af5c18 seamonkey-dom-inspector-1.0.9-0.7.el3.ia64.rpm 1a6f45e9e0fee8b07e2e3cb5a36d83fe seamonkey-js-debugger-1.0.9-0.7.el3.ia64.rpm 03dacacb60b2c18bf4d6fc41113282fd seamonkey-mail-1.0.9-0.7.el3.ia64.rpm 8e47f7229d9a3dc2f6b5e942f03d2c7a seamonkey-nspr-1.0.9-0.7.el3.i386.rpm f77b2452de18260129bd3265cdb74a4c seamonkey-nspr-1.0.9-0.7.el3.ia64.rpm a212fc72072927ad79e2a7ec8aecad47 seamonkey-nspr-devel-1.0.9-0.7.el3.ia64.rpm c05c87ae811f0f3d8d12a853c4cd9bf5 seamonkey-nss-1.0.9-0.7.el3.i386.rpm c6c00be9a575eebdc8a9a4283bf334cb seamonkey-nss-1.0.9-0.7.el3.ia64.rpm 3f2fcd5226a3a336fc2efbf5d5d72de6 seamonkey-nss-devel-1.0.9-0.7.el3.ia64.rpm x86_64: 9a8aa961ed6f29720e15b09a5c4c38e1 seamonkey-1.0.9-0.7.el3.i386.rpm d6de65c5743016d407c0115cf21b038f seamonkey-1.0.9-0.7.el3.x86_64.rpm 8082ba52d40e7335f03faf90b66230fa seamonkey-chat-1.0.9-0.7.el3.x86_64.rpm 7ee13cf204109c619f0dabbc90e79ca4 seamonkey-debuginfo-1.0.9-0.7.el3.i386.rpm 463a350143c1beeb51995587a9c77a82 seamonkey-debuginfo-1.0.9-0.7.el3.x86_64.rpm 1b2e8979ea6bb9e7a4f8682ac36665ff seamonkey-devel-1.0.9-0.7.el3.x86_64.rpm 8e3fc5924d0072d054c9726c088d15ab seamonkey-dom-inspector-1.0.9-0.7.el3.x86_64.rpm d79d123afcc1cb1837c0a0e045539489 seamonkey-js-debugger-1.0.9-0.7.el3.x86_64.rpm 03112e323fda6fc7b3ae0faa564fda9d seamonkey-mail-1.0.9-0.7.el3.x86_64.rpm 8e47f7229d9a3dc2f6b5e942f03d2c7a seamonkey-nspr-1.0.9-0.7.el3.i386.rpm 7eedced44f310615dde442268c880215 seamonkey-nspr-1.0.9-0.7.el3.x86_64.rpm 69945ae848ea8b751ce0e56edfe99a79 seamonkey-nspr-devel-1.0.9-0.7.el3.x86_64.rpm c05c87ae811f0f3d8d12a853c4cd9bf5 seamonkey-nss-1.0.9-0.7.el3.i386.rpm 40c23b118b4ea4aa4f9740c6977d8876 seamonkey-nss-1.0.9-0.7.el3.x86_64.rpm b738e33b7bb6e412466167be226c54c3 seamonkey-nss-devel-1.0.9-0.7.el3.x86_64.rpm Red Hat Enterprise Linux WS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/seamonkey-1.0.9-0.7.el3.src.rpm 150f676d49a99ce4f8447357b6be3215 seamonkey-1.0.9-0.7.el3.src.rpm i386: 9a8aa961ed6f29720e15b09a5c4c38e1 seamonkey-1.0.9-0.7.el3.i386.rpm 2e2b9158351e44581b6d284e66ecf09f seamonkey-chat-1.0.9-0.7.el3.i386.rpm 7ee13cf204109c619f0dabbc90e79ca4 seamonkey-debuginfo-1.0.9-0.7.el3.i386.rpm 023fa64536ea661a42b90d617cc42c76 seamonkey-devel-1.0.9-0.7.el3.i386.rpm 469d47d79f36e02f07d172d15c77582b seamonkey-dom-inspector-1.0.9-0.7.el3.i386.rpm 5e63b9a65cb4bdce5d9f0dce2a36c7ae seamonkey-js-debugger-1.0.9-0.7.el3.i386.rpm 2321d1af2e5bf03513074850723a66df seamonkey-mail-1.0.9-0.7.el3.i386.rpm 8e47f7229d9a3dc2f6b5e942f03d2c7a seamonkey-nspr-1.0.9-0.7.el3.i386.rpm a6a612150a333061c7cddaa46beb849c seamonkey-nspr-devel-1.0.9-0.7.el3.i386.rpm c05c87ae811f0f3d8d12a853c4cd9bf5 seamonkey-nss-1.0.9-0.7.el3.i386.rpm d8d95eceb819cc2232e649f125b65009 seamonkey-nss-devel-1.0.9-0.7.el3.i386.rpm ia64: 8be6a28953f2624ff8145b5572b01a75 seamonkey-1.0.9-0.7.el3.ia64.rpm 6e39f2fb35a9617855def0a06ab7440e seamonkey-chat-1.0.9-0.7.el3.ia64.rpm 7ee13cf204109c619f0dabbc90e79ca4 seamonkey-debuginfo-1.0.9-0.7.el3.i386.rpm 9189e9fb27cfe69d00f9fcf62cdf2b9e seamonkey-debuginfo-1.0.9-0.7.el3.ia64.rpm aa36d21ba81163ef79344216f8006507 seamonkey-devel-1.0.9-0.7.el3.ia64.rpm 2b63aa0603bde48c77b5e05dc1af5c18 seamonkey-dom-inspector-1.0.9-0.7.el3.ia64.rpm 1a6f45e9e0fee8b07e2e3cb5a36d83fe seamonkey-js-debugger-1.0.9-0.7.el3.ia64.rpm 03dacacb60b2c18bf4d6fc41113282fd seamonkey-mail-1.0.9-0.7.el3.ia64.rpm 8e47f7229d9a3dc2f6b5e942f03d2c7a seamonkey-nspr-1.0.9-0.7.el3.i386.rpm f77b2452de18260129bd3265cdb74a4c seamonkey-nspr-1.0.9-0.7.el3.ia64.rpm a212fc72072927ad79e2a7ec8aecad47 seamonkey-nspr-devel-1.0.9-0.7.el3.ia64.rpm c05c87ae811f0f3d8d12a853c4cd9bf5 seamonkey-nss-1.0.9-0.7.el3.i386.rpm c6c00be9a575eebdc8a9a4283bf334cb seamonkey-nss-1.0.9-0.7.el3.ia64.rpm 3f2fcd5226a3a336fc2efbf5d5d72de6 seamonkey-nss-devel-1.0.9-0.7.el3.ia64.rpm x86_64: 9a8aa961ed6f29720e15b09a5c4c38e1 seamonkey-1.0.9-0.7.el3.i386.rpm d6de65c5743016d407c0115cf21b038f seamonkey-1.0.9-0.7.el3.x86_64.rpm 8082ba52d40e7335f03faf90b66230fa seamonkey-chat-1.0.9-0.7.el3.x86_64.rpm 7ee13cf204109c619f0dabbc90e79ca4 seamonkey-debuginfo-1.0.9-0.7.el3.i386.rpm 463a350143c1beeb51995587a9c77a82 seamonkey-debuginfo-1.0.9-0.7.el3.x86_64.rpm 1b2e8979ea6bb9e7a4f8682ac36665ff seamonkey-devel-1.0.9-0.7.el3.x86_64.rpm 8e3fc5924d0072d054c9726c088d15ab seamonkey-dom-inspector-1.0.9-0.7.el3.x86_64.rpm d79d123afcc1cb1837c0a0e045539489 seamonkey-js-debugger-1.0.9-0.7.el3.x86_64.rpm 03112e323fda6fc7b3ae0faa564fda9d seamonkey-mail-1.0.9-0.7.el3.x86_64.rpm 8e47f7229d9a3dc2f6b5e942f03d2c7a seamonkey-nspr-1.0.9-0.7.el3.i386.rpm 7eedced44f310615dde442268c880215 seamonkey-nspr-1.0.9-0.7.el3.x86_64.rpm 69945ae848ea8b751ce0e56edfe99a79 seamonkey-nspr-devel-1.0.9-0.7.el3.x86_64.rpm c05c87ae811f0f3d8d12a853c4cd9bf5 seamonkey-nss-1.0.9-0.7.el3.i386.rpm 40c23b118b4ea4aa4f9740c6977d8876 seamonkey-nss-1.0.9-0.7.el3.x86_64.rpm b738e33b7bb6e412466167be226c54c3 seamonkey-nss-devel-1.0.9-0.7.el3.x86_64.rpm Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/seamonkey-1.0.9-7.el4.src.rpm 47abeb1d691c037289a305f68cb5d888 seamonkey-1.0.9-7.el4.src.rpm i386: e9222124bb89f2de3a904208cb34c8e0 seamonkey-1.0.9-7.el4.i386.rpm b44cbbb7a1631a7fdf4288d34fa71f14 seamonkey-chat-1.0.9-7.el4.i386.rpm b7b6231b38b6c00dd5acec3106072cee seamonkey-debuginfo-1.0.9-7.el4.i386.rpm b5504b4165127439ba8e460899b8b1d3 seamonkey-devel-1.0.9-7.el4.i386.rpm 6bae7094fa87982a9231fdcf22920346 seamonkey-dom-inspector-1.0.9-7.el4.i386.rpm 0fbd54693df4d2ac8888969c85c99451 seamonkey-js-debugger-1.0.9-7.el4.i386.rpm bca8b93bd3e74b42ea943d86c7433f8d seamonkey-mail-1.0.9-7.el4.i386.rpm 15f401773011f8a7de27028ad7a0a5e2 seamonkey-nspr-1.0.9-7.el4.i386.rpm 99da2ce21bc01b326fb53d2b79c0aee5 seamonkey-nspr-devel-1.0.9-7.el4.i386.rpm 7b25dfcc60d88a2c4a7c331293a7736d seamonkey-nss-1.0.9-7.el4.i386.rpm 088ff97238a854d56898568ecbab941e seamonkey-nss-devel-1.0.9-7.el4.i386.rpm ia64: 28ebd79e0b957b9ec2e9b3c3ac2d14d6 seamonkey-1.0.9-7.el4.ia64.rpm 2a5b9da8230c99feaca4c4d7455638fd seamonkey-chat-1.0.9-7.el4.ia64.rpm b7b6231b38b6c00dd5acec3106072cee seamonkey-debuginfo-1.0.9-7.el4.i386.rpm 9ef63a1082922d57eafa088fca5d6fc4 seamonkey-debuginfo-1.0.9-7.el4.ia64.rpm b428dfe7791042260b504028a8219236 seamonkey-devel-1.0.9-7.el4.ia64.rpm 6ed126b272899a2729ad910d3be60441 seamonkey-dom-inspector-1.0.9-7.el4.ia64.rpm b3dc9681f3c1c66db0ee3d6bef61d981 seamonkey-js-debugger-1.0.9-7.el4.ia64.rpm a9126241150cd85689814286ed3be170 seamonkey-mail-1.0.9-7.el4.ia64.rpm 15f401773011f8a7de27028ad7a0a5e2 seamonkey-nspr-1.0.9-7.el4.i386.rpm db627f13d5b21b9c1031dc8dc3fbe939 seamonkey-nspr-1.0.9-7.el4.ia64.rpm ef13cb9266d3faf696f52c23dd70c2ab seamonkey-nspr-devel-1.0.9-7.el4.ia64.rpm 7b25dfcc60d88a2c4a7c331293a7736d seamonkey-nss-1.0.9-7.el4.i386.rpm 35ccf51f5c8bc793730518358e271b8d seamonkey-nss-1.0.9-7.el4.ia64.rpm ae24ebad82cb8e3aba365cdeb691bb9b seamonkey-nss-devel-1.0.9-7.el4.ia64.rpm ppc: edd71fd1f5ad9e90a1ef14e459bf5bb0 seamonkey-1.0.9-7.el4.ppc.rpm c9c79d49384e4e7a7a7e5d79dd73c58f seamonkey-chat-1.0.9-7.el4.ppc.rpm 92e33c7b57f0c41093cbdcf2e6f5e18b seamonkey-debuginfo-1.0.9-7.el4.ppc.rpm 3eef3918f8daf22350dee721cc1fc1d1 seamonkey-devel-1.0.9-7.el4.ppc.rpm 099a618f92e2c08f9d9684af90ca067c seamonkey-dom-inspector-1.0.9-7.el4.ppc.rpm f8232000a4908a199862f9845571d696 seamonkey-js-debugger-1.0.9-7.el4.ppc.rpm b82e0c39e6e8648f0107327ca5e78179 seamonkey-mail-1.0.9-7.el4.ppc.rpm f8506288600a1de7d91ea423a53c0054 seamonkey-nspr-1.0.9-7.el4.ppc.rpm 32b69e1ce9dd96c5dd39ab8f9c55ae7e seamonkey-nspr-devel-1.0.9-7.el4.ppc.rpm fa9eeb95ba336ad8b035f7fae9fd4597 seamonkey-nss-1.0.9-7.el4.ppc.rpm 8a85c746327b9f138a5424f018a55fe5 seamonkey-nss-devel-1.0.9-7.el4.ppc.rpm s390: 73a4c5517db860b248ec9459a2b88428 seamonkey-1.0.9-7.el4.s390.rpm 9f3c75c20f418d91058f2803a359f8aa seamonkey-chat-1.0.9-7.el4.s390.rpm 6cae34b1c3ba6f51e8d1fdd85490c295 seamonkey-debuginfo-1.0.9-7.el4.s390.rpm 8a2488917d8dde37d6a5d93d7597fed7 seamonkey-devel-1.0.9-7.el4.s390.rpm b48e87dd6831c127d15823d832ee5b8f seamonkey-dom-inspector-1.0.9-7.el4.s390.rpm 6e564e76f8d4f9cc1d6d8a4491d8b2e3 seamonkey-js-debugger-1.0.9-7.el4.s390.rpm 5bb39f2e9c02aaaff512f2f0aff30351 seamonkey-mail-1.0.9-7.el4.s390.rpm 