From bugzilla at redhat.com  Thu Jul  2 15:25:45 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Thu, 2 Jul 2009 11:25:45 -0400
Subject: [RHSA-2009:1138-01] Important: openswan security update
Message-ID: <200907021525.n62FPjDe029207@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: openswan security update
Advisory ID:       RHSA-2009:1138-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1138.html
Issue date:        2009-07-02
CVE Names:         CVE-2009-2185 
=====================================================================

1. Summary:

Updated openswan packages that fix multiple security issues are now
available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Description:

Openswan is a free implementation of Internet Protocol Security (IPsec)
and Internet Key Exchange (IKE). IPsec uses strong cryptography to provide
both authentication and encryption services. These services allow you to
build secure tunnels through untrusted networks. Everything passing through
the untrusted network is encrypted by the IPsec gateway machine, and
decrypted by the gateway at the other end of the tunnel. The resulting
tunnel is a virtual private network (VPN).

Multiple insufficient input validation flaws were found in the way
Openswan's pluto IKE daemon processed some fields of X.509 certificates. A
remote attacker could provide a specially-crafted X.509 certificate that
would crash the pluto daemon. (CVE-2009-2185)

All users of openswan are advised to upgrade to these updated packages,
which contain a backported patch to correct these issues. After installing
this update, the ipsec service will be restarted automatically.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

507362 - CVE-2009-2185 Openswan ASN.1 parser vulnerability

6. Package List:

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/openswan-2.6.14-1.el5_3.3.src.rpm

i386:
openswan-2.6.14-1.el5_3.3.i386.rpm
openswan-debuginfo-2.6.14-1.el5_3.3.i386.rpm
openswan-doc-2.6.14-1.el5_3.3.i386.rpm

x86_64:
openswan-2.6.14-1.el5_3.3.x86_64.rpm
openswan-debuginfo-2.6.14-1.el5_3.3.x86_64.rpm
openswan-doc-2.6.14-1.el5_3.3.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/openswan-2.6.14-1.el5_3.3.src.rpm

i386:
openswan-2.6.14-1.el5_3.3.i386.rpm
openswan-debuginfo-2.6.14-1.el5_3.3.i386.rpm
openswan-doc-2.6.14-1.el5_3.3.i386.rpm

ia64:
openswan-2.6.14-1.el5_3.3.ia64.rpm
openswan-debuginfo-2.6.14-1.el5_3.3.ia64.rpm
openswan-doc-2.6.14-1.el5_3.3.ia64.rpm

ppc:
openswan-2.6.14-1.el5_3.3.ppc.rpm
openswan-debuginfo-2.6.14-1.el5_3.3.ppc.rpm
openswan-doc-2.6.14-1.el5_3.3.ppc.rpm

s390x:
openswan-2.6.14-1.el5_3.3.s390x.rpm
openswan-debuginfo-2.6.14-1.el5_3.3.s390x.rpm
openswan-doc-2.6.14-1.el5_3.3.s390x.rpm

x86_64:
openswan-2.6.14-1.el5_3.3.x86_64.rpm
openswan-debuginfo-2.6.14-1.el5_3.3.x86_64.rpm
openswan-doc-2.6.14-1.el5_3.3.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2185
http://www.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKTNFnXlSAg2UNWIIRAugsAJ4yaxSTRGdgKqPWiqhYXrOwugw5lACfblkL
8Sb2/1P4b1TJZXDNJGwb76I=
=8sMZ
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Thu Jul  2 15:26:31 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Thu, 2 Jul 2009 11:26:31 -0400
Subject: [RHSA-2009:1139-01] Moderate: pidgin security and bug fix update
Message-ID: <200907021526.n62FQV4Q030108@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: pidgin security and bug fix update
Advisory ID:       RHSA-2009:1139-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1139.html
Issue date:        2009-07-02
CVE Names:         CVE-2009-1889 
=====================================================================

1. Summary:

Updated pidgin packages that fix one security issue and one bug are now
available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64

3. Description:

Pidgin is an instant messaging program which can log in to multiple
accounts on multiple instant messaging networks simultaneously. The AOL
Open System for CommunicAtion in Realtime (OSCAR) protocol is used by the
AOL ICQ and AIM instant messaging systems.

A denial of service flaw was found in the Pidgin OSCAR protocol
implementation. If a remote ICQ user sent a web message to a local Pidgin
user using this protocol, it would cause excessive memory usage, leading to
a denial of service (Pidgin crash). (CVE-2009-1889)

These updated packages also fix the following bug:

* the Yahoo! Messenger Protocol changed, making it incompatible (and
unusable) with Pidgin versions prior to 2.5.7. This update provides Pidgin
2.5.8, which implements version 16 of the Yahoo! Messenger Protocol, which
resolves this issue.

Note: These packages upgrade Pidgin to version 2.5.8. Refer to the Pidgin
release notes for a full list of changes:
http://developer.pidgin.im/wiki/ChangeLog

All Pidgin users should upgrade to these updated packages, which correct
these issues. Pidgin must be restarted for this update to take effect.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

508271 - pidgin Yahoo protocol 16 [rhel-4.8.z]
508272 - pidgin Yahoo protocol 16 [rhel-5.3.z]
508738 - CVE-2009-1889 pidgin: DoS via specially-crafted ICQWebMessage

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/pidgin-2.5.8-1.el4.src.rpm

i386:
finch-2.5.8-1.el4.i386.rpm
finch-devel-2.5.8-1.el4.i386.rpm
libpurple-2.5.8-1.el4.i386.rpm
libpurple-devel-2.5.8-1.el4.i386.rpm
libpurple-perl-2.5.8-1.el4.i386.rpm
libpurple-tcl-2.5.8-1.el4.i386.rpm
pidgin-2.5.8-1.el4.i386.rpm
pidgin-debuginfo-2.5.8-1.el4.i386.rpm
pidgin-devel-2.5.8-1.el4.i386.rpm
pidgin-perl-2.5.8-1.el4.i386.rpm

ia64:
finch-2.5.8-1.el4.ia64.rpm
finch-devel-2.5.8-1.el4.ia64.rpm
libpurple-2.5.8-1.el4.ia64.rpm
libpurple-devel-2.5.8-1.el4.ia64.rpm
libpurple-perl-2.5.8-1.el4.ia64.rpm
libpurple-tcl-2.5.8-1.el4.ia64.rpm
pidgin-2.5.8-1.el4.ia64.rpm
pidgin-debuginfo-2.5.8-1.el4.ia64.rpm
pidgin-devel-2.5.8-1.el4.ia64.rpm
pidgin-perl-2.5.8-1.el4.ia64.rpm

ppc:
finch-2.5.8-1.el4.ppc.rpm
finch-devel-2.5.8-1.el4.ppc.rpm
libpurple-2.5.8-1.el4.ppc.rpm
libpurple-devel-2.5.8-1.el4.ppc.rpm
libpurple-perl-2.5.8-1.el4.ppc.rpm
libpurple-tcl-2.5.8-1.el4.ppc.rpm
pidgin-2.5.8-1.el4.ppc.rpm
pidgin-debuginfo-2.5.8-1.el4.ppc.rpm
pidgin-devel-2.5.8-1.el4.ppc.rpm
pidgin-perl-2.5.8-1.el4.ppc.rpm

x86_64:
finch-2.5.8-1.el4.x86_64.rpm
finch-devel-2.5.8-1.el4.x86_64.rpm
libpurple-2.5.8-1.el4.x86_64.rpm
libpurple-devel-2.5.8-1.el4.x86_64.rpm
libpurple-perl-2.5.8-1.el4.x86_64.rpm
libpurple-tcl-2.5.8-1.el4.x86_64.rpm
pidgin-2.5.8-1.el4.x86_64.rpm
pidgin-debuginfo-2.5.8-1.el4.x86_64.rpm
pidgin-devel-2.5.8-1.el4.x86_64.rpm
pidgin-perl-2.5.8-1.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/pidgin-2.5.8-1.el4.src.rpm

i386:
finch-2.5.8-1.el4.i386.rpm
finch-devel-2.5.8-1.el4.i386.rpm
libpurple-2.5.8-1.el4.i386.rpm
libpurple-devel-2.5.8-1.el4.i386.rpm
libpurple-perl-2.5.8-1.el4.i386.rpm
libpurple-tcl-2.5.8-1.el4.i386.rpm
pidgin-2.5.8-1.el4.i386.rpm
pidgin-debuginfo-2.5.8-1.el4.i386.rpm
pidgin-devel-2.5.8-1.el4.i386.rpm
pidgin-perl-2.5.8-1.el4.i386.rpm

x86_64:
finch-2.5.8-1.el4.x86_64.rpm
finch-devel-2.5.8-1.el4.x86_64.rpm
libpurple-2.5.8-1.el4.x86_64.rpm
libpurple-devel-2.5.8-1.el4.x86_64.rpm
libpurple-perl-2.5.8-1.el4.x86_64.rpm
libpurple-tcl-2.5.8-1.el4.x86_64.rpm
pidgin-2.5.8-1.el4.x86_64.rpm
pidgin-debuginfo-2.5.8-1.el4.x86_64.rpm
pidgin-devel-2.5.8-1.el4.x86_64.rpm
pidgin-perl-2.5.8-1.el4.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/pidgin-2.5.8-1.el4.src.rpm

i386:
finch-2.5.8-1.el4.i386.rpm
finch-devel-2.5.8-1.el4.i386.rpm
libpurple-2.5.8-1.el4.i386.rpm
libpurple-devel-2.5.8-1.el4.i386.rpm
libpurple-perl-2.5.8-1.el4.i386.rpm
libpurple-tcl-2.5.8-1.el4.i386.rpm
pidgin-2.5.8-1.el4.i386.rpm
pidgin-debuginfo-2.5.8-1.el4.i386.rpm
pidgin-devel-2.5.8-1.el4.i386.rpm
pidgin-perl-2.5.8-1.el4.i386.rpm

ia64:
finch-2.5.8-1.el4.ia64.rpm
finch-devel-2.5.8-1.el4.ia64.rpm
libpurple-2.5.8-1.el4.ia64.rpm
libpurple-devel-2.5.8-1.el4.ia64.rpm
libpurple-perl-2.5.8-1.el4.ia64.rpm
libpurple-tcl-2.5.8-1.el4.ia64.rpm
pidgin-2.5.8-1.el4.ia64.rpm
pidgin-debuginfo-2.5.8-1.el4.ia64.rpm
pidgin-devel-2.5.8-1.el4.ia64.rpm
pidgin-perl-2.5.8-1.el4.ia64.rpm

x86_64:
finch-2.5.8-1.el4.x86_64.rpm
finch-devel-2.5.8-1.el4.x86_64.rpm
libpurple-2.5.8-1.el4.x86_64.rpm
libpurple-devel-2.5.8-1.el4.x86_64.rpm
libpurple-perl-2.5.8-1.el4.x86_64.rpm
libpurple-tcl-2.5.8-1.el4.x86_64.rpm
pidgin-2.5.8-1.el4.x86_64.rpm
pidgin-debuginfo-2.5.8-1.el4.x86_64.rpm
pidgin-devel-2.5.8-1.el4.x86_64.rpm
pidgin-perl-2.5.8-1.el4.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/pidgin-2.5.8-1.el4.src.rpm

i386:
finch-2.5.8-1.el4.i386.rpm
finch-devel-2.5.8-1.el4.i386.rpm
libpurple-2.5.8-1.el4.i386.rpm
libpurple-devel-2.5.8-1.el4.i386.rpm
libpurple-perl-2.5.8-1.el4.i386.rpm
libpurple-tcl-2.5.8-1.el4.i386.rpm
pidgin-2.5.8-1.el4.i386.rpm
pidgin-debuginfo-2.5.8-1.el4.i386.rpm
pidgin-devel-2.5.8-1.el4.i386.rpm
pidgin-perl-2.5.8-1.el4.i386.rpm

