From bugzilla at redhat.com Wed Oct 1 17:35:22 2008 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 1 Oct 2008 13:35:22 -0400 Subject: [RHSA-2008:0890-01] Moderate: wireshark security update Message-ID: <200810011735.m91HZMgM015008@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: wireshark security update Advisory ID: RHSA-2008:0890-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0890.html Issue date: 2008-10-01 CVE Names: CVE-2008-1070 CVE-2008-1071 CVE-2008-1072 CVE-2008-1561 CVE-2008-1562 CVE-2008-1563 CVE-2008-3137 CVE-2008-3138 CVE-2008-3141 CVE-2008-3145 CVE-2008-3146 CVE-2008-3932 CVE-2008-3933 CVE-2008-3934 ===================================================================== 1. Summary: Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal. Multiple buffer overflow flaws were found in Wireshark. If Wireshark read a malformed packet off a network, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2008-3146) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malformed dump file. (CVE-2008-1070, CVE-2008-1071, CVE-2008-1072, CVE-2008-1561, CVE-2008-1562, CVE-2008-1563, CVE-2008-3137, CVE-2008-3138, CVE-2008-3141, CVE-2008-3145, CVE-2008-3932, CVE-2008-3933, CVE-2008-3934) Additionally, this update changes the default Pluggable Authentication Modules (PAM) configuration to always prompt for the root password before each start of Wireshark. This avoids unintentionally running Wireshark with root privileges. Users of wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.3, and resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 435481 - CVE-2008-1070 wireshark: SCTP dissector crash 435482 - CVE-2008-1071 wireshark: SNMP dissector crash 435483 - CVE-2008-1072 wireshark: TFTP dissector crash 439943 - CVE-2008-1563 wireshark: crash in SCCP dissector 440014 - CVE-2008-1561 wireshark: crash in X.509sat and Roofnet dissectors 440015 - CVE-2008-1562 wireshark: crash in LDAP dissector 448584 - Don't automatically use stored privileges 454970 - CVE-2008-3137 wireshark: crash in the GSM SMS dissector 454971 - CVE-2008-3138 wireshark: unexpected exit in the PANA and KISMET dissectors 454975 - CVE-2008-3141 wireshark: memory disclosure in the RMI dissector 454984 - CVE-2008-3145 wireshark: crash in the packet reassembling 461242 - CVE-2008-3146 wireshark: multiple buffer overflows in NCP dissector 461243 - CVE-2008-3932 wireshark: infinite loop in the NCP dissector 461244 - CVE-2008-3933 wireshark: crash triggered by zlib-compressed packet data 461245 - CVE-2008-3934 wireshark: crash via crafted Tektronix .rf5 file 6. Package List: Red Hat Enterprise Linux AS version 3: Source: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/wireshark-1.0.3-EL3.3.src.rpm i386: wireshark-1.0.3-EL3.3.i386.rpm wireshark-debuginfo-1.0.3-EL3.3.i386.rpm wireshark-gnome-1.0.3-EL3.3.i386.rpm ia64: wireshark-1.0.3-EL3.3.ia64.rpm wireshark-debuginfo-1.0.3-EL3.3.ia64.rpm wireshark-gnome-1.0.3-EL3.3.ia64.rpm ppc: wireshark-1.0.3-EL3.3.ppc.rpm wireshark-debuginfo-1.0.3-EL3.3.ppc.rpm wireshark-gnome-1.0.3-EL3.3.ppc.rpm s390: wireshark-1.0.3-EL3.3.s390.rpm wireshark-debuginfo-1.0.3-EL3.3.s390.rpm wireshark-gnome-1.0.3-EL3.3.s390.rpm s390x: wireshark-1.0.3-EL3.3.s390x.rpm wireshark-debuginfo-1.0.3-EL3.3.s390x.rpm wireshark-gnome-1.0.3-EL3.3.s390x.rpm x86_64: wireshark-1.0.3-EL3.3.x86_64.rpm wireshark-debuginfo-1.0.3-EL3.3.x86_64.rpm wireshark-gnome-1.0.3-EL3.3.x86_64.rpm Red Hat Desktop version 3: Source: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/wireshark-1.0.3-EL3.3.src.rpm i386: wireshark-1.0.3-EL3.3.i386.rpm wireshark-debuginfo-1.0.3-EL3.3.i386.rpm wireshark-gnome-1.0.3-EL3.3.i386.rpm x86_64: wireshark-1.0.3-EL3.3.x86_64.rpm wireshark-debuginfo-1.0.3-EL3.3.x86_64.rpm wireshark-gnome-1.0.3-EL3.3.x86_64.rpm Red Hat Enterprise Linux ES version 3: Source: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/wireshark-1.0.3-EL3.3.src.rpm i386: wireshark-1.0.3-EL3.3.i386.rpm wireshark-debuginfo-1.0.3-EL3.3.i386.rpm wireshark-gnome-1.0.3-EL3.3.i386.rpm ia64: wireshark-1.0.3-EL3.3.ia64.rpm wireshark-debuginfo-1.0.3-EL3.3.ia64.rpm wireshark-gnome-1.0.3-EL3.3.ia64.rpm x86_64: wireshark-1.0.3-EL3.3.x86_64.rpm wireshark-debuginfo-1.0.3-EL3.3.x86_64.rpm wireshark-gnome-1.0.3-EL3.3.x86_64.rpm Red Hat Enterprise Linux WS version 3: Source: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/wireshark-1.0.3-EL3.3.src.rpm i386: wireshark-1.0.3-EL3.3.i386.rpm wireshark-debuginfo-1.0.3-EL3.3.i386.rpm wireshark-gnome-1.0.3-EL3.3.i386.rpm ia64: wireshark-1.0.3-EL3.3.ia64.rpm wireshark-debuginfo-1.0.3-EL3.3.ia64.rpm wireshark-gnome-1.0.3-EL3.3.ia64.rpm x86_64: wireshark-1.0.3-EL3.3.x86_64.rpm wireshark-debuginfo-1.0.3-EL3.3.x86_64.rpm wireshark-gnome-1.0.3-EL3.3.x86_64.rpm Red Hat Enterprise Linux AS version 4: Source: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/wireshark-1.0.3-3.el4_7.src.rpm i386: wireshark-1.0.3-3.el4_7.i386.rpm wireshark-debuginfo-1.0.3-3.el4_7.i386.rpm wireshark-gnome-1.0.3-3.el4_7.i386.rpm ia64: wireshark-1.0.3-3.el4_7.ia64.rpm wireshark-debuginfo-1.0.3-3.el4_7.ia64.rpm wireshark-gnome-1.0.3-3.el4_7.ia64.rpm ppc: wireshark-1.0.3-3.el4_7.ppc.rpm wireshark-debuginfo-1.0.3-3.el4_7.ppc.rpm wireshark-gnome-1.0.3-3.el4_7.ppc.rpm s390: wireshark-1.0.3-3.el4_7.s390.rpm wireshark-debuginfo-1.0.3-3.el4_7.s390.rpm wireshark-gnome-1.0.3-3.el4_7.s390.rpm s390x: wireshark-1.0.3-3.el4_7.s390x.rpm wireshark-debuginfo-1.0.3-3.el4_7.s390x.rpm wireshark-gnome-1.0.3-3.el4_7.s390x.rpm x86_64: wireshark-1.0.3-3.el4_7.x86_64.rpm wireshark-debuginfo-1.0.3-3.el4_7.x86_64.rpm wireshark-gnome-1.0.3-3.el4_7.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: Source: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/wireshark-1.0.3-3.el4_7.src.rpm i386: wireshark-1.0.3-3.el4_7.i386.rpm wireshark-debuginfo-1.0.3-3.el4_7.i386.rpm wireshark-gnome-1.0.3-3.el4_7.i386.rpm x86_64: wireshark-1.0.3-3.el4_7.x86_64.rpm wireshark-debuginfo-1.0.3-3.el4_7.x86_64.rpm wireshark-gnome-1.0.3-3.el4_7.x86_64.rpm Red Hat Enterprise Linux ES version 4: Source: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/wireshark-1.0.3-3.el4_7.src.rpm i386: wireshark-1.0.3-3.el4_7.i386.rpm wireshark-debuginfo-1.0.3-3.el4_7.i386.rpm wireshark-gnome-1.0.3-3.el4_7.i386.rpm ia64: wireshark-1.0.3-3.el4_7.ia64.rpm wireshark-debuginfo-1.0.3-3.el4_7.ia64.rpm wireshark-gnome-1.0.3-3.el4_7.ia64.rpm x86_64: wireshark-1.0.3-3.el4_7.x86_64.rpm wireshark-debuginfo-1.0.3-3.el4_7.x86_64.rpm wireshark-gnome-1.0.3-3.el4_7.x86_64.rpm Red Hat Enterprise Linux WS version 4: Source: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/wireshark-1.0.3-3.el4_7.src.rpm i386: wireshark-1.0.3-3.el4_7.i386.rpm wireshark-debuginfo-1.0.3-3.el4_7.i386.rpm wireshark-gnome-1.0.3-3.el4_7.i386.rpm ia64: wireshark-1.0.3-3.el4_7.ia64.rpm wireshark-debuginfo-1.0.3-3.el4_7.ia64.rpm wireshark-gnome-1.0.3-3.el4_7.ia64.rpm x86_64: wireshark-1.0.3-3.el4_7.x86_64.rpm wireshark-debuginfo-1.0.3-3.el4_7.x86_64.rpm wireshark-gnome-1.0.3-3.el4_7.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/wireshark-1.0.3-4.el5_2.src.rpm i386: wireshark-1.0.3-4.el5_2.i386.rpm wireshark-debuginfo-1.0.3-4.el5_2.i386.rpm x86_64: wireshark-1.0.3-4.el5_2.x86_64.rpm wireshark-debuginfo-1.0.3-4.el5_2.x86_64.rpm RHEL Desktop Workstation (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/wireshark-1.0.3-4.el5_2.src.rpm i386: wireshark-debuginfo-1.0.3-4.el5_2.i386.rpm wireshark-gnome-1.0.3-4.el5_2.i386.rpm x86_64: wireshark-debuginfo-1.0.3-4.el5_2.x86_64.rpm wireshark-gnome-1.0.3-4.el5_2.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/wireshark-1.0.3-4.el5_2.src.rpm i386: wireshark-1.0.3-4.el5_2.i386.rpm wireshark-debuginfo-1.0.3-4.el5_2.i386.rpm wireshark-gnome-1.0.3-4.el5_2.i386.rpm ia64: wireshark-1.0.3-4.el5_2.ia64.rpm wireshark-debuginfo-1.0.3-4.el5_2.ia64.rpm wireshark-gnome-1.0.3-4.el5_2.ia64.rpm ppc: wireshark-1.0.3-4.el5_2.ppc.rpm wireshark-debuginfo-1.0.3-4.el5_2.ppc.rpm wireshark-gnome-1.0.3-4.el5_2.ppc.rpm s390x: wireshark-1.0.3-4.el5_2.s390x.rpm wireshark-debuginfo-1.0.3-4.el5_2.s390x.rpm wireshark-gnome-1.0.3-4.el5_2.s390x.rpm x86_64: wireshark-1.0.3-4.el5_2.x86_64.rpm wireshark-debuginfo-1.0.3-4.el5_2.x86_64.rpm wireshark-gnome-1.0.3-4.el5_2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1070 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1071 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1072 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1561 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1562 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1563 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3137 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3138 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3141 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3145 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3146 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3932 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3933 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3934 http://www.redhat.com/security/updates/classification/#moderate http://www.wireshark.org/docs/relnotes/ http://www.wireshark.org/security/ 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFI47SDXlSAg2UNWIIRAn+rAKCpwzf0qDvMW7oKkRFBPKG9SUM8EQCdFOrY IA/ni3ULZkdy5MvSwZ19o1U= =X25R -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Oct 1 17:36:42 2008 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 1 Oct 2008 13:36:42 -0400 Subject: [RHSA-2008:0892-01] Important: xen security and bug fix update Message-ID: <200810011736.m91Hagtj015673@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: xen security and bug fix update Advisory ID: RHSA-2008:0892-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0892.html Issue date: 2008-10-01 CVE Names: CVE-2008-1945 CVE-2008-1952 ===================================================================== 1. Summary: Updated xen packages that resolve a couple of security issues and fix a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Multi OS (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, x86_64 RHEL Virtualization (v. 5 server) - i386, ia64, x86_64 3. Description: The xen packages contain tools for managing the virtual machine monitor in Red Hat Virtualization. It was discovered that the hypervisor's para-virtualized framebuffer (PVFB) backend failed to validate the frontend's framebuffer description properly. This could allow a privileged user in the unprivileged domain (DomU) to cause a denial of service, or, possibly, elevate privileges to the privileged domain (Dom0). (CVE-2008-1952) A flaw was found in the QEMU block format auto-detection, when running fully-virtualized guests and using Qemu images written on removable media (USB storage, 3.5" disks). Privileged users of such fully-virtualized guests (DomU), with a raw-formatted disk image, were able to write a header to that disk image describing another format. This could allow such guests to read arbitrary files in their hypervisor's host (Dom0). (CVE-2008-1945) Additionally, the following bug is addressed in this update: * The qcow-create command terminated when invoked due to glibc bounds checking on the realpath() function. Users of xen are advised to upgrade to these updated packages, which resolve these security issues and fix this bug. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 445844 - CVE-2008-1945 qemu/kvm/xen: add image format options for USB storage and removable media 447759 - CVE-2008-1952 qemu/xen/kvm: ioemu: Fix PVFB backend to limit frame buffer size 454651 - xen: buffer overflow detected: qcow-create terminated 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xen-3.0.3-64.el5_2.3.src.rpm i386: xen-debuginfo-3.0.3-64.el5_2.3.i386.rpm xen-libs-3.0.3-64.el5_2.3.i386.rpm x86_64: xen-debuginfo-3.0.3-64.el5_2.3.i386.rpm xen-debuginfo-3.0.3-64.el5_2.3.x86_64.rpm xen-libs-3.0.3-64.el5_2.3.i386.rpm xen-libs-3.0.3-64.el5_2.3.x86_64.rpm RHEL Desktop Multi OS (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xen-3.0.3-64.el5_2.3.src.rpm i386: xen-3.0.3-64.el5_2.3.i386.rpm xen-debuginfo-3.0.3-64.el5_2.3.i386.rpm xen-devel-3.0.3-64.el5_2.3.i386.rpm x86_64: xen-3.0.3-64.el5_2.3.x86_64.rpm xen-debuginfo-3.0.3-64.el5_2.3.i386.rpm xen-debuginfo-3.0.3-64.el5_2.3.x86_64.rpm xen-devel-3.0.3-64.el5_2.3.i386.rpm xen-devel-3.0.3-64.el5_2.3.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/xen-3.0.3-64.el5_2.3.src.rpm i386: xen-debuginfo-3.0.3-64.el5_2.3.i386.rpm xen-libs-3.0.3-64.el5_2.3.i386.rpm ia64: xen-debuginfo-3.0.3-64.el5_2.3.ia64.rpm xen-libs-3.0.3-64.el5_2.3.ia64.rpm x86_64: xen-debuginfo-3.0.3-64.el5_2.3.i386.rpm xen-debuginfo-3.0.3-64.el5_2.3.x86_64.rpm xen-libs-3.0.3-64.el5_2.3.i386.rpm xen-libs-3.0.3-64.el5_2.3.x86_64.rpm RHEL Virtualization (v. 5 server): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/xen-3.0.3-64.el5_2.3.src.rpm i386: xen-3.0.3-64.el5_2.3.i386.rpm xen-debuginfo-3.0.3-64.el5_2.3.i386.rpm xen-devel-3.0.3-64.el5_2.3.i386.rpm ia64: xen-3.0.3-64.el5_2.3.ia64.rpm xen-debuginfo-3.0.3-64.el5_2.3.ia64.rpm xen-devel-3.0.3-64.el5_2.3.ia64.rpm x86_64: xen-3.0.3-64.el5_2.3.x86_64.rpm xen-debuginfo-3.0.3-64.el5_2.3.i386.rpm xen-debuginfo-3.0.3-64.el5_2.3.x86_64.rpm xen-devel-3.0.3-64.el5_2.3.i386.rpm xen-devel-3.0.3-64.el5_2.3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1945 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1952 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFI47TgXlSAg2UNWIIRAg5UAJsEUr1+pUjbl3/08UPFnMIPdf/n9QCfQ9sd kDIU9Rw1GPKzUDcb5jyYkbU= =+rKB -----END PGP SIGNATURE----- From bugzilla at redhat.com Wed Oct 1 17:37:26 2008 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Wed, 1 Oct 2008 13:37:26 -0400 Subject: [RHSA-2008:0908-01] Moderate: thunderbird security update Message-ID: <200810011737.m91HbQF6016036@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: thunderbird security update Advisory ID: RHSA-2008:0908-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0908.html Issue date: 2008-10-01 CVE Names: CVE-2008-0016 CVE-2008-3835 CVE-2008-4058 CVE-2008-4059 CVE-2008-4060 CVE-2008-4061 CVE-2008-4062 CVE-2008-4065 CVE-2008-4066 CVE-2008-4067 CVE-2008-4068 CVE-2008-4070 ===================================================================== 1. Summary: Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64 3. Description: Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062) Several flaws were found in the way malformed HTML mail content was displayed. An HTML mail message containing specially crafted content could potentially trick a Thunderbird user into surrendering sensitive information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068) A flaw was found in Thunderbird that caused certain characters to be stripped from JavaScript code. This flaw could allow malicious JavaScript to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066) Note: JavaScript support is disabled by default in Thunderbird; the above issue is not exploitable unless JavaScript is enabled. A heap based buffer overflow flaw was found in the handling of cancelled newsgroup messages. If the user cancels a specially crafted newsgroup message it could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-4070) All Thunderbird users should upgrade to these updated packages, which resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 463181 - CVE-2008-0016 Mozilla UTF-8 stack buffer overflow 463182 - CVE-2008-3835 mozilla: nsXMLDocument::OnChannelRedirect() same-origin violation 463190 - CVE-2008-4058 Mozilla privilege escalation via XPCnativeWrapper pollution 463192 - CVE-2008-4059 Mozilla privilege escalation via XPCnativeWrapper pollution 463198 - CVE-2008-4060 Mozilla privilege escalation via XPCnativeWrapper pollution 463199 - CVE-2008-4061 Mozilla layout engine crash 463201 - CVE-2008-4062 Mozilla crashes with evidence of memory corruption 463234 - CVE-2008-4065 Mozilla BOM characters stripped from JavaScript before execution 463243 - CVE-2008-4066 Mozilla low surrogates stripped from JavaScript before execution 463246 - CVE-2008-4067 Mozilla resource: traversal vulnerability 463248 - CVE-2008-4068 Mozilla local HTML file recource: bypass 464041 - CVE-2008-4070 Thunderbird cancelled newsgrop messages 6. Package List: Red Hat Enterprise Linux AS version 4: Source: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/thunderbird-1.5.0.12-16.el4.src.rpm i386: thunderbird-1.5.0.12-16.el4.i386.rpm thunderbird-debuginfo-1.5.0.12-16.el4.i386.rpm ia64: thunderbird-1.5.0.12-16.el4.ia64.rpm thunderbird-debuginfo-1.5.0.12-16.el4.ia64.rpm ppc: thunderbird-1.5.0.12-16.el4.ppc.rpm thunderbird-debuginfo-1.5.0.12-16.el4.ppc.rpm s390: thunderbird-1.5.0.12-16.el4.s390.rpm thunderbird-debuginfo-1.5.0.12-16.el4.s390.rpm s390x: thunderbird-1.5.0.12-16.el4.s390x.rpm thunderbird-debuginfo-1.5.0.12-16.el4.s390x.rpm x86_64: thunderbird-1.5.0.12-16.el4.x86_64.rpm thunderbird-debuginfo-1.5.0.12-16.el4.