4451abdc42ae4e2121f3e3969cd461a7 seamonkey-nspr-1.0.9-7.el4.s390.rpm 4f6cf44905f11ead9035d233dacae82f seamonkey-nspr-devel-1.0.9-7.el4.s390.rpm d198068d0c9dd65e0ca4612b64e49f99 seamonkey-nss-1.0.9-7.el4.s390.rpm c17632df25d9b233a359e5b4cbf6abb8 seamonkey-nss-devel-1.0.9-7.el4.s390.rpm s390x: e4cdc119350f6bfabf3a80ac75d14033 seamonkey-1.0.9-7.el4.s390x.rpm 2008d67722c5e10ddd10a8640cfcd75a seamonkey-chat-1.0.9-7.el4.s390x.rpm 6cae34b1c3ba6f51e8d1fdd85490c295 seamonkey-debuginfo-1.0.9-7.el4.s390.rpm 04dc9f6a90318a823f789c0895282e6f seamonkey-debuginfo-1.0.9-7.el4.s390x.rpm 99c4cb0b3300c9fbd9f6fd1130fac9d4 seamonkey-devel-1.0.9-7.el4.s390x.rpm bc5633a34344f07960e5a94edad7884c seamonkey-dom-inspector-1.0.9-7.el4.s390x.rpm 67cebbb3a2986327a23311726ff74b5c seamonkey-js-debugger-1.0.9-7.el4.s390x.rpm 51d1f8641f826715ae950ab9dc792e05 seamonkey-mail-1.0.9-7.el4.s390x.rpm 4451abdc42ae4e2121f3e3969cd461a7 seamonkey-nspr-1.0.9-7.el4.s390.rpm 3940355e04292699a3aa405571a6f7ac seamonkey-nspr-1.0.9-7.el4.s390x.rpm 80cbaae8b3452b62dbf19d39a335e04b seamonkey-nspr-devel-1.0.9-7.el4.s390x.rpm d198068d0c9dd65e0ca4612b64e49f99 seamonkey-nss-1.0.9-7.el4.s390.rpm 6a6ef467a6db5e69e59f19ea795486e6 seamonkey-nss-1.0.9-7.el4.s390x.rpm 54499109deaf5d12c22fe4ad1f418970 seamonkey-nss-devel-1.0.9-7.el4.s390x.rpm x86_64: 1a85db50a21bb776e02e5f54fee39155 seamonkey-1.0.9-7.el4.x86_64.rpm b2d3af3131203e15517bf09234e489a3 seamonkey-chat-1.0.9-7.el4.x86_64.rpm b7b6231b38b6c00dd5acec3106072cee seamonkey-debuginfo-1.0.9-7.el4.i386.rpm f4e88589ac6cef8f4ae5c539cf422745 seamonkey-debuginfo-1.0.9-7.el4.x86_64.rpm 26c33791fceb829d618eb6b5e58e04bc seamonkey-devel-1.0.9-7.el4.x86_64.rpm e1cab447d8a9120f9b416eddc8f77f02 seamonkey-dom-inspector-1.0.9-7.el4.x86_64.rpm d5c75288b67fd1c55050f91ad3ac18a1 seamonkey-js-debugger-1.0.9-7.el4.x86_64.rpm 26dd4d7355ea70910548715ceb2ed6b7 seamonkey-mail-1.0.9-7.el4.x86_64.rpm 15f401773011f8a7de27028ad7a0a5e2 seamonkey-nspr-1.0.9-7.el4.i386.rpm 75a13cd6e619c82786ca6ec45020c316 seamonkey-nspr-1.0.9-7.el4.x86_64.rpm 33d5448b121102620e7fbc9c83b35c52 seamonkey-nspr-devel-1.0.9-7.el4.x86_64.rpm 7b25dfcc60d88a2c4a7c331293a7736d seamonkey-nss-1.0.9-7.el4.i386.rpm 46129da9524faf23b46ea9f907716fe6 seamonkey-nss-1.0.9-7.el4.x86_64.rpm a6fdac50cc604c70077848c58f87aa53 seamonkey-nss-devel-1.0.9-7.el4.x86_64.rpm Red Hat Enterprise Linux AS version 4.5.z: SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/4AS-4.5.z/en/os/SRPMS/seamonkey-1.0.9-7.el4.src.rpm 47abeb1d691c037289a305f68cb5d888 seamonkey-1.0.9-7.el4.src.rpm i386: e9222124bb89f2de3a904208cb34c8e0 seamonkey-1.0.9-7.el4.i386.rpm b44cbbb7a1631a7fdf4288d34fa71f14 seamonkey-chat-1.0.9-7.el4.i386.rpm b7b6231b38b6c00dd5acec3106072cee seamonkey-debuginfo-1.0.9-7.el4.i386.rpm b5504b4165127439ba8e460899b8b1d3 seamonkey-devel-1.0.9-7.el4.i386.rpm 6bae7094fa87982a9231fdcf22920346 seamonkey-dom-inspector-1.0.9-7.el4.i386.rpm 0fbd54693df4d2ac8888969c85c99451 seamonkey-js-debugger-1.0.9-7.el4.i386.rpm bca8b93bd3e74b42ea943d86c7433f8d seamonkey-mail-1.0.9-7.el4.i386.rpm 15f401773011f8a7de27028ad7a0a5e2 seamonkey-nspr-1.0.9-7.el4.i386.rpm 99da2ce21bc01b326fb53d2b79c0aee5 seamonkey-nspr-devel-1.0.9-7.el4.i386.rpm 7b25dfcc60d88a2c4a7c331293a7736d seamonkey-nss-1.0.9-7.el4.i386.rpm 088ff97238a854d56898568ecbab941e seamonkey-nss-devel-1.0.9-7.el4.i386.rpm ia64: 28ebd79e0b957b9ec2e9b3c3ac2d14d6 seamonkey-1.0.9-7.el4.ia64.rpm 2a5b9da8230c99feaca4c4d7455638fd seamonkey-chat-1.0.9-7.el4.ia64.rpm b7b6231b38b6c00dd5acec3106072cee seamonkey-debuginfo-1.0.9-7.el4.i386.rpm 9ef63a1082922d57eafa088fca5d6fc4 seamonkey-debuginfo-1.0.9-7.el4.ia64.rpm b428dfe7791042260b504028a8219236 seamonkey-devel-1.0.9-7.el4.ia64.rpm 6ed126b272899a2729ad910d3be60441 seamonkey-dom-inspector-1.0.9-7.el4.ia64.rpm b3dc9681f3c1c66db0ee3d6bef61d981 seamonkey-js-debugger-1.0.9-7.el4.ia64.rpm a9126241150cd85689814286ed3be170 seamonkey-mail-1.0.9-7.el4.ia64.rpm 15f401773011f8a7de27028ad7a0a5e2 seamonkey-nspr-1.0.9-7.el4.i386.rpm db627f13d5b21b9c1031dc8dc3fbe939 seamonkey-nspr-1.0.9-7.el4.ia64.rpm ef13cb9266d3faf696f52c23dd70c2ab seamonkey-nspr-devel-1.0.9-7.el4.ia64.rpm 7b25dfcc60d88a2c4a7c331293a7736d seamonkey-nss-1.0.9-7.el4.i386.rpm 35ccf51f5c8bc793730518358e271b8d seamonkey-nss-1.0.9-7.el4.ia64.rpm ae24ebad82cb8e3aba365cdeb691bb9b seamonkey-nss-devel-1.0.9-7.el4.ia64.rpm ppc: edd71fd1f5ad9e90a1ef14e459bf5bb0 seamonkey-1.0.9-7.el4.ppc.rpm c9c79d49384e4e7a7a7e5d79dd73c58f seamonkey-chat-1.0.9-7.el4.ppc.rpm 92e33c7b57f0c41093cbdcf2e6f5e18b seamonkey-debuginfo-1.0.9-7.el4.ppc.rpm 3eef3918f8daf22350dee721cc1fc1d1 seamonkey-devel-1.0.9-7.el4.ppc.rpm 099a618f92e2c08f9d9684af90ca067c seamonkey-dom-inspector-1.0.9-7.el4.ppc.rpm f8232000a4908a199862f9845571d696 seamonkey-js-debugger-1.0.9-7.el4.ppc.rpm b82e0c39e6e8648f0107327ca5e78179 seamonkey-mail-1.0.9-7.el4.ppc.rpm f8506288600a1de7d91ea423a53c0054 seamonkey-nspr-1.0.9-7.el4.ppc.rpm 32b69e1ce9dd96c5dd39ab8f9c55ae7e seamonkey-nspr-devel-1.0.9-7.el4.ppc.rpm fa9eeb95ba336ad8b035f7fae9fd4597 seamonkey-nss-1.0.9-7.el4.ppc.rpm 8a85c746327b9f138a5424f018a55fe5 seamonkey-nss-devel-1.0.9-7.el4.ppc.rpm s390: 73a4c5517db860b248ec9459a2b88428 seamonkey-1.0.9-7.el4.s390.rpm 9f3c75c20f418d91058f2803a359f8aa seamonkey-chat-1.0.9-7.el4.s390.rpm 6cae34b1c3ba6f51e8d1fdd85490c295 seamonkey-debuginfo-1.0.9-7.el4.s390.rpm 8a2488917d8dde37d6a5d93d7597fed7 seamonkey-devel-1.0.9-7.el4.s390.rpm b48e87dd6831c127d15823d832ee5b8f seamonkey-dom-inspector-1.0.9-7.el4.s390.rpm 6e564e76f8d4f9cc1d6d8a4491d8b2e3 seamonkey-js-debugger-1.0.9-7.el4.s390.rpm 5bb39f2e9c02aaaff512f2f0aff30351 seamonkey-mail-1.0.9-7.el4.s390.rpm 4451abdc42ae4e2121f3e3969cd461a7 seamonkey-nspr-1.0.9-7.el4.s390.rpm 4f6cf44905f11ead9035d233dacae82f seamonkey-nspr-devel-1.0.9-7.el4.s390.rpm d198068d0c9dd65e0ca4612b64e49f99 seamonkey-nss-1.0.9-7.el4.s390.rpm c17632df25d9b233a359e5b4cbf6abb8 seamonkey-nss-devel-1.0.9-7.el4.s390.rpm s390x: e4cdc119350f6bfabf3a80ac75d14033 seamonkey-1.0.9-7.el4.s390x.rpm 2008d67722c5e10ddd10a8640cfcd75a seamonkey-chat-1.0.9-7.el4.s390x.rpm 6cae34b1c3ba6f51e8d1fdd85490c295 seamonkey-debuginfo-1.0.9-7.el4.s390.rpm 04dc9f6a90318a823f789c0895282e6f seamonkey-debuginfo-1.0.9-7.el4.s390x.rpm 99c4cb0b3300c9fbd9f6fd1130fac9d4 seamonkey-devel-1.0.9-7.el4.s390x.rpm bc5633a34344f07960e5a94edad7884c seamonkey-dom-inspector-1.0.9-7.el4.s390x.rpm 67cebbb3a2986327a23311726ff74b5c seamonkey-js-debugger-1.0.9-7.el4.s390x.rpm 51d1f8641f826715ae950ab9dc792e05 seamonkey-mail-1.0.9-7.el4.s390x.rpm 4451abdc42ae4e2121f3e3969cd461a7 seamonkey-nspr-1.0.9-7.el4.s390.rpm 3940355e04292699a3aa405571a6f7ac seamonkey-nspr-1.0.9-7.el4.s390x.rpm 80cbaae8b3452b62dbf19d39a335e04b seamonkey-nspr-devel-1.0.9-7.el4.s390x.rpm d198068d0c9dd65e0ca4612b64e49f99 seamonkey-nss-1.0.9-7.el4.s390.rpm 6a6ef467a6db5e69e59f19ea795486e6 seamonkey-nss-1.0.9-7.el4.s390x.rpm 54499109deaf5d12c22fe4ad1f418970 seamonkey-nss-devel-1.0.9-7.el4.s390x.rpm x86_64: 1a85db50a21bb776e02e5f54fee39155 seamonkey-1.0.9-7.el4.x86_64.rpm b2d3af3131203e15517bf09234e489a3 seamonkey-chat-1.0.9-7.el4.x86_64.rpm b7b6231b38b6c00dd5acec3106072cee seamonkey-debuginfo-1.0.9-7.el4.i386.rpm f4e88589ac6cef8f4ae5c539cf422745 seamonkey-debuginfo-1.0.9-7.el4.x86_64.rpm 26c33791fceb829d618eb6b5e58e04bc seamonkey-devel-1.0.9-7.el4.x86_64.rpm e1cab447d8a9120f9b416eddc8f77f02 seamonkey-dom-inspector-1.0.9-7.el4.x86_64.rpm d5c75288b67fd1c55050f91ad3ac18a1 seamonkey-js-debugger-1.0.9-7.el4.x86_64.rpm 26dd4d7355ea70910548715ceb2ed6b7 seamonkey-mail-1.0.9-7.el4.x86_64.rpm 15f401773011f8a7de27028ad7a0a5e2 seamonkey-nspr-1.0.9-7.el4.i386.rpm 75a13cd6e619c82786ca6ec45020c316 seamonkey-nspr-1.0.9-7.el4.x86_64.rpm 33d5448b121102620e7fbc9c83b35c52 seamonkey-nspr-devel-1.0.9-7.el4.x86_64.rpm 7b25dfcc60d88a2c4a7c331293a7736d seamonkey-nss-1.0.9-7.el4.i386.rpm 46129da9524faf23b46ea9f907716fe6 seamonkey-nss-1.0.9-7.el4.x86_64.rpm a6fdac50cc604c70077848c58f87aa53 seamonkey-nss-devel-1.0.9-7.el4.