ia64:
finch-2.5.8-1.el4.ia64.rpm
finch-devel-2.5.8-1.el4.ia64.rpm
libpurple-2.5.8-1.el4.ia64.rpm
libpurple-devel-2.5.8-1.el4.ia64.rpm
libpurple-perl-2.5.8-1.el4.ia64.rpm
libpurple-tcl-2.5.8-1.el4.ia64.rpm
pidgin-2.5.8-1.el4.ia64.rpm
pidgin-debuginfo-2.5.8-1.el4.ia64.rpm
pidgin-devel-2.5.8-1.el4.ia64.rpm
pidgin-perl-2.5.8-1.el4.ia64.rpm

x86_64:
finch-2.5.8-1.el4.x86_64.rpm
finch-devel-2.5.8-1.el4.x86_64.rpm
libpurple-2.5.8-1.el4.x86_64.rpm
libpurple-devel-2.5.8-1.el4.x86_64.rpm
libpurple-perl-2.5.8-1.el4.x86_64.rpm
libpurple-tcl-2.5.8-1.el4.x86_64.rpm
pidgin-2.5.8-1.el4.x86_64.rpm
pidgin-debuginfo-2.5.8-1.el4.x86_64.rpm
pidgin-devel-2.5.8-1.el4.x86_64.rpm
pidgin-perl-2.5.8-1.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pidgin-2.5.8-1.el5.src.rpm

i386:
finch-2.5.8-1.el5.i386.rpm
libpurple-2.5.8-1.el5.i386.rpm
libpurple-perl-2.5.8-1.el5.i386.rpm
libpurple-tcl-2.5.8-1.el5.i386.rpm
pidgin-2.5.8-1.el5.i386.rpm
pidgin-debuginfo-2.5.8-1.el5.i386.rpm
pidgin-perl-2.5.8-1.el5.i386.rpm

x86_64:
finch-2.5.8-1.el5.i386.rpm
finch-2.5.8-1.el5.x86_64.rpm
libpurple-2.5.8-1.el5.i386.rpm
libpurple-2.5.8-1.el5.x86_64.rpm
libpurple-perl-2.5.8-1.el5.x86_64.rpm
libpurple-tcl-2.5.8-1.el5.x86_64.rpm
pidgin-2.5.8-1.el5.i386.rpm
pidgin-2.5.8-1.el5.x86_64.rpm
pidgin-debuginfo-2.5.8-1.el5.i386.rpm
pidgin-debuginfo-2.5.8-1.el5.x86_64.rpm
pidgin-perl-2.5.8-1.el5.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pidgin-2.5.8-1.el5.src.rpm

i386:
finch-devel-2.5.8-1.el5.i386.rpm
libpurple-devel-2.5.8-1.el5.i386.rpm
pidgin-debuginfo-2.5.8-1.el5.i386.rpm
pidgin-devel-2.5.8-1.el5.i386.rpm

x86_64:
finch-devel-2.5.8-1.el5.i386.rpm
finch-devel-2.5.8-1.el5.x86_64.rpm
libpurple-devel-2.5.8-1.el5.i386.rpm
libpurple-devel-2.5.8-1.el5.x86_64.rpm
pidgin-debuginfo-2.5.8-1.el5.i386.rpm
pidgin-debuginfo-2.5.8-1.el5.x86_64.rpm
pidgin-devel-2.5.8-1.el5.i386.rpm
pidgin-devel-2.5.8-1.el5.x86_64.rpm

RHEL Optional Productivity Applications (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/pidgin-2.5.8-1.el5.src.rpm

i386:
finch-2.5.8-1.el5.i386.rpm
finch-devel-2.5.8-1.el5.i386.rpm
libpurple-2.5.8-1.el5.i386.rpm
libpurple-devel-2.5.8-1.el5.i386.rpm
libpurple-perl-2.5.8-1.el5.i386.rpm
libpurple-tcl-2.5.8-1.el5.i386.rpm
pidgin-2.5.8-1.el5.i386.rpm
pidgin-debuginfo-2.5.8-1.el5.i386.rpm
pidgin-devel-2.5.8-1.el5.i386.rpm
pidgin-perl-2.5.8-1.el5.i386.rpm

x86_64:
finch-2.5.8-1.el5.i386.rpm
finch-2.5.8-1.el5.x86_64.rpm
finch-devel-2.5.8-1.el5.i386.rpm
finch-devel-2.5.8-1.el5.x86_64.rpm
libpurple-2.5.8-1.el5.i386.rpm
libpurple-2.5.8-1.el5.x86_64.rpm
libpurple-devel-2.5.8-1.el5.i386.rpm
libpurple-devel-2.5.8-1.el5.x86_64.rpm
libpurple-perl-2.5.8-1.el5.x86_64.rpm
libpurple-tcl-2.5.8-1.el5.x86_64.rpm
pidgin-2.5.8-1.el5.i386.rpm
pidgin-2.5.8-1.el5.x86_64.rpm
pidgin-debuginfo-2.5.8-1.el5.i386.rpm
pidgin-debuginfo-2.5.8-1.el5.x86_64.rpm
pidgin-devel-2.5.8-1.el5.i386.rpm
pidgin-devel-2.5.8-1.el5.x86_64.rpm
pidgin-perl-2.5.8-1.el5.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1889
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKTNF/XlSAg2UNWIIRAr8lAKCr/4odojtnNTEP/gqW9lDWfQjv5wCgkjsb
3ibMWjOdc4L9r3p2PHAGfFA=
=WHwQ
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Thu Jul  2 17:06:54 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Thu, 2 Jul 2009 13:06:54 -0400
Subject: [RHSA-2009:1140-02] Moderate: ruby security update
Message-ID: <200907021706.n62H6sWi026672@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: ruby security update
Advisory ID:       RHSA-2009:1140-02
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1140.html
Issue date:        2009-07-02
CVE Names:         CVE-2007-1558 CVE-2009-0642 CVE-2009-1904 
=====================================================================

1. Summary:

Updated ruby packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Description:

Ruby is an extensible, interpreted, object-oriented, scripting language. It
has features to process text files and to do system management tasks.

A flaw was found in the way the Ruby POP module processed certain APOP
authentication requests. By sending certain responses when the Ruby APOP
module attempted to authenticate using APOP against a POP server, a remote
attacker could, potentially, acquire certain portions of a user's
authentication credentials. (CVE-2007-1558)

It was discovered that Ruby did not properly check the return value when
verifying X.509 certificates. This could, potentially, allow a remote
attacker to present an invalid X.509 certificate, and have Ruby treat it as
valid. (CVE-2009-0642)

A flaw was found in the way Ruby converted BigDecimal objects to Float
numbers. If an attacker were able to provide certain input for the
BigDecimal object converter, they could crash an application using this
class. (CVE-2009-1904)

All Ruby users should upgrade to these updated packages, which contain
backported patches to resolve these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

241191 - CVE-2007-1558 fetchmail/mutt/evolution/...: APOP password disclosure vulnerability
486183 - CVE-2009-0642 ruby: Incorrect checks for validity of X.509 certificates
504958 - CVE-2009-1904 ruby: DoS vulnerability in BigDecimal

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/ruby-1.8.1-7.el4_8.3.src.rpm

i386:
irb-1.8.1-7.el4_8.3.i386.rpm
ruby-1.8.1-7.el4_8.3.i386.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.i386.rpm
ruby-devel-1.8.1-7.el4_8.3.i386.rpm
ruby-docs-1.8.1-7.el4_8.3.i386.rpm
ruby-libs-1.8.1-7.el4_8.3.i386.rpm
ruby-mode-1.8.1-7.el4_8.3.i386.rpm
ruby-tcltk-1.8.1-7.el4_8.3.i386.rpm

ia64:
irb-1.8.1-7.el4_8.3.ia64.rpm
ruby-1.8.1-7.el4_8.3.ia64.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.i386.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.ia64.rpm
ruby-devel-1.8.1-7.el4_8.3.ia64.rpm
ruby-docs-1.8.1-7.el4_8.3.ia64.rpm
ruby-libs-1.8.1-7.el4_8.3.i386.rpm
ruby-libs-1.8.1-7.el4_8.3.ia64.rpm
ruby-mode-1.8.1-7.el4_8.3.ia64.rpm
ruby-tcltk-1.8.1-7.el4_8.3.ia64.rpm

ppc:
irb-1.8.1-7.el4_8.3.ppc.rpm
ruby-1.8.1-7.el4_8.3.ppc.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.ppc.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.ppc64.rpm
ruby-devel-1.8.1-7.el4_8.3.ppc.rpm
ruby-docs-1.8.1-7.el4_8.3.ppc.rpm
ruby-libs-1.8.1-7.el4_8.3.ppc.rpm
ruby-libs-1.8.1-7.el4_8.3.ppc64.rpm
ruby-mode-1.8.1-7.el4_8.3.ppc.rpm
ruby-tcltk-1.8.1-7.el4_8.3.ppc.rpm

s390:
irb-1.8.1-7.el4_8.3.s390.rpm
ruby-1.8.1-7.el4_8.3.s390.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.s390.rpm
ruby-devel-1.8.1-7.el4_8.3.s390.rpm
ruby-docs-1.8.1-7.el4_8.3.s390.rpm
ruby-libs-1.8.1-7.el4_8.3.s390.rpm
ruby-mode-1.8.1-7.el4_8.3.s390.rpm
ruby-tcltk-1.8.1-7.el4_8.3.s390.rpm

s390x:
irb-1.8.1-7.el4_8.3.s390x.rpm
ruby-1.8.1-7.el4_8.3.s390x.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.s390.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.s390x.rpm
ruby-devel-1.8.1-7.el4_8.3.s390x.rpm
ruby-docs-1.8.1-7.el4_8.3.s390x.rpm
ruby-libs-1.8.1-7.el4_8.3.s390.rpm
ruby-libs-1.8.1-7.el4_8.3.s390x.rpm
ruby-mode-1.8.1-7.el4_8.3.s390x.rpm
ruby-tcltk-1.8.1-7.el4_8.3.s390x.rpm

x86_64:
irb-1.8.1-7.el4_8.3.x86_64.rpm
ruby-1.8.1-7.el4_8.3.x86_64.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.i386.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.x86_64.rpm
ruby-devel-1.8.1-7.el4_8.3.x86_64.rpm
ruby-docs-1.8.1-7.el4_8.3.x86_64.rpm
ruby-libs-1.8.1-7.el4_8.3.i386.rpm
ruby-libs-1.8.1-7.el4_8.3.x86_64.rpm
ruby-mode-1.8.1-7.el4_8.3.x86_64.rpm
ruby-tcltk-1.8.1-7.el4_8.3.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/ruby-1.8.1-7.el4_8.3.src.rpm

i386:
irb-1.8.1-7.el4_8.3.i386.rpm
ruby-1.8.1-7.el4_8.3.i386.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.i386.rpm
ruby-devel-1.8.1-7.el4_8.3.i386.rpm
ruby-docs-1.8.1-7.el4_8.3.i386.rpm
ruby-libs-1.8.1-7.el4_8.3.i386.rpm
ruby-mode-1.8.1-7.el4_8.3.i386.rpm
ruby-tcltk-1.8.1-7.el4_8.3.i386.rpm