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: Source: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/thunderbird-1.5.0.12-16.el4.src.rpm i386: thunderbird-1.5.0.12-16.el4.i386.rpm thunderbird-debuginfo-1.5.0.12-16.el4.i386.rpm x86_64: thunderbird-1.5.0.12-16.el4.x86_64.rpm thunderbird-debuginfo-1.5.0.12-16.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4: Source: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/thunderbird-1.5.0.12-16.el4.src.rpm i386: thunderbird-1.5.0.12-16.el4.i386.rpm thunderbird-debuginfo-1.5.0.12-16.el4.i386.rpm ia64: thunderbird-1.5.0.12-16.el4.ia64.rpm thunderbird-debuginfo-1.5.0.12-16.el4.ia64.rpm x86_64: thunderbird-1.5.0.12-16.el4.x86_64.rpm thunderbird-debuginfo-1.5.0.12-16.el4.x86_64.rpm Red Hat Enterprise Linux WS version 4: Source: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/thunderbird-1.5.0.12-16.el4.src.rpm i386: thunderbird-1.5.0.12-16.el4.i386.rpm thunderbird-debuginfo-1.5.0.12-16.el4.i386.rpm ia64: thunderbird-1.5.0.12-16.el4.ia64.rpm thunderbird-debuginfo-1.5.0.12-16.el4.ia64.rpm x86_64: thunderbird-1.5.0.12-16.el4.x86_64.rpm thunderbird-debuginfo-1.5.0.12-16.el4.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/thunderbird-2.0.0.17-1.el5.src.rpm i386: thunderbird-2.0.0.17-1.el5.i386.rpm thunderbird-debuginfo-2.0.0.17-1.el5.i386.rpm x86_64: thunderbird-2.0.0.17-1.el5.x86_64.rpm thunderbird-debuginfo-2.0.0.17-1.el5.x86_64.rpm RHEL Optional Productivity Applications (v. 5 server): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/thunderbird-2.0.0.17-1.el5.src.rpm i386: thunderbird-2.0.0.17-1.el5.i386.rpm thunderbird-debuginfo-2.0.0.17-1.el5.i386.rpm x86_64: thunderbird-2.0.0.17-1.el5.x86_64.rpm thunderbird-debuginfo-2.0.0.17-1.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0016 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3835 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4058 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4059 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4060 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4061 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4062 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4065 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4066 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4067 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4068 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4070 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFI47U0XlSAg2UNWIIRAroEAKC/pCBo/joIQ8oU8g3+viBzNjtsHgCgxPvn VAr663If+AaEaB6gihKWvOk= =rvb/ -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Oct 2 14:17:10 2008 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 2 Oct 2008 10:17:10 -0400 Subject: [RHSA-2008:0862-02] Important: tomcat security update Message-ID: <200810021417.m92EHAOH032296@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: tomcat security update Advisory ID: RHSA-2008:0862-02 Product: Red Hat Application Server Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0862.html Issue date: 2008-10-02 CVE Names: CVE-2007-5342 CVE-2007-5461 CVE-2008-1232 CVE-2008-1947 CVE-2008-2370 CVE-2008-2938 ===================================================================== 1. Summary: Updated tomcat packages that fix several security issues are now available for Red Hat Application Server v2. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Application Server v2 4AS - noarch Red Hat Application Server v2 4ES - noarch Red Hat Application Server v2 4WS - noarch 3. Description: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. The default security policy in the JULI logging component did not restrict access permissions to files. This could be misused by untrusted web applications to access and write arbitrary files in the context of the Tomcat process. (CVE-2007-5342) A directory traversal vulnerability was discovered in the Apache Tomcat webdav servlet. Under certain configurations, this allowed remote, authenticated users to read files accessible to the local Tomcat process. (CVE-2007-5461) A cross-site scripting vulnerability was discovered in the HttpServletResponse.sendError() method. A remote attacker could inject arbitrary web script or HTML via forged HTTP headers. (CVE-2008-1232) An additional cross-site scripting vulnerability was discovered in the host manager application. A remote attacker could inject arbitrary web script or HTML via the hostname parameter. (CVE-2008-1947) A traversal vulnerability was discovered when using a RequestDispatcher in combination with a servlet or JSP. A remote attacker could utilize a specially-crafted request parameter to access protected web resources. (CVE-2008-2370) An additional traversal vulnerability was discovered when the "allowLinking" and "URIencoding" settings were activated. A remote attacker could use a UTF-8-encoded request to extend their privileges and obtain local files accessible to the Tomcat process. (CVE-2008-2938) Users of tomcat should upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 333791 - CVE-2007-5461 Absolute path traversal Apache Tomcat WEBDAV 427216 - CVE-2007-5342 Apache Tomcat's default security policy is too open 446393 - CVE-2008-1947 Tomcat host manager xss - name field 456120 - CVE-2008-2938 tomcat Unicode directory traversal vulnerability 457597 - CVE-2008-1232 tomcat: Cross-Site-Scripting enabled by sendError call 457934 - CVE-2008-2370 tomcat RequestDispatcher information disclosure vulnerability 6. Package List: Red Hat Application Server v2 4AS: Source: ftp://updates.redhat.com/enterprise/4AS/en/RHAPS/SRPMS/tomcat5-5.5.23-0jpp_4rh.9.src.rpm noarch: tomcat5-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-admin-webapps-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-common-lib-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-jasper-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-jasper-javadoc-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-jsp-2.0-api-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-server-lib-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-servlet-2.4-api-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-webapps-5.5.23-0jpp_4rh.9.noarch.rpm Red Hat Application Server v2 4ES: Source: ftp://updates.redhat.com/enterprise/4ES/en/RHAPS/SRPMS/tomcat5-5.5.23-0jpp_4rh.9.src.rpm noarch: tomcat5-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-admin-webapps-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-common-lib-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-jasper-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-jasper-javadoc-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-jsp-2.0-api-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-server-lib-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-servlet-2.4-api-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-webapps-5.5.23-0jpp_4rh.9.noarch.rpm Red Hat Application Server v2 4WS: Source: ftp://updates.redhat.com/enterprise/4WS/en/RHAPS/SRPMS/tomcat5-5.5.23-0jpp_4rh.9.src.rpm noarch: tomcat5-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-admin-webapps-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-common-lib-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-jasper-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-jasper-javadoc-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-jsp-2.0-api-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-server-lib-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-servlet-2.4-api-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp_4rh.9.noarch.rpm tomcat5-webapps-5.5.23-0jpp_4rh.9.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5342 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5461 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1232 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1947 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2370 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2938 http://tomcat.apache.org/security-5.html http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFI5NekXlSAg2UNWIIRAtp3AJ9Zts2rGoDhCJODuTyQXfoS7zyaowCeO5JD rpoTFxuEmE7G7Kwqx/jNldQ= =uUFJ -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Oct 2 14:19:35 2008 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 2 Oct 2008 10:19:35 -0400 Subject: [RHSA-2008:0864-02] Important: tomcat security update Message-ID: <200810021419.m92EJZwM001158@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: tomcat security update Advisory ID: RHSA-2008:0864-02 Product: Red Hat Developer Suite v.3 Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0864.html Issue date: 2008-10-02 Keywords: Security CVE Names: CVE-2008-1232 CVE-2008-1947 CVE-2008-2370 CVE-2008-2938 ===================================================================== 1. Summary: Updated tomcat packages that fix multiple security issues are now available for Red Hat Developer Suite 3. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Developer Suite v.3 (AS v.4) - noarch 3. Description: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. A cross-site scripting vulnerability was discovered in the HttpServletResponse.sendError() method. A remote attacker could inject arbitrary web script or HTML via forged HTTP headers. (CVE-2008-1232) An additional cross-site scripting vulnerability was discovered in the host manager application. A remote attacker could inject arbitrary web script or HTML via the hostname parameter. (CVE-2008-1947) A traversal vulnerability was discovered when using a RequestDispatcher in combination with a servlet or JSP. A remote attacker could utilize a specially-crafted request parameter to access protected web resources. (CVE-2008-2370) An additional traversal vulnerability was discovered when the "allowLinking" and "URIencoding" settings were activated. A remote attacker could use a UTF-8-encoded request to extend their privileges and obtain local files accessible to the Tomcat process. (CVE-2008-2938) Users of tomcat should upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 446393 - CVE-2008-1947 Tomcat host manager xss - name field 456120 - CVE-2008-2938 tomcat Unicode directory traversal vulnerability 457597 - CVE-2008-1232 tomcat: Cross-Site-Scripting enabled by sendError call 457934 - CVE-2008-2370 tomcat RequestDispatcher information disclosure vulnerability 6. Package List: Red Hat Developer Suite v.3 (AS v.4): Source: ftp://updates.redhat.com/enterprise/4AS/en/RHDS3/SRPMS/tomcat5-5.5.23-0jpp_12rh.src.rpm noarch: tomcat5-5.5.23-0jpp_12rh.noarch.rpm tomcat5-common-lib-5.5.23-0jpp_12rh.noarch.rpm tomcat5-jasper-5.5.23-0jpp_12rh.noarch.rpm tomcat5-jsp-2.0-api-5.5.23-0jpp_12rh.noarch.rpm tomcat5-server-lib-5.5.23-0jpp_12rh.noarch.rpm tomcat5-servlet-2.4-api-5.5.23-0jpp_12rh.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1232 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1947 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2370 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2938 http://tomcat.apache.org/security-5.html http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFI5Nf8XlSAg2UNWIIRAsG5AJ42/G+9f8PMTm34X13mhK6wjTFy5wCfYngY Hm8J+289xvTLIXJh2pXauvc= =F+LH -----END PGP SIGNATURE----- From bugzilla at redhat.com Thu Oct 2 14:21:30 2008 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 2 Oct 2008 10:21:30 -0400 Subject: [RHSA-2008:0907-01] Moderate: pam_krb5 security update Message-ID: <200810021421.m92ELU7J003482@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: pam_krb5 security update Advisory ID: RHSA-2008:0907-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0907.html Issue date: 2008-10-02 CVE Names: CVE-2008-3825 ===================================================================== 1. Summary: An updated pam_krb5 package that fixes a security issue is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: The pam_krb5 module allows Pluggable Authentication Modules (PAM) aware applications to use Kerberos to verify user identities by obtaining user credentials at log in time. A flaw was found in the pam_krb5 "existing_ticket" configuration option. If a system is configured to use an existing credential cache via the "existing_ticket" option, it may be possible for a local user to gain elevated privileges by using a different, local user's credential cache. (CVE-2008-3825) Red Hat would like to thank St?phane Bertin for responsibly disclosing this issue. Users of pam_krb5 should upgrade to this updated package, which contains a backported patch to resolve this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 461960 - CVE-2008-3825 pam_krb5 existing_ticket permission flaw 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pam_krb5-2.2.14-1.el5_2.1.src.rpm i386: pam_krb5-2.2.14-1.el5_2.1.i386.rpm pam_krb5-debuginfo-2.2.14-1.el5_2.1.i386.rpm x86_64: pam_krb5-2.2.14-1.el5_2.1.i386.rpm pam_krb5-2.2.14-1.el5_2.1.x86_64.rpm pam_krb5-debuginfo-2.2.14-1.el5_2.1.i386.rpm pam_krb5-debuginfo-2.2.14-1.el5_2.1.