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/seamonkey-1.0.9-7.el4.src.rpm 47abeb1d691c037289a305f68cb5d888 seamonkey-1.0.9-7.el4.src.rpm i386: e9222124bb89f2de3a904208cb34c8e0 seamonkey-1.0.9-7.el4.i386.rpm b44cbbb7a1631a7fdf4288d34fa71f14 seamonkey-chat-1.0.9-7.el4.i386.rpm b7b6231b38b6c00dd5acec3106072cee seamonkey-debuginfo-1.0.9-7.el4.i386.rpm b5504b4165127439ba8e460899b8b1d3 seamonkey-devel-1.0.9-7.el4.i386.rpm 6bae7094fa87982a9231fdcf22920346 seamonkey-dom-inspector-1.0.9-7.el4.i386.rpm 0fbd54693df4d2ac8888969c85c99451 seamonkey-js-debugger-1.0.9-7.el4.i386.rpm bca8b93bd3e74b42ea943d86c7433f8d seamonkey-mail-1.0.9-7.el4.i386.rpm 15f401773011f8a7de27028ad7a0a5e2 seamonkey-nspr-1.0.9-7.el4.i386.rpm 99da2ce21bc01b326fb53d2b79c0aee5 seamonkey-nspr-devel-1.0.9-7.el4.i386.rpm 7b25dfcc60d88a2c4a7c331293a7736d seamonkey-nss-1.0.9-7.el4.i386.rpm 088ff97238a854d56898568ecbab941e seamonkey-nss-devel-1.0.9-7.el4.i386.rpm x86_64: 1a85db50a21bb776e02e5f54fee39155 seamonkey-1.0.9-7.el4.x86_64.rpm b2d3af3131203e15517bf09234e489a3 seamonkey-chat-1.0.9-7.el4.x86_64.rpm b7b6231b38b6c00dd5acec3106072cee seamonkey-debuginfo-1.0.9-7.el4.i386.rpm f4e88589ac6cef8f4ae5c539cf422745 seamonkey-debuginfo-1.0.9-7.el4.x86_64.rpm 26c33791fceb829d618eb6b5e58e04bc seamonkey-devel-1.0.9-7.el4.x86_64.rpm e1cab447d8a9120f9b416eddc8f77f02 seamonkey-dom-inspector-1.0.9-7.el4.x86_64.rpm d5c75288b67fd1c55050f91ad3ac18a1 seamonkey-js-debugger-1.0.9-7.el4.x86_64.rpm 26dd4d7355ea70910548715ceb2ed6b7 seamonkey-mail-1.0.9-7.el4.x86_64.rpm 15f401773011f8a7de27028ad7a0a5e2 seamonkey-nspr-1.0.9-7.el4.i386.rpm 75a13cd6e619c82786ca6ec45020c316 seamonkey-nspr-1.0.9-7.el4.x86_64.rpm 33d5448b121102620e7fbc9c83b35c52 seamonkey-nspr-devel-1.0.9-7.el4.x86_64.rpm 7b25dfcc60d88a2c4a7c331293a7736d seamonkey-nss-1.0.9-7.el4.i386.rpm 46129da9524faf23b46ea9f907716fe6 seamonkey-nss-1.0.9-7.el4.x86_64.rpm a6fdac50cc604c70077848c58f87aa53 seamonkey-nss-devel-1.0.9-7.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/seamonkey-1.0.9-7.el4.src.rpm 47abeb1d691c037289a305f68cb5d888 seamonkey-1.0.9-7.el4.src.rpm i386: e9222124bb89f2de3a904208cb34c8e0 seamonkey-1.0.9-7.el4.i386.rpm b44cbbb7a1631a7fdf4288d34fa71f14 seamonkey-chat-1.0.9-7.el4.i386.rpm b7b6231b38b6c00dd5acec3106072cee seamonkey-debuginfo-1.0.9-7.el4.i386.rpm b5504b4165127439ba8e460899b8b1d3 seamonkey-devel-1.0.9-7.el4.i386.rpm 6bae7094fa87982a9231fdcf22920346 seamonkey-dom-inspector-1.0.9-7.el4.i386.rpm 0fbd54693df4d2ac8888969c85c99451 seamonkey-js-debugger-1.0.9-7.el4.i386.rpm bca8b93bd3e74b42ea943d86c7433f8d seamonkey-mail-1.0.9-7.el4.i386.rpm 15f401773011f8a7de27028ad7a0a5e2 seamonkey-nspr-1.0.9-7.el4.i386.rpm 99da2ce21bc01b326fb53d2b79c0aee5 seamonkey-nspr-devel-1.0.9-7.el4.i386.rpm 7b25dfcc60d88a2c4a7c331293a7736d seamonkey-nss-1.0.9-7.el4.i386.rpm 088ff97238a854d56898568ecbab941e seamonkey-nss-devel-1.0.9-7.el4.i386.rpm ia64: 28ebd79e0b957b9ec2e9b3c3ac2d14d6 seamonkey-1.0.9-7.el4.ia64.rpm 2a5b9da8230c99feaca4c4d7455638fd seamonkey-chat-1.0.9-7.el4.ia64.rpm b7b6231b38b6c00dd5acec3106072cee seamonkey-debuginfo-1.0.9-7.el4.i386.rpm 9ef63a1082922d57eafa088fca5d6fc4 seamonkey-debuginfo-1.0.9-7.el4.ia64.rpm b428dfe7791042260b504028a8219236 seamonkey-devel-1.0.9-7.el4.ia64.rpm 6ed126b272899a2729ad910d3be60441 seamonkey-dom-inspector-1.0.9-7.el4.ia64.rpm b3dc9681f3c1c66db0ee3d6bef61d981 seamonkey-js-debugger-1.0.9-7.el4.ia64.rpm a9126241150cd85689814286ed3be170 seamonkey-mail-1.0.9-7.el4.ia64.rpm 15f401773011f8a7de27028ad7a0a5e2 seamonkey-nspr-1.0.9-7.el4.i386.rpm db627f13d5b21b9c1031dc8dc3fbe939 seamonkey-nspr-1.0.9-7.el4.ia64.rpm ef13cb9266d3faf696f52c23dd70c2ab seamonkey-nspr-devel-1.0.9-7.el4.ia64.rpm 7b25dfcc60d88a2c4a7c331293a7736d seamonkey-nss-1.0.9-7.el4.i386.rpm 35ccf51f5c8bc793730518358e271b8d seamonkey-nss-1.0.9-7.el4.ia64.rpm ae24ebad82cb8e3aba365cdeb691bb9b seamonkey-nss-devel-1.0.9-7.el4.ia64.rpm x86_64: 1a85db50a21bb776e02e5f54fee39155 seamonkey-1.0.9-7.el4.x86_64.rpm b2d3af3131203e15517bf09234e489a3 seamonkey-chat-1.0.9-7.el4.x86_64.rpm b7b6231b38b6c00dd5acec3106072cee seamonkey-debuginfo-1.0.9-7.el4.i386.rpm f4e88589ac6cef8f4ae5c539cf422745 seamonkey-debuginfo-1.0.9-7.el4.x86_64.rpm 26c33791fceb829d618eb6b5e58e04bc seamonkey-devel-1.0.9-7.el4.x86_64.rpm e1cab447d8a9120f9b416eddc8f77f02 seamonkey-dom-inspector-1.0.9-7.el4.x86_64.rpm d5c75288b67fd1c55050f91ad3ac18a1 seamonkey-js-debugger-1.0.9-7.el4.x86_64.rpm 26dd4d7355ea70910548715ceb2ed6b7 seamonkey-mail-1.0.9-7.el4.x86_64.rpm 15f401773011f8a7de27028ad7a0a5e2 seamonkey-nspr-1.0.9-7.el4.i386.rpm 75a13cd6e619c82786ca6ec45020c316 seamonkey-nspr-1.0.9-7.el4.x86_64.rpm 33d5448b121102620e7fbc9c83b35c52 seamonkey-nspr-devel-1.0.9-7.el4.x86_64.rpm 7b25dfcc60d88a2c4a7c331293a7736d seamonkey-nss-1.0.9-7.el4.i386.rpm 46129da9524faf23b46ea9f907716fe6 seamonkey-nss-1.0.9-7.el4.x86_64.rpm a6fdac50cc604c70077848c58f87aa53 seamonkey-nss-devel-1.0.9-7.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4.5.z: SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/4ES-4.5.z/en/os/SRPMS/seamonkey-1.0.9-7.el4.src.rpm 47abeb1d691c037289a305f68cb5d888 seamonkey-1.0.9-7.el4.src.rpm i386: e9222124bb89f2de3a904208cb34c8e0 seamonkey-1.0.9-7.el4.i386.rpm b44cbbb7a1631a7fdf4288d34fa71f14 seamonkey-chat-1.0.9-7.el4.i386.rpm b7b6231b38b6c00dd5acec3106072cee seamonkey-debuginfo-1.0.9-7.el4.i386.rpm b5504b4165127439ba8e460899b8b1d3 seamonkey-devel-1.0.9-7.el4.i386.rpm 6bae7094fa87982a9231fdcf22920346 seamonkey-dom-inspector-1.0.9-7.el4.i386.rpm 0fbd54693df4d2ac8888969c85c99451 seamonkey-js-debugger-1.0.9-7.el4.i386.rpm bca8b93bd3e74b42ea943d86c7433f8d seamonkey-mail-1.0.9-7.el4.i386.rpm 15f401773011f8a7de27028ad7a0a5e2 seamonkey-nspr-1.0.9-7.el4.i386.rpm 99da2ce21bc01b326fb53d2b79c0aee5 seamonkey-nspr-devel-1.0.9-7.el4.i386.rpm 7b25dfcc60d88a2c4a7c331293a7736d seamonkey-nss-1.0.9-7.el4.i386.rpm 088ff97238a854d56898568ecbab941e seamonkey-nss-devel-1.0.9-7.el4.i386.rpm ia64: 28ebd79e0b957b9ec2e9b3c3ac2d14d6 seamonkey-1.0.9-7.el4.ia64.rpm 2a5b9da8230c99feaca4c4d7455638fd seamonkey-chat-1.0.9-7.el4.ia64.rpm b7b6231b38b6c00dd5acec3106072cee seamonkey-debuginfo-1.0.9-7.el4.i386.rpm 9ef63a1082922d57eafa088fca5d6fc4 seamonkey-debuginfo-1.0.9-7.el4.ia64.rpm b428dfe7791042260b504028a8219236 seamonkey-devel-1.0.9-7.el4.ia64.rpm 6ed126b272899a2729ad910d3be60441 seamonkey-dom-inspector-1.0.9-7.el4.ia64.rpm b3dc9681f3c1c66db0ee3d6bef61d981 seamonkey-js-debugger-1.0.9-7.el4.ia64.rpm a9126241150cd85689814286ed3be170 seamonkey-mail-1.0.9-7.el4.ia64.rpm 15f401773011f8a7de27028ad7a0a5e2 seamonkey-nspr-1.0.9-7.el4.i386.rpm db627f13d5b21b9c1031dc8dc3fbe939 seamonkey-nspr-1.0.9-7.el4.ia64.rpm ef13cb9266d3faf696f52c23dd70c2ab seamonkey-nspr-devel-1.0.9-7.el4.ia64.rpm 7b25dfcc60d88a2c4a7c331293a7736d seamonkey-nss-1.0.9-7.el4.i386.rpm 35ccf51f5c8bc793730518358e271b8d seamonkey-nss-1.0.9-7.el4.ia64.rpm ae24ebad82cb8e3aba365cdeb691bb9b seamonkey-nss-devel-1.0.9-7.el4.ia64.rpm x86_64: 1a85db50a21bb776e02e5f54fee39155 seamonkey-1.0.9-7.el4.x86_64.rpm b2d3af3131203e15517bf09234e489a3 seamonkey-chat-1.0.9-7.el4.x86_64.rpm b7b6231b38b6c00dd5acec3106072cee seamonkey-debuginfo-1.0.9-7.el4.i386.rpm f4e88589ac6cef8f4ae5c539cf422745 seamonkey-debuginfo-1.0.9-7.el4.x86_64.rpm 26c33791fceb829d618eb6b5e58e04bc seamonkey-devel-1.0.9-7.el4.x86_64.rpm e1cab447d8a9120f9b416eddc8f77f02 seamonkey-dom-inspector-1.0.9-7.el4.x86_64.rpm d5c75288b67fd1c55050f91ad3ac18a1 seamonkey-js-debugger-1.0.9-7.el4.x86_64.rpm 26dd4d7355ea70910548715ceb2ed6b7 seamonkey-mail-1.0.9-7.el4.x86_64.rpm 15f401773011f8a7de27028ad7a0a5e2 seamonkey-nspr-1.0.9-7.el4.i386.rpm 75a13cd6e619c82786ca6ec45020c316 seamonkey-nspr-1.0.9-7.el4.x86_64.rpm 33d5448b121102620e7fbc9c83b35c52 seamonkey-nspr-devel-1.0.9-7.el4.x86_64.rpm 7b25dfcc60d88a2c4a7c331293a7736d seamonkey-nss-1.0.9-7.el4.i386.rpm 46129da9524faf23b46ea9f907716fe6 seamonkey-nss-1.0.9-7.el4.x86_64.rpm a6fdac50cc604c70077848c58f87aa53 seamonkey-nss-devel-1.0.9-7.el4.