x86_64:
irb-1.8.1-7.el4_8.3.x86_64.rpm
ruby-1.8.1-7.el4_8.3.x86_64.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.i386.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.x86_64.rpm
ruby-devel-1.8.1-7.el4_8.3.x86_64.rpm
ruby-docs-1.8.1-7.el4_8.3.x86_64.rpm
ruby-libs-1.8.1-7.el4_8.3.i386.rpm
ruby-libs-1.8.1-7.el4_8.3.x86_64.rpm
ruby-mode-1.8.1-7.el4_8.3.x86_64.rpm
ruby-tcltk-1.8.1-7.el4_8.3.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/ruby-1.8.1-7.el4_8.3.src.rpm

i386:
irb-1.8.1-7.el4_8.3.i386.rpm
ruby-1.8.1-7.el4_8.3.i386.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.i386.rpm
ruby-devel-1.8.1-7.el4_8.3.i386.rpm
ruby-docs-1.8.1-7.el4_8.3.i386.rpm
ruby-libs-1.8.1-7.el4_8.3.i386.rpm
ruby-mode-1.8.1-7.el4_8.3.i386.rpm
ruby-tcltk-1.8.1-7.el4_8.3.i386.rpm

ia64:
irb-1.8.1-7.el4_8.3.ia64.rpm
ruby-1.8.1-7.el4_8.3.ia64.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.i386.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.ia64.rpm
ruby-devel-1.8.1-7.el4_8.3.ia64.rpm
ruby-docs-1.8.1-7.el4_8.3.ia64.rpm
ruby-libs-1.8.1-7.el4_8.3.i386.rpm
ruby-libs-1.8.1-7.el4_8.3.ia64.rpm
ruby-mode-1.8.1-7.el4_8.3.ia64.rpm
ruby-tcltk-1.8.1-7.el4_8.3.ia64.rpm

x86_64:
irb-1.8.1-7.el4_8.3.x86_64.rpm
ruby-1.8.1-7.el4_8.3.x86_64.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.i386.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.x86_64.rpm
ruby-devel-1.8.1-7.el4_8.3.x86_64.rpm
ruby-docs-1.8.1-7.el4_8.3.x86_64.rpm
ruby-libs-1.8.1-7.el4_8.3.i386.rpm
ruby-libs-1.8.1-7.el4_8.3.x86_64.rpm
ruby-mode-1.8.1-7.el4_8.3.x86_64.rpm
ruby-tcltk-1.8.1-7.el4_8.3.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/ruby-1.8.1-7.el4_8.3.src.rpm

i386:
irb-1.8.1-7.el4_8.3.i386.rpm
ruby-1.8.1-7.el4_8.3.i386.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.i386.rpm
ruby-devel-1.8.1-7.el4_8.3.i386.rpm
ruby-docs-1.8.1-7.el4_8.3.i386.rpm
ruby-libs-1.8.1-7.el4_8.3.i386.rpm
ruby-mode-1.8.1-7.el4_8.3.i386.rpm
ruby-tcltk-1.8.1-7.el4_8.3.i386.rpm

ia64:
irb-1.8.1-7.el4_8.3.ia64.rpm
ruby-1.8.1-7.el4_8.3.ia64.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.i386.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.ia64.rpm
ruby-devel-1.8.1-7.el4_8.3.ia64.rpm
ruby-docs-1.8.1-7.el4_8.3.ia64.rpm
ruby-libs-1.8.1-7.el4_8.3.i386.rpm
ruby-libs-1.8.1-7.el4_8.3.ia64.rpm
ruby-mode-1.8.1-7.el4_8.3.ia64.rpm
ruby-tcltk-1.8.1-7.el4_8.3.ia64.rpm

x86_64:
irb-1.8.1-7.el4_8.3.x86_64.rpm
ruby-1.8.1-7.el4_8.3.x86_64.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.i386.rpm
ruby-debuginfo-1.8.1-7.el4_8.3.x86_64.rpm
ruby-devel-1.8.1-7.el4_8.3.x86_64.rpm
ruby-docs-1.8.1-7.el4_8.3.x86_64.rpm
ruby-libs-1.8.1-7.el4_8.3.i386.rpm
ruby-libs-1.8.1-7.el4_8.3.x86_64.rpm
ruby-mode-1.8.1-7.el4_8.3.x86_64.rpm
ruby-tcltk-1.8.1-7.el4_8.3.x86_64.rpm

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/ruby-1.8.5-5.el5_3.7.src.rpm

i386:
ruby-1.8.5-5.el5_3.7.i386.rpm
ruby-debuginfo-1.8.5-5.el5_3.7.i386.rpm
ruby-docs-1.8.5-5.el5_3.7.i386.rpm
ruby-irb-1.8.5-5.el5_3.7.i386.rpm
ruby-libs-1.8.5-5.el5_3.7.i386.rpm
ruby-rdoc-1.8.5-5.el5_3.7.i386.rpm
ruby-ri-1.8.5-5.el5_3.7.i386.rpm
ruby-tcltk-1.8.5-5.el5_3.7.i386.rpm

x86_64:
ruby-1.8.5-5.el5_3.7.x86_64.rpm
ruby-debuginfo-1.8.5-5.el5_3.7.i386.rpm
ruby-debuginfo-1.8.5-5.el5_3.7.x86_64.rpm
ruby-docs-1.8.5-5.el5_3.7.x86_64.rpm
ruby-irb-1.8.5-5.el5_3.7.x86_64.rpm
ruby-libs-1.8.5-5.el5_3.7.i386.rpm
ruby-libs-1.8.5-5.el5_3.7.x86_64.rpm
ruby-rdoc-1.8.5-5.el5_3.7.x86_64.rpm
ruby-ri-1.8.5-5.el5_3.7.x86_64.rpm
ruby-tcltk-1.8.5-5.el5_3.7.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/ruby-1.8.5-5.el5_3.7.src.rpm

i386:
ruby-debuginfo-1.8.5-5.el5_3.7.i386.rpm
ruby-devel-1.8.5-5.el5_3.7.i386.rpm
ruby-mode-1.8.5-5.el5_3.7.i386.rpm

x86_64:
ruby-debuginfo-1.8.5-5.el5_3.7.i386.rpm
ruby-debuginfo-1.8.5-5.el5_3.7.x86_64.rpm
ruby-devel-1.8.5-5.el5_3.7.i386.rpm
ruby-devel-1.8.5-5.el5_3.7.x86_64.rpm
ruby-mode-1.8.5-5.el5_3.7.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/ruby-1.8.5-5.el5_3.7.src.rpm

i386:
ruby-1.8.5-5.el5_3.7.i386.rpm
ruby-debuginfo-1.8.5-5.el5_3.7.i386.rpm
ruby-devel-1.8.5-5.el5_3.7.i386.rpm
ruby-docs-1.8.5-5.el5_3.7.i386.rpm
ruby-irb-1.8.5-5.el5_3.7.i386.rpm
ruby-libs-1.8.5-5.el5_3.7.i386.rpm
ruby-mode-1.8.5-5.el5_3.7.i386.rpm
ruby-rdoc-1.8.5-5.el5_3.7.i386.rpm
ruby-ri-1.8.5-5.el5_3.7.i386.rpm
ruby-tcltk-1.8.5-5.el5_3.7.i386.rpm

ia64:
ruby-1.8.5-5.el5_3.7.ia64.rpm
ruby-debuginfo-1.8.5-5.el5_3.7.ia64.rpm
ruby-devel-1.8.5-5.el5_3.7.ia64.rpm
ruby-docs-1.8.5-5.el5_3.7.ia64.rpm
ruby-irb-1.8.5-5.el5_3.7.ia64.rpm
ruby-libs-1.8.5-5.el5_3.7.ia64.rpm
ruby-mode-1.8.5-5.el5_3.7.ia64.rpm
ruby-rdoc-1.8.5-5.el5_3.7.ia64.rpm
ruby-ri-1.8.5-5.el5_3.7.ia64.rpm
ruby-tcltk-1.8.5-5.el5_3.7.ia64.rpm

ppc:
ruby-1.8.5-5.el5_3.7.ppc.rpm
ruby-debuginfo-1.8.5-5.el5_3.7.ppc.rpm
ruby-debuginfo-1.8.5-5.el5_3.7.ppc64.rpm
ruby-devel-1.8.5-5.el5_3.7.ppc.rpm
ruby-devel-1.8.5-5.el5_3.7.ppc64.rpm
ruby-docs-1.8.5-5.el5_3.7.ppc.rpm
ruby-irb-1.8.5-5.el5_3.7.ppc.rpm
ruby-libs-1.8.5-5.el5_3.7.ppc.rpm
ruby-libs-1.8.5-5.el5_3.7.ppc64.rpm
ruby-mode-1.8.5-5.el5_3.7.ppc.rpm
ruby-rdoc-1.8.5-5.el5_3.7.ppc.rpm
ruby-ri-1.8.5-5.el5_3.7.ppc.rpm
ruby-tcltk-1.8.5-5.el5_3.7.ppc.rpm

s390x:
ruby-1.8.5-5.el5_3.7.s390x.rpm
ruby-debuginfo-1.8.5-5.el5_3.7.s390.rpm
ruby-debuginfo-1.8.5-5.el5_3.7.s390x.rpm
ruby-devel-1.8.5-5.el5_3.7.s390.rpm
ruby-devel-1.8.5-5.el5_3.7.s390x.rpm
ruby-docs-1.8.5-5.el5_3.7.s390x.rpm
ruby-irb-1.8.5-5.el5_3.7.s390x.rpm
ruby-libs-1.8.5-5.el5_3.7.s390.rpm
ruby-libs-1.8.5-5.el5_3.7.s390x.rpm
ruby-mode-1.8.5-5.el5_3.7.s390x.rpm
ruby-rdoc-1.8.5-5.el5_3.7.s390x.rpm
ruby-ri-1.8.5-5.el5_3.7.s390x.rpm
ruby-tcltk-1.8.5-5.el5_3.7.s390x.rpm

x86_64:
ruby-1.8.5-5.el5_3.7.x86_64.rpm
ruby-debuginfo-1.8.5-5.el5_3.7.i386.rpm
ruby-debuginfo-1.8.5-5.el5_3.7.x86_64.rpm
ruby-devel-1.8.5-5.el5_3.7.i386.rpm
ruby-devel-1.8.5-5.el5_3.7.x86_64.rpm
ruby-docs-1.8.5-5.el5_3.7.x86_64.rpm
ruby-irb-1.8.5-5.el5_3.7.x86_64.rpm
ruby-libs-1.8.5-5.el5_3.7.i386.rpm
ruby-libs-1.8.5-5.el5_3.7.x86_64.rpm
ruby-mode-1.8.5-5.el5_3.7.x86_64.rpm
ruby-rdoc-1.8.5-5.el5_3.7.x86_64.rpm
ruby-ri-1.8.5-5.el5_3.7.x86_64.rpm
ruby-tcltk-1.8.5-5.el5_3.7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1558
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0642
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1904
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKTOjZXlSAg2UNWIIRApmfAJ4hL3LESrhpOWPHSuPPP0hHf04l/ACeP6Qk
xADthyb9rgzWXxu9Q39Sl/M=
=9kgV
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Thu Jul  9 16:20:14 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Thu, 9 Jul 2009 12:20:14 -0400
Subject: [RHSA-2009:1148-01] Important: httpd security update
Message-ID: <200907091620.n69GKOAx015922@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: httpd security update
Advisory ID:       RHSA-2009:1148-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1148.html
Issue date:        2009-07-09
CVE Names:         CVE-2009-1890 CVE-2009-1891 
=====================================================================

1. Summary:

Updated httpd packages that fix two security issues are now available for
Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Description:

The Apache HTTP Server is a popular Web server.