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/pam_krb5-2.2.14-1.el5_2.1.src.rpm i386: pam_krb5-2.2.14-1.el5_2.1.i386.rpm pam_krb5-debuginfo-2.2.14-1.el5_2.1.i386.rpm ia64: pam_krb5-2.2.14-1.el5_2.1.i386.rpm pam_krb5-2.2.14-1.el5_2.1.ia64.rpm pam_krb5-debuginfo-2.2.14-1.el5_2.1.i386.rpm pam_krb5-debuginfo-2.2.14-1.el5_2.1.ia64.rpm ppc: pam_krb5-2.2.14-1.el5_2.1.ppc.rpm pam_krb5-2.2.14-1.el5_2.1.ppc64.rpm pam_krb5-debuginfo-2.2.14-1.el5_2.1.ppc.rpm pam_krb5-debuginfo-2.2.14-1.el5_2.1.ppc64.rpm s390x: pam_krb5-2.2.14-1.el5_2.1.s390.rpm pam_krb5-2.2.14-1.el5_2.1.s390x.rpm pam_krb5-debuginfo-2.2.14-1.el5_2.1.s390.rpm pam_krb5-debuginfo-2.2.14-1.el5_2.1.s390x.rpm x86_64: pam_krb5-2.2.14-1.el5_2.1.i386.rpm pam_krb5-2.2.14-1.el5_2.1.x86_64.rpm pam_krb5-debuginfo-2.2.14-1.el5_2.1.i386.rpm pam_krb5-debuginfo-2.2.14-1.el5_2.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3825 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFI5NiWXlSAg2UNWIIRArirAJ0VoBW42fdMiVPH0Gezls6+1ZuzmwCgk25k kemQxIMhMKjztg8nqexYnYw= =glcJ -----END PGP SIGNATURE----- From bugzilla at redhat.com Tue Oct 7 19:47:59 2008 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Tue, 7 Oct 2008 15:47:59 -0400 Subject: [RHSA-2008:0857-02] Important: kernel security and bug fix update Message-ID: <200810071947.m97JlxGf007659@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2008:0857-02 Product: Red Hat Enterprise MRG for RHEL-5 Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0857.html Issue date: 2008-10-07 CVE Names: CVE-2008-3534 CVE-2008-3535 CVE-2008-3275 CVE-2008-3276 CVE-2008-3915 CVE-2008-3792 CVE-2008-3526 CVE-2008-3272 CVE-2008-4113 CVE-2008-4445 ===================================================================== 1. Summary: Updated kernel packages that fix several security issues and several bugs are now available for Red Hat Enterprise MRG 1.0. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: MRG Realtime for RHEL 5 Server - i386, noarch, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. A possible integer overflow was found in the Linux kernel Stream Control Transmission Protocol (SCTP) implementation. This could allow an attacker to cause a denial of service. (CVE-2008-3526, Important) A deficiency was found in the Linux kernel Stream Control Transmission Protocol (SCTP) Authentication Extension implementation. All the SCTP-AUTH socket options could cause a kernel panic if the API was used when the extension is disabled. (CVE-2008-3792, Important) Missing boundary checks were reported in the Linux kernel SCTP implementation. This could, potentially, cause information disclosure via a specially crafted SCTP_HMAC_IDENT IOCTL request. (CVE-2008-4113, CVE-2008-4445, Important) Tobias Klein reported a missing check in the Linux kernel's Open Sound System (OSS) implementation. This deficiency could lead to a possible information leak. (CVE-2008-3272, Moderate) A deficiency was found in the Linux kernel virtual filesystem (VFS) implementation. This could allow a local unprivileged user to make a series of file creations within deleted directories, possibly causing a denial of service. (CVE-2008-3275, Moderate) A flaw was found in the Linux kernel Network File System daemon (nfsd) when NFSv4 was enabled. Remote attackers could use this to cause a denial of service via a buffer overflow. (CVE-2008-3915, Moderate) A possible integer overflow was discovered in the Linux kernel Datagram Congestion Control Protocol (DCCP) implementation. This could allow a remote attacker to cause a denial of service on a victim's machine. (CVE-2008-3276, Low) A deficiency was found in the Linux kernel tmpfs implementation. This could allow a local unprivileged user to make a certain sequence of file operations, possibly causing a denial of service. (CVE-2008-3534, Low) An off-by-one error was found in the iov_iter_advance function. This could allow a local unprivileged user to cause a denial of service as demonstrated by a testcase from the Linux Test Project. (CVE-2008-3535, Low) These updated packages also fix the following bugs: * fixed a warning in the openib code. * increased MAX_STACK_TRACE_ENTRIES on the debug kernel variant. * enqueue deprioritized RT tasks to head of prio array. * use timer_pending() to test ipv6 FIB timers. * added a lower-bound check for the length field in PPPOE headers. * pppoe: unshare skb to avoid possible data loss. * using growisofs could cause oops due to the lack of proper sanity checks. * random seed improvement. * enabled the "Panic on Oops" feature. * fixed a portability issue in parse_pmtmr() due to variable type. * fixed sanity check in cifs/asn1.c. * fixed a bug introduced by a previous fix, related to the inode code. * added better sanity checks to dlm code. * dynamic ftrace enhancements. The daemon is no longer used. * fixed a format string bug in cpufreq. * avoid a potential kernel stack overflow in binfmt_misc.c * fixed the long boot-up time when CONFIG_PROVE_LOCKING is enabled. * use a better random seed for NAT port randomization. * a compat_semaphore was being handled as a regular semaphore due to casting (qla2xxx driver). All users of Red Hat Enterprise MRG should upgrade to these new packages, which address these vulnerabilities and fix these bugs. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 447942 - openib broken in 2.6.24.7-55.el5rt 448574 - [MRG] Hit BUG: MAX_STACK_TRACE_ENTRIES too low! when booting kernel-rt-debug-2.6.24.4-32ibmrt2.2 454270 - SCHED_FIFO spec violation 457012 - ipv6: use timer pending to fix bridge reference count problem [mrg-1] 457014 - pppoe: Check packet length on all receive paths [mrg-1] 457019 - pppoe: Unshare skb before anything else [mrg-1] 457027 - ide-cd: fix oops when using growisofs [mrg-1] 457507 - CVE-2008-3534 kernel: tmpfs: fix kernel BUG in shmem_delete_inode 457703 - CVE-2008-3535 kernel: fix off-by-one error in iov_iter_advance() 457858 - CVE-2008-3275 Linux kernel local filesystem DoS 457995 - CVE-2008-3272 kernel snd_seq_oss_synth_make_info leak 458016 - kernel: random32: seeding improvement [mrg-1] 458104 - kernel should panic on oops 458340 - parse_pmtmr() receives a (possible) ulong then stores that in a u32 [mrg-1] 458350 - fs/cifs/asn1.c:403: warning: comparison is always false due to limited range of data type 458487 - [Realtime][Kernel] kernel BUG at fs/inode.c:262! 458755 - kernel: dlm: fix possible use-after-free [mrg-1] 458756 - kernel: dlm: check for null in device_write [mrg-1] 458758 - kernel: dlm: dlm/user.c input validation fixes [mrg-1] 459141 - Add ftrace boot time nop replacement 459226 - CVE-2008-3276 Linux kernel dccp_setsockopt_change() integer overflow 459459 - kernel: cpufreq: fix format string bug [mrg-1] 459462 - kernel: binfmt_misc.c: avoid potential kernel stack overflow [mrg-1] 459478 - [FOCUS] Long boot time and strange Hardware Clock message 459942 - kernel: nf_nat: use secure_ipv4_port_ephemeral() for NAT port randomization [mrg-1] 459955 - CVE-2008-3792 kernel: sctp: fix potential panics in the SCTP-AUTH API 460093 - CVE-2008-3526 Linux kernel sctp_setsockopt_auth_key() integer overflow 460455 - [FOCUS][24] R2:SAN:Hang triggered by filesystem testing on SAN 461101 - CVE-2008-3915 kernel: nfsd: fix buffer overrun decoding NFSv4 acl 462599 - CVE-2008-4445 kernel: sctp: fix random memory dereference with SCTP_HMAC_IDENT option 464514 - CVE-2008-4113 kernel: sctp_getsockopt_hmac_ident information disclosure 6. Package List: MRG Realtime for RHEL 5 Server: Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHEMRG/SRPMS/kernel-rt-2.6.24.7-81.el5rt.src.rpm i386: kernel-rt-2.6.24.7-81.el5rt.i686.rpm kernel-rt-debug-2.6.24.7-81.el5rt.i686.rpm kernel-rt-debug-debuginfo-2.6.24.7-81.el5rt.i686.rpm kernel-rt-debug-devel-2.6.24.7-81.el5rt.i686.rpm kernel-rt-debuginfo-2.6.24.7-81.el5rt.i686.rpm kernel-rt-debuginfo-common-2.6.24.7-81.el5rt.i686.rpm kernel-rt-devel-2.6.24.7-81.el5rt.i686.rpm kernel-rt-trace-2.6.24.7-81.el5rt.i686.rpm kernel-rt-trace-debuginfo-2.6.24.7-81.el5rt.i686.rpm kernel-rt-trace-devel-2.6.24.7-81.el5rt.i686.rpm kernel-rt-vanilla-2.6.24.7-81.el5rt.i686.rpm kernel-rt-vanilla-debuginfo-2.6.24.7-81.el5rt.i686.rpm kernel-rt-vanilla-devel-2.6.24.7-81.el5rt.i686.rpm noarch: kernel-rt-doc-2.6.24.7-81.el5rt.noarch.rpm x86_64: kernel-rt-2.6.24.7-81.el5rt.x86_64.rpm kernel-rt-debug-2.6.24.7-81.el5rt.x86_64.rpm kernel-rt-debug-debuginfo-2.6.24.7-81.el5rt.x86_64.rpm kernel-rt-debug-devel-2.6.24.7-81.el5rt.x86_64.rpm kernel-rt-debuginfo-2.6.24.7-81.el5rt.x86_64.rpm kernel-rt-debuginfo-common-2.6.24.7-81.el5rt.x86_64.rpm kernel-rt-devel-2.6.24.7-81.el5rt.x86_64.rpm kernel-rt-trace-2.6.24.7-81.el5rt.x86_64.rpm kernel-rt-trace-debuginfo-2.6.24.7-81.el5rt.x86_64.rpm kernel-rt-trace-devel-2.6.24.7-81.el5rt.x86_64.rpm kernel-rt-vanilla-2.6.24.7-81.el5rt.x86_64.rpm kernel-rt-vanilla-debuginfo-2.6.24.7-81.el5rt.x86_64.rpm kernel-rt-vanilla-devel-2.6.24.7-81.el5rt.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3534 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3535 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3275 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3276 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3915 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3792 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3526 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3272 http://cve.mitre.org/cgi-bin/cvename.cgi?name= http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4113 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4445 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFI67zsXlSAg2UNWIIRArwgAJ4lCPgncis6Iz9lo618mEGPrEXfrwCeLHjQ HzHjqfCtibtl4Wj+JCKdJ7g= =T4zi -----END PGP SIGNATURE----- From bugzilla at redhat.com Tue Oct 7 19:48:16 2008 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Tue, 7 Oct 2008 15:48:16 -0400 Subject: [RHSA-2008:0911-01] Moderate: condor security, bug fix and enhancement update Message-ID: <200810071948.m97JmGRQ007873@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: condor security, bug fix and enhancement update Advisory ID: RHSA-2008:0911-01 Product: Red Hat Enterprise MRG for RHEL-5 Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0911.html Issue date: 2008-10-07 CVE Names: CVE-2008-3826 CVE-2008-3828 CVE-2008-3829 CVE-2008-3830 ===================================================================== 1. Summary: Updated condor packages that address multiple security issues, fix several bugs, and introduce feature enhancements are now available for Red Hat Enterprise MRG 1.0 for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: MRG Grid for RHEL 5 Server - i386, x86_64 3. Description: Condor is a specialized workload management system for compute-intensive jobs. It provides a job queuing mechanism, scheduling policy, priority scheme, and resource monitoring and management. A flaw was found in the way Condor processed user submitted jobs. It was possible for a user to submit a job in a way that could cause that job to run as a different user with access to the pool. (CVE-2008-3826) A stack based buffer overflow flaw was found in Condor's condor_schedd daemon. A user who had permissions to submit a job could do so in a manner that could cause condor_schedd to crash or, potentially, execute arbitrary code with the permissions of condor_schedd. (CVE-2008-3828) A denial-of-service flaw was found in Condor's condor_schedd daemon. A user who had permissions to submit a job could do so in a manner that would cause condor_schedd to crash. (CVE-2008-3829) A flaw was found in the way Condor processes allowed and denied netmasks for access control. If a configuration file contained an overlapping netmask in the allow or deny rules, it could cause that rule to be ignored, allowing unintended access. (CVE-2008-3830) This update also fixes the following bugs: * the "amazon_gahp -m" command sets the AMAZON_GAHP_WORKER_MAX_NUM configuration option, fixing the maximum number of processes contacting EC2 at any given time. Previously, Condor did not honor this option, leaving the maximum number of created threads unbounded. This has been corrected: values set with the "-m" argument are now properly understood. * the gridmanager constructed KeyPairs for all outstanding EC2 jobs before any jobs are started. When there were many (>10,000) EC2 jobs in the queue, significant delays occurred. With this update, KeyPairs are no longer constructed up-front. * an error in condor_negotiator caused intialization code to re-run whenever condor_reconfig was run. The flag which noted if the initialization code should run was always set to "true". This error has been corrected: the initialization code now executes only at startup. As well, this update adds the following enhancements: * this release introduces Concurrency Limits. These allow Condor to account for resources not directly under its control, such as software licenses. * this update includes the latest stable upstream release of Condor: version 7.0.5. Information on the features and fixes included with this release are in the Condor Release Notes, available via the link in the References section below. * base support for low-latency scheduling and transparent translation of EC2 jobs has also been added in this update. Note: implementation of these two features depends on separate packages which are yet to be released. All Red Hat Enterprise MRG 1.0 users are advised to upgrade to these updated packages which address these vulnerabilities, fix these bugs and add these enhancements. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 451069 - gSOAP amazon-gahp needs max to worker pool 451799 - upfront construction of ec2 KeyPairs is time consuming 462662 - SetAttribute does not check validity of attribute's name 463987 - CVE-2008-3826 condor: users can run jobs with arbitrary owners 463990 - CVE-2008-3828 condor: buffer overflow in lookup_macro 463995 - CVE-2008-3829 condor: denial of service attack on Schedd via corrupt logfile 463997 - CVE-2008-3830 condor: allow or deny with overlapping netmasks may be ignored 6. Package List: MRG Grid for RHEL 5 Server: Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHEMRG/SRPMS/condor-7.0.5-2.el5.src.rpm i386: condor-7.0.5-2.el5.i386.rpm condor-debuginfo-7.0.5-2.el5.i386.rpm condor-static-7.0.5-2.el5.i386.rpm x86_64: condor-7.0.5-2.el5.x86_64.rpm condor-debuginfo-7.0.5-2.el5.x86_64.rpm condor-static-7.0.5-2.