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/seamonkey-1.0.9-7.el4.src.rpm 47abeb1d691c037289a305f68cb5d888 seamonkey-1.0.9-7.el4.src.rpm i386: e9222124bb89f2de3a904208cb34c8e0 seamonkey-1.0.9-7.el4.i386.rpm b44cbbb7a1631a7fdf4288d34fa71f14 seamonkey-chat-1.0.9-7.el4.i386.rpm b7b6231b38b6c00dd5acec3106072cee seamonkey-debuginfo-1.0.9-7.el4.i386.rpm b5504b4165127439ba8e460899b8b1d3 seamonkey-devel-1.0.9-7.el4.i386.rpm 6bae7094fa87982a9231fdcf22920346 seamonkey-dom-inspector-1.0.9-7.el4.i386.rpm 0fbd54693df4d2ac8888969c85c99451 seamonkey-js-debugger-1.0.9-7.el4.i386.rpm bca8b93bd3e74b42ea943d86c7433f8d seamonkey-mail-1.0.9-7.el4.i386.rpm 15f401773011f8a7de27028ad7a0a5e2 seamonkey-nspr-1.0.9-7.el4.i386.rpm 99da2ce21bc01b326fb53d2b79c0aee5 seamonkey-nspr-devel-1.0.9-7.el4.i386.rpm 7b25dfcc60d88a2c4a7c331293a7736d seamonkey-nss-1.0.9-7.el4.i386.rpm 088ff97238a854d56898568ecbab941e seamonkey-nss-devel-1.0.9-7.el4.i386.rpm ia64: 28ebd79e0b957b9ec2e9b3c3ac2d14d6 seamonkey-1.0.9-7.el4.ia64.rpm 2a5b9da8230c99feaca4c4d7455638fd seamonkey-chat-1.0.9-7.el4.ia64.rpm b7b6231b38b6c00dd5acec3106072cee seamonkey-debuginfo-1.0.9-7.el4.i386.rpm 9ef63a1082922d57eafa088fca5d6fc4 seamonkey-debuginfo-1.0.9-7.el4.ia64.rpm b428dfe7791042260b504028a8219236 seamonkey-devel-1.0.9-7.el4.ia64.rpm 6ed126b272899a2729ad910d3be60441 seamonkey-dom-inspector-1.0.9-7.el4.ia64.rpm b3dc9681f3c1c66db0ee3d6bef61d981 seamonkey-js-debugger-1.0.9-7.el4.ia64.rpm a9126241150cd85689814286ed3be170 seamonkey-mail-1.0.9-7.el4.ia64.rpm 15f401773011f8a7de27028ad7a0a5e2 seamonkey-nspr-1.0.9-7.el4.i386.rpm db627f13d5b21b9c1031dc8dc3fbe939 seamonkey-nspr-1.0.9-7.el4.ia64.rpm ef13cb9266d3faf696f52c23dd70c2ab seamonkey-nspr-devel-1.0.9-7.el4.ia64.rpm 7b25dfcc60d88a2c4a7c331293a7736d seamonkey-nss-1.0.9-7.el4.i386.rpm 35ccf51f5c8bc793730518358e271b8d seamonkey-nss-1.0.9-7.el4.ia64.rpm ae24ebad82cb8e3aba365cdeb691bb9b seamonkey-nss-devel-1.0.9-7.el4.ia64.rpm x86_64: 1a85db50a21bb776e02e5f54fee39155 seamonkey-1.0.9-7.el4.x86_64.rpm b2d3af3131203e15517bf09234e489a3 seamonkey-chat-1.0.9-7.el4.x86_64.rpm b7b6231b38b6c00dd5acec3106072cee seamonkey-debuginfo-1.0.9-7.el4.i386.rpm f4e88589ac6cef8f4ae5c539cf422745 seamonkey-debuginfo-1.0.9-7.el4.x86_64.rpm 26c33791fceb829d618eb6b5e58e04bc seamonkey-devel-1.0.9-7.el4.x86_64.rpm e1cab447d8a9120f9b416eddc8f77f02 seamonkey-dom-inspector-1.0.9-7.el4.x86_64.rpm d5c75288b67fd1c55050f91ad3ac18a1 seamonkey-js-debugger-1.0.9-7.el4.x86_64.rpm 26dd4d7355ea70910548715ceb2ed6b7 seamonkey-mail-1.0.9-7.el4.x86_64.rpm 15f401773011f8a7de27028ad7a0a5e2 seamonkey-nspr-1.0.9-7.el4.i386.rpm 75a13cd6e619c82786ca6ec45020c316 seamonkey-nspr-1.0.9-7.el4.x86_64.rpm 33d5448b121102620e7fbc9c83b35c52 seamonkey-nspr-devel-1.0.9-7.el4.x86_64.rpm 7b25dfcc60d88a2c4a7c331293a7736d seamonkey-nss-1.0.9-7.el4.i386.rpm 46129da9524faf23b46ea9f907716fe6 seamonkey-nss-1.0.9-7.el4.x86_64.rpm a6fdac50cc604c70077848c58f87aa53 seamonkey-nss-devel-1.0.9-7.el4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5947 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5959 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5960 http://www.redhat.com/security/updates/classification/#critical 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHS1j1XlSAg2UNWIIRAsIlAKCdFilsXwB49mWmnCKWVWEq41THzQCfRb1W iWyOYuIwT4D1SsBFHznlBZg= =yki0 -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Nov 28 18:53:35 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 28 Nov 2007 13:53:35 -0500 Subject: New mailing list available, RHSA-announce@redhat.com Message-ID: <200711281853.lASIrZQX020196@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 A new mailing list, RHSA-announce, is now available and will be used to send out security advisories for every Red Hat product and service. In the past, advisories were sent to separate mailing lists, with one list for each product family: * enterprise-watch-list: issues affecting Red Hat Enterprise Linux and layered products. * jboss-watch-list: issues affecting JBoss Enterprise Middleware. Relevant advisories will continue to be sent to enterprise-watch-list and jboss-watch-list, but will now also be sent to RHSA-announce. Advisories for products which never had separate lists, such as Red Hat Satellite Server, will be sent to the RHSA-announce list. Subscribe to RHSA-announce if you are interested in flaws affecting every Red Hat product. Continue to use the separate lists mentioned above if you want to receive a subset of advisories for the product family that interests you. Or use Red Hat Network to receive customized advisories for just the products and packages you are using. https://www.redhat.com/mailman/listinfo/RHSA-announce Visit https://www.redhat.com/security/updates/ for more details about security updates, our policies, and how to contact us. Thanks, Mark - -- Mark J Cox / Red Hat Security Response Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHTbkqXlSAg2UNWIIRAmyDAJ9xElohzdvATm995ZoHWkxyJTARAQCgukhn LNpFQnURbt/UDSGy6FHcc8E= =hxan -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 29 14:49:10 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 29 Nov 2007 09:49:10 -0500 Subject: [RHSA-2007:0993-01] Important: kernel security update Message-ID: <200711291449.lATEnAvx025923@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: kernel security update Advisory ID: RHSA-2007:0993-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0993.html Issue date: 2007-11-29 Updated on: 2007-11-29 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-4571 CVE-2007-4997 CVE-2007-5494 - --------------------------------------------------------------------- 1. Summary: Updated kernel packages that fix various security issues in the Red Hat Enterprise Linux 5 kernel are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, noarch, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, noarch, ppc, s390x, x86_64 3. Problem description: The Linux kernel handles the basic functions of the operating system. These new kernel packages contain fixes for the following security issues: A memory leak was found in the Red Hat Content Accelerator kernel patch. A local user could use this flaw to cause a denial of service (memory exhaustion). (CVE-2007-5494, Important) A flaw was found in the handling of IEEE 802.11 frames affecting several wireless LAN modules. In certain circumstances, a remote attacker could trigger this flaw by sending a malicious packet over a wireless network and cause a denial of service (kernel crash). (CVE-2007-4997, Important). A flaw was found in the Advanced Linux Sound Architecture (ALSA). A local user who had the ability to read the /proc/driver/snd-page-alloc file could see portions of kernel memory. (CVE-2007-4571, Moderate). In addition to the security issues described above, several bug fixes preventing possible memory corruption, system crashes, SCSI I/O fails, networking drivers performance regression and journaling block device layer issue were also included. Red Hat Enterprise Linux 5 users are advised to upgrade to these packages, which contain backported patches to resolve these issues. Red Hat would like to credit Vasily Averin, Chris Evans, and Neil Kettle for reporting the security issues corrected by this update. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 288961 - CVE-2007-4571 ALSA memory disclosure flaw 305011 - [RHEL 5.1.z]: Tick divider bugs on x86_64 315051 - CVE-2007-5494 open(O_ATOMICLOOKUP) leaks dentry 345141 - [PATCH] jbd: wait for already submitted t_sync_datalist buffer to complete (Possibility of in-place data destruction) 345151 - LSPP: audit rule causes kernel 'out of memory' condition and auditd failure 345161 - [EL5][BUG] Unexpected SIGILL on NFS/Montecito(ia64) 345171 - task->mm or slab corruption with CIFS 346341 - CVE-2007-4997 kernel ieee80211 off-by-two integer underflow 381001 - LSPP: audit enable not picking up all processes 381021 - [Broadcom 5.1.z bug] Performance regression on 5705 TG3 NICs 381101 - LTC35628-kexec/kdump kernel hung on Power5+ and Power6 based systems 381121 - LTC38135-vSCSI client reports 'Device sdX not ready' after deactive/active device on vSCSI server 381131 - forcedeth driver mishandles MSI interrupts under high load 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/kernel-2.6.18-53.1.4.el5.src.rpm f4ddc1c32090e95051a82221882f7f07 kernel-2.6.18-53.1.4.el5.src.rpm i386: 7db3e79c57682e6ccd52808899b615df kernel-2.6.18-53.1.4.el5.i686.rpm 3c710dd56c71e05a719254eabe5bef4e kernel-PAE-2.6.18-53.1.4.el5.i686.rpm f7abc5aa783e93096d38c54b59c090d2 kernel-PAE-debuginfo-2.6.18-53.1.4.el5.i686.rpm dc530282b624ccba683f4b181a6f3a07 kernel-PAE-devel-2.6.18-53.1.4.el5.i686.rpm f18ab8596f0de5f8aec9c5c06aa0772c kernel-debug-2.6.18-53.1.4.el5.i686.rpm 78fb69f9be4c5e3376ef657578bcbf3b kernel-debug-debuginfo-2.6.18-53.1.4.el5.i686.rpm 9e7dabd8afecabf2d81b7244e248d085 kernel-debug-devel-2.6.18-53.1.4.el5.i686.rpm 8ced8998555bd4ca582718aa4de6491a kernel-debuginfo-2.6.18-53.1.4.el5.i686.rpm 82cb46f9d27253be25240cdae5303f48 kernel-debuginfo-common-2.6.18-53.1.4.el5.i686.rpm 46c3986d06610e1ff1f13aea20e12a55 kernel-devel-2.6.18-53.1.4.el5.i686.rpm 03ecab2d61860ff849f17ed525f68a9b kernel-headers-2.6.18-53.1.4.el5.i386.rpm 3ac39f5fcd33e7c1e8d374cf26f23bba kernel-xen-2.6.18-53.1.4.el5.i686.rpm 866a71427e007f544ffa867f14e4ec2d kernel-xen-debuginfo-2.6.18-53.1.4.el5.i686.rpm 2d25af7fd212ed6bfe30b0fefd89e400 kernel-xen-devel-2.6.18-53.1.4.el5.i686.rpm noarch: ab3753a735ea61deb37182250b04c9d0 kernel-doc-2.6.18-53.1.4.el5.noarch.rpm x86_64: e071879c6de07723825ff525634ef14a kernel-2.6.18-53.1.4.el5.x86_64.rpm a328b40f9eb70cf9e0a4340ffcec53c8 kernel-debug-2.6.18-53.1.4.el5.x86_64.rpm 45e5066c1c1cdfe1c920f1ace4cf7268 kernel-debug-debuginfo-2.6.18-53.1.4.el5.x86_64.rpm 98613f3375199acf9ee60b5c8c407958 kernel-debug-devel-2.6.18-53.1.4.el5.x86_64.rpm 82206cb4393732d240ac50dce71c1510 kernel-debuginfo-2.6.18-53.1.4.el5.x86_64.rpm 4d470ccb5145a0fc225f44afca2c32ae kernel-debuginfo-common-2.6.18-53.1.4.el5.x86_64.rpm 5302a54d9169a4df8a048f67d3b2e518 kernel-devel-2.6.18-53.1.4.el5.x86_64.rpm a63da08cd0cca7cec81542537decb183 kernel-headers-2.6.18-53.1.4.el5.x86_64.rpm 5fa46572f8d861903ecf1d6d983e7153 kernel-xen-2.6.18-53.1.4.el5.x86_64.rpm 8ea07b9267a2c3265fb285a05b2ca982 kernel-xen-debuginfo-2.6.18-53.1.4.el5.x86_64.rpm 9877be5ebfd8402f5bd65d241bcf55f3 kernel-xen-devel-2.6.18-53.1.4.el5.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/kernel-2.6.18-53.1.4.el5.src.rpm f4ddc1c32090e95051a82221882f7f07 kernel-2.6.18-53.1.4.el5.src.rpm i386: 7db3e79c57682e6ccd52808899b615df kernel-2.6.18-53.1.4.el5.i686.rpm 3c710dd56c71e05a719254eabe5bef4e kernel-PAE-2.6.18-53.1.4.el5.i686.rpm f7abc5aa783e93096d38c54b59c090d2 kernel-PAE-debuginfo-2.6.18-53.1.4.el5.i686.rpm dc530282b624ccba683f4b181a6f3a07 kernel-PAE-devel-2.6.18-53.1.4.el5.i686.rpm f18ab8596f0de5f8aec9c5c06aa0772c kernel-debug-2.6.18-53.1.4.el5.i686.rpm 78fb69f9be4c5e3376ef657578bcbf3b kernel-debug-debuginfo-2.6.18-53.1.4.el5.i686.rpm 9e7dabd8afecabf2d81b7244e248d085 kernel-debug-devel-2.6.18-53.1.4.el5.i686.rpm 8ced8998555bd4ca582718aa4de6491a kernel-debuginfo-2.6.18-53.1.4.el5.i686.rpm 82cb46f9d27253be25240cdae5303f48 kernel-debuginfo-common-2.6.18-53.1.4.el5.i686.rpm 46c3986d06610e1ff1f13aea20e12a55 kernel-devel-2.6.18-53.1.4.el5.i686.rpm 03ecab2d61860ff849f17ed525f68a9b kernel-headers-2.6.18-53.1.4.el5.i386.rpm 3ac39f5fcd33e7c1e8d374cf26f23bba kernel-xen-2.6.18-53.1.4.el5.i686.rpm 866a71427e007f544ffa867f14e4ec2d kernel-xen-debuginfo-2.6.18-53.1.4.el5.i686.rpm 2d25af7fd212ed6bfe30b0fefd89e400 kernel-xen-devel-2.6.18-53.1.4.el5.i686.rpm ia64: c4b5c7f03fe8aa5770515d2926360589 kernel-2.6.18-53.1.4.el5.ia64.rpm 9d93070855eb35f4c9c51ba96544513b kernel-debug-2.6.18-53.1.4.el5.ia64.rpm 0724c9c99e58c2acc4190e5ed49f7a05 kernel-debug-debuginfo-2.6.18-53.1.4.el5.ia64.rpm d920157b8a5bb9c9b908924e1fe1ca5f kernel-debug-devel-2.6.18-53.1.4.el5.ia64.rpm 8685ce4e872ab826646f1db5193480e9 kernel-debuginfo-2.6.18-53.1.4.el5.ia64.rpm f8db66a50e12476bb86186bf9715d4cc kernel-debuginfo-common-2.6.18-53.1.4.el5.ia64.rpm ddffbae0bc152f6863d0ee443de9048c kernel-devel-2.6.18-53.1.4.el5.ia64.rpm 20971ff3bd352465d95f9687256b15df kernel-headers-2.6.18-53.1.4.el5.ia64.rpm d28c5d53ae4bf8f382ec428e32203e66 kernel-xen-2.6.18-53.1.4.el5.ia64.rpm 408a5a1dd9994a11a0547b8750def8a0 kernel-xen-debuginfo-2.6.18-53.1.4.el5.ia64.rpm 8f4c718a88b46be011e49c745d6ce4f2 kernel-xen-devel-2.6.18-53.1.4.el5.ia64.rpm noarch: ab3753a735ea61deb37182250b04c9d0 kernel-doc-2.6.18-53.1.4.el5.noarch.rpm ppc: bd068aebc02e617f34caee156d252841 kernel-2.6.18-53.1.4.el5.ppc64.rpm d277953a40d21ba17dbed7fd6c6f680f kernel-debug-2.6.18-53.1.4.el5.ppc64.rpm 0c62d227991dbaee59c812d1c252df88 kernel-debug-debuginfo-2.6.18-53.1.4.el5.ppc64.rpm 5ef886d8a3eece47fd0232d229264bac kernel-debug-devel-2.6.18-53.1.4.el5.ppc64.rpm eb49f51637a97ad6806cc19a3bc078d0 kernel-debuginfo-2.6.18-53.1.4.el5.ppc64.rpm 45131661332edcf45b864400399abb9c kernel-debuginfo-common-2.6.18-53.1.4.el5.ppc64.rpm 4164d433f794761cd04d2d455f3924e4 kernel-devel-2.6.18-53.1.4.el5.ppc64.rpm 951eee41009d6a83c90c535864f5bad7 kernel-headers-2.6.18-53.1.4.el5.ppc.rpm 3b14f2e47dde5989f2f26794b2fe012c kernel-headers-2.6.18-53.1.4.el5.ppc64.rpm fc215987bde440bbf9890392ad349a05 kernel-kdump-2.6.18-53.1.4.el5.ppc64.rpm 444294c39857ad466ab0bb4dab2b8f71 kernel-kdump-debuginfo-2.6.18-53.1.4.el5.ppc64.rpm fc5c6c3f402b21502ef445ac0b7feefd kernel-kdump-devel-2.6.18-53.1.4.el5.ppc64.rpm s390x: 2c3701f34e15686807a362d304b8894f kernel-2.6.18-53.1.4.el5.s390x.rpm d47000222a8ec41fad683f222b0594a4 kernel-debug-2.6.18-53.1.4.el5.s390x.rpm e674b9c3f52f21850e8ebaeb68e8758b kernel-debug-debuginfo-2.6.18-53.1.4.el5.s390x.rpm a4ce8f8b5cdd2655b69f39445de25825 kernel-debug-devel-2.6.18-53.1.4.el5.s390x.rpm f86888ee8a26a352070cc3523c75e7c9 kernel-debuginfo-2.6.18-53.1.4.el5.s390x.rpm abee5165caaad3c697fc4934f874090a kernel-debuginfo-common-2.6.18-53.1.4.el5.s390x.rpm 8578e33e3544a093221a9299b0b50c1b kernel-devel-2.6.18-53.1.4.el5.s390x.rpm 9d94999160c4adeea1e65b0207219628 kernel-headers-2.6.18-53.1.4.el5.s390x.rpm x86_64: e071879c6de07723825ff525634ef14a kernel-2.6.18-53.1.4.el5.x86_64.rpm a328b40f9eb70cf9e0a4340ffcec53c8 kernel-debug-2.6.18-53.1.4.el5.x86_64.rpm 45e5066c1c1cdfe1c920f1ace4cf7268 kernel-debug-debuginfo-2.6.18-53.1.4.el5.x86_64.rpm 98613f3375199acf9ee60b5c8c407958 kernel-debug-devel-2.6.18-53.1.4.el5.x86_64.rpm 82206cb4393732d240ac50dce71c1510 kernel-debuginfo-2.6.18-53.1.4.el5.x86_64.rpm 4d470ccb5145a0fc225f44afca2c32ae kernel-debuginfo-common-2.6.18-53.1.4.el5.x86_64.rpm 5302a54d9169a4df8a048f67d3b2e518 kernel-devel-2.6.18-53.1.4.el5.x86_64.rpm a63da08cd0cca7cec81542537decb183 kernel-headers-2.6.18-53.1.4.el5.x86_64.rpm 5fa46572f8d861903ecf1d6d983e7153 kernel-xen-2.6.18-53.1.4.el5.x86_64.rpm 8ea07b9267a2c3265fb285a05b2ca982 kernel-xen-debuginfo-2.6.18-53.1.4.el5.x86_64.rpm 9877be5ebfd8402f5bd65d241bcf55f3 kernel-xen-devel-2.6.18-53.1.4.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4571 http://cve.mitre.org/cgi-bin/cvename.cgi?name= http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4997 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5494 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHTtFLXlSAg2UNWIIRAgoWAJsHN/PKUKAfrg+z2CKG88A8BcFnSgCgtLOp 90k6eLxwtAXrJpXPKfYbmbs= =6rbk -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 29 14:51:20 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 29 Nov 2007 09:51:20 -0500 Subject: [RHSA-2007:1059-01] Important: pcre security update Message-ID: <200711291451.lATEpK2q026534@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: pcre security update Advisory ID: RHSA-2007:1059-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1059.html Issue date: 2007-11-29 Updated on: 2007-11-29 Product: Red Hat Enterprise Linux CVE Names: CVE-2006-7225 CVE-2006-7226 CVE-2006-7228 CVE-2006-7230 - --------------------------------------------------------------------- 1. Summary: Updated pcre packages that resolve several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: PCRE is a Perl-compatible regular expression library. Flaws were discovered in the way PCRE handles certain malformed regular expressions. If an application linked against PCRE, such as Konqueror, parses a malicious regular expression, it may have been possible to run arbitrary code as the user running the application. (CVE-2006-7225, CVE-2006-7226, CVE-2006-7228, CVE-2006-7230) Users of PCRE are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. Red Hat would like to thank Ludwig Nussel