A denial of service flaw was found in the Apache mod_proxy module when it
was used as a reverse proxy. A remote attacker could use this flaw to force
a proxy process to consume large amounts of CPU time. (CVE-2009-1890)

A denial of service flaw was found in the Apache mod_deflate module. This
module continued to compress large files until compression was complete,
even if the network connection that requested the content was closed before
compression completed. This would cause mod_deflate to consume large
amounts of CPU if mod_deflate was enabled for a large file. (CVE-2009-1891)

All httpd users should upgrade to these updated packages, which contain
backported patches to correct these issues. After installing the updated
packages, the httpd daemon must be restarted for the update to take effect.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

509125 - CVE-2009-1891 httpd: possible temporary DoS (CPU consumption) in mod_deflate
509375 - CVE-2009-1890 httpd: mod_proxy reverse proxy DoS (infinite loop)

6. Package List:

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/httpd-2.2.3-22.el5_3.2.src.rpm

i386:
httpd-2.2.3-22.el5_3.2.i386.rpm
httpd-debuginfo-2.2.3-22.el5_3.2.i386.rpm
mod_ssl-2.2.3-22.el5_3.2.i386.rpm

x86_64:
httpd-2.2.3-22.el5_3.2.x86_64.rpm
httpd-debuginfo-2.2.3-22.el5_3.2.x86_64.rpm
mod_ssl-2.2.3-22.el5_3.2.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/httpd-2.2.3-22.el5_3.2.src.rpm

i386:
httpd-debuginfo-2.2.3-22.el5_3.2.i386.rpm
httpd-devel-2.2.3-22.el5_3.2.i386.rpm
httpd-manual-2.2.3-22.el5_3.2.i386.rpm

x86_64:
httpd-debuginfo-2.2.3-22.el5_3.2.i386.rpm
httpd-debuginfo-2.2.3-22.el5_3.2.x86_64.rpm
httpd-devel-2.2.3-22.el5_3.2.i386.rpm
httpd-devel-2.2.3-22.el5_3.2.x86_64.rpm
httpd-manual-2.2.3-22.el5_3.2.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/httpd-2.2.3-22.el5_3.2.src.rpm

i386:
httpd-2.2.3-22.el5_3.2.i386.rpm
httpd-debuginfo-2.2.3-22.el5_3.2.i386.rpm
httpd-devel-2.2.3-22.el5_3.2.i386.rpm
httpd-manual-2.2.3-22.el5_3.2.i386.rpm
mod_ssl-2.2.3-22.el5_3.2.i386.rpm

ia64:
httpd-2.2.3-22.el5_3.2.ia64.rpm
httpd-debuginfo-2.2.3-22.el5_3.2.ia64.rpm
httpd-devel-2.2.3-22.el5_3.2.ia64.rpm
httpd-manual-2.2.3-22.el5_3.2.ia64.rpm
mod_ssl-2.2.3-22.el5_3.2.ia64.rpm

ppc:
httpd-2.2.3-22.el5_3.2.ppc.rpm
httpd-debuginfo-2.2.3-22.el5_3.2.ppc.rpm
httpd-debuginfo-2.2.3-22.el5_3.2.ppc64.rpm
httpd-devel-2.2.3-22.el5_3.2.ppc.rpm
httpd-devel-2.2.3-22.el5_3.2.ppc64.rpm
httpd-manual-2.2.3-22.el5_3.2.ppc.rpm
mod_ssl-2.2.3-22.el5_3.2.ppc.rpm

s390x:
httpd-2.2.3-22.el5_3.2.s390x.rpm
httpd-debuginfo-2.2.3-22.el5_3.2.s390.rpm
httpd-debuginfo-2.2.3-22.el5_3.2.s390x.rpm
httpd-devel-2.2.3-22.el5_3.2.s390.rpm
httpd-devel-2.2.3-22.el5_3.2.s390x.rpm
httpd-manual-2.2.3-22.el5_3.2.s390x.rpm
mod_ssl-2.2.3-22.el5_3.2.s390x.rpm

x86_64:
httpd-2.2.3-22.el5_3.2.x86_64.rpm
httpd-debuginfo-2.2.3-22.el5_3.2.i386.rpm
httpd-debuginfo-2.2.3-22.el5_3.2.x86_64.rpm
httpd-devel-2.2.3-22.el5_3.2.i386.rpm
httpd-devel-2.2.3-22.el5_3.2.x86_64.rpm
httpd-manual-2.2.3-22.el5_3.2.x86_64.rpm
mod_ssl-2.2.3-22.el5_3.2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1890
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1891
http://www.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKVhiwXlSAg2UNWIIRAqTKAKCM+sFsdxe/rwAve62R9s3CFsFCLQCeKxC9
81T66r1YlzywFo5JLoQYPb8=
=jmRJ
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Tue Jul 14 19:48:02 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Tue, 14 Jul 2009 15:48:02 -0400
Subject: [RHSA-2009:1136-01] Critical: dhcp security update
Message-ID: <200907141948.n6EJm2xc014431@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: dhcp security update
Advisory ID:       RHSA-2009:1136-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1136.html
Issue date:        2009-07-14
CVE Names:         CVE-2009-0692 
=====================================================================

1. Summary:

Updated dhcp packages that fix a security issue are now available for Red
Hat Enterprise Linux 4 and 4.7 Extended Update Support.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux AS version 4.7.z - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux ES version 4.7.z - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Description:

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows
individual devices on an IP network to get their own network configuration
information, including an IP address, a subnet mask, and a broadcast
address.

The Mandriva Linux Engineering Team discovered a stack-based buffer
overflow flaw in the ISC DHCP client. If the DHCP client were to receive a
malicious DHCP response, it could crash or execute arbitrary code with the
permissions of the client (root). (CVE-2009-0692)

Users of DHCP should upgrade to these updated packages, which contain a
backported patch to correct this issue.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

507717 - CVE-2009-0692 dhclient: stack overflow leads to arbitrary code execution as root

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/dhcp-3.0.1-65.el4_8.1.src.rpm

i386:
dhclient-3.0.1-65.el4_8.1.i386.rpm
dhcp-3.0.1-65.el4_8.1.i386.rpm
dhcp-debuginfo-3.0.1-65.el4_8.1.i386.rpm
dhcp-devel-3.0.1-65.el4_8.1.i386.rpm

ia64:
dhclient-3.0.1-65.el4_8.1.ia64.rpm
dhcp-3.0.1-65.el4_8.1.ia64.rpm
dhcp-debuginfo-3.0.1-65.el4_8.1.ia64.rpm
dhcp-devel-3.0.1-65.el4_8.1.ia64.rpm

ppc:
dhclient-3.0.1-65.el4_8.1.ppc.rpm
dhcp-3.0.1-65.el4_8.1.ppc.rpm
dhcp-debuginfo-3.0.1-65.el4_8.1.ppc.rpm
dhcp-devel-3.0.1-65.el4_8.1.ppc.rpm

s390:
dhclient-3.0.1-65.el4_8.1.s390.rpm
dhcp-3.0.1-65.el4_8.1.s390.rpm
dhcp-debuginfo-3.0.1-65.el4_8.1.s390.rpm
dhcp-devel-3.0.1-65.el4_8.1.s390.rpm

s390x:
dhclient-3.0.1-65.el4_8.1.s390x.rpm
dhcp-3.0.1-65.el4_8.1.s390x.rpm
dhcp-debuginfo-3.0.1-65.el4_8.1.s390x.rpm
dhcp-devel-3.0.1-65.el4_8.1.s390x.rpm

x86_64:
dhclient-3.0.1-65.el4_8.1.x86_64.rpm
dhcp-3.0.1-65.el4_8.1.x86_64.rpm
dhcp-debuginfo-3.0.1-65.el4_8.1.x86_64.rpm
dhcp-devel-3.0.1-65.el4_8.1.x86_64.rpm

Red Hat Enterprise Linux AS version 4.7.z:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/dhcp-3.0.1-62.el4_7.1.src.rpm

i386:
dhclient-3.0.1-62.el4_7.1.i386.rpm
dhcp-3.0.1-62.el4_7.1.i386.rpm
dhcp-debuginfo-3.0.1-62.el4_7.1.i386.rpm
dhcp-devel-3.0.1-62.el4_7.1.i386.rpm

ia64:
dhclient-3.0.1-62.el4_7.1.ia64.rpm
dhcp-3.0.1-62.el4_7.1.ia64.rpm
dhcp-debuginfo-3.0.1-62.el4_7.1.ia64.rpm
dhcp-devel-3.0.1-62.el4_7.1.ia64.rpm

ppc:
dhclient-3.0.1-62.el4_7.1.ppc.rpm
dhcp-3.0.1-62.el4_7.1.ppc.rpm
dhcp-debuginfo-3.0.1-62.el4_7.1.ppc.rpm
dhcp-devel-3.0.1-62.el4_7.1.ppc.rpm

s390:
dhclient-3.0.1-62.el4_7.1.s390.rpm
dhcp-3.0.1-62.el4_7.1.s390.rpm
dhcp-debuginfo-3.0.1-62.el4_7.1.s390.rpm
dhcp-devel-3.0.1-62.el4_7.1.s390.rpm

s390x:
dhclient-3.0.1-62.el4_7.1.s390x.rpm
dhcp-3.0.1-62.el4_7.1.s390x.rpm
dhcp-debuginfo-3.0.1-62.el4_7.1.s390x.rpm
dhcp-devel-3.0.1-62.el4_7.1.s390x.rpm

x86_64:
dhclient-3.0.1-62.el4_7.1.x86_64.rpm
dhcp-3.0.1-62.el4_7.1.x86_64.rpm
dhcp-debuginfo-3.0.1-62.el4_7.1.x86_64.rpm
dhcp-devel-3.0.1-62.el4_7.1.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/dhcp-3.0.1-65.el4_8.1.src.rpm

i386:
dhclient-3.0.1-65.el4_8.1.i386.rpm
dhcp-3.0.1-65.el4_8.1.i386.rpm
dhcp-debuginfo-3.0.1-65.el4_8.1.i386.rpm
dhcp-devel-3.0.1-65.el4_8.1.i386.rpm

x86_64:
dhclient-3.0.1-65.el4_8.1.x86_64.rpm
dhcp-3.0.1-65.el4_8.1.x86_64.rpm
dhcp-debuginfo-3.0.1-65.el4_8.1.x86_64.rpm
dhcp-devel-3.0.1-65.el4_8.1.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/dhcp-3.0.1-65.el4_8.1.src.rpm

i386:
dhclient-3.0.1-65.el4_8.1.i386.rpm
dhcp-3.0.1-65.el4_8.1.i386.rpm
dhcp-debuginfo-3.0.1-65.el4_8.1.i386.rpm
dhcp-devel-3.0.1-65.el4_8.1.i386.rpm

ia64:
dhclient-3.0.1-65.el4_8.1.ia64.rpm
dhcp-3.0.1-65.el4_8.1.ia64.rpm
dhcp-debuginfo-3.0.1-65.el4_8.1.ia64.rpm
dhcp-devel-3.0.1-65.el4_8.1.ia64.rpm

x86_64:
dhclient-3.0.1-65.el4_8.1.x86_64.rpm
dhcp-3.0.1-65.el4_8.1.x86_64.rpm
dhcp-debuginfo-3.0.1-65.el4_8.1.x86_64.rpm
dhcp-devel-3.0.1-65.el4_8.1.x86_64.rpm