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3826 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3828 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3829 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3830 http://www.redhat.com/security/updates/classification/#moderate http://cs.wisc.edu/condor/manual/v7.0/8_3Stable_Release.html 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFI67z2XlSAg2UNWIIRApoDAJ4/oiPtABadtVkcFDNyRnlFSHQsNQCbBp8w QC7iTbm8AdtLW+/d9FxIXTk= =DoS4 -----END PGP SIGNATURE----- From bugzilla at redhat.com Tue Oct 7 19:48:28 2008 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Tue, 7 Oct 2008 15:48:28 -0400 Subject: [RHSA-2008:0924-01] Moderate: condor security, bug fix and enhancement update Message-ID: <200810071948.m97JmSum008032@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: condor security, bug fix and enhancement update Advisory ID: RHSA-2008:0924-01 Product: Red Hat Enterprise MRG for RHEL-4 Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0924.html Issue date: 2008-10-07 CVE Names: CVE-2008-3826 CVE-2008-3828 CVE-2008-3829 CVE-2008-3830 ===================================================================== 1. Summary: Updated condor packages that fix multiple security issues, several bugs and introduce feature enhancements are now available for Red Hat Enterprise MRG 1.0 for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat MRG Grid for RHEL-4 AS - i386, x86_64 Red Hat MRG Grid for RHEL-4 ES - i386, x86_64 3. Description: Condor is a specialized workload management system for compute-intensive jobs. It provides a job queuing mechanism, scheduling policy, priority scheme, and resource monitoring and management. A flaw was found in the way Condor processed user submitted jobs. It was possible for a user to submit a job in a way that could cause that job to run as a different user with access to the pool. (CVE-2008-3826) A stack based buffer overflow flaw was found in Condor's condor_schedd daemon. A user who had permissions to submit a job could do so in a manner that could cause condor_schedd to crash or, potentially, execute arbitrary code with the permissions of condor_schedd. (CVE-2008-3828) A denial-of-service flaw was found in Condor's condor_schedd daemon. A user who had permissions to submit a job could do so in a manner that would cause condor_schedd to crash. (CVE-2008-3829) A flaw was found in the way Condor processes allowed and denied netmasks for access control. If a configuration file contained an overlapping netmask in the allow or deny rules, it could cause that rule to be ignored, allowing unintended access. (CVE-2008-3830) This update also fixes the following bugs: * the "amazon_gahp -m" command sets the AMAZON_GAHP_WORKER_MAX_NUM configuration option, fixing the maximum number of processes contacting EC2 at any given time. Previously, Condor did not honor this option, leaving the maximum number of created threads unbounded. This has been corrected: values set with the "-m" argument are now properly understood. * the gridmanager constructed KeyPairs for all outstanding EC2 jobs before any jobs are started. When there were many (>10,000) EC2 jobs in the queue, significant delays occurred. With this update, KeyPairs are no longer constructed up-front. * an error in condor_negotiator caused intialization code to re-run whenever condor_reconfig was run. The flag which noted if the initialization code should run was always set to "true". This error has been corrected: the initialization code now executes only at startup. As well, this update adds the following enhancements: * this release introduces Concurrency Limits. These allow Condor to account for resources not directly under its control, such as software licenses. * this update includes the latest stable upstream release of Condor: version 7.0.5. Information on the features and fixes included with this release are in the Condor Release Notes, available via the link in the References section below. * base support for low-latency scheduling and transparent translation of EC2 jobs has also been added in this update. Note: implementation of these two features depends on separate packages which are yet to be released. All Red Hat Enterprise MRG 1.0 users are advised to upgrade to these updated packages which address these vulnerabilities, fix these bugs and add these enhancements. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 463359 - RHEL4: SetAttribute does not check validity of attribute's name 463362 - RHEL4: gSOAP amazon-gahp needs max to worker pool 463363 - RHEL4: upfront construction of ec2 KeyPairs is time consuming 463987 - CVE-2008-3826 condor: users can run jobs with arbitrary owners 463990 - CVE-2008-3828 condor: buffer overflow in lookup_macro 463995 - CVE-2008-3829 condor: denial of service attack on Schedd via corrupt logfile 463997 - CVE-2008-3830 condor: allow or deny with overlapping netmasks may be ignored 6. Package List: Red Hat MRG Grid for RHEL-4 AS: Source: ftp://updates.redhat.com/enterprise/4AS/en/RHEMRG/SRPMS/condor-7.0.5-2.el4.src.rpm i386: condor-7.0.5-2.el4.i386.rpm condor-debuginfo-7.0.5-2.el4.i386.rpm condor-static-7.0.5-2.el4.i386.rpm x86_64: condor-7.0.5-2.el4.x86_64.rpm condor-debuginfo-7.0.5-2.el4.x86_64.rpm condor-static-7.0.5-2.el4.x86_64.rpm Red Hat MRG Grid for RHEL-4 ES: Source: ftp://updates.redhat.com/enterprise/4ES/en/RHEMRG/SRPMS/condor-7.0.5-2.el4.src.rpm i386: condor-7.0.5-2.el4.i386.rpm condor-debuginfo-7.0.5-2.el4.i386.rpm condor-static-7.0.5-2.el4.i386.rpm x86_64: condor-7.0.5-2.el4.x86_64.rpm condor-debuginfo-7.0.5-2.el4.x86_64.rpm condor-static-7.0.5-2.el4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3826 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3828 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3829 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3830 http://www.redhat.com/security/updates/classification/#moderate http://cs.wisc.edu/condor/manual/v7.0/8_3Stable_Release.html 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFI670GXlSAg2UNWIIRAm/aAJ9KrWVfZPAp5ZLEqeB6MMQ8GQwzsACdGUHW qLpqOSx9aCLzm3zTl2hMhM4= =47v8 -----END PGP SIGNATURE----- From bugzilla at redhat.com Fri Oct 10 07:52:17 2008 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Fri, 10 Oct 2008 03:52:17 -0400 Subject: [RHSA-2008:0937-01] Important: cups security update Message-ID: <200810100752.m9A7qHI0007324@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: cups security update Advisory ID: RHSA-2008:0937-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0937.html Issue date: 2008-10-10 CVE Names: CVE-2008-3639 CVE-2008-3640 CVE-2008-3641 ===================================================================== 1. Summary: Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems. A buffer overflow flaw was discovered in the SGI image format decoding routines used by the CUPS image converting filter "imagetops". An attacker could create a malicious SGI image file that could, possibly, execute arbitrary code as the "lp" user if the file was printed. (CVE-2008-3639) An integer overflow flaw leading to a heap buffer overflow was discovered in the Text-to-PostScript "texttops" filter. An attacker could create a malicious text file that could, possibly, execute arbitrary code as the "lp" user if the file was printed. (CVE-2008-3640) An insufficient buffer bounds checking flaw was discovered in the HP-GL/2-to-PostScript "hpgltops" filter. An attacker could create a malicious HP-GL/2 file that could, possibly, execute arbitrary code as the "lp" user if the file was printed. (CVE-2008-3641) Red Hat would like to thank regenrecht for reporting these issues. All CUPS users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 464710 - CVE-2008-3639 CUPS: SGI image parser heap-based buffer overflow 464713 - CVE-2008-3640 CUPS: texttops integer overflow 464716 - CVE-2008-3641 CUPS: HP/GL reader insufficient bounds checking 6. Package List: Red Hat Enterprise Linux AS version 3: Source: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/cups-1.1.17-13.3.54.src.rpm i386: cups-1.1.17-13.3.54.i386.rpm cups-debuginfo-1.1.17-13.3.54.i386.rpm cups-devel-1.1.17-13.3.54.i386.rpm cups-libs-1.1.17-13.3.54.i386.rpm ia64: cups-1.1.17-13.3.54.ia64.rpm cups-debuginfo-1.1.17-13.3.54.i386.rpm cups-debuginfo-1.1.17-13.3.54.ia64.rpm cups-devel-1.1.17-13.3.54.ia64.rpm cups-libs-1.1.17-13.3.54.i386.rpm cups-libs-1.1.17-13.3.54.ia64.rpm ppc: cups-1.1.17-13.3.54.ppc.rpm cups-debuginfo-1.1.17-13.3.54.ppc.rpm cups-debuginfo-1.1.17-13.3.54.ppc64.rpm cups-devel-1.1.17-13.3.54.ppc.rpm cups-libs-1.1.17-13.3.54.ppc.rpm cups-libs-1.1.17-13.3.54.ppc64.rpm s390: cups-1.1.17-13.3.54.s390.rpm cups-debuginfo-1.1.17-13.3.54.s390.rpm cups-devel-1.1.17-13.3.54.s390.rpm cups-libs-1.1.17-13.3.54.s390.rpm s390x: cups-1.1.17-13.3.54.s390x.rpm cups-debuginfo-1.1.17-13.3.54.s390.rpm cups-debuginfo-1.1.17-13.3.54.s390x.rpm cups-devel-1.1.17-13.3.54.s390x.rpm cups-libs-1.1.17-13.3.54.s390.rpm cups-libs-1.1.17-13.3.54.s390x.rpm x86_64: cups-1.1.17-13.3.54.x86_64.rpm cups-debuginfo-1.1.17-13.3.54.i386.rpm cups-debuginfo-1.1.17-13.3.54.x86_64.rpm cups-devel-1.1.17-13.3.54.x86_64.rpm cups-libs-1.1.17-13.3.54.i386.rpm cups-libs-1.1.17-13.3.54.x86_64.rpm Red Hat Desktop version 3: Source: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/cups-1.1.17-13.3.54.src.rpm i386: cups-1.1.17-13.3.54.i386.rpm cups-debuginfo-1.1.17-13.3.54.i386.rpm cups-devel-1.1.17-13.3.54.i386.rpm cups-libs-1.1.17-13.3.54.i386.rpm x86_64: cups-1.1.17-13.3.54.x86_64.rpm cups-debuginfo-1.1.17-13.3.54.i386.rpm cups-debuginfo-1.1.17-13.3.54.x86_64.rpm cups-devel-1.1.17-13.3.54.x86_64.rpm cups-libs-1.1.17-13.3.54.i386.rpm cups-libs-1.1.17-13.3.54.x86_64.rpm Red Hat Enterprise Linux ES version 3: Source: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/cups-1.1.17-13.3.54.src.rpm i386: cups-1.1.17-13.3.54.i386.rpm cups-debuginfo-1.1.17-13.3.54.i386.rpm cups-devel-1.1.17-13.3.54.i386.rpm cups-libs-1.1.17-13.3.54.i386.rpm ia64: cups-1.1.17-13.3.54.ia64.rpm cups-debuginfo-1.1.17-13.3.54.i386.rpm cups-debuginfo-1.1.17-13.3.54.ia64.rpm cups-devel-1.1.17-13.3.54.ia64.rpm cups-libs-1.1.17-13.3.54.i386.rpm cups-libs-1.1.17-13.3.54.ia64.rpm x86_64: cups-1.1.17-13.3.54.x86_64.rpm cups-debuginfo-1.1.17-13.3.54.i386.rpm cups-debuginfo-1.1.17-13.3.54.x86_64.rpm cups-devel-1.1.17-13.3.54.x86_64.rpm cups-libs-1.1.17-13.3.54.i386.rpm cups-libs-1.1.17-13.3.54.x86_64.rpm Red Hat Enterprise Linux WS version 3: Source: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/cups-1.1.17-13.3.54.src.rpm i386: cups-1.1.17-13.3.54.i386.rpm cups-debuginfo-1.1.17-13.3.54.i386.rpm cups-devel-1.1.17-13.3.54.i386.rpm cups-libs-1.1.17-13.3.54.i386.rpm ia64: cups-1.1.17-13.3.54.ia64.rpm cups-debuginfo-1.1.17-13.3.54.i386.rpm cups-debuginfo-1.1.17-13.3.54.ia64.rpm cups-devel-1.1.17-13.3.54.ia64.rpm cups-libs-1.1.17-13.3.54.i386.rpm cups-libs-1.1.17-13.3.54.ia64.rpm x86_64: cups-1.1.17-13.3.54.x86_64.rpm cups-debuginfo-1.1.17-13.3.54.i386.rpm cups-debuginfo-1.1.17-13.3.54.x86_64.rpm cups-devel-1.1.17-13.3.54.x86_64.rpm cups-libs-1.1.17-13.3.54.i386.rpm cups-libs-1.1.17-13.3.54.x86_64.rpm Red Hat Enterprise Linux AS version 4: Source: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/cups-1.1.22-0.rc1.9.27.el4_7.1.src.rpm i386: cups-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-devel-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm ia64: cups-1.1.22-0.rc1.9.27.el4_7.1.ia64.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.ia64.rpm cups-devel-1.1.22-0.rc1.9.27.el4_7.1.ia64.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.ia64.rpm ppc: cups-1.1.22-0.rc1.9.27.el4_7.1.ppc.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.ppc.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.ppc64.rpm cups-devel-1.1.22-0.rc1.9.27.el4_7.1.ppc.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.ppc.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.ppc64.rpm s390: cups-1.1.22-0.rc1.9.27.el4_7.1.s390.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.s390.rpm cups-devel-1.1.22-0.rc1.9.27.el4_7.1.s390.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.s390.rpm s390x: cups-1.1.22-0.rc1.9.27.el4_7.1.s390x.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.s390.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.s390x.rpm cups-devel-1.1.22-0.rc1.9.27.el4_7.1.s390x.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.s390.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.s390x.rpm x86_64: cups-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm cups-devel-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: Source: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/cups-1.1.22-0.rc1.9.27.el4_7.1.src.rpm i386: cups-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-devel-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm x86_64: cups-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm cups-devel-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm Red Hat Enterprise Linux ES version 4: Source: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/cups-1.1.22-0.rc1.9.27.el4_7.1.src.rpm i386: cups-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-devel-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm ia64: cups-1.1.22-0.rc1.9.27.el4_7.1.ia64.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.ia64.rpm cups-devel-1.1.22-0.rc1.9.27.el4_7.1.ia64.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.ia64.rpm x86_64: cups-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm cups-devel-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm Red Hat Enterprise Linux WS version 4: Source: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/cups-1.1.22-0.rc1.9.27.el4_7.1.src.rpm i386: cups-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-devel-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm ia64: cups-1.1.22-0.rc1.9.27.el4_7.1.ia64.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.ia64.rpm cups-devel-1.1.22-0.rc1.9.27.el4_7.1.ia64.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.ia64.rpm x86_64: cups-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-debuginfo-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm cups-devel-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.i386.rpm cups-libs-1.1.22-0.rc1.9.27.el4_7.1.