for reporting these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 383371 - CVE-2006-7228 pcre integer overflow 384761 - CVE-2006-7225 pcre miscalculation of memory requirements for malformed Posix character class 384781 - CVE-2006-7226 pcre miscalculation of memory requirements for repeated subpattern containing a named recursion or subroutine reference 384801 - CVE-2006-7230 pcre miscalculation of memory requirements if options are changed during pattern compilation 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pcre-6.6-2.el5_1.7.src.rpm 7cc3f071a95e8dabeae35ea9bb35bf44 pcre-6.6-2.el5_1.7.src.rpm i386: d201068ae3b6af398aad8e3fedd2875e pcre-6.6-2.el5_1.7.i386.rpm a7608c94759540227129fec7616f0586 pcre-debuginfo-6.6-2.el5_1.7.i386.rpm x86_64: d201068ae3b6af398aad8e3fedd2875e pcre-6.6-2.el5_1.7.i386.rpm 408ac25d3001d6df1e1a1373b70efe74 pcre-6.6-2.el5_1.7.x86_64.rpm a7608c94759540227129fec7616f0586 pcre-debuginfo-6.6-2.el5_1.7.i386.rpm 1f6c032ee4cf2e520dfc2b94af4d8e7c pcre-debuginfo-6.6-2.el5_1.7.x86_64.rpm RHEL Desktop Workstation (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pcre-6.6-2.el5_1.7.src.rpm 7cc3f071a95e8dabeae35ea9bb35bf44 pcre-6.6-2.el5_1.7.src.rpm i386: a7608c94759540227129fec7616f0586 pcre-debuginfo-6.6-2.el5_1.7.i386.rpm a28a9ee687328bc25eb01588c8738784 pcre-devel-6.6-2.el5_1.7.i386.rpm x86_64: a7608c94759540227129fec7616f0586 pcre-debuginfo-6.6-2.el5_1.7.i386.rpm 1f6c032ee4cf2e520dfc2b94af4d8e7c pcre-debuginfo-6.6-2.el5_1.7.x86_64.rpm a28a9ee687328bc25eb01588c8738784 pcre-devel-6.6-2.el5_1.7.i386.rpm b9f543c695ad7d8141a5c2fd80692981 pcre-devel-6.6-2.el5_1.7.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/pcre-6.6-2.el5_1.7.src.rpm 7cc3f071a95e8dabeae35ea9bb35bf44 pcre-6.6-2.el5_1.7.src.rpm i386: d201068ae3b6af398aad8e3fedd2875e pcre-6.6-2.el5_1.7.i386.rpm a7608c94759540227129fec7616f0586 pcre-debuginfo-6.6-2.el5_1.7.i386.rpm a28a9ee687328bc25eb01588c8738784 pcre-devel-6.6-2.el5_1.7.i386.rpm ia64: 7d60719573aecd2222867ddbe66bbe6c pcre-6.6-2.el5_1.7.ia64.rpm 2a5a73c832ba4f60ecf4dfad7b99c78a pcre-debuginfo-6.6-2.el5_1.7.ia64.rpm df733a18eee9d49b391b21e048eee94f pcre-devel-6.6-2.el5_1.7.ia64.rpm ppc: 12d9ca99b5c09e31a4945526dc22e881 pcre-6.6-2.el5_1.7.ppc.rpm 955028fb20133c35e15d4ca6036ba226 pcre-6.6-2.el5_1.7.ppc64.rpm ac6427735ecb436b105ca5b4643a857a pcre-debuginfo-6.6-2.el5_1.7.ppc.rpm 432b54afab5a5e6f98c21629027a9dbf pcre-debuginfo-6.6-2.el5_1.7.ppc64.rpm 6858d1c5a378e8957e1dba0d2d18850c pcre-devel-6.6-2.el5_1.7.ppc.rpm 72331b7d69a6f8ae26dff73b3529bc71 pcre-devel-6.6-2.el5_1.7.ppc64.rpm s390x: 4d7d135ce1ad2cb90de046aa30091e13 pcre-6.6-2.el5_1.7.s390.rpm b0c3c10df3700779b4196686e6724b54 pcre-6.6-2.el5_1.7.s390x.rpm dd5ad0c3bb9b1205875f69e48ffcdeb2 pcre-debuginfo-6.6-2.el5_1.7.s390.rpm c53c6d37bc7bc35946c2f4ce049609ba pcre-debuginfo-6.6-2.el5_1.7.s390x.rpm 6e24bad9004f1803d75c7de2de5d5512 pcre-devel-6.6-2.el5_1.7.s390.rpm 8f07ac7aee4d20b28aa8ebe5e0203d55 pcre-devel-6.6-2.el5_1.7.s390x.rpm x86_64: d201068ae3b6af398aad8e3fedd2875e pcre-6.6-2.el5_1.7.i386.rpm 408ac25d3001d6df1e1a1373b70efe74 pcre-6.6-2.el5_1.7.x86_64.rpm a7608c94759540227129fec7616f0586 pcre-debuginfo-6.6-2.el5_1.7.i386.rpm 1f6c032ee4cf2e520dfc2b94af4d8e7c pcre-debuginfo-6.6-2.el5_1.7.x86_64.rpm a28a9ee687328bc25eb01588c8738784 pcre-devel-6.6-2.el5_1.7.i386.rpm b9f543c695ad7d8141a5c2fd80692981 pcre-devel-6.6-2.el5_1.7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7225 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7226 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7228 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7230 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHTtHcXlSAg2UNWIIRArdaAKCzMMCIDpWfzEvLbuDxa7fhMYPkLgCgrwTF d9ISpt+wKee/JJU+lFUzrL4= =nqPS -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 29 14:57:02 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 29 Nov 2007 09:57:02 -0500 Subject: [RHSA-2007:1063-01] Important: pcre security update Message-ID: <200711291457.lATEv2tl027404@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: pcre security update Advisory ID: RHSA-2007:1063-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1063.html Issue date: 2007-11-29 Updated on: 2007-11-29 Product: Red Hat Enterprise Linux CVE Names: CVE-2006-7228 CVE-2007-1660 - --------------------------------------------------------------------- 1. Summary: Updated pcre packages that resolve several security issues are now available for Red Hat Enterprise Linux 3. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 3. Problem description: PCRE is a Perl-compatible regular expression library. Flaws were discovered in the way PCRE handles certain malformed regular expressions. If an application linked against PCRE, such as Konqueror, parsed a malicious regular expression, it may have been possible to run arbitrary code as the user running the application. (CVE-2006-7228, CVE-2007-1660) Users of PCRE are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. Red Hat would like to thank Ludwig Nussel for reporting these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 315881 - CVE-2007-1660 pcre regular expression flaws 383371 - CVE-2006-7228 pcre integer overflow 6. RPMs required: Red Hat Enterprise Linux AS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/pcre-3.9-10.4.src.rpm 44ea64b64fa610c91ae055878e4e8085 pcre-3.9-10.4.src.rpm i386: 95779554a24650e24d757e764aa74f25 pcre-3.9-10.4.i386.rpm 56c96fa950f63b46658ecbcedecb4dd1 pcre-debuginfo-3.9-10.4.i386.rpm e9ea2e70165ac3d7e95249ccd16a9983 pcre-devel-3.9-10.4.i386.rpm ia64: 95779554a24650e24d757e764aa74f25 pcre-3.9-10.4.i386.rpm fd7349f54aceb88dcd86b267f812bafc pcre-3.9-10.4.ia64.rpm 56c96fa950f63b46658ecbcedecb4dd1 pcre-debuginfo-3.9-10.4.i386.rpm f9c1e6ff16151dc24ae22b51ab0c79f2 pcre-debuginfo-3.9-10.4.ia64.rpm 721a7dfcd642f66fcbcc2ac04afdb8bb pcre-devel-3.9-10.4.ia64.rpm ppc: adf37fe2c059c2cfe6a0f4f844603e29 pcre-3.9-10.4.ppc.rpm 4c1c16803cb4ae09a5242d059d51658b pcre-3.9-10.4.ppc64.rpm 81c5a80144897a28c1d28a3a590c3f88 pcre-debuginfo-3.9-10.4.ppc.rpm 605e239ef723907e2d4bdb359886d809 pcre-debuginfo-3.9-10.4.ppc64.rpm faa3350c0417e79165768dafa44fd495 pcre-devel-3.9-10.4.ppc.rpm s390: 432d71cf2022271a823ead5d9549504f pcre-3.9-10.4.s390.rpm 2939c20c7b5fa5cb63bb8d12fa23f3bc pcre-debuginfo-3.9-10.4.s390.rpm ebf139993b5ee8f90d1668acf229d202 pcre-devel-3.9-10.4.s390.rpm s390x: 432d71cf2022271a823ead5d9549504f pcre-3.9-10.4.s390.rpm 3a808e46628e79d79c7e808aacc44c15 pcre-3.9-10.4.s390x.rpm 2939c20c7b5fa5cb63bb8d12fa23f3bc pcre-debuginfo-3.9-10.4.s390.rpm 91e8e1fa0791367d99d051eecc0b9179 pcre-debuginfo-3.9-10.4.s390x.rpm 24b9c346b9c686fe3cf12768673bab18 pcre-devel-3.9-10.4.s390x.rpm x86_64: 95779554a24650e24d757e764aa74f25 pcre-3.9-10.4.i386.rpm 0d5e674d6622efd83c07fdcd16ba3dc2 pcre-3.9-10.4.x86_64.rpm 56c96fa950f63b46658ecbcedecb4dd1 pcre-debuginfo-3.9-10.4.i386.rpm dd121878136f47104359f54deb77b0dd pcre-debuginfo-3.9-10.4.x86_64.rpm b6d06e7efdfd9ed8b35a15b1370808c6 pcre-devel-3.9-10.4.x86_64.rpm Red Hat Desktop version 3: SRPMS: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/pcre-3.9-10.4.src.rpm 44ea64b64fa610c91ae055878e4e8085 pcre-3.9-10.4.src.rpm i386: 95779554a24650e24d757e764aa74f25 pcre-3.9-10.4.i386.rpm 56c96fa950f63b46658ecbcedecb4dd1 pcre-debuginfo-3.9-10.4.i386.rpm e9ea2e70165ac3d7e95249ccd16a9983 pcre-devel-3.9-10.4.i386.rpm x86_64: 95779554a24650e24d757e764aa74f25 pcre-3.9-10.4.i386.rpm 0d5e674d6622efd83c07fdcd16ba3dc2 pcre-3.9-10.4.x86_64.rpm 56c96fa950f63b46658ecbcedecb4dd1 pcre-debuginfo-3.9-10.4.i386.rpm dd121878136f47104359f54deb77b0dd pcre-debuginfo-3.9-10.4.x86_64.rpm b6d06e7efdfd9ed8b35a15b1370808c6 pcre-devel-3.9-10.4.x86_64.rpm Red Hat Enterprise Linux ES version 3: SRPMS: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/pcre-3.9-10.4.src.rpm 44ea64b64fa610c91ae055878e4e8085 pcre-3.9-10.4.src.rpm i386: 95779554a24650e24d757e764aa74f25 pcre-3.9-10.4.i386.rpm 56c96fa950f63b46658ecbcedecb4dd1 pcre-debuginfo-3.9-10.4.i386.rpm e9ea2e70165ac3d7e95249ccd16a9983 pcre-devel-3.9-10.4.i386.rpm ia64: 95779554a24650e24d757e764aa74f25 pcre-3.9-10.4.i386.rpm