Red Hat Enterprise Linux ES version 4.7.z:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/dhcp-3.0.1-62.el4_7.1.src.rpm

i386:
dhclient-3.0.1-62.el4_7.1.i386.rpm
dhcp-3.0.1-62.el4_7.1.i386.rpm
dhcp-debuginfo-3.0.1-62.el4_7.1.i386.rpm
dhcp-devel-3.0.1-62.el4_7.1.i386.rpm

ia64:
dhclient-3.0.1-62.el4_7.1.ia64.rpm
dhcp-3.0.1-62.el4_7.1.ia64.rpm
dhcp-debuginfo-3.0.1-62.el4_7.1.ia64.rpm
dhcp-devel-3.0.1-62.el4_7.1.ia64.rpm

x86_64:
dhclient-3.0.1-62.el4_7.1.x86_64.rpm
dhcp-3.0.1-62.el4_7.1.x86_64.rpm
dhcp-debuginfo-3.0.1-62.el4_7.1.x86_64.rpm
dhcp-devel-3.0.1-62.el4_7.1.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/dhcp-3.0.1-65.el4_8.1.src.rpm

i386:
dhclient-3.0.1-65.el4_8.1.i386.rpm
dhcp-3.0.1-65.el4_8.1.i386.rpm
dhcp-debuginfo-3.0.1-65.el4_8.1.i386.rpm
dhcp-devel-3.0.1-65.el4_8.1.i386.rpm

ia64:
dhclient-3.0.1-65.el4_8.1.ia64.rpm
dhcp-3.0.1-65.el4_8.1.ia64.rpm
dhcp-debuginfo-3.0.1-65.el4_8.1.ia64.rpm
dhcp-devel-3.0.1-65.el4_8.1.ia64.rpm

x86_64:
dhclient-3.0.1-65.el4_8.1.x86_64.rpm
dhcp-3.0.1-65.el4_8.1.x86_64.rpm
dhcp-debuginfo-3.0.1-65.el4_8.1.x86_64.rpm
dhcp-devel-3.0.1-65.el4_8.1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0692
http://www.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKXODbXlSAg2UNWIIRArP8AJ42wpZQSvLhJ46S9js3F6egJb+8awCfcRir
qlNZwvaUJ9oq2oXwJZDBRN0=
=dPjm
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Tue Jul 14 19:48:14 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Tue, 14 Jul 2009 15:48:14 -0400
Subject: [RHSA-2009:1154-02] Critical: dhcp security update
Message-ID: <200907141948.n6EJmExs014545@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: dhcp security update
Advisory ID:       RHSA-2009:1154-02
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1154.html
Issue date:        2009-07-14
CVE Names:         CVE-2009-0692 CVE-2009-1893 
=====================================================================

1. Summary:

Updated dhcp packages that fix two security issues are now available for
Red Hat Enterprise Linux 3.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

3. Description:

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows
individual devices on an IP network to get their own network configuration
information, including an IP address, a subnet mask, and a broadcast
address.

The Mandriva Linux Engineering Team discovered a stack-based buffer
overflow flaw in the ISC DHCP client. If the DHCP client were to receive a
malicious DHCP response, it could crash or execute arbitrary code with the
permissions of the client (root). (CVE-2009-0692)

An insecure temporary file use flaw was discovered in the DHCP daemon's
init script ("/etc/init.d/dhcpd"). A local attacker could use this flaw to
overwrite an arbitrary file with the output of the "dhcpd -t" command via
a symbolic link attack, if a system administrator executed the DHCP init
script with the "configtest", "restart", or "reload" option.
(CVE-2009-1893)

Users of DHCP should upgrade to these updated packages, which contain
backported patches to correct these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

507717 - CVE-2009-0692 dhclient: stack overflow leads to arbitrary code execution as root
510024 - CVE-2009-1893 dhcp: insecure temporary file use in the dhcpd init script

6. Package List:

Red Hat Enterprise Linux AS version 3:

Source:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/dhcp-3.0.1-10.2_EL3.src.rpm

i386:
dhclient-3.0.1-10.2_EL3.i386.rpm
dhcp-3.0.1-10.2_EL3.i386.rpm
dhcp-debuginfo-3.0.1-10.2_EL3.i386.rpm
dhcp-devel-3.0.1-10.2_EL3.i386.rpm

ia64:
dhclient-3.0.1-10.2_EL3.ia64.rpm
dhcp-3.0.1-10.2_EL3.ia64.rpm
dhcp-debuginfo-3.0.1-10.2_EL3.ia64.rpm
dhcp-devel-3.0.1-10.2_EL3.ia64.rpm

ppc:
dhclient-3.0.1-10.2_EL3.ppc.rpm
dhcp-3.0.1-10.2_EL3.ppc.rpm
dhcp-debuginfo-3.0.1-10.2_EL3.ppc.rpm
dhcp-devel-3.0.1-10.2_EL3.ppc.rpm

s390:
dhclient-3.0.1-10.2_EL3.s390.rpm
dhcp-3.0.1-10.2_EL3.s390.rpm
dhcp-debuginfo-3.0.1-10.2_EL3.s390.rpm
dhcp-devel-3.0.1-10.2_EL3.s390.rpm

s390x:
dhclient-3.0.1-10.2_EL3.s390x.rpm
dhcp-3.0.1-10.2_EL3.s390x.rpm
dhcp-debuginfo-3.0.1-10.2_EL3.s390x.rpm
dhcp-devel-3.0.1-10.2_EL3.s390x.rpm

x86_64:
dhclient-3.0.1-10.2_EL3.x86_64.rpm
dhcp-3.0.1-10.2_EL3.x86_64.rpm
dhcp-debuginfo-3.0.1-10.2_EL3.x86_64.rpm
dhcp-devel-3.0.1-10.2_EL3.x86_64.rpm

Red Hat Desktop version 3:

Source:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/dhcp-3.0.1-10.2_EL3.src.rpm

i386:
dhclient-3.0.1-10.2_EL3.i386.rpm
dhcp-3.0.1-10.2_EL3.i386.rpm
dhcp-debuginfo-3.0.1-10.2_EL3.i386.rpm
dhcp-devel-3.0.1-10.2_EL3.i386.rpm

x86_64:
dhclient-3.0.1-10.2_EL3.x86_64.rpm
dhcp-3.0.1-10.2_EL3.x86_64.rpm
dhcp-debuginfo-3.0.1-10.2_EL3.x86_64.rpm
dhcp-devel-3.0.1-10.2_EL3.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

Source:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/dhcp-3.0.1-10.2_EL3.src.rpm

i386:
dhclient-3.0.1-10.2_EL3.i386.rpm
dhcp-3.0.1-10.2_EL3.i386.rpm
dhcp-debuginfo-3.0.1-10.2_EL3.i386.rpm
dhcp-devel-3.0.1-10.2_EL3.i386.rpm

ia64:
dhclient-3.0.1-10.2_EL3.ia64.rpm
dhcp-3.0.1-10.2_EL3.ia64.rpm
dhcp-debuginfo-3.0.1-10.2_EL3.ia64.rpm
dhcp-devel-3.0.1-10.2_EL3.ia64.rpm

x86_64:
dhclient-3.0.1-10.2_EL3.x86_64.rpm
dhcp-3.0.1-10.2_EL3.x86_64.rpm
dhcp-debuginfo-3.0.1-10.2_EL3.x86_64.rpm
dhcp-devel-3.0.1-10.2_EL3.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

Source:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/dhcp-3.0.1-10.2_EL3.src.rpm

i386:
dhclient-3.0.1-10.2_EL3.i386.rpm
dhcp-3.0.1-10.2_EL3.i386.rpm
dhcp-debuginfo-3.0.1-10.2_EL3.i386.rpm
dhcp-devel-3.0.1-10.2_EL3.i386.rpm

ia64:
dhclient-3.0.1-10.2_EL3.ia64.rpm
dhcp-3.0.1-10.2_EL3.ia64.rpm
dhcp-debuginfo-3.0.1-10.2_EL3.ia64.rpm
dhcp-devel-3.0.1-10.2_EL3.ia64.rpm

x86_64:
dhclient-3.0.1-10.2_EL3.x86_64.rpm
dhcp-3.0.1-10.2_EL3.x86_64.rpm
dhcp-debuginfo-3.0.1-10.2_EL3.x86_64.rpm
dhcp-devel-3.0.1-10.2_EL3.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0692
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1893
http://www.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKXOD3XlSAg2UNWIIRAqd7AJ9zGRO76iKVh7QDbCvHQSrD+cllPwCeOvNw
+duGG9sBrF2MUuGkUehbbN8=
=fCiq
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Tue Jul 14 19:48:39 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Tue, 14 Jul 2009 15:48:39 -0400
Subject: [RHSA-2009:1156-01] Important: httpd security update
Message-ID: <200907141948.n6EJmds6014920@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: httpd security update
Advisory ID:       RHSA-2009:1156-01
Product:           Red Hat Application Stack
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1156.html
Issue date:        2009-07-14
CVE Names:         CVE-2009-1195 CVE-2009-1890 CVE-2009-1891 
=====================================================================

1. Summary:

Updated httpd packages that fix multiple security issues are now available
for Red Hat Application Stack v2.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Application Stack v2 for Enterprise Linux (v.5) - i386, x86_64

3. Description:

The Apache HTTP Server is a popular Web server.

A denial of service flaw was found in the Apache mod_proxy module when it
was used as a reverse proxy. A remote attacker could use this flaw to force
a proxy process to consume large amounts of CPU time. (CVE-2009-1890)

A denial of service flaw was found in the Apache mod_deflate module. This
module continued to compress large files until compression was complete,
even if the network connection that requested the content was closed before
compression completed. This would cause mod_deflate to consume large
amounts of CPU if mod_deflate was enabled for a large file. (CVE-2009-1891)

A flaw was found in the handling of the "Options" and "AllowOverride"
directives used by the Apache HTTP Server. In configurations using the
"AllowOverride" directive with certain "Options=" arguments, local users
were not restricted from executing commands from a Server-Side-Include
script as intended. (CVE-2009-1195)

All httpd users should upgrade to these updated packages, which contain
backported patches to correct these issues. After installing the updated
packages, the httpd daemon must be restarted for the update to take effect.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

489436 - CVE-2009-1195 AllowOverride Options=IncludesNoExec allows Options Includes
509125 - CVE-2009-1891 httpd: possible temporary DoS (CPU consumption) in mod_deflate
509375 - CVE-2009-1890 httpd: mod_proxy reverse proxy DoS (infinite loop)

6. Package List:

Red Hat Application Stack v2 for Enterprise Linux (v.5):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHWAS/SRPMS/httpd-2.2.11-3.el5s2.src.rpm

i386:
httpd-2.2.11-3.el5s2.i386.rpm
httpd-debuginfo-2.2.11-3.el5s2.i386.rpm
httpd-devel-2.2.11-3.el5s2.i386.rpm
httpd-manual-2.2.11-3.el5s2.i386.rpm
mod_ssl-2.2.11-3.el5s2.i386.rpm

x86_64:
httpd-2.2.11-3.el5s2.x86_64.rpm
httpd-debuginfo-2.2.11-3.el5s2.i386.rpm
httpd-debuginfo-2.2.11-3.el5s2.x86_64.rpm
httpd-devel-2.2.11-3.el5s2.i386.rpm
httpd-devel-2.2.11-3.el5s2.x86_64.rpm
httpd-manual-2.2.11-3.el5s2.x86_64.rpm
mod_ssl-2.2.11-3.el5s2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1195
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1890
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1891
http://www.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKXOENXlSAg2UNWIIRAphhAJ0VvHd5YGiMlc050i8pykPMbkT2zgCfRnjg
A7hj/bXYnC37VmpVX48Bsvw=
=wsXi
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Tue Jul 14 19:48:50 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Tue, 14 Jul 2009 15:48:50 -0400
Subject: [RHSA-2009:1157-01] Important: kernel-rt security and bug fix update
Message-ID: <200907141948.n6EJmoGl015026@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: kernel-rt security and bug fix update
Advisory ID:       RHSA-2009:1157-01
Product:           Red Hat Enterprise MRG for RHEL-5
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1157.html
Issue date:        2009-07-14
CVE Names:         CVE-2009-1385 CVE-2009-1389 CVE-2009-1630 
                   CVE-2009-1633 CVE-2009-1961 
=====================================================================

1. Summary:

Updated kernel-rt packages that fix several security issues and various
bugs are now available for Red Hat Enterprise MRG 1.1.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

MRG Realtime for RHEL 5 Server - i386, noarch, x86_64

3. Description:

The kernel-rt packages contain the Linux kernel, the core of any Linux
operating system.