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/cups-1.2.4-11.18.el5_2.2.src.rpm i386: cups-1.2.4-11.18.el5_2.2.i386.rpm cups-debuginfo-1.2.4-11.18.el5_2.2.i386.rpm cups-libs-1.2.4-11.18.el5_2.2.i386.rpm cups-lpd-1.2.4-11.18.el5_2.2.i386.rpm x86_64: cups-1.2.4-11.18.el5_2.2.x86_64.rpm cups-debuginfo-1.2.4-11.18.el5_2.2.i386.rpm cups-debuginfo-1.2.4-11.18.el5_2.2.x86_64.rpm cups-libs-1.2.4-11.18.el5_2.2.i386.rpm cups-libs-1.2.4-11.18.el5_2.2.x86_64.rpm cups-lpd-1.2.4-11.18.el5_2.2.x86_64.rpm RHEL Desktop Workstation (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/cups-1.2.4-11.18.el5_2.2.src.rpm i386: cups-debuginfo-1.2.4-11.18.el5_2.2.i386.rpm cups-devel-1.2.4-11.18.el5_2.2.i386.rpm x86_64: cups-debuginfo-1.2.4-11.18.el5_2.2.i386.rpm cups-debuginfo-1.2.4-11.18.el5_2.2.x86_64.rpm cups-devel-1.2.4-11.18.el5_2.2.i386.rpm cups-devel-1.2.4-11.18.el5_2.2.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/cups-1.2.4-11.18.el5_2.2.src.rpm i386: cups-1.2.4-11.18.el5_2.2.i386.rpm cups-debuginfo-1.2.4-11.18.el5_2.2.i386.rpm cups-devel-1.2.4-11.18.el5_2.2.i386.rpm cups-libs-1.2.4-11.18.el5_2.2.i386.rpm cups-lpd-1.2.4-11.18.el5_2.2.i386.rpm ia64: cups-1.2.4-11.18.el5_2.2.ia64.rpm cups-debuginfo-1.2.4-11.18.el5_2.2.i386.rpm cups-debuginfo-1.2.4-11.18.el5_2.2.ia64.rpm cups-devel-1.2.4-11.18.el5_2.2.ia64.rpm cups-libs-1.2.4-11.18.el5_2.2.i386.rpm cups-libs-1.2.4-11.18.el5_2.2.ia64.rpm cups-lpd-1.2.4-11.18.el5_2.2.ia64.rpm ppc: cups-1.2.4-11.18.el5_2.2.ppc.rpm cups-debuginfo-1.2.4-11.18.el5_2.2.ppc.rpm cups-debuginfo-1.2.4-11.18.el5_2.2.ppc64.rpm cups-devel-1.2.4-11.18.el5_2.2.ppc.rpm cups-devel-1.2.4-11.18.el5_2.2.ppc64.rpm cups-libs-1.2.4-11.18.el5_2.2.ppc.rpm cups-libs-1.2.4-11.18.el5_2.2.ppc64.rpm cups-lpd-1.2.4-11.18.el5_2.2.ppc.rpm s390x: cups-1.2.4-11.18.el5_2.2.s390x.rpm cups-debuginfo-1.2.4-11.18.el5_2.2.s390.rpm cups-debuginfo-1.2.4-11.18.el5_2.2.s390x.rpm cups-devel-1.2.4-11.18.el5_2.2.s390.rpm cups-devel-1.2.4-11.18.el5_2.2.s390x.rpm cups-libs-1.2.4-11.18.el5_2.2.s390.rpm cups-libs-1.2.4-11.18.el5_2.2.s390x.rpm cups-lpd-1.2.4-11.18.el5_2.2.s390x.rpm x86_64: cups-1.2.4-11.18.el5_2.2.x86_64.rpm cups-debuginfo-1.2.4-11.18.el5_2.2.i386.rpm cups-debuginfo-1.2.4-11.18.el5_2.2.x86_64.rpm cups-devel-1.2.4-11.18.el5_2.2.i386.rpm cups-devel-1.2.4-11.18.el5_2.2.x86_64.rpm cups-libs-1.2.4-11.18.el5_2.2.i386.rpm cups-libs-1.2.4-11.18.el5_2.2.x86_64.rpm cups-lpd-1.2.4-11.18.el5_2.2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3639 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3640 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3641 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFI7wloXlSAg2UNWIIRApxAAJ9mx77EV8tc7AG+EuFi1dxTVuMNpgCeMokz CngrUaVKz0531YFHVqCy0r4= =ROji -----END PGP SIGNATURE----- From bugzilla at redhat.com Tue Oct 21 15:04:27 2008 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Tue, 21 Oct 2008 11:04:27 -0400 Subject: [RHSA-2008:0895-02] Moderate: ruby security update Message-ID: <200810211504.m9LF4RTQ018699@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: ruby security update Advisory ID: RHSA-2008:0895-02 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0895.html Issue date: 2008-10-21 CVE Names: CVE-2008-3443 CVE-2008-3655 ===================================================================== 1. Summary: Updated ruby packages that fix various security issues are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 3. Description: Ruby is an interpreted scripting language for quick and easy object-oriented programming. A number of flaws were found in the safe-level restrictions in Ruby. It was possible for an attacker to create a carefully crafted malicious script that can allow the bypass of certain safe-level restrictions. (CVE-2008-3655) A denial of service flaw was found in Ruby's regular expression engine. If a Ruby script tried to process a large amount of data via a regular expression, it could cause Ruby to enter an infinite-loop and crash. (CVE-2008-3443) Users of ruby should upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 458948 - CVE-2008-3655 ruby: multiple insufficient safe mode restrictions 459266 - CVE-2008-3443 ruby: Memory allocation failure in Ruby regex engine (remotely exploitable DoS) 6. Package List: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 : Source: ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/ruby-1.6.4-7.el2.src.rpm i386: irb-1.6.4-7.el2.i386.rpm ruby-1.6.4-7.el2.i386.rpm ruby-devel-1.6.4-7.el2.i386.rpm ruby-docs-1.6.4-7.el2.i386.rpm ruby-libs-1.6.4-7.el2.i386.rpm ruby-tcltk-1.6.4-7.el2.i386.rpm Red Hat Enterprise Linux ES version 2.1: Source: ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/ruby-1.6.4-7.el2.src.rpm i386: irb-1.6.4-7.el2.i386.rpm ruby-1.6.4-7.el2.i386.rpm ruby-devel-1.6.4-7.el2.i386.rpm ruby-docs-1.6.4-7.el2.i386.rpm ruby-libs-1.6.4-7.el2.i386.rpm ruby-tcltk-1.6.4-7.el2.i386.rpm Red Hat Enterprise Linux WS version 2.1: Source: ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/ruby-1.6.4-7.el2.src.rpm i386: irb-1.6.4-7.el2.i386.rpm ruby-1.6.4-7.el2.i386.rpm ruby-devel-1.6.4-7.el2.i386.rpm ruby-docs-1.6.4-7.el2.i386.rpm ruby-libs-1.6.4-7.el2.i386.rpm ruby-tcltk-1.6.4-7.el2.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3443 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3655 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFI/e9eXlSAg2UNWIIRAojUAJ4vN3Pig/xdB7A60gjQS6aU8MHixgCfYfn+ ROtoNaBPciuwH026vG6FBYA= =jETQ -----END PGP SIGNATURE----- From bugzilla at redhat.com Tue Oct 21 15:04:47 2008 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Tue, 21 Oct 2008 11:04:47 -0400 Subject: [RHSA-2008:0896-01] Moderate: ruby security update Message-ID: <200810211504.m9LF4lBn018778@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: ruby security update Advisory ID: RHSA-2008:0896-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0896.html Issue date: 2008-10-21 CVE Names: CVE-2008-3443 CVE-2008-3655 CVE-2008-3905 ===================================================================== 1. Summary: Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 3. Description: Ruby is an interpreted scripting language for quick and easy object-oriented programming. The Ruby DNS resolver library, resolv.rb, used predictable transaction IDs and a fixed source port when sending DNS requests. A remote attacker could use this flaw to spoof a malicious reply to a DNS query. (CVE-2008-3905) A number of flaws were found in the safe-level restrictions in Ruby. It was possible for an attacker to create a carefully crafted malicious script that can allow the bypass of certain safe-level restrictions. (CVE-2008-3655) A denial of service flaw was found in Ruby's regular expression engine. If a Ruby script tried to process a large amount of data via a regular expression, it could cause Ruby to enter an infinite-loop and crash. (CVE-2008-3443) Users of ruby should upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 458948 - CVE-2008-3655 ruby: multiple insufficient safe mode restrictions 459266 - CVE-2008-3443 ruby: Memory allocation failure in Ruby regex engine (remotely exploitable DoS) 461495 - CVE-2008-3905 ruby: use of predictable source port and transaction id in DNS requests done by resolv.rb module 6. Package List: Red Hat Enterprise Linux AS version 3: Source: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/ruby-1.6.8-13.el3.src.rpm i386: irb-1.6.8-13.el3.i386.rpm ruby-1.6.8-13.el3.i386.rpm ruby-debuginfo-1.6.8-13.el3.i386.rpm ruby-devel-1.6.8-13.el3.i386.rpm ruby-docs-1.6.8-13.el3.i386.rpm ruby-libs-1.6.8-13.el3.i386.rpm ruby-mode-1.6.8-13.el3.i386.rpm ruby-tcltk-1.6.8-13.el3.i386.rpm ia64: irb-1.6.8-13.el3.ia64.rpm ruby-1.6.8-13.el3.ia64.rpm ruby-debuginfo-1.6.8-13.el3.i386.rpm ruby-debuginfo-1.6.8-13.el3.ia64.rpm ruby-devel-1.6.8-13.el3.ia64.rpm ruby-docs-1.6.8-13.el3.ia64.rpm ruby-libs-1.6.8-13.el3.i386.rpm ruby-libs-1.6.8-13.el3.ia64.rpm ruby-mode-1.6.8-13.el3.ia64.rpm ruby-tcltk-1.6.8-13.el3.ia64.rpm ppc: irb-1.6.8-13.el3.ppc.rpm ruby-1.6.8-13.el3.ppc.rpm ruby-debuginfo-1.6.8-13.el3.ppc.rpm ruby-debuginfo-1.6.8-13.el3.ppc64.rpm ruby-devel-1.6.8-13.el3.ppc.rpm ruby-docs-1.6.8-13.el3.ppc.rpm ruby-libs-1.6.8-13.el3.ppc.rpm ruby-libs-1.6.8-13.el3.ppc64.rpm ruby-mode-1.6.8-13.el3.ppc.rpm ruby-tcltk-1.6.8-13.el3.ppc.rpm s390: irb-1.6.8-13.el3.s390.rpm ruby-1.6.8-13.el3.s390.rpm ruby-debuginfo-1.6.8-13.el3.s390.rpm ruby-devel-1.6.8-13.el3.s390.rpm ruby-docs-1.6.8-13.el3.s390.rpm ruby-libs-1.6.8-13.el3.s390.rpm ruby-mode-1.6.8-13.el3.s390.rpm ruby-tcltk-1.6.8-13.el3.s390.rpm s390x: irb-1.6.8-13.el3.s390x.rpm ruby-1.6.8-13.el3.s390x.rpm ruby-debuginfo-1.6.8-13.el3.s390.rpm ruby-debuginfo-1.6.8-13.el3.s390x.rpm ruby-devel-1.6.8-13.el3.s390x.rpm ruby-docs-1.6.8-13.el3.s390x.rpm ruby-libs-1.6.8-13.el3.s390.rpm ruby-libs-1.6.8-13.el3.s390x.rpm ruby-mode-1.6.8-13.el3.s390x.rpm ruby-tcltk-1.6.8-13.el3.s390x.rpm x86_64: irb-1.6.8-13.el3.x86_64.rpm ruby-1.6.8-13.el3.x86_64.rpm ruby-debuginfo-1.6.8-13.el3.i386.rpm ruby-debuginfo-1.6.8-13.el3.x86_64.rpm ruby-devel-1.6.8-13.el3.x86_64.rpm ruby-docs-1.6.8-13.el3.x86_64.rpm ruby-libs-1.6.8-13.el3.i386.rpm ruby-libs-1.6.8-13.el3.x86_64.rpm ruby-mode-1.6.8-13.el3.x86_64.rpm ruby-tcltk-1.6.8-13.el3.x86_64.rpm Red Hat Desktop version 3: Source: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/ruby-1.6.8-13.el3.src.rpm i386: irb-1.6.8-13.el3.i386.rpm ruby-1.6.8-13.el3.i386.rpm ruby-debuginfo-1.6.8-13.el3.i386.rpm ruby-devel-1.6.8-13.el3.i386.rpm ruby-docs-1.6.8-13.el3.i386.rpm ruby-libs-1.6.8-13.el3.i386.rpm ruby-mode-1.6.8-13.el3.i386.rpm ruby-tcltk-1.6.8-13.el3.i386.rpm x86_64: irb-1.6.8-13.el3.x86_64.rpm ruby-1.6.8-13.el3.x86_64.rpm ruby-debuginfo-1.6.8-13.el3.i386.rpm ruby-debuginfo-1.6.8-13.el3.x86_64.rpm ruby-devel-1.6.8-13.el3.x86_64.rpm ruby-docs-1.6.8-13.el3.x86_64.rpm ruby-libs-1.6.8-13.el3.i386.rpm ruby-libs-1.6.8-13.el3.x86_64.rpm ruby-mode-1.6.8-13.el3.x86_64.rpm ruby-tcltk-1.6.8-13.el3.x86_64.rpm Red Hat Enterprise Linux ES version 3: Source: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/ruby-1.6.8-13.el3.src.rpm i386: irb-1.6.8-13.el3.i386.rpm ruby-1.6.8-13.el3.i386.rpm ruby-debuginfo-1.6.8-13.el3.i386.rpm ruby-devel-1.6.8-13.el3.i386.rpm ruby-docs-1.6.8-13.el3.i386.rpm ruby-libs-1.6.8-13.el3.i386.rpm ruby-mode-1.6.8-13.el3.i386.rpm ruby-tcltk-1.6.8-13.el3.i386.rpm ia64: irb-1.6.8-13.el3.ia64.rpm ruby-1.6.8-13.el3.ia64.rpm ruby-debuginfo-1.6.8-13.el3.i386.rpm ruby-debuginfo-1.6.8-13.el3.ia64.rpm ruby-devel-1.6.8-13.el3.ia64.rpm ruby-docs-1.6.8-13.el3.ia64.rpm ruby-libs-1.6.8-13.el3.i386.rpm ruby-libs-1.6.8-13.el3.ia64.rpm ruby-mode-1.6.8-13.el3.ia64.rpm ruby-tcltk-1.6.8-13.el3.ia64.rpm x86_64: irb-1.6.8-13.el3.x86_64.rpm ruby-1.6.8-13.el3.x86_64.rpm ruby-debuginfo-1.6.8-13.el3.i386.rpm ruby-debuginfo-1.6.8-13.el3.x86_64.rpm ruby-devel-1.6.8-13.el3.x86_64.rpm ruby-docs-1.6.8-13.el3.x86_64.rpm ruby-libs-1.6.8-13.el3.i386.rpm ruby-libs-1.6.8-13.el3.x86_64.rpm ruby-mode-1.6.8-13.el3.x86_64.rpm ruby-tcltk-1.6.8-13.el3.x86_64.rpm Red Hat Enterprise Linux WS version 3: Source: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/ruby-1.6.8-13.el3.src.rpm i386: irb-1.6.8-13.el3.i386.rpm ruby-1.6.8-13.el3.i386.rpm ruby-debuginfo-1.6.8-13.el3.i386.rpm ruby-devel-1.6.8-13.el3.i386.rpm ruby-docs-1.6.8-13.el3.i386.rpm ruby-libs-1.6.8-13.el3.i386.rpm ruby-mode-1.6.8-13.el3.i386.rpm ruby-tcltk-1.6.8-13.el3.i386.rpm ia64: irb-1.6.8-13.el3.ia64.rpm ruby-1.6.8-13.el3.ia64.rpm ruby-debuginfo-1.6.8-13.el3.i386.rpm ruby-debuginfo-1.6.8-13.el3.ia64.rpm ruby-devel-1.6.8-13.el3.ia64.rpm ruby-docs-1.6.8-13.el3.ia64.rpm ruby-libs-1.6.8-13.el3.i386.rpm ruby-libs-1.6.8-13.el3.ia64.rpm ruby-mode-1.6.8-13.el3.ia64.rpm ruby-tcltk-1.6.8-13.el3.ia64.rpm x86_64: irb-1.6.8-13.el3.x86_64.rpm ruby-1.6.8-13.el3.x86_64.rpm ruby-debuginfo-1.6.8-13.el3.i386.rpm ruby-debuginfo-1.6.8-13.el3.x86_64.rpm ruby-devel-1.6.8-13.el3.x86_64.rpm ruby-docs-1.6.8-13.el3.x86_64.rpm ruby-libs-1.6.8-13.el3.i386.rpm ruby-libs-1.6.8-13.el3.x86_64.rpm ruby-mode-1.6.8-13.el3.x86_64.rpm ruby-tcltk-1.6.8-13.el3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3443 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3655 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3905 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFI/e+AXlSAg2UNWIIRAkaaAKCxokgMmvl7L7wJQsgl2yXL98mSugCeNIyp l9NIsTL8kJUDtAf/I/HbAsQ= =U+FD -----END PGP SIGNATURE----- From bugzilla at redhat.com Tue Oct 21 15:05:04 2008 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Tue, 21 Oct 2008 11:05:04 -0400 Subject: [RHSA-2008:0897-01] Moderate: ruby security update Message-ID: <200810211505.m9LF59Gu019214@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: ruby security update Advisory ID: RHSA-2008:0897-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0897.html Issue date: 2008-10-21 CVE Names: CVE-2008-3443 CVE-2008-3655 CVE-2008-3656 CVE-2008-3657 CVE-2008-3790 CVE-2008-3905 ===================================================================== 1. Summary: Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: Ruby is an interpreted scripting language for quick and easy object-oriented programming. The Ruby DNS resolver library, resolv.rb, used predictable transaction IDs and a fixed source port when sending DNS requests. A remote attacker could use this flaw to spoof a malicious reply to a DNS query. (CVE-2008-3905) Ruby's XML document parsing module (REXML) was prone to a denial of service attack via XML documents with large XML entity definitions recursion. A specially-crafted XML file could cause a Ruby application using the REXML module to use an excessive amount of CPU and memory. (CVE-2008-3790) An insufficient "taintness" check flaw was discovered in Ruby's DL module, which provides direct access to the C language functions. An attacker could use this flaw to bypass intended safe-level restrictions by calling external C functions with the arguments from an untrusted tainted inputs. (CVE-2008-3657) A denial of service flaw was discovered in WEBrick, Ruby's HTTP server toolkit. A remote attacker could send a specially-crafted HTTP request to a WEBrick server that would cause the server to use an excessive amount of CPU time. (CVE-2008-3656) A number of flaws were found in the safe-level restrictions in Ruby. It was possible for an attacker to create a carefully crafted malicious script that can allow the bypass of certain safe-level restrictions. (CVE-2008-3655) A denial of service flaw was found in Ruby's regular expression engine. If a Ruby script tried to process a large amount of data via a regular expression, it could cause Ruby to enter an infinite-loop and crash. (CVE-2008-3443) Users of ruby should upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 458948 - CVE-2008-3655 ruby: multiple insufficient safe mode restrictions 458953 - CVE-2008-3656 ruby: WEBrick DoS vulnerability (CPU consumption) 458966 - CVE-2008-3657 ruby: missing "taintness" checks in dl module 459266 - CVE-2008-3443 ruby: Memory allocation failure in Ruby