fd7349f54aceb88dcd86b267f812bafc pcre-3.9-10.4.ia64.rpm 56c96fa950f63b46658ecbcedecb4dd1 pcre-debuginfo-3.9-10.4.i386.rpm f9c1e6ff16151dc24ae22b51ab0c79f2 pcre-debuginfo-3.9-10.4.ia64.rpm 721a7dfcd642f66fcbcc2ac04afdb8bb pcre-devel-3.9-10.4.ia64.rpm x86_64: 95779554a24650e24d757e764aa74f25 pcre-3.9-10.4.i386.rpm 0d5e674d6622efd83c07fdcd16ba3dc2 pcre-3.9-10.4.x86_64.rpm 56c96fa950f63b46658ecbcedecb4dd1 pcre-debuginfo-3.9-10.4.i386.rpm dd121878136f47104359f54deb77b0dd pcre-debuginfo-3.9-10.4.x86_64.rpm b6d06e7efdfd9ed8b35a15b1370808c6 pcre-devel-3.9-10.4.x86_64.rpm Red Hat Enterprise Linux WS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/pcre-3.9-10.4.src.rpm 44ea64b64fa610c91ae055878e4e8085 pcre-3.9-10.4.src.rpm i386: 95779554a24650e24d757e764aa74f25 pcre-3.9-10.4.i386.rpm 56c96fa950f63b46658ecbcedecb4dd1 pcre-debuginfo-3.9-10.4.i386.rpm e9ea2e70165ac3d7e95249ccd16a9983 pcre-devel-3.9-10.4.i386.rpm ia64: 95779554a24650e24d757e764aa74f25 pcre-3.9-10.4.i386.rpm fd7349f54aceb88dcd86b267f812bafc pcre-3.9-10.4.ia64.rpm 56c96fa950f63b46658ecbcedecb4dd1 pcre-debuginfo-3.9-10.4.i386.rpm f9c1e6ff16151dc24ae22b51ab0c79f2 pcre-debuginfo-3.9-10.4.ia64.rpm 721a7dfcd642f66fcbcc2ac04afdb8bb pcre-devel-3.9-10.4.ia64.rpm x86_64: 95779554a24650e24d757e764aa74f25 pcre-3.9-10.4.i386.rpm 0d5e674d6622efd83c07fdcd16ba3dc2 pcre-3.9-10.4.x86_64.rpm 56c96fa950f63b46658ecbcedecb4dd1 pcre-debuginfo-3.9-10.4.i386.rpm dd121878136f47104359f54deb77b0dd pcre-debuginfo-3.9-10.4.x86_64.rpm b6d06e7efdfd9ed8b35a15b1370808c6 pcre-devel-3.9-10.4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7228 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1660 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHTtM3XlSAg2UNWIIRAsOWAJ9oMn7V6qFZFrdQQF0c0NG+si3XTQCfUEaW bR3m4KOaylsgKf1zo8E2umc= =+hYj -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 29 14:59:25 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 29 Nov 2007 09:59:25 -0500 Subject: [RHSA-2007:1065-01] Moderate: pcre security update Message-ID: <200711291459.lATExP62027629@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: pcre security update Advisory ID: RHSA-2007:1065-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1065.html Issue date: 2007-11-29 Updated on: 2007-11-29 Product: Red Hat Enterprise Linux CVE Names: CVE-2006-7228 CVE-2007-1660 - --------------------------------------------------------------------- 1. Summary: Updated pcre packages that resolve several security issues are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 3. Problem description: PCRE is a Perl-compatible regular expression library. Flaws were discovered in the way PCRE handles certain malformed regular expressions. If an application linked against PCRE parses a malicious regular expression, it may have been possible to run arbitrary code as the user running the application. (CVE-2006-7228, CVE-2007-1660) Users of PCRE are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. Red Hat would like to thank Ludwig Nussel for reporting these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 315881 - CVE-2007-1660 pcre regular expression flaws 383371 - CVE-2006-7228 pcre integer overflow 6. RPMs required: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 : SRPMS: ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/pcre-3.4-2.4.src.rpm b022b4a160b9ae10502caf8f7f41e3df pcre-3.4-2.4.src.rpm i386: 93b438935eef79a4694bce231c88677d pcre-3.4-2.4.i386.rpm ba0028614c709b8890fa2df7f943a6ec pcre-devel-3.4-2.4.i386.rpm ia64: cdcd3056392e75214d16493b9e3a5cf5 pcre-3.4-2.4.ia64.rpm bb8cf92b2f4f9a24653116e027a5ee2a pcre-devel-3.4-2.4.ia64.rpm Red Hat Linux Advanced Workstation 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/pcre-3.4-2.4.src.rpm b022b4a160b9ae10502caf8f7f41e3df pcre-3.4-2.4.src.rpm ia64: cdcd3056392e75214d16493b9e3a5cf5 pcre-3.4-2.4.ia64.rpm bb8cf92b2f4f9a24653116e027a5ee2a pcre-devel-3.4-2.4.ia64.rpm Red Hat Enterprise Linux ES version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/pcre-3.4-2.4.src.rpm b022b4a160b9ae10502caf8f7f41e3df pcre-3.4-2.4.src.rpm i386: 93b438935eef79a4694bce231c88677d pcre-3.4-2.4.i386.rpm ba0028614c709b8890fa2df7f943a6ec pcre-devel-3.4-2.4.i386.rpm Red Hat Enterprise Linux WS version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/pcre-3.4-2.4.src.rpm b022b4a160b9ae10502caf8f7f41e3df pcre-3.4-2.4.src.rpm i386: 93b438935eef79a4694bce231c88677d pcre-3.4-2.4.i386.rpm ba0028614c709b8890fa2df7f943a6ec pcre-devel-3.4-2.4.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7228 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1660 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHTtO7XlSAg2UNWIIRAoEdAJ4wSjLsZMrfEs9DFA17aWhP84/JyACgsklM gYgDYsoe2SztglBbjpIhIKg= =Es9f -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 29 15:09:44 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 29 Nov 2007 10:09:44 -0500 Subject: [RHSA-2007:1068-01] Important: pcre security update Message-ID: <200711291509.lATF9iQt029261@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: pcre security update Advisory ID: RHSA-2007:1068-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1068.html Issue date: 2007-11-29 Updated on: 2007-11-29 Product: Red Hat Enterprise Linux CVE Names: CVE-2006-7225 CVE-2006-7226 CVE-2006-7228 CVE-2006-7230 CVE-2007-1659 - --------------------------------------------------------------------- 1. Summary: Updated pcre packages that resolve several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: PCRE is a Perl-compatible regular expression library. Flaws were discovered in the way PCRE handles certain malformed regular expressions. If an application linked against PCRE, such as Konqueror, parses a malicious regular expression, it may have been possible to run arbitrary code as the user running the application. (CVE-2006-7225, CVE-2006-7226, CVE-2006-7228, CVE-2006-7230, CVE-2007-1659) Users of PCRE are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. Red Hat would like to thank Ludwig Nussel for reporting these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 315871 - CVE-2007-1659 pcre regular expression flaws 383371 - CVE-2006-7228 pcre integer overflow 384761 - CVE-2006-7225 pcre miscalculation of memory requirements for malformed Posix character class 384781 - CVE-2006-7226 pcre miscalculation of memory requirements for repeated subpattern containing a named recursion or subroutine reference 384801 - CVE-2006-7230 pcre miscalculation of memory requirements if options are changed during pattern compilation 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/pcre-4.5-4.el4_6.6.src.rpm 3fc0fdaf84b06cdf5788640cff0026f6 pcre-4.5-4.el4_6.6.src.rpm i386: 2fc7dcfeab667b57d6cd72b3900e23e4 pcre-4.5-4.el4_6.6.i386.rpm 1792b64ed883f57a999ed859b9a9e554 pcre-debuginfo-4.5-4.el4_6.6.i386.rpm 9965f80d4d5ab3b571ab3c3cc9898990 pcre-devel-4.5-4.el4_6.6.i386.rpm ia64: 2fc7dcfeab667b57d6cd72b3900e23e4 pcre-4.5-4.el4_6.6.i386.rpm 33f4eab971ef408facd1641eabaa467a pcre-4.5-4.el4_6.6.ia64.rpm 1792b64ed883f57a999ed859b9a9e554 pcre-debuginfo-4.5-4.el4_6.6.i386.rpm e5a27c2bddd2644641b1ad235508fbda pcre-debuginfo-4.5-4.el4_6.6.ia64.rpm 6dfe274bd09371d8e0de10c5cc92bc26 pcre-devel-4.5-4.el4_6.6.ia64.rpm ppc: 47acc99aadd1698c477beb54465e13f9 pcre-4.5-4.el4_6.6.ppc.rpm c7bc58a2b1b45cba707f6e32f6b5182b pcre-4.5-4.el4_6.6.ppc64.rpm 91d3d8000f09f9f3c8da971773718f24 pcre-debuginfo-4.5-4.el4_6.6.ppc.rpm 3efa974cd8f22041f71552ae295fc477 pcre-debuginfo-4.5-4.el4_6.6.ppc64.rpm ffc58e305b91c427bab0f1d536bf8e3a pcre-devel-4.5-4.el4_6.6.ppc.rpm s390: db4e05d53ed8fb12030d2f6684d9d869 pcre-4.5-4.el4_6.6.s390.rpm 4c60f3a6fa76de879ace31d7c635b68f pcre-debuginfo-4.5-4.el4_6.6.s390.rpm 28d5cef76bf6ad728e777cd80e0e6628 pcre-devel-4.5-4.el4_6.6.s390.rpm s390x: db4e05d53ed8fb12030d2f6684d9d869 pcre-4.5-4.el4_6.6.s390.rpm 934cdcaa114cd70bf10f089fff41fea1 pcre-4.5-4.el4_6.6.s390x.rpm 4c60f3a6fa76de879ace31d7c635b68f pcre-debuginfo-4.5-4.el4_6.6.s390.rpm fc3a110b4cd548dc04590636f57c28ea pcre-debuginfo-4.5-4.el4_6.6.s390x.rpm f8589e25f1c60407ae174a941b3fa51f pcre-devel-4.5-4.el4_6.6.s390x.rpm x86_64: 2fc7dcfeab667b57d6cd72b3900e23e4 pcre-4.5-4.el4_6.6.i386.rpm 5ec42946ee8eea49029ff7b06ee58234 pcre-4.5-4.el4_6.6.x86_64.rpm 1792b64ed883f57a999ed859b9a9e554 pcre-debuginfo-4.5-4.el4_6.6.i386.rpm d39e0bdc461577451e10a9d855e6fc73 pcre-debuginfo-4.5-4.el4_6.6.x86_64.rpm d2464456a160a001ee8810a35235b3ae pcre-devel-4.5-4.el4_6.6.