Security fixes:

* a flaw was found in the Intel PRO/1000 network driver in the Linux
kernel. Frames with sizes near the MTU of an interface may be split across
multiple hardware receive descriptors. Receipt of such a frame could leak
through a validation check, leading to a corruption of the length check. A
remote attacker could use this flaw to send a specially-crafted packet that
would cause a denial of service or code execution. (CVE-2009-1385,
Important)

* Michael Tokarev reported a flaw in the Realtek r8169 Ethernet driver in
the Linux kernel. This driver allowed interfaces using this driver to
receive frames larger than what could be handled. This could lead to a
remote denial of service or code execution. (CVE-2009-1389, Important)

* several flaws were found in the way the Linux kernel CIFS implementation
handles Unicode strings. CIFS clients convert Unicode strings sent by a
server to their local character sets, and then write those strings into
memory. If a malicious server sent a long enough string, it could write
past the end of the target memory region and corrupt other memory areas,
possibly leading to a denial of service or privilege escalation on the
client mounting the CIFS share. (CVE-2009-1633, Important)

* Frank Filz reported the NFSv4 client was missing a file permission check
for the execute bit in some situations. This could allow local,
unprivileged users to run non-executable files on NFSv4 mounted file
systems. (CVE-2009-1630, Moderate)

* a deadlock flaw was found in the Linux kernel splice implementation. This
deadlock could occur during interactions between the
generic_file_splice_write() and splice_from_pipe() functions, possibly
leading to a partial denial of service on the file system partition where
the deadlock occurs. (CVE-2009-1961, Moderate)

Bug fixes:

* a stack buffer used by get_event_name() was not large enough to
accommodate the nul terminator that sprintf() writes. In some cases, this
could lead to an invalid pointer or a kernel panic. With this update, the
function is modified to allow space for the nul terminator. (BZ#503902)

* free_bootmem() was hard-coded to use node 0. This could have caused a
kernel panic during boot on a NUMA system that happens to boot on a node
other than node 0. With this update, free_bootmem() acts on the current
node, resolving this issue. (BZ#503048)

* CPU flag mishandling caused TSC clocksource synchronization to fail (TSC
was marked unstable) on the Intel? microarchitecture (Nehalem). In
addition, TSC clocksource checks added to the 64-bit kernel code are now
present for i386 systems. Also, "/proc/cpuinfo" now shows TSC-related
flags. (BZ#50289, BZ#508756)

* barriers are used to make sure delayed work requested from threads is
processed before continuing. run_workqueue(), however, exited before
processing all barriers, causing threads to wait forever. In a reported
case, this bug caused missing path issues for Device Mapper Multipathing.
(BZ#504133)

* calling pipe() with an invalid address caused a file descriptor leak.
(BZ#509629)

* the code to add "/dev/rtc" contained a printk statement without a log
level prefix. (BZ#510099)

* an extra check has been added to the realtime kernel to avoid a rare
corruption of the FPU (Floating Point Unit) stack, which could occur if a
task using FPU registers was preempted by an interruption. (BZ#509359)

* fix a boot-up problem on HP ProLiant SL2x170z G6 and similar systems by
adding Intel ICH10 controllers back to the ata_piix driver. (BZ#508783)

* converts a UID comparison in AGP to a more secure capability check. By
default, "/dev/agpgart" is accessible only to the root user. (BZ#505493)

Users should upgrade to these updated packages, which contain backported
patches to correct these issues. The system must be rebooted for this
update to take effect.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

496572 - CVE-2009-1633 kernel: cifs: fix potential buffer overruns when converting unicode strings sent by server
500297 - CVE-2009-1630 kernel: nfs: fix NFS v4 client handling of MAY_EXEC in nfs_permission
502893 - TSC synchronisation fails on Nehalem
502981 - CVE-2009-1385 kernel: e1000_clean_rx_irq() denial of service
503048 - LS21 do not boot RT enabled kernels (not APIC issue) - ibm-ls21-7972-01.rhts.bos.redhat.com
503474 - CVE-2009-1961 kernel: splice local denial of service
503902 - kernel: TPM: get_event_name stack corruption [mrg-1]
504133 - /sbin/multipath threads are waiting forever
504726 - CVE-2009-1389 kernel: r8169: fix crash when large packets are received
505493 - kernel: agp: remove uid comparison as security check [mrg-1]
509629 - kernel: fd leak if pipe() is called with an invalid address [mrg-1]
510099 - printk in rtc-dev.c missing a loglevel prefix

6. Package List:

MRG Realtime for RHEL 5 Server:

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/RHEMRG/SRPMS/kernel-rt-2.6.24.7-126.el5rt.src.rpm

i386:
kernel-rt-2.6.24.7-126.el5rt.i686.rpm
kernel-rt-debug-2.6.24.7-126.el5rt.i686.rpm
kernel-rt-debug-debuginfo-2.6.24.7-126.el5rt.i686.rpm
kernel-rt-debug-devel-2.6.24.7-126.el5rt.i686.rpm
kernel-rt-debuginfo-2.6.24.7-126.el5rt.i686.rpm
kernel-rt-debuginfo-common-2.6.24.7-126.el5rt.i686.rpm
kernel-rt-devel-2.6.24.7-126.el5rt.i686.rpm
kernel-rt-trace-2.6.24.7-126.el5rt.i686.rpm
kernel-rt-trace-debuginfo-2.6.24.7-126.el5rt.i686.rpm
kernel-rt-trace-devel-2.6.24.7-126.el5rt.i686.rpm
kernel-rt-vanilla-2.6.24.7-126.el5rt.i686.rpm
kernel-rt-vanilla-debuginfo-2.6.24.7-126.el5rt.i686.rpm
kernel-rt-vanilla-devel-2.6.24.7-126.el5rt.i686.rpm

noarch:
kernel-rt-doc-2.6.24.7-126.el5rt.noarch.rpm

x86_64:
kernel-rt-2.6.24.7-126.el5rt.x86_64.rpm
kernel-rt-debug-2.6.24.7-126.el5rt.x86_64.rpm
kernel-rt-debug-debuginfo-2.6.24.7-126.el5rt.x86_64.rpm
kernel-rt-debug-devel-2.6.24.7-126.el5rt.x86_64.rpm
kernel-rt-debuginfo-2.6.24.7-126.el5rt.x86_64.rpm
kernel-rt-debuginfo-common-2.6.24.7-126.el5rt.x86_64.rpm
kernel-rt-devel-2.6.24.7-126.el5rt.x86_64.rpm
kernel-rt-trace-2.6.24.7-126.el5rt.x86_64.rpm
kernel-rt-trace-debuginfo-2.6.24.7-126.el5rt.x86_64.rpm
kernel-rt-trace-devel-2.6.24.7-126.el5rt.x86_64.rpm
kernel-rt-vanilla-2.6.24.7-126.el5rt.x86_64.rpm
kernel-rt-vanilla-debuginfo-2.6.24.7-126.el5rt.x86_64.rpm
kernel-rt-vanilla-devel-2.6.24.7-126.el5rt.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1385
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1389
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1630
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1633
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1961
http://www.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKXOEbXlSAg2UNWIIRAienAJsFFF0nnHSUYZwOAizwhTomZuC8lACfdOhU
j43/04K6FWiQm8jdr1g6bFo=
=woBz
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Thu Jul 16 19:52:42 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Thu, 16 Jul 2009 15:52:42 -0400
Subject: [RHSA-2009:1159-01] Moderate: libtiff security update
Message-ID: <200907161952.n6GJqgMO018920@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: libtiff security update
Advisory ID:       RHSA-2009:1159-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1159.html
Issue date:        2009-07-16
CVE Names:         CVE-2009-2285 CVE-2009-2347 
=====================================================================

1. Summary:

Updated libtiff packages that fix several security issues are now available
for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Description:

The libtiff packages contain a library of functions for manipulating Tagged
Image File Format (TIFF) files.

Several integer overflow flaws, leading to heap-based buffer overflows,
were found in various libtiff color space conversion tools. An attacker
could create a specially-crafted TIFF file, which once opened by an
unsuspecting user, would cause the conversion tool to crash or,
potentially, execute arbitrary code with the privileges of the user running
the tool. (CVE-2009-2347)

A buffer underwrite flaw was found in libtiff's Lempel-Ziv-Welch (LZW)
compression algorithm decoder. An attacker could create a specially-crafted
LZW-encoded TIFF file, which once opened by an unsuspecting user, would
cause an application linked with libtiff to access an out-of-bounds memory
location, leading to a denial of service (application crash).
(CVE-2009-2285)

The CVE-2009-2347 flaws were discovered by Tielei Wang from ICST-ERCIS,
Peking University.

All libtiff users should upgrade to these updated packages, which contain
backported patches to correct these issues. After installing this update,
all applications linked with the libtiff library (such as Konqueror) must
be restarted for the update to take effect.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

507465 - CVE-2009-2285 libtiff: LZWDecodeCompat underflow
510041 - CVE-2009-2347 libtiff: integer overflows in various inter-color spaces conversion tools (crash, ACE)

6. Package List:

Red Hat Enterprise Linux AS version 3:

Source:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/libtiff-3.5.7-33.el3.src.rpm

i386:
libtiff-3.5.7-33.el3.i386.rpm
libtiff-debuginfo-3.5.7-33.el3.i386.rpm
libtiff-devel-3.5.7-33.el3.i386.rpm

ia64:
libtiff-3.5.7-33.el3.i386.rpm
libtiff-3.5.7-33.el3.ia64.rpm
libtiff-debuginfo-3.5.7-33.el3.i386.rpm
libtiff-debuginfo-3.5.7-33.el3.ia64.rpm
libtiff-devel-3.5.7-33.el3.ia64.rpm

ppc:
libtiff-3.5.7-33.el3.ppc.rpm
libtiff-3.5.7-33.el3.ppc64.rpm
libtiff-debuginfo-3.5.7-33.el3.ppc.rpm
libtiff-debuginfo-3.5.7-33.el3.ppc64.rpm
libtiff-devel-3.5.7-33.el3.ppc.rpm

s390:
libtiff-3.5.7-33.el3.s390.rpm
libtiff-debuginfo-3.5.7-33.el3.s390.rpm
libtiff-devel-3.5.7-33.el3.s390.rpm

s390x:
libtiff-3.5.7-33.el3.s390.rpm
libtiff-3.5.7-33.el3.s390x.rpm
libtiff-debuginfo-3.5.7-33.el3.s390.rpm
libtiff-debuginfo-3.5.7-33.el3.s390x.rpm
libtiff-devel-3.5.7-33.el3.s390x.rpm

x86_64:
libtiff-3.5.7-33.el3.i386.rpm
libtiff-3.5.7-33.el3.x86_64.rpm
libtiff-debuginfo-3.5.7-33.el3.i386.rpm
libtiff-debuginfo-3.5.7-33.el3.x86_64.rpm
libtiff-devel-3.5.7-33.el3.x86_64.rpm

Red Hat Desktop version 3:

Source:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/libtiff-3.5.7-33.el3.src.rpm

i386:
libtiff-3.5.7-33.el3.i386.rpm
libtiff-debuginfo-3.5.7-33.el3.i386.rpm
libtiff-devel-3.5.7-33.el3.i386.rpm

x86_64:
libtiff-3.5.7-33.el3.i386.rpm
libtiff-3.5.7-33.el3.x86_64.rpm
libtiff-debuginfo-3.5.7-33.el3.i386.rpm
libtiff-debuginfo-3.5.7-33.el3.x86_64.rpm
libtiff-devel-3.5.7-33.el3.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

Source:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/libtiff-3.5.7-33.el3.src.rpm

i386:
libtiff-3.5.7-33.el3.i386.rpm
libtiff-debuginfo-3.5.7-33.el3.i386.rpm
libtiff-devel-3.5.7-33.el3.i386.rpm

ia64:
libtiff-3.5.7-33.el3.i386.rpm
libtiff-3.5.7-33.el3.ia64.rpm
libtiff-debuginfo-3.5.7-33.el3.i386.rpm
libtiff-debuginfo-3.5.7-33.el3.ia64.rpm
libtiff-devel-3.5.7-33.el3.ia64.rpm

x86_64:
libtiff-3.5.7-33.el3.i386.rpm
libtiff-3.5.7-33.el3.x86_64.rpm
libtiff-debuginfo-3.5.7-33.el3.i386.rpm
libtiff-debuginfo-3.5.7-33.el3.x86_64.rpm
libtiff-devel-3.5.7-33.el3.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

Source:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/libtiff-3.5.7-33.el3.src.rpm

i386:
libtiff-3.5.7-33.el3.i386.rpm
libtiff-debuginfo-3.5.7-33.el3.i386.rpm
libtiff-devel-3.5.7-33.el3.i386.rpm

ia64:
libtiff-3.5.7-33.el3.i386.rpm
libtiff-3.5.7-33.el3.ia64.rpm
libtiff-debuginfo-3.5.7-33.el3.i386.rpm
libtiff-debuginfo-3.5.7-33.el3.ia64.rpm
libtiff-devel-3.5.7-33.el3.ia64.rpm

x86_64:
libtiff-3.5.7-33.el3.i386.rpm
libtiff-3.5.7-33.el3.x86_64.rpm
libtiff-debuginfo-3.5.7-33.el3.i386.rpm
libtiff-debuginfo-3.5.7-33.el3.x86_64.rpm
libtiff-devel-3.5.7-33.el3.x86_64.rpm

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/libtiff-3.6.1-12.el4_8.4.src.rpm

i386:
libtiff-3.6.1-12.el4_8.4.i386.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.i386.rpm
libtiff-devel-3.6.1-12.el4_8.4.i386.rpm

ia64:
libtiff-3.6.1-12.el4_8.4.i386.rpm
libtiff-3.6.1-12.el4_8.4.ia64.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.i386.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.ia64.rpm
libtiff-devel-3.6.1-12.el4_8.4.ia64.rpm

ppc:
libtiff-3.6.1-12.el4_8.4.ppc.rpm
libtiff-3.6.1-12.el4_8.4.ppc64.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.ppc.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.ppc64.rpm
libtiff-devel-3.6.1-12.el4_8.4.ppc.rpm

s390:
libtiff-3.6.1-12.el4_8.4.s390.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.s390.rpm
libtiff-devel-3.6.1-12.el4_8.4.s390.rpm

s390x:
libtiff-3.6.1-12.el4_8.4.s390.rpm
libtiff-3.6.1-12.el4_8.4.s390x.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.s390.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.s390x.rpm
libtiff-devel-3.6.1-12.el4_8.4.s390x.rpm

x86_64:
libtiff-3.6.1-12.el4_8.4.i386.rpm
libtiff-3.6.1-12.el4_8.4.x86_64.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.i386.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.x86_64.rpm
libtiff-devel-3.6.1-12.el4_8.4.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/libtiff-3.6.1-12.el4_8.4.src.rpm

i386:
libtiff-3.6.1-12.el4_8.4.i386.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.i386.rpm
libtiff-devel-3.6.1-12.el4_8.4.i386.rpm

x86_64:
libtiff-3.6.1-12.el4_8.4.i386.rpm
libtiff-3.6.1-12.el4_8.4.x86_64.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.i386.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.x86_64.rpm
libtiff-devel-3.6.1-12.el4_8.4.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/libtiff-3.6.1-12.el4_8.4.src.rpm

i386:
libtiff-3.6.1-12.el4_8.4.i386.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.i386.rpm
libtiff-devel-3.6.1-12.el4_8.4.i386.rpm

ia64:
libtiff-3.6.1-12.el4_8.4.i386.rpm
libtiff-3.6.1-12.el4_8.4.ia64.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.i386.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.ia64.rpm
libtiff-devel-3.6.1-12.el4_8.4.ia64.rpm

x86_64:
libtiff-3.6.1-12.el4_8.4.i386.rpm
libtiff-3.6.1-12.el4_8.4.x86_64.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.i386.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.x86_64.rpm
libtiff-devel-3.6.1-12.el4_8.4.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/libtiff-3.6.1-12.el4_8.4.src.rpm

i386:
libtiff-3.6.1-12.el4_8.4.i386.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.i386.rpm
libtiff-devel-3.6.1-12.el4_8.4.i386.rpm

ia64:
libtiff-3.6.1-12.el4_8.4.i386.rpm
libtiff-3.6.1-12.el4_8.4.ia64.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.i386.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.ia64.rpm
libtiff-devel-3.6.1-12.el4_8.4.ia64.rpm

x86_64:
libtiff-3.6.1-12.el4_8.4.i386.rpm
libtiff-3.6.1-12.el4_8.4.x86_64.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.i386.rpm
libtiff-debuginfo-3.6.1-12.el4_8.4.x86_64.rpm
libtiff-devel-3.6.1-12.el4_8.4.x86_64.rpm

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/libtiff-3.8.2-7.el5_3.4.src.rpm

i386:
libtiff-3.8.2-7.el5_3.4.i386.rpm
libtiff-debuginfo-3.8.2-7.el5_3.4.i386.rpm

x86_64:
libtiff-3.8.2-7.el5_3.4.i386.rpm
libtiff-3.8.2-7.el5_3.4.x86_64.rpm
libtiff-debuginfo-3.8.2-7.el5_3.4.i386.rpm
libtiff-debuginfo-3.8.2-7.el5_3.4.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/libtiff-3.8.2-7.el5_3.4.src.rpm

i386:
libtiff-debuginfo-3.8.2-7.el5_3.4.i386.rpm
libtiff-devel-3.8.2-7.el5_3.4.i386.rpm

x86_64:
libtiff-debuginfo-3.8.2-7.el5_3.4.i386.rpm
libtiff-debuginfo-3.8.2-7.el5_3.4.x86_64.rpm
libtiff-devel-3.8.2-7.el5_3.4.i386.rpm
libtiff-devel-3.8.2-7.el5_3.4.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/libtiff-3.8.2-7.el5_3.4.src.rpm

i386:
libtiff-3.8.2-7.el5_3.4.i386.rpm
libtiff-debuginfo-3.8.2-7.el5_3.4.i386.rpm
libtiff-devel-3.8.2-7.el5_3.4.i386.rpm

ia64:
libtiff-3.8.2-7.el5_3.4.i386.rpm
libtiff-3.8.2-7.el5_3.4.ia64.rpm
libtiff-debuginfo-3.8.2-7.el5_3.4.i386.rpm
libtiff-debuginfo-3.8.2-7.el5_3.4.ia64.rpm
libtiff-devel-3.8.2-7.el5_3.4.ia64.rpm

ppc:
libtiff-3.8.2-7.el5_3.4.ppc.rpm
libtiff-3.8.2-7.el5_3.4.ppc64.rpm
libtiff-debuginfo-3.8.2-7.el5_3.4.ppc.rpm
libtiff-debuginfo-3.8.2-7.el5_3.4.ppc64.rpm
libtiff-devel-3.8.2-7.el5_3.4.ppc.rpm
libtiff-devel-3.8.2-7.el5_3.4.ppc64.rpm

s390x:
libtiff-3.8.2-7.el5_3.4.s390.rpm
libtiff-3.8.2-7.el5_3.4.s390x.rpm
libtiff-debuginfo-3.8.2-7.el5_3.4.s390.rpm
libtiff-debuginfo-3.8.2-7.el5_3.4.s390x.rpm
libtiff-devel-3.8.2-7.el5_3.4.s390.rpm
libtiff-devel-3.8.2-7.el5_3.4.s390x.rpm

x86_64:
libtiff-3.8.2-7.el5_3.4.i386.rpm
libtiff-3.8.2-7.el5_3.4.x86_64.rpm
libtiff-debuginfo-3.8.2-7.el5_3.4.i386.rpm
libtiff-debuginfo-3.8.2-7.el5_3.4.x86_64.rpm
libtiff-devel-3.8.2-7.el5_3.4.i386.rpm
libtiff-devel-3.8.2-7.el5_3.4.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2285
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2347
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKX4T2XlSAg2UNWIIRAnx4AJ9v5eoAg9xHADjNjn0IVwo20iM8EQCeOhQ+
GC231VAD3uUYKnJJuE7710A=
=XjtU
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Wed Jul 22 01:31:45 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Tue, 21 Jul 2009 21:31:45 -0400
Subject: [RHSA-2009:1162-01] Critical: firefox security update
Message-ID: <200907220131.n6M1VjFE008887@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: firefox security update
Advisory ID:       RHSA-2009:1162-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1162.html
Issue date:        2009-07-21
CVE Names:         CVE-2009-2462 CVE-2009-2463 CVE-2009-2464 
                   CVE-2009-2465 CVE-2009-2466 CVE-2009-2467 
                   CVE-2009-2469 CVE-2009-2471 CVE-2009-2472 
=====================================================================

1. Summary:

Updated firefox packages that fix several security issues are now available
for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Description:

Mozilla Firefox is an open source Web browser. XULRunner provides the XUL
Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause Firefox to crash or,
potentially, execute arbitrary code as the user running Firefox.
(CVE-2009-2462, CVE-2009-2463, CVE-2009-2464, CVE-2009-2465, CVE-2009-2466,
CVE-2009-2467, CVE-2009-2469, CVE-2009-2471)

Several flaws were found in the way Firefox handles malformed JavaScript
code. A website containing malicious content could launch a cross-site
scripting (XSS) attack or execute arbitrary JavaScript with the permissions
of another website. (CVE-2009-2472)

For technical details regarding these flaws, refer to the Mozilla security
advisories for Firefox 3.0.12. You can find a link to the Mozilla
advisories in the References section of this errata.