regex engine (remotely exploitable DoS) 460134 - CVE-2008-3790 ruby: DoS vulnerability in the REXML module 461495 - CVE-2008-3905 ruby: use of predictable source port and transaction id in DNS requests done by resolv.rb module 6. Package List: Red Hat Enterprise Linux AS version 4: Source: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/ruby-1.8.1-7.el4_7.1.src.rpm i386: irb-1.8.1-7.el4_7.1.i386.rpm ruby-1.8.1-7.el4_7.1.i386.rpm ruby-debuginfo-1.8.1-7.el4_7.1.i386.rpm ruby-devel-1.8.1-7.el4_7.1.i386.rpm ruby-docs-1.8.1-7.el4_7.1.i386.rpm ruby-libs-1.8.1-7.el4_7.1.i386.rpm ruby-mode-1.8.1-7.el4_7.1.i386.rpm ruby-tcltk-1.8.1-7.el4_7.1.i386.rpm ia64: irb-1.8.1-7.el4_7.1.ia64.rpm ruby-1.8.1-7.el4_7.1.ia64.rpm ruby-debuginfo-1.8.1-7.el4_7.1.i386.rpm ruby-debuginfo-1.8.1-7.el4_7.1.ia64.rpm ruby-devel-1.8.1-7.el4_7.1.ia64.rpm ruby-docs-1.8.1-7.el4_7.1.ia64.rpm ruby-libs-1.8.1-7.el4_7.1.i386.rpm ruby-libs-1.8.1-7.el4_7.1.ia64.rpm ruby-mode-1.8.1-7.el4_7.1.ia64.rpm ruby-tcltk-1.8.1-7.el4_7.1.ia64.rpm ppc: irb-1.8.1-7.el4_7.1.ppc.rpm ruby-1.8.1-7.el4_7.1.ppc.rpm ruby-debuginfo-1.8.1-7.el4_7.1.ppc.rpm ruby-debuginfo-1.8.1-7.el4_7.1.ppc64.rpm ruby-devel-1.8.1-7.el4_7.1.ppc.rpm ruby-docs-1.8.1-7.el4_7.1.ppc.rpm ruby-libs-1.8.1-7.el4_7.1.ppc.rpm ruby-libs-1.8.1-7.el4_7.1.ppc64.rpm ruby-mode-1.8.1-7.el4_7.1.ppc.rpm ruby-tcltk-1.8.1-7.el4_7.1.ppc.rpm s390: irb-1.8.1-7.el4_7.1.s390.rpm ruby-1.8.1-7.el4_7.1.s390.rpm ruby-debuginfo-1.8.1-7.el4_7.1.s390.rpm ruby-devel-1.8.1-7.el4_7.1.s390.rpm ruby-docs-1.8.1-7.el4_7.1.s390.rpm ruby-libs-1.8.1-7.el4_7.1.s390.rpm ruby-mode-1.8.1-7.el4_7.1.s390.rpm ruby-tcltk-1.8.1-7.el4_7.1.s390.rpm s390x: irb-1.8.1-7.el4_7.1.s390x.rpm ruby-1.8.1-7.el4_7.1.s390x.rpm ruby-debuginfo-1.8.1-7.el4_7.1.s390.rpm ruby-debuginfo-1.8.1-7.el4_7.1.s390x.rpm ruby-devel-1.8.1-7.el4_7.1.s390x.rpm ruby-docs-1.8.1-7.el4_7.1.s390x.rpm ruby-libs-1.8.1-7.el4_7.1.s390.rpm ruby-libs-1.8.1-7.el4_7.1.s390x.rpm ruby-mode-1.8.1-7.el4_7.1.s390x.rpm ruby-tcltk-1.8.1-7.el4_7.1.s390x.rpm x86_64: irb-1.8.1-7.el4_7.1.x86_64.rpm ruby-1.8.1-7.el4_7.1.x86_64.rpm ruby-debuginfo-1.8.1-7.el4_7.1.i386.rpm ruby-debuginfo-1.8.1-7.el4_7.1.x86_64.rpm ruby-devel-1.8.1-7.el4_7.1.x86_64.rpm ruby-docs-1.8.1-7.el4_7.1.x86_64.rpm ruby-libs-1.8.1-7.el4_7.1.i386.rpm ruby-libs-1.8.1-7.el4_7.1.x86_64.rpm ruby-mode-1.8.1-7.el4_7.1.x86_64.rpm ruby-tcltk-1.8.1-7.el4_7.1.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: Source: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/ruby-1.8.1-7.el4_7.1.src.rpm i386: irb-1.8.1-7.el4_7.1.i386.rpm ruby-1.8.1-7.el4_7.1.i386.rpm ruby-debuginfo-1.8.1-7.el4_7.1.i386.rpm ruby-devel-1.8.1-7.el4_7.1.i386.rpm ruby-docs-1.8.1-7.el4_7.1.i386.rpm ruby-libs-1.8.1-7.el4_7.1.i386.rpm ruby-mode-1.8.1-7.el4_7.1.i386.rpm ruby-tcltk-1.8.1-7.el4_7.1.i386.rpm x86_64: irb-1.8.1-7.el4_7.1.x86_64.rpm ruby-1.8.1-7.el4_7.1.x86_64.rpm ruby-debuginfo-1.8.1-7.el4_7.1.i386.rpm ruby-debuginfo-1.8.1-7.el4_7.1.x86_64.rpm ruby-devel-1.8.1-7.el4_7.1.x86_64.rpm ruby-docs-1.8.1-7.el4_7.1.x86_64.rpm ruby-libs-1.8.1-7.el4_7.1.i386.rpm ruby-libs-1.8.1-7.el4_7.1.x86_64.rpm ruby-mode-1.8.1-7.el4_7.1.x86_64.rpm ruby-tcltk-1.8.1-7.el4_7.1.x86_64.rpm Red Hat Enterprise Linux ES version 4: Source: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/ruby-1.8.1-7.el4_7.1.src.rpm i386: irb-1.8.1-7.el4_7.1.i386.rpm ruby-1.8.1-7.el4_7.1.i386.rpm ruby-debuginfo-1.8.1-7.el4_7.1.i386.rpm ruby-devel-1.8.1-7.el4_7.1.i386.rpm ruby-docs-1.8.1-7.el4_7.1.i386.rpm ruby-libs-1.8.1-7.el4_7.1.i386.rpm ruby-mode-1.8.1-7.el4_7.1.i386.rpm ruby-tcltk-1.8.1-7.el4_7.1.i386.rpm ia64: irb-1.8.1-7.el4_7.1.ia64.rpm ruby-1.8.1-7.el4_7.1.ia64.rpm ruby-debuginfo-1.8.1-7.el4_7.1.i386.rpm ruby-debuginfo-1.8.1-7.el4_7.1.ia64.rpm ruby-devel-1.8.1-7.el4_7.1.ia64.rpm ruby-docs-1.8.1-7.el4_7.1.ia64.rpm ruby-libs-1.8.1-7.el4_7.1.i386.rpm ruby-libs-1.8.1-7.el4_7.1.ia64.rpm ruby-mode-1.8.1-7.el4_7.1.ia64.rpm ruby-tcltk-1.8.1-7.el4_7.1.ia64.rpm x86_64: irb-1.8.1-7.el4_7.1.x86_64.rpm ruby-1.8.1-7.el4_7.1.x86_64.rpm ruby-debuginfo-1.8.1-7.el4_7.1.i386.rpm ruby-debuginfo-1.8.1-7.el4_7.1.x86_64.rpm ruby-devel-1.8.1-7.el4_7.1.x86_64.rpm ruby-docs-1.8.1-7.el4_7.1.x86_64.rpm ruby-libs-1.8.1-7.el4_7.1.i386.rpm ruby-libs-1.8.1-7.el4_7.1.x86_64.rpm ruby-mode-1.8.1-7.el4_7.1.x86_64.rpm ruby-tcltk-1.8.1-7.el4_7.1.x86_64.rpm Red Hat Enterprise Linux WS version 4: Source: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/ruby-1.8.1-7.el4_7.1.src.rpm i386: irb-1.8.1-7.el4_7.1.i386.rpm ruby-1.8.1-7.el4_7.1.i386.rpm ruby-debuginfo-1.8.1-7.el4_7.1.i386.rpm ruby-devel-1.8.1-7.el4_7.1.i386.rpm ruby-docs-1.8.1-7.el4_7.1.i386.rpm ruby-libs-1.8.1-7.el4_7.1.i386.rpm ruby-mode-1.8.1-7.el4_7.1.i386.rpm ruby-tcltk-1.8.1-7.el4_7.1.i386.rpm ia64: irb-1.8.1-7.el4_7.1.ia64.rpm ruby-1.8.1-7.el4_7.1.ia64.rpm ruby-debuginfo-1.8.1-7.el4_7.1.i386.rpm ruby-debuginfo-1.8.1-7.el4_7.1.ia64.rpm ruby-devel-1.8.1-7.el4_7.1.ia64.rpm ruby-docs-1.8.1-7.el4_7.1.ia64.rpm ruby-libs-1.8.1-7.el4_7.1.i386.rpm ruby-libs-1.8.1-7.el4_7.1.ia64.rpm ruby-mode-1.8.1-7.el4_7.1.ia64.rpm ruby-tcltk-1.8.1-7.el4_7.1.ia64.rpm x86_64: irb-1.8.1-7.el4_7.1.x86_64.rpm ruby-1.8.1-7.el4_7.1.x86_64.rpm ruby-debuginfo-1.8.1-7.el4_7.1.i386.rpm ruby-debuginfo-1.8.1-7.el4_7.1.x86_64.rpm ruby-devel-1.8.1-7.el4_7.1.x86_64.rpm ruby-docs-1.8.1-7.el4_7.1.x86_64.rpm ruby-libs-1.8.1-7.el4_7.1.i386.rpm ruby-libs-1.8.1-7.el4_7.1.x86_64.rpm ruby-mode-1.8.1-7.el4_7.1.x86_64.rpm ruby-tcltk-1.8.1-7.el4_7.1.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/ruby-1.8.5-5.el5_2.5.src.rpm i386: ruby-1.8.5-5.el5_2.5.i386.rpm ruby-debuginfo-1.8.5-5.el5_2.5.i386.rpm ruby-docs-1.8.5-5.el5_2.5.i386.rpm ruby-irb-1.8.5-5.el5_2.5.i386.rpm ruby-libs-1.8.5-5.el5_2.5.i386.rpm ruby-rdoc-1.8.5-5.el5_2.5.i386.rpm ruby-ri-1.8.5-5.el5_2.5.i386.rpm ruby-tcltk-1.8.5-5.el5_2.5.i386.rpm x86_64: ruby-1.8.5-5.el5_2.5.x86_64.rpm ruby-debuginfo-1.8.5-5.el5_2.5.i386.rpm ruby-debuginfo-1.8.5-5.el5_2.5.x86_64.rpm ruby-docs-1.8.5-5.el5_2.5.x86_64.rpm ruby-irb-1.8.5-5.el5_2.5.x86_64.rpm ruby-libs-1.8.5-5.el5_2.5.i386.rpm ruby-libs-1.8.5-5.el5_2.5.x86_64.rpm ruby-rdoc-1.8.5-5.el5_2.5.x86_64.rpm ruby-ri-1.8.5-5.el5_2.5.x86_64.rpm ruby-tcltk-1.8.5-5.el5_2.5.x86_64.rpm RHEL Desktop Workstation (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/ruby-1.8.5-5.el5_2.5.src.rpm i386: ruby-debuginfo-1.8.5-5.el5_2.5.i386.rpm ruby-devel-1.8.5-5.el5_2.5.i386.rpm ruby-mode-1.8.5-5.el5_2.5.i386.rpm x86_64: ruby-debuginfo-1.8.5-5.el5_2.5.i386.rpm ruby-debuginfo-1.8.5-5.el5_2.5.x86_64.rpm ruby-devel-1.8.5-5.el5_2.5.i386.rpm ruby-devel-1.8.5-5.el5_2.5.x86_64.rpm ruby-mode-1.8.5-5.el5_2.5.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/ruby-1.8.5-5.el5_2.5.src.rpm i386: ruby-1.8.5-5.el5_2.5.i386.rpm ruby-debuginfo-1.8.5-5.el5_2.5.i386.rpm ruby-devel-1.8.5-5.el5_2.5.i386.rpm ruby-docs-1.8.5-5.el5_2.5.i386.rpm ruby-irb-1.8.5-5.el5_2.5.i386.rpm ruby-libs-1.8.5-5.el5_2.5.i386.rpm ruby-mode-1.8.5-5.el5_2.5.i386.rpm ruby-rdoc-1.8.5-5.el5_2.5.i386.rpm ruby-ri-1.8.5-5.el5_2.5.i386.rpm ruby-tcltk-1.8.5-5.el5_2.5.i386.rpm ia64: ruby-1.8.5-5.el5_2.5.ia64.rpm ruby-debuginfo-1.8.5-5.el5_2.5.ia64.rpm ruby-devel-1.8.5-5.el5_2.5.ia64.rpm ruby-docs-1.8.5-5.el5_2.5.ia64.rpm ruby-irb-1.8.5-5.el5_2.5.ia64.rpm ruby-libs-1.8.5-5.el5_2.5.ia64.rpm ruby-mode-1.8.5-5.el5_2.5.ia64.rpm ruby-rdoc-1.8.5-5.el5_2.5.ia64.rpm ruby-ri-1.8.5-5.el5_2.5.ia64.rpm ruby-tcltk-1.8.5-5.el5_2.5.ia64.rpm ppc: ruby-1.8.5-5.el5_2.5.ppc.rpm ruby-debuginfo-1.8.5-5.el5_2.5.ppc.rpm ruby-debuginfo-1.8.5-5.el5_2.5.ppc64.rpm ruby-devel-1.8.5-5.el5_2.5.ppc.rpm ruby-devel-1.8.5-5.el5_2.5.ppc64.rpm ruby-docs-1.8.5-5.el5_2.5.ppc.rpm ruby-irb-1.8.5-5.el5_2.5.ppc.rpm ruby-libs-1.8.5-5.el5_2.5.ppc.rpm ruby-libs-1.8.5-5.el5_2.5.ppc64.rpm ruby-mode-1.8.5-5.el5_2.5.ppc.rpm ruby-rdoc-1.8.5-5.el5_2.5.ppc.rpm ruby-ri-1.8.5-5.el5_2.5.ppc.rpm ruby-tcltk-1.8.5-5.el5_2.5.ppc.rpm s390x: ruby-1.8.5-5.el5_2.5.s390x.rpm ruby-debuginfo-1.8.5-5.el5_2.5.s390.rpm ruby-debuginfo-1.8.5-5.el5_2.5.s390x.rpm ruby-devel-1.8.5-5.el5_2.5.s390.rpm ruby-devel-1.8.5-5.el5_2.5.s390x.rpm ruby-docs-1.8.5-5.el5_2.5.s390x.rpm ruby-irb-1.8.5-5.el5_2.5.s390x.rpm ruby-libs-1.8.5-5.el5_2.5.s390.rpm ruby-libs-1.8.5-5.el5_2.5.s390x.rpm ruby-mode-1.8.5-5.el5_2.5.s390x.rpm ruby-rdoc-1.8.5-5.el5_2.5.s390x.rpm ruby-ri-1.8.5-5.el5_2.5.s390x.rpm ruby-tcltk-1.8.5-5.el5_2.5.s390x.rpm x86_64: ruby-1.8.5-5.el5_2.5.x86_64.rpm ruby-debuginfo-1.8.5-5.el5_2.5.i386.rpm ruby-debuginfo-1.8.5-5.el5_2.5.x86_64.rpm ruby-devel-1.8.5-5.el5_2.5.i386.rpm ruby-devel-1.8.5-5.el5_2.5.x86_64.rpm ruby-docs-1.8.5-5.el5_2.5.x86_64.rpm ruby-irb-1.8.5-5.el5_2.5.x86_64.rpm ruby-libs-1.8.5-5.el5_2.5.i386.rpm ruby-libs-1.8.5-5.el5_2.5.x86_64.rpm ruby-mode-1.8.5-5.el5_2.5.x86_64.rpm ruby-rdoc-1.8.5-5.el5_2.5.x86_64.rpm ruby-ri-1.8.5-5.el5_2.5.x86_64.rpm ruby-tcltk-1.8.5-5.el5_2.5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3443 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3655 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3656 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3657 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3790 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3905 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFI/e+UXlSAg2UNWIIRAhkmAKCipGrP/Td1I7HfBbBs9nbNOLSSqwCbBZ7x YqlWKQvtkDOlTAE5C1RpHXc= =NCZC -----END PGP SIGNATURE----- From bugzilla at redhat.com Tue Oct 21 15:21:03 2008 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Tue, 21 Oct 2008 11:21:03 -0400 Subject: [RHSA-2008:0946-01] Moderate: ed security update Message-ID: <200810211521.m9LFL3Iv030306@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: ed security update Advisory ID: RHSA-2008:0946-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0946.html Issue date: 2008-10-21 CVE Names: CVE-2008-3916 ===================================================================== 1. Summary: An updated ed package that fixes one security issue is now available for Red Hat Enterprise Linux 2.1, 3, 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: ed is a line-oriented text editor, used to create, display, and modify text files (both interactively and via shell scripts). A heap-based buffer overflow was discovered in the way ed, the GNU line editor, processed long file names. An attacker could create a file with a specially-crafted name that could possibly execute an arbitrary code when opened in the ed editor. (CVE-2008-3916) Users of ed should upgrade to this updated package, which contains a backported patch to resolve this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 462584 - CVE-2008-3916 ed: Heap-based buffer overflow (arb. code execution) 6. Package List: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 : Source: ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/ed-0.2-21.1.src.rpm i386: ed-0.2-21.1.i386.rpm ia64: ed-0.2-21.1.ia64.rpm Red Hat Linux Advanced Workstation 2.1: Source: ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/ed-0.2-21.1.src.rpm ia64: ed-0.2-21.1.ia64.rpm Red Hat Enterprise Linux ES version 2.1: Source: ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/ed-0.2-21.1.src.rpm i386: ed-0.2-21.1.i386.rpm Red Hat Enterprise Linux WS version 2.1: Source: ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/ed-0.2-21.1.src.rpm i386: ed-0.2-21.1.i386.rpm Red Hat Enterprise Linux AS version 3: Source: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/ed-0.2-33.30E.1.src.rpm i386: ed-0.2-33.30E.1.i386.rpm ed-debuginfo-0.2-33.30E.1.i386.rpm ia64: ed-0.2-33.30E.1.ia64.rpm ed-debuginfo-0.2-33.30E.1.ia64.rpm ppc: ed-0.2-33.30E.1.ppc.rpm ed-debuginfo-0.2-33.30E.1.ppc.rpm s390: ed-0.2-33.30E.1.s390.rpm ed-debuginfo-0.2-33.30E.1.s390.rpm s390x: ed-0.2-33.30E.1.s390x.rpm ed-debuginfo-0.2-33.30E.1.s390x.rpm x86_64: ed-0.2-33.30E.1.x86_64.rpm ed-debuginfo-0.2-33.30E.1.x86_64.rpm Red Hat Desktop version 3: Source: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/ed-0.2-33.30E.1.src.rpm i386: ed-0.2-33.30E.1.i386.rpm ed-debuginfo-0.2-33.30E.1.i386.rpm x86_64: ed-0.2-33.30E.1.x86_64.rpm ed-debuginfo-0.2-33.30E.1.x86_64.rpm Red Hat Enterprise Linux ES version 3: Source: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/ed-0.2-33.30E.1.src.rpm i386: ed-0.2-33.30E.1.i386.rpm ed-debuginfo-0.2-33.30E.1.i386.rpm ia64: ed-0.2-33.30E.1.ia64.rpm ed-debuginfo-0.2-33.30E.1.ia64.rpm x86_64: ed-0.2-33.30E.1.x86_64.rpm ed-debuginfo-0.2-33.30E.1.x86_64.rpm Red Hat Enterprise Linux WS version 3: Source: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/ed-0.2-33.30E.1.src.rpm i386: ed-0.2-33.30E.1.i386.rpm ed-debuginfo-0.2-33.30E.1.i386.rpm ia64: ed-0.2-33.30E.1.ia64.rpm ed-debuginfo-0.2-33.30E.1.ia64.rpm x86_64: ed-0.2-33.30E.1.x86_64.rpm ed-debuginfo-0.2-33.30E.1.x86_64.rpm Red Hat Enterprise Linux AS version 4: Source: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/ed-0.2-36.el4_7.1.src.rpm i386: ed-0.2-36.el4_7.1.i386.rpm ed-debuginfo-0.2-36.el4_7.1.i386.rpm ia64: ed-0.2-36.el4_7.1.ia64.rpm ed-debuginfo-0.2-36.el4_7.1.ia64.rpm ppc: ed-0.2-36.el4_7.1.ppc.rpm ed-debuginfo-0.2-36.el4_7.1.ppc.rpm s390: ed-0.2-36.el4_7.1.s390.rpm ed-debuginfo-0.2-36.el4_7.1.s390.rpm s390x: ed-0.2-36.el4_7.1.s390x.rpm ed-debuginfo-0.2-36.el4_7.1.s390x.rpm x86_64: ed-0.2-36.el4_7.1.x86_64.rpm ed-debuginfo-0.2-36.el4_7.1.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: Source: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/ed-0.2-36.el4_7.1.src.rpm i386: ed-0.2-36.el4_7.1.i386.rpm ed-debuginfo-0.2-36.el4_7.1.i386.rpm x86_64: ed-0.2-36.el4_7.1.x86_64.rpm ed-debuginfo-0.2-36.el4_7.1.x86_64.rpm Red Hat Enterprise Linux ES version 4: Source: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/ed-0.2-36.el4_7.1.src.rpm i386: ed-0.2-36.el4_7.1.i386.rpm ed-debuginfo-0.2-36.el4_7.1.i386.rpm ia64: ed-0.2-36.el4_7.1.ia64.rpm ed-debuginfo-0.2-36.el4_7.1.ia64.rpm x86_64: ed-0.2-36.el4_7.1.x86_64.rpm ed-debuginfo-0.2-36.el4_7.1.x86_64.rpm Red Hat Enterprise Linux WS version 4: Source: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/ed-0.2-36.el4_7.1.src.rpm i386: ed-0.2-36.el4_7.1.i386.rpm ed-debuginfo-0.2-36.el4_7.1.i386.rpm ia64: ed-0.2-36.el4_7.1.ia64.rpm ed-debuginfo-0.2-36.el4_7.1.ia64.rpm x86_64: ed-0.2-36.el4_7.1.x86_64.rpm ed-debuginfo-0.2-36.el4_7.1.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/ed-0.2-39.el5_2.src.rpm i386: ed-0.2-39.el5_2.i386.rpm ed-debuginfo-0.2-39.el5_2.i386.rpm x86_64: ed-0.2-39.el5_2.x86_64.rpm ed-debuginfo-0.2-39.el5_2.