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/pcre-4.5-4.el4_6.6.src.rpm 3fc0fdaf84b06cdf5788640cff0026f6 pcre-4.5-4.el4_6.6.src.rpm i386: 2fc7dcfeab667b57d6cd72b3900e23e4 pcre-4.5-4.el4_6.6.i386.rpm 1792b64ed883f57a999ed859b9a9e554 pcre-debuginfo-4.5-4.el4_6.6.i386.rpm 9965f80d4d5ab3b571ab3c3cc9898990 pcre-devel-4.5-4.el4_6.6.i386.rpm x86_64: 2fc7dcfeab667b57d6cd72b3900e23e4 pcre-4.5-4.el4_6.6.i386.rpm 5ec42946ee8eea49029ff7b06ee58234 pcre-4.5-4.el4_6.6.x86_64.rpm 1792b64ed883f57a999ed859b9a9e554 pcre-debuginfo-4.5-4.el4_6.6.i386.rpm d39e0bdc461577451e10a9d855e6fc73 pcre-debuginfo-4.5-4.el4_6.6.x86_64.rpm d2464456a160a001ee8810a35235b3ae pcre-devel-4.5-4.el4_6.6.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/pcre-4.5-4.el4_6.6.src.rpm 3fc0fdaf84b06cdf5788640cff0026f6 pcre-4.5-4.el4_6.6.src.rpm i386: 2fc7dcfeab667b57d6cd72b3900e23e4 pcre-4.5-4.el4_6.6.i386.rpm 1792b64ed883f57a999ed859b9a9e554 pcre-debuginfo-4.5-4.el4_6.6.i386.rpm 9965f80d4d5ab3b571ab3c3cc9898990 pcre-devel-4.5-4.el4_6.6.i386.rpm ia64: 2fc7dcfeab667b57d6cd72b3900e23e4 pcre-4.5-4.el4_6.6.i386.rpm 33f4eab971ef408facd1641eabaa467a pcre-4.5-4.el4_6.6.ia64.rpm 1792b64ed883f57a999ed859b9a9e554 pcre-debuginfo-4.5-4.el4_6.6.i386.rpm e5a27c2bddd2644641b1ad235508fbda pcre-debuginfo-4.5-4.el4_6.6.ia64.rpm 6dfe274bd09371d8e0de10c5cc92bc26 pcre-devel-4.5-4.el4_6.6.ia64.rpm x86_64: 2fc7dcfeab667b57d6cd72b3900e23e4 pcre-4.5-4.el4_6.6.i386.rpm 5ec42946ee8eea49029ff7b06ee58234 pcre-4.5-4.el4_6.6.x86_64.rpm 1792b64ed883f57a999ed859b9a9e554 pcre-debuginfo-4.5-4.el4_6.6.i386.rpm d39e0bdc461577451e10a9d855e6fc73 pcre-debuginfo-4.5-4.el4_6.6.x86_64.rpm d2464456a160a001ee8810a35235b3ae pcre-devel-4.5-4.el4_6.6.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/pcre-4.5-4.el4_6.6.src.rpm 3fc0fdaf84b06cdf5788640cff0026f6 pcre-4.5-4.el4_6.6.src.rpm i386: 2fc7dcfeab667b57d6cd72b3900e23e4 pcre-4.5-4.el4_6.6.i386.rpm 1792b64ed883f57a999ed859b9a9e554 pcre-debuginfo-4.5-4.el4_6.6.i386.rpm 9965f80d4d5ab3b571ab3c3cc9898990 pcre-devel-4.5-4.el4_6.6.i386.rpm ia64: 2fc7dcfeab667b57d6cd72b3900e23e4 pcre-4.5-4.el4_6.6.i386.rpm 33f4eab971ef408facd1641eabaa467a pcre-4.5-4.el4_6.6.ia64.rpm 1792b64ed883f57a999ed859b9a9e554 pcre-debuginfo-4.5-4.el4_6.6.i386.rpm e5a27c2bddd2644641b1ad235508fbda pcre-debuginfo-4.5-4.el4_6.6.ia64.rpm 6dfe274bd09371d8e0de10c5cc92bc26 pcre-devel-4.5-4.el4_6.6.ia64.rpm x86_64: 2fc7dcfeab667b57d6cd72b3900e23e4 pcre-4.5-4.el4_6.6.i386.rpm 5ec42946ee8eea49029ff7b06ee58234 pcre-4.5-4.el4_6.6.x86_64.rpm 1792b64ed883f57a999ed859b9a9e554 pcre-debuginfo-4.5-4.el4_6.6.i386.rpm d39e0bdc461577451e10a9d855e6fc73 pcre-debuginfo-4.5-4.el4_6.6.x86_64.rpm d2464456a160a001ee8810a35235b3ae pcre-devel-4.5-4.el4_6.6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7225 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7226 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7228 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7230 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1659 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHTtY1XlSAg2UNWIIRAikxAJ9OELYnFxcI0Y1oBXxErFmXwA1qUQCguVY1 7EQaFgPnBgKIqdZL0S7M/Xo= =JPO8 -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Nov 29 15:47:24 2007 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 29 Nov 2007 10:47:24 -0500 Subject: [RHSA-2007:1078-02] Important: cairo security update Message-ID: <200711291547.lATFlO8P003534@pobox.devel.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: cairo security update Advisory ID: RHSA-2007:1078-02 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-1078.html Issue date: 2007-11-29 Updated on: 2007-11-29 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-5503 - --------------------------------------------------------------------- 1. Summary: Updated Cairo packages that resolve a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Problem description: Cairo is a vector graphics library designed to provide high-quality display and print output. An integer overflow flaw was found in the way Cairo processes PNG images. If an application linked against Cairo processes a malicious PNG image, it is possible to execute arbitrary code as the user running the application. (CVE-2007-5503) Users of Cairo are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bug IDs fixed (http://bugzilla.redhat.com/): 387431 - CVE-2007-5503 cairo integer overflow 6. RPMs required: Red Hat Enterprise Linux Desktop (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/cairo-1.2.4-3.el5_1.src.rpm cbfeb076c6d2c87325cc8c20bffb0673 cairo-1.2.4-3.el5_1.src.rpm i386: 58f31c9334847d100a28ad6606c9b636 cairo-1.2.4-3.el5_1.i386.rpm a472da9c63d69629bb7affd9ddb667dd cairo-debuginfo-1.2.4-3.el5_1.i386.rpm x86_64: 58f31c9334847d100a28ad6606c9b636 cairo-1.2.4-3.el5_1.i386.rpm 463958973b4ba3ada3cff99a930db908 cairo-1.2.4-3.el5_1.x86_64.rpm a472da9c63d69629bb7affd9ddb667dd cairo-debuginfo-1.2.4-3.el5_1.i386.rpm d92aae7fabdfabf7922c08dd848319ea cairo-debuginfo-1.2.4-3.el5_1.x86_64.rpm RHEL Desktop Workstation (v. 5 client): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/cairo-1.2.4-3.el5_1.src.rpm cbfeb076c6d2c87325cc8c20bffb0673 cairo-1.2.4-3.el5_1.src.rpm i386: a472da9c63d69629bb7affd9ddb667dd cairo-debuginfo-1.2.4-3.el5_1.i386.rpm e1a06df5b1e3e5f43f1d5c646f1bb258 cairo-devel-1.2.4-3.el5_1.i386.rpm x86_64: a472da9c63d69629bb7affd9ddb667dd cairo-debuginfo-1.2.4-3.el5_1.i386.rpm d92aae7fabdfabf7922c08dd848319ea cairo-debuginfo-1.2.4-3.el5_1.x86_64.rpm e1a06df5b1e3e5f43f1d5c646f1bb258 cairo-devel-1.2.4-3.el5_1.i386.rpm 6b10f796d9594dc439eb6e4e984a659b cairo-devel-1.2.4-3.el5_1.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): SRPMS: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/cairo-1.2.4-3.el5_1.src.rpm cbfeb076c6d2c87325cc8c20bffb0673 cairo-1.2.4-3.el5_1.src.rpm i386: 58f31c9334847d100a28ad6606c9b636 cairo-1.2.4-3.el5_1.i386.rpm a472da9c63d69629bb7affd9ddb667dd cairo-debuginfo-1.2.4-3.el5_1.i386.rpm e1a06df5b1e3e5f43f1d5c646f1bb258 cairo-devel-1.2.4-3.el5_1.i386.rpm ia64: 58f31c9334847d100a28ad6606c9b636 cairo-1.2.4-3.el5_1.i386.rpm 60844055ceee625c95d7b94eae351948 cairo-1.2.4-3.el5_1.ia64.rpm a472da9c63d69629bb7affd9ddb667dd cairo-debuginfo-1.2.4-3.el5_1.i386.rpm 6c1cdfc4c6037b039536b53fc034bb33 cairo-debuginfo-1.2.4-3.el5_1.ia64.rpm 20d33a44a958bf53aada42c08761be8b cairo-devel-1.2.4-3.el5_1.ia64.rpm ppc: e4b5250dba1bd0056e3deacd16a6dd65 cairo-1.2.4-3.el5_1.ppc.rpm 579359058ecca388892e6a28f6ddefba cairo-1.2.4-3.el5_1.ppc64.rpm e4896a5f59dc0743790ae8b6b47411ab cairo-debuginfo-1.2.4-3.el5_1.ppc.rpm be276ee81fbb89ab6ddcd5e88e38b63d cairo-debuginfo-1.2.4-3.el5_1.ppc64.rpm 8942d9ed93096e9f3f3f8d8703e40b7a cairo-devel-1.2.4-3.el5_1.ppc.rpm 490be6cf85b9035f6170f553862ad5f2 cairo-devel-1.2.4-3.el5_1.ppc64.rpm s390x: 7fb5f3ca96b9407a294ac379cb654e16 cairo-1.2.4-3.el5_1.s390.rpm 5d5975bbf5ee037afa85d0304042bf10 cairo-1.2.4-3.el5_1.s390x.rpm 2a186fe9ed80d8ceb6aa4a301f6fe478 cairo-debuginfo-1.2.4-3.el5_1.s390.rpm 271f845a5e9c57a1766630c5fac29133 cairo-debuginfo-1.2.4-3.el5_1.s390x.rpm b94a16d274895163a7a0990392f722bb cairo-devel-1.2.4-3.el5_1.s390.rpm 9a395c63e51fc02d00ad1ca31280e407 cairo-devel-1.2.4-3.el5_1.s390x.rpm x86_64: 58f31c9334847d100a28ad6606c9b636 cairo-1.2.4-3.el5_1.i386.rpm 463958973b4ba3ada3cff99a930db908 cairo-1.2.4-3.el5_1.x86_64.rpm a472da9c63d69629bb7affd9ddb667dd cairo-debuginfo-1.2.4-3.el5_1.i386.rpm d92aae7fabdfabf7922c08dd848319ea cairo-debuginfo-1.2.4-3.el5_1.x86_64.rpm e1a06df5b1e3e5f43f1d5c646f1bb258 cairo-devel-1.2.4-3.el5_1.i386.rpm 6b10f796d9594dc439eb6e4e984a659b cairo-devel-1.2.4-3.el5_1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5503 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHTt8HXlSAg2UNWIIRAtRIAJ0YV4Sn5f0YX+Ed0Fjd9hVyU1tRmACgsTmn YXiAA4z0we5r7sK0Tr3Z+Rw= =GpRn -----END PGP SIGNATURE-----