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/ed-0.2-39.el5_2.src.rpm i386: ed-0.2-39.el5_2.i386.rpm ed-debuginfo-0.2-39.el5_2.i386.rpm ia64: ed-0.2-39.el5_2.ia64.rpm ed-debuginfo-0.2-39.el5_2.ia64.rpm ppc: ed-0.2-39.el5_2.ppc.rpm ed-debuginfo-0.2-39.el5_2.ppc.rpm s390x: ed-0.2-39.el5_2.s390x.rpm ed-debuginfo-0.2-39.el5_2.s390x.rpm x86_64: ed-0.2-39.el5_2.x86_64.rpm ed-debuginfo-0.2-39.el5_2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3916 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFI/fNVXlSAg2UNWIIRAhUxAKC0CYXQssY2usEEOHhH/9h2Kds1rACdGdU1 Vh/xkV1YxbjRL67/hSbkrvc= =4zNQ -----END PGP SIGNATURE----- From bugzilla at redhat.com Fri Oct 24 14:48:06 2008 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Fri, 24 Oct 2008 10:48:06 -0400 Subject: [RHSA-2008:0891-01] Moderate: java-1.5.0-ibm security update Message-ID: <200810241448.m9OEm6PJ030736@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: java-1.5.0-ibm security update Advisory ID: RHSA-2008:0891-01 Product: Red Hat Enterprise Linux Extras Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0891.html Issue date: 2008-10-24 CVE Names: CVE-2008-3103 ===================================================================== 1. Summary: Updated java-1.5.0-ibm packages that fix a security issue are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 Extras - i386, ppc, s390, s390x, x86_64 Red Hat Desktop version 4 Extras - i386, x86_64 Red Hat Enterprise Linux ES version 4 Extras - i386, x86_64 Red Hat Enterprise Linux WS version 4 Extras - i386, x86_64 RHEL Desktop Supplementary (v. 5 client) - i386, x86_64 RHEL Supplementary (v. 5 server) - i386, ppc, s390x, x86_64 3. Description: The IBM 1.5.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit. A flaw was found in the Java Management Extensions (JMX) management agent. When local monitoring is enabled, remote attackers could use this flaw to perform illegal operations. (CVE-2008-3103) All users of java-1.5.0-ibm are advised to upgrade to these updated packages containing the IBM 1.5.0 SR8a Java release, which resolves this issue. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 452659 - CVE-2008-3103 OpenJDK JMX allows illegal operations with local monitoring (6332953) 6. Package List: Red Hat Enterprise Linux AS version 4 Extras: i386: java-1.5.0-ibm-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-jdbc-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-plugin-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el4.i386.rpm ppc: java-1.5.0-ibm-1.5.0.8-1jpp.2.el4.ppc.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el4.ppc.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el4.ppc.rpm java-1.5.0-ibm-javacomm-1.5.0.8-1jpp.2.el4.ppc.rpm java-1.5.0-ibm-jdbc-1.5.0.8-1jpp.2.el4.ppc.rpm java-1.5.0-ibm-plugin-1.5.0.8-1jpp.2.el4.ppc.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el4.ppc.rpm s390: java-1.5.0-ibm-1.5.0.8-1jpp.2.el4.s390.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el4.s390.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el4.s390.rpm java-1.5.0-ibm-jdbc-1.5.0.8-1jpp.2.el4.s390.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el4.s390.rpm s390x: java-1.5.0-ibm-1.5.0.8-1jpp.2.el4.s390x.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el4.s390x.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el4.s390x.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el4.s390x.rpm x86_64: java-1.5.0-ibm-1.5.0.8-1jpp.2.el4.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el4.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el4.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.8-1jpp.2.el4.x86_64.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el4.x86_64.rpm Red Hat Desktop version 4 Extras: i386: java-1.5.0-ibm-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-jdbc-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-plugin-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el4.i386.rpm x86_64: java-1.5.0-ibm-1.5.0.8-1jpp.2.el4.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el4.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el4.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.8-1jpp.2.el4.x86_64.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4 Extras: i386: java-1.5.0-ibm-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-jdbc-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-plugin-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el4.i386.rpm x86_64: java-1.5.0-ibm-1.5.0.8-1jpp.2.el4.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el4.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el4.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.8-1jpp.2.el4.x86_64.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el4.x86_64.rpm Red Hat Enterprise Linux WS version 4 Extras: i386: java-1.5.0-ibm-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-jdbc-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-plugin-1.5.0.8-1jpp.2.el4.i386.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el4.i386.rpm x86_64: java-1.5.0-ibm-1.5.0.8-1jpp.2.el4.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el4.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el4.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.8-1jpp.2.el4.x86_64.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el4.x86_64.rpm RHEL Desktop Supplementary (v. 5 client): i386: java-1.5.0-ibm-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-accessibility-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-jdbc-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-plugin-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el5.i386.rpm x86_64: java-1.5.0-ibm-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-1.5.0.8-1jpp.2.el5.x86_64.rpm java-1.5.0-ibm-accessibility-1.5.0.8-1jpp.2.el5.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el5.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el5.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.8-1jpp.2.el5.x86_64.rpm java-1.5.0-ibm-jdbc-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-plugin-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el5.x86_64.rpm RHEL Supplementary (v. 5 server): i386: java-1.5.0-ibm-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-accessibility-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-jdbc-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-plugin-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el5.i386.rpm ppc: java-1.5.0-ibm-1.5.0.8-1jpp.2.el5.ppc.rpm java-1.5.0-ibm-1.5.0.8-1jpp.2.el5.ppc64.rpm java-1.5.0-ibm-accessibility-1.5.0.8-1jpp.2.el5.ppc.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el5.ppc.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el5.ppc64.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el5.ppc.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el5.ppc64.rpm java-1.5.0-ibm-javacomm-1.5.0.8-1jpp.2.el5.ppc.rpm java-1.5.0-ibm-javacomm-1.5.0.8-1jpp.2.el5.ppc64.rpm java-1.5.0-ibm-jdbc-1.5.0.8-1jpp.2.el5.ppc.rpm java-1.5.0-ibm-plugin-1.5.0.8-1jpp.2.el5.ppc.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el5.ppc.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el5.ppc64.rpm s390x: java-1.5.0-ibm-1.5.0.8-1jpp.2.el5.s390.rpm java-1.5.0-ibm-1.5.0.8-1jpp.2.el5.s390x.rpm java-1.5.0-ibm-accessibility-1.5.0.8-1jpp.2.el5.s390x.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el5.s390.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el5.s390x.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el5.s390.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el5.s390x.rpm java-1.5.0-ibm-jdbc-1.5.0.8-1jpp.2.el5.s390.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el5.s390.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el5.s390x.rpm x86_64: java-1.5.0-ibm-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-1.5.0.8-1jpp.2.el5.x86_64.rpm java-1.5.0-ibm-accessibility-1.5.0.8-1jpp.2.el5.x86_64.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-demo-1.5.0.8-1jpp.2.el5.x86_64.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-devel-1.5.0.8-1jpp.2.el5.x86_64.rpm java-1.5.0-ibm-javacomm-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-javacomm-1.5.0.8-1jpp.2.el5.x86_64.rpm java-1.5.0-ibm-jdbc-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-plugin-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el5.i386.rpm java-1.5.0-ibm-src-1.5.0.8-1jpp.2.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3103 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFJAeAaXlSAg2UNWIIRAmuRAJ0WedwoS9kVz27a/yKTkH7IKW5yiQCff6Ch UsDWvzUxsubQ5ck2gm6WFaU= =O63q -----END PGP SIGNATURE----- From bugzilla at redhat.com Fri Oct 24 14:48:49 2008 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Fri, 24 Oct 2008 10:48:49 -0400 Subject: [RHSA-2008:0906-01] Critical: java-1.6.0-ibm security update Message-ID: <200810241448.m9OEmngk031295@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: java-1.6.0-ibm security update Advisory ID: RHSA-2008:0906-01 Product: Red Hat Enterprise Linux Extras Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0906.html Issue date: 2008-10-24 CVE Names: CVE-2008-3103 CVE-2008-3104 CVE-2008-3105 CVE-2008-3106 CVE-2008-3109 CVE-2008-3110 CVE-2008-3112 CVE-2008-3114 ===================================================================== 1. Summary: Updated java-1.6.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras and Red Hat Enterprise Linux 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 Extras - i386, ppc, s390, s390x, x86_64 Red Hat Desktop version 4 Extras - i386, x86_64 Red Hat Enterprise Linux ES version 4 Extras - i386, x86_64 Red Hat Enterprise Linux WS version 4 Extras - i386, x86_64 RHEL Desktop Supplementary (v. 5 client) - i386, x86_64 RHEL Supplementary (v. 5 server) - i386, ppc, s390x, x86_64 3. Description: The IBM 1.6.0 Java release includes the IBM Java 2 Runtime Environment and the IBM Java 2 Software Development Kit. A flaw was found in the Java Management Extensions (JMX) management agent. When local monitoring is enabled, remote attackers could use this flaw to perform illegal operations. (CVE-2008-3103) Several flaws involving the handling of unsigned applets were found. A remote attacker could misuse an unsigned applet in order to connect to services on the host running the applet. (CVE-2008-3104) Several flaws in the Java API for XML Web Services (JAX-WS) client and the JAX-WS service implementation were found. A remote attacker who could cause malicious XML to be processed by an application could access URLs, or cause a denial of service. (CVE-2008-3105, CVE-2008-3106) Several flaws within the Java Runtime Environment (JRE) scripting support were found. A remote attacker could grant an untrusted applet extended privileges, such as reading and writing local files, executing local programs, or querying the sensitive data of other applets. (CVE-2008-3109, CVE-2008-3110) A flaw in Java Web Start was found. Using an untrusted Java Web Start application, a remote attacker could create or delete arbitrary files with the permissions of the user running the untrusted application. (CVE-2008-3112) A flaw in Java Web Start when processing untrusted applications was found. An attacker could use this flaw to acquire sensitive information, such as the location of the cache. (CVE-2008-3114) All users of java-1.6.0-ibm are advised to upgrade to these updated packages, containing the IBM 1.6.0 SR2 Java release, which resolves these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 452649 - CVE-2008-3105 CVE-2008-3106 OpenJDK JAX-WS unauthorized URL access (6542088) 452659 - CVE-2008-3103 OpenJDK JMX allows illegal operations with local monitoring (6332953) 454601 - CVE-2008-3104 Java RE allows Same Origin Policy to be Bypassed (6687932) 454603 - CVE-2008-3109 CVE-2008-3110 Security Vulnerabilities in the Java Runtime Environment Scripting Language Support (6529568, 6529579) 454606 - CVE-2008-3112 Java Web Start, arbitrary file creation (6703909) 454608 - CVE-2008-3114 Java Web Start, untrusted application may determine Cache Location (6704074) 6. Package List: Red Hat Enterprise Linux AS version 4 Extras: i386: java-1.6.0-ibm-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-javacomm-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-plugin-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el4.i386.rpm ppc: java-1.6.0-ibm-1.6.0.2-1jpp.2.el4.ppc.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el4.ppc.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el4.ppc.rpm java-1.6.0-ibm-javacomm-1.6.0.2-1jpp.2.el4.ppc.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el4.ppc.rpm java-1.6.0-ibm-plugin-1.6.0.2-1jpp.2.el4.ppc.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el4.ppc.rpm s390: java-1.6.0-ibm-1.6.0.2-1jpp.2.el4.s390.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el4.s390.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el4.s390.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el4.s390.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el4.s390.rpm s390x: java-1.6.0-ibm-1.6.0.2-1jpp.2.el4.s390x.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el4.s390x.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el4.s390x.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el4.s390x.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el4.s390x.rpm x86_64: java-1.6.0-ibm-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-javacomm-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el4.x86_64.rpm Red Hat Desktop version 4 Extras: i386: java-1.6.0-ibm-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-javacomm-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-plugin-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el4.i386.rpm x86_64: java-1.6.0-ibm-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-javacomm-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4 Extras: i386: java-1.6.0-ibm-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-javacomm-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-plugin-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el4.i386.rpm x86_64: java-1.6.0-ibm-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-javacomm-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el4.x86_64.rpm Red Hat Enterprise Linux WS version 4 Extras: i386: java-1.6.0-ibm-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-javacomm-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-plugin-1.6.0.2-1jpp.2.el4.i386.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el4.i386.rpm x86_64: java-1.6.0-ibm-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-javacomm-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el4.x86_64.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el4.x86_64.rpm RHEL Desktop Supplementary (v. 5 client): i386: java-1.6.0-ibm-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-accessibility-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-javacomm-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-plugin-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el5.i386.rpm x86_64: java-1.6.0-ibm-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-1.6.0.2-1jpp.2.el5.x86_64.rpm java-1.6.0-ibm-accessibility-1.6.0.2-1jpp.2.el5.x86_64.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el5.x86_64.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el5.x86_64.rpm java-1.6.0-ibm-javacomm-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-javacomm-1.6.0.2-1jpp.2.el5.x86_64.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el5.x86_64.rpm java-1.6.0-ibm-plugin-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el5.x86_64.rpm RHEL Supplementary (v. 5 server): i386: java-1.6.0-ibm-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-accessibility-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-javacomm-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-plugin-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el5.i386.rpm ppc: java-1.6.0-ibm-1.6.0.2-1jpp.2.el5.ppc.rpm java-1.6.0-ibm-1.6.0.2-1jpp.2.el5.ppc64.rpm java-1.6.0-ibm-accessibility-1.6.0.2-1jpp.2.el5.ppc.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el5.ppc.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el5.ppc64.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el5.ppc.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el5.ppc64.rpm java-1.6.0-ibm-javacomm-1.6.0.2-1jpp.2.el5.ppc.rpm java-1.6.0-ibm-javacomm-1.6.0.2-1jpp.2.el5.ppc64.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el5.ppc.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el5.ppc64.rpm java-1.6.0-ibm-plugin-1.6.0.2-1jpp.2.el5.ppc.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el5.ppc.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el5.ppc64.rpm s390x: java-1.6.0-ibm-1.6.0.2-1jpp.2.el5.s390.rpm java-1.6.0-ibm-1.6.0.2-1jpp.2.el5.s390x.rpm java-1.6.0-ibm-accessibility-1.6.0.2-1jpp.2.el5.s390x.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el5.s390.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el5.s390x.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el5.s390.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el5.s390x.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el5.s390.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el5.s390x.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el5.s390.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el5.s390x.rpm x86_64: java-1.6.0-ibm-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-1.6.0.2-1jpp.2.el5.x86_64.rpm java-1.6.0-ibm-accessibility-1.6.0.2-1jpp.2.el5.x86_64.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-demo-1.6.0.2-1jpp.2.el5.x86_64.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-devel-1.6.0.2-1jpp.2.el5.x86_64.rpm java-1.6.0-ibm-javacomm-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-javacomm-1.6.0.2-1jpp.2.el5.x86_64.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-jdbc-1.6.0.2-1jpp.2.el5.x86_64.rpm java-1.6.0-ibm-plugin-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el5.i386.rpm java-1.6.0-ibm-src-1.6.0.2-1jpp.2.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3103 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3104 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3105 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3106 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3109 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3110 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3112 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3114 http://www-128.ibm.com/developerworks/java/jdk/alerts/ http://www.redhat.com/security/updates/classification/#critical 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFJAeAsXlSAg2UNWIIRAkirAJ99BOqkWhAMyYTaQzrx6SSdHoOd2gCeIJd9 hEPc/XmL6lIerQh63+rV0OM= =t1eA -----END PGP SIGNATURE----- From bugzilla at redhat.com Mon Oct 27 17:19:56 2008 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Mon, 27 Oct 2008 13:19:56 -0400 Subject: [RHSA-2008:0965-01] Important: lynx security update Message-ID: <200810271719.m9RHJuIT026951@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: lynx security update Advisory ID: RHSA-2008:0965-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0965.html Issue date: 2008-10-27 CVE Names: CVE-2008-4690 CVE-2006-7234 ===================================================================== 1. Summary: An updated lynx package that corrects two security issues is now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: Lynx is a text-based Web browser. An arbitrary command execution flaw was found in the Lynx "lynxcgi:" URI handler. An attacker could create a web page redirecting to a malicious URL that could execute arbitrary code as the user running Lynx in the non-default "Advanced" user mode. (CVE-2008-4690) Note: In these updated lynx packages, Lynx will always prompt users before loading a "lynxcgi:" URI. Additionally, the default lynx.cfg configuration file now marks all "lynxcgi:" URIs as untrusted by default. A flaw was found in a way Lynx handled ".mailcap" and ".mime.types" configuration files. Files in the browser's current working directory were opened before those in the user's home directory. A local attacker, able to convince a user to run Lynx in a directory under their control, could possibly execute arbitrary commands as the user running Lynx. (CVE-2006-7234) All users of Lynx are advised to upgrade to this updated package, which contains backported patches correcting these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 214205 - CVE-2006-7234 lynx: .mailcap and .mime.types files read from CWD 468184 - CVE-2008-4690 lynx: remote arbitrary command execution via a crafted lynxcgi: URL 6. Package List: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 : Source: ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/lynx-2.8.4-18.1.3.src.rpm i386: lynx-2.8.4-18.1.3.i386.rpm ia64: lynx-2.8.4-18.1.3.ia64.rpm Red Hat Linux Advanced Workstation 2.1: Source: ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/lynx-2.8.4-18.1.3.src.rpm ia64: lynx-2.8.4-18.1.3.ia64.rpm Red Hat Enterprise Linux ES version 2.1: Source: ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/lynx-2.8.4-18.1.3.src.rpm i386: lynx-2.8.4-18.1.3.i386.rpm Red Hat Enterprise Linux WS version 2.1: Source: ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/lynx-2.8.4-18.1.3.src.rpm i386: lynx-2.8.4-18.1.3.i386.rpm Red Hat Enterprise Linux AS version 3: Source: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/lynx-2.8.5-11.3.src.rpm i386: lynx-2.8.5-11.3.i386.rpm lynx-debuginfo-2.8.5-11.3.i386.rpm ia64: lynx-2.8.5-11.3.ia64.rpm lynx-debuginfo-2.8.5-11.3.ia64.rpm ppc: lynx-2.8.5-11.3.ppc.rpm lynx-debuginfo-2.8.5-11.3.ppc.rpm s390: lynx-2.8.5-11.3.s390.rpm lynx-debuginfo-2.8.5-11.3.s390.rpm s390x: lynx-2.8.5-11.3.s390x.rpm lynx-debuginfo-2.8.5-11.3.s390x.rpm x86_64: lynx-2.8.5-11.3.x86_64.rpm lynx-debuginfo-2.8.5-11.3.x86_64.rpm Red Hat Desktop version 3: Source: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/lynx-2.8.5-11.3.src.rpm i386: lynx-2.8.5-11.3.i386.rpm lynx-debuginfo-2.8.5-11.3.i386.rpm x86_64: lynx-2.8.5-11.3.x86_64.rpm lynx-debuginfo-2.8.5-11.3.x86_64.rpm Red Hat Enterprise Linux ES version 3: Source: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/lynx-2.8.5-11.3.src.rpm i386: lynx-2.8.5-11.3.i386.rpm lynx-debuginfo-2.8.5-11.3.i386.rpm ia64: lynx-2.8.5-11.3.ia64.rpm lynx-debuginfo-2.8.5-11.3.ia64.rpm x86_64: lynx-2.8.5-11.3.x86_64.rpm lynx-debuginfo-2.8.5-11.3.x86_64.rpm Red Hat Enterprise Linux WS version 3: Source: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/lynx-2.8.5-11.3.src.rpm i386: lynx-2.8.5-11.3.i386.rpm lynx-debuginfo-2.8.5-11.3.i386.rpm ia64: lynx-2.8.5-11.3.ia64.rpm lynx-debuginfo-2.8.5-11.3.ia64.rpm x86_64: lynx-2.8.5-11.3.x86_64.rpm lynx-debuginfo-2.8.5-11.3.x86_64.rpm Red Hat Enterprise Linux AS version 4: Source: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/lynx-2.8.5-18.2.el4_7.1.src.rpm i386: lynx-2.8.5-18.2.el4_7.1.i386.rpm lynx-debuginfo-2.8.5-18.2.el4_7.1.i386.rpm ia64: lynx-2.8.5-18.2.el4_7.1.ia64.rpm lynx-debuginfo-2.8.5-18.2.el4_7.1.ia64.rpm ppc: lynx-2.8.5-18.2.el4_7.1.ppc.rpm lynx-debuginfo-2.8.5-18.2.el4_7.1.ppc.rpm s390: lynx-2.8.5-18.2.el4_7.1.s390.rpm lynx-debuginfo-2.8.5-18.2.el4_7.1.s390.rpm s390x: lynx-2.8.5-18.2.el4_7.1.s390x.rpm lynx-debuginfo-2.8.5-18.2.el4_7.1.s390x.rpm x86_64: lynx-2.8.5-18.2.el4_7.1.x86_64.rpm lynx-debuginfo-2.8.5-18.2.el4_7.1.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: Source: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/lynx-2.8.5-18.2.el4_7.1.src.rpm i386: lynx-2.8.5-18.2.el4_7.1.i386.rpm lynx-debuginfo-2.8.5-18.2.el4_7.1.i386.rpm x86_64: lynx-2.8.5-18.2.el4_7.1.x86_64.rpm lynx-debuginfo-2.8.5-18.2.el4_7.1.x86_64.rpm Red Hat Enterprise Linux ES version 4: Source: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/lynx-2.8.5-18.2.el4_7.1.src.rpm i386: lynx-2.8.5-18.2.el4_7.1.i386.rpm lynx-debuginfo-2.8.5-18.2.el4_7.1.i386.rpm ia64: lynx-2.8.5-18.2.el4_7.1.ia64.rpm lynx-debuginfo-2.8.5-18.2.el4_7.1.ia64.rpm x86_64: lynx-2.8.5-18.2.el4_7.1.x86_64.rpm lynx-debuginfo-2.8.5-18.2.el4_7.1.x86_64.rpm Red Hat Enterprise Linux WS version 4: Source: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/lynx-2.8.5-18.2.el4_7.1.src.rpm i386: lynx-2.8.5-18.2.el4_7.1.i386.rpm lynx-debuginfo-2.8.5-18.2.el4_7.1.i386.rpm ia64: lynx-2.8.5-18.2.el4_7.1.ia64.rpm lynx-debuginfo-2.8.5-18.2.el4_7.1.ia64.rpm x86_64: lynx-2.8.5-18.2.el4_7.1.x86_64.rpm lynx-debuginfo-2.8.5-18.2.el4_7.1.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/lynx-2.8.5-28.1.el5_2.1.src.rpm i386: lynx-2.8.5-28.1.el5_2.1.i386.rpm lynx-debuginfo-2.8.5-28.1.el5_2.1.i386.rpm x86_64: lynx-2.8.5-28.1.el5_2.1.x86_64.rpm lynx-debuginfo-2.8.5-28.1.el5_2.1.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/lynx-2.8.5-28.1.el5_2.1.src.rpm i386: lynx-2.8.5-28.1.el5_2.1.i386.rpm lynx-debuginfo-2.8.5-28.1.el5_2.1.i386.rpm ia64: lynx-2.8.5-28.1.el5_2.1.ia64.rpm lynx-debuginfo-2.8.5-28.1.el5_2.1.ia64.rpm ppc: lynx-2.8.5-28.1.el5_2.1.ppc.rpm lynx-debuginfo-2.8.5-28.1.el5_2.1.ppc.rpm s390x: lynx-2.8.5-28.1.el5_2.1.s390x.rpm lynx-debuginfo-2.8.5-28.1.el5_2.1.s390x.rpm x86_64: lynx-2.8.5-28.1.el5_2.1.x86_64.rpm lynx-debuginfo-2.8.5-28.1.el5_2.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4690 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7234 http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFJBfcrXlSAg2UNWIIRAufQAKCRhP/uxRa7PihwJ4hLe719B9FCcQCgt27E pVzCY2+MlVjopXLt+zwX/aw= =Tsds -----END PGP SIGNATURE----- From bugzilla at redhat.com Tue Oct 28 14:42:50 2008 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Tue, 28 Oct 2008 10:42:50 -0400 Subject: [RHSA-2008:0945-01] Important: flash-plugin security update Message-ID: <200810281442.m9SEgofh020701@int-mx1.corp.redhat.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: flash-plugin security update Advisory ID: RHSA-2008:0945-01 Product: Red Hat Enterprise Linux Extras Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0945.html Issue date: 2008-10-28 CVE Names: CVE-2007-4324 CVE-2007-6243 CVE-2008-3873 CVE-2008-4401 CVE-2008-4503 ===================================================================== 1. Summary: An updated Adobe Flash Player package that fixes several security issues is now available for Red Hat Enterprise Linux 5 Supplementary. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: RHEL Desktop Supplementary (v. 5 client) - i386, x86_64 RHEL Supplementary (v. 5 server) - i386, x86_64 3. Description: The flash-plugin package contains a Firefox-compatible Adobe Flash Player Web browser plug-in. A flaw was found in the way Adobe Flash Player wrote content to the clipboard. A malicious SWF file could populate the clipboard with a URL that could cause the user to mistakenly load an attacker-controlled URL. (CVE-2008-3873) A flaw was found which allowed Adobe Flash Player's ActionScript to initiate file uploads and downloads without user interaction. FileReference.browse and FileReference.download calls can now only be initiated via user interaction, such as mouse-clicks or key-presses on the keyboard. (CVE-2008-4401) A flaw was found in Adobe Flash Player's display of the Settings Manager content. A malicious SWF file could trick the user into unknowingly clicking a link or dialog. This could then give the malicious SWF file permission to access the local machine's camera or microphone. (CVE-2008-4503) Flaws were found in the way Flash Player restricted the interpretation and usage of cross-domain policy files. A remote attacker could use Flash Player to conduct cross-domain and cross-site scripting attacks (CVE-2007-4324, CVE-2007-6243). This update provides enhanced fixes for these issues. Adobe Flash Player 10 also includes bug fixes and feature enhancements including: * improved stability on the Linux platform by fixing a race condition issue in sound output. * new support for custom filters and effects, native 3D transformation and animation, advanced audio processing, a new, more flexible text engine, and GPU hardware acceleration. For more information on new features and enhancements, see the Adobe Flash Player site and the Adobe Labs Release Notes. Note: some users may have installed a 3rd-party component, libflashsupport, for older versions of Flash Player. Adobe Flash Player 10 no longer supports libflashsupport. Users are advised to remove libflashsupport if they have it installed. All users of Adobe Flash Player should upgrade to this updated package, which contains Flash Player version 10.0.12.36. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 252292 - CVE-2007-4324 Flash movie can determine whether a TCP port is open 440664 - CVE-2007-6243 Flash Player cross-domain and cross-site scripting flaws 465736 - CVE-2008-3873 flash: clipboard hijack attack 466154 - CVE-2008-4401 flash-plugin: upload/download user interaction 466344 - CVE-2008-4503 Adobe Flash Player clickjacking 6. Package List: RHEL Desktop Supplementary (v. 5 client): i386: flash-plugin-10.0.12.36-2.el5.i386.rpm x86_64: flash-plugin-10.0.12.36-2.el5.i386.rpm RHEL Supplementary (v. 5 server): i386: flash-plugin-10.0.12.36-2.el5.i386.rpm x86_64: flash-plugin-10.0.12.36-2.el5.i386.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4324 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6243 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3873 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4401 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4503 http://adobe.com/products/flashplayer http://labs.adobe.com/technologies/flashplayer10/releasenotes.html http://www.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFJByTSXlSAg2UNWIIRAlItAJ9aqlQwNSicgNI0KgBR5fPmR4m0QgCeJ55O pa+gqJ3/Zs4KSEos+BKUnEw= =2xVI -----END PGP SIGNATURE-----