All Firefox users should upgrade to these updated packages, which contain
Firefox version 3.0.12, which corrects these issues. After installing the
update, Firefox must be restarted for the changes to take effect.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

512128 - CVE-2009-2462 Mozilla Browser engine crashes
512131 - CVE-2009-2463 Mozilla Base64 decoding crash
512133 - CVE-2009-2464 Mozilla crash with multiple RDFs in XUL tree
512135 - CVE-2009-2465 Mozilla double frame construction crashes
512136 - CVE-2009-2466 Mozilla JavaScript engine crashes
512137 - CVE-2009-2467 Mozilla remote code execution during Flash player unloading
512142 - CVE-2009-2469 Mozilla remote code execution using watch and __defineSetter__ on SVG element
512146 - CVE-2009-2471 Mozilla setTimeout loses XPCNativeWrappers
512147 - CVE-2009-2472 Mozilla multiple cross origin wrapper bypasses

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/firefox-3.0.12-1.el4.src.rpm

i386:
firefox-3.0.12-1.el4.i386.rpm
firefox-debuginfo-3.0.12-1.el4.i386.rpm

ia64:
firefox-3.0.12-1.el4.ia64.rpm
firefox-debuginfo-3.0.12-1.el4.ia64.rpm

ppc:
firefox-3.0.12-1.el4.ppc.rpm
firefox-debuginfo-3.0.12-1.el4.ppc.rpm

s390:
firefox-3.0.12-1.el4.s390.rpm
firefox-debuginfo-3.0.12-1.el4.s390.rpm

s390x:
firefox-3.0.12-1.el4.s390x.rpm
firefox-debuginfo-3.0.12-1.el4.s390x.rpm

x86_64:
firefox-3.0.12-1.el4.x86_64.rpm
firefox-debuginfo-3.0.12-1.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/firefox-3.0.12-1.el4.src.rpm

i386:
firefox-3.0.12-1.el4.i386.rpm
firefox-debuginfo-3.0.12-1.el4.i386.rpm

x86_64:
firefox-3.0.12-1.el4.x86_64.rpm
firefox-debuginfo-3.0.12-1.el4.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/firefox-3.0.12-1.el4.src.rpm

i386:
firefox-3.0.12-1.el4.i386.rpm
firefox-debuginfo-3.0.12-1.el4.i386.rpm

ia64:
firefox-3.0.12-1.el4.ia64.rpm
firefox-debuginfo-3.0.12-1.el4.ia64.rpm

x86_64:
firefox-3.0.12-1.el4.x86_64.rpm
firefox-debuginfo-3.0.12-1.el4.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/firefox-3.0.12-1.el4.src.rpm

i386:
firefox-3.0.12-1.el4.i386.rpm
firefox-debuginfo-3.0.12-1.el4.i386.rpm

ia64:
firefox-3.0.12-1.el4.ia64.rpm
firefox-debuginfo-3.0.12-1.el4.ia64.rpm

x86_64:
firefox-3.0.12-1.el4.x86_64.rpm
firefox-debuginfo-3.0.12-1.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/firefox-3.0.12-1.el5_3.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xulrunner-1.9.0.12-1.el5_3.src.rpm

i386:
firefox-3.0.12-1.el5_3.i386.rpm
firefox-debuginfo-3.0.12-1.el5_3.i386.rpm
xulrunner-1.9.0.12-1.el5_3.i386.rpm
xulrunner-debuginfo-1.9.0.12-1.el5_3.i386.rpm

x86_64:
firefox-3.0.12-1.el5_3.i386.rpm
firefox-3.0.12-1.el5_3.x86_64.rpm
firefox-debuginfo-3.0.12-1.el5_3.i386.rpm
firefox-debuginfo-3.0.12-1.el5_3.x86_64.rpm
xulrunner-1.9.0.12-1.el5_3.i386.rpm
xulrunner-1.9.0.12-1.el5_3.x86_64.rpm
xulrunner-debuginfo-1.9.0.12-1.el5_3.i386.rpm
xulrunner-debuginfo-1.9.0.12-1.el5_3.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xulrunner-1.9.0.12-1.el5_3.src.rpm

i386:
xulrunner-debuginfo-1.9.0.12-1.el5_3.i386.rpm
xulrunner-devel-1.9.0.12-1.el5_3.i386.rpm
xulrunner-devel-unstable-1.9.0.12-1.el5_3.i386.rpm

x86_64:
xulrunner-debuginfo-1.9.0.12-1.el5_3.i386.rpm
xulrunner-debuginfo-1.9.0.12-1.el5_3.x86_64.rpm
xulrunner-devel-1.9.0.12-1.el5_3.i386.rpm
xulrunner-devel-1.9.0.12-1.el5_3.x86_64.rpm
xulrunner-devel-unstable-1.9.0.12-1.el5_3.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/firefox-3.0.12-1.el5_3.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/xulrunner-1.9.0.12-1.el5_3.src.rpm

i386:
firefox-3.0.12-1.el5_3.i386.rpm
firefox-debuginfo-3.0.12-1.el5_3.i386.rpm
xulrunner-1.9.0.12-1.el5_3.i386.rpm
xulrunner-debuginfo-1.9.0.12-1.el5_3.i386.rpm
xulrunner-devel-1.9.0.12-1.el5_3.i386.rpm
xulrunner-devel-unstable-1.9.0.12-1.el5_3.i386.rpm

ia64:
firefox-3.0.12-1.el5_3.ia64.rpm
firefox-debuginfo-3.0.12-1.el5_3.ia64.rpm
xulrunner-1.9.0.12-1.el5_3.ia64.rpm
xulrunner-debuginfo-1.9.0.12-1.el5_3.ia64.rpm
xulrunner-devel-1.9.0.12-1.el5_3.ia64.rpm
xulrunner-devel-unstable-1.9.0.12-1.el5_3.ia64.rpm

ppc:
firefox-3.0.12-1.el5_3.ppc.rpm
firefox-debuginfo-3.0.12-1.el5_3.ppc.rpm
xulrunner-1.9.0.12-1.el5_3.ppc.rpm
xulrunner-1.9.0.12-1.el5_3.ppc64.rpm
xulrunner-debuginfo-1.9.0.12-1.el5_3.ppc.rpm
xulrunner-debuginfo-1.9.0.12-1.el5_3.ppc64.rpm
xulrunner-devel-1.9.0.12-1.el5_3.ppc.rpm
xulrunner-devel-1.9.0.12-1.el5_3.ppc64.rpm
xulrunner-devel-unstable-1.9.0.12-1.el5_3.ppc.rpm

s390x:
firefox-3.0.12-1.el5_3.s390.rpm
firefox-3.0.12-1.el5_3.s390x.rpm
firefox-debuginfo-3.0.12-1.el5_3.s390.rpm
firefox-debuginfo-3.0.12-1.el5_3.s390x.rpm
xulrunner-1.9.0.12-1.el5_3.s390.rpm
xulrunner-1.9.0.12-1.el5_3.s390x.rpm
xulrunner-debuginfo-1.9.0.12-1.el5_3.s390.rpm
xulrunner-debuginfo-1.9.0.12-1.el5_3.s390x.rpm
xulrunner-devel-1.9.0.12-1.el5_3.s390.rpm
xulrunner-devel-1.9.0.12-1.el5_3.s390x.rpm
xulrunner-devel-unstable-1.9.0.12-1.el5_3.s390x.rpm

x86_64:
firefox-3.0.12-1.el5_3.i386.rpm
firefox-3.0.12-1.el5_3.x86_64.rpm
firefox-debuginfo-3.0.12-1.el5_3.i386.rpm
firefox-debuginfo-3.0.12-1.el5_3.x86_64.rpm
xulrunner-1.9.0.12-1.el5_3.i386.rpm
xulrunner-1.9.0.12-1.el5_3.x86_64.rpm
xulrunner-debuginfo-1.9.0.12-1.el5_3.i386.rpm
xulrunner-debuginfo-1.9.0.12-1.el5_3.x86_64.rpm
xulrunner-devel-1.9.0.12-1.el5_3.i386.rpm
xulrunner-devel-1.9.0.12-1.el5_3.x86_64.rpm
xulrunner-devel-unstable-1.9.0.12-1.el5_3.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2462
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2463
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2464
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2465
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2466
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2467
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2469
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2471
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2472
http://www.redhat.com/security/updates/classification/#critical
http://www.mozilla.org/security/known-vulnerabilities/firefox30.html#firefox3.0.12

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKZmvsXlSAg2UNWIIRAnxrAJ9loG6Cs6YO8JUVO4TeAw2ssvD6BQCfUQ/X
RF36DJ3H7dch9LwnIkAqk6w=
=dm2P
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Wed Jul 22 01:32:15 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Tue, 21 Jul 2009 21:32:15 -0400
Subject: [RHSA-2009:1163-01] Critical: seamonkey security update
Message-ID: <200907220132.n6M1WF0q009140@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: seamonkey security update
Advisory ID:       RHSA-2009:1163-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1163.html
Issue date:        2009-07-21
CVE Names:         CVE-2009-2462 CVE-2009-2463 CVE-2009-2466 
=====================================================================

1. Summary:

Updated seamonkey packages that fix several security issues are now
available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Description:

SeaMonkey is an open source Web browser, email and newsgroup client, IRC
chat client, and HTML editor.

Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause SeaMonkey to crash or,
potentially, execute arbitrary code as the user running SeaMonkey.
(CVE-2009-2462, CVE-2009-2463, CVE-2009-2466)

All SeaMonkey users should upgrade to these updated packages, which correct
these issues. After installing the update, SeaMonkey must be restarted for
the changes to take effect.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

512128 - CVE-2009-2462 Mozilla Browser engine crashes
512131 - CVE-2009-2463 Mozilla Base64 decoding crash
512136 - CVE-2009-2466 Mozilla JavaScript engine crashes

6. Package List:

Red Hat Enterprise Linux AS version 3:

Source:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/seamonkey-1.0.9-0.40.el3.src.rpm

i386:
seamonkey-1.0.9-0.40.el3.i386.rpm
seamonkey-chat-1.0.9-0.40.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.i386.rpm
seamonkey-devel-1.0.9-0.40.el3.i386.rpm
seamonkey-dom-inspector-1.0.9-0.40.el3.i386.rpm
seamonkey-js-debugger-1.0.9-0.40.el3.i386.rpm
seamonkey-mail-1.0.9-0.40.el3.i386.rpm
seamonkey-nspr-1.0.9-0.40.el3.i386.rpm
seamonkey-nspr-devel-1.0.9-0.40.el3.i386.rpm
seamonkey-nss-1.0.9-0.40.el3.i386.rpm
seamonkey-nss-devel-1.0.9-0.40.el3.i386.rpm

ia64:
seamonkey-1.0.9-0.40.el3.ia64.rpm
seamonkey-chat-1.0.9-0.40.el3.ia64.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.ia64.rpm
seamonkey-devel-1.0.9-0.40.el3.ia64.rpm
seamonkey-dom-inspector-1.0.9-0.40.el3.ia64.rpm
seamonkey-js-debugger-1.0.9-0.40.el3.ia64.rpm
seamonkey-mail-1.0.9-0.40.el3.ia64.rpm
seamonkey-nspr-1.0.9-0.40.el3.i386.rpm
seamonkey-nspr-1.0.9-0.40.el3.ia64.rpm
seamonkey-nspr-devel-1.0.9-0.40.el3.ia64.rpm
seamonkey-nss-1.0.9-0.40.el3.i386.rpm
seamonkey-nss-1.0.9-0.40.el3.ia64.rpm
seamonkey-nss-devel-1.0.9-0.40.el3.ia64.rpm

ppc:
seamonkey-1.0.9-0.40.el3.ppc.rpm
seamonkey-chat-1.0.9-0.40.el3.ppc.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.ppc.rpm
seamonkey-devel-1.0.9-0.40.el3.ppc.rpm
seamonkey-dom-inspector-1.0.9-0.40.el3.ppc.rpm
seamonkey-js-debugger-1.0.9-0.40.el3.ppc.rpm
seamonkey-mail-1.0.9-0.40.el3.ppc.rpm
seamonkey-nspr-1.0.9-0.40.el3.ppc.rpm
seamonkey-nspr-devel-1.0.9-0.40.el3.ppc.rpm
seamonkey-nss-1.0.9-0.40.el3.ppc.rpm
seamonkey-nss-devel-1.0.9-0.40.el3.ppc.rpm

s390:
seamonkey-1.0.9-0.40.el3.s390.rpm
seamonkey-chat-1.0.9-0.40.el3.s390.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.s390.rpm
seamonkey-devel-1.0.9-0.40.el3.s390.rpm
seamonkey-dom-inspector-1.0.9-0.40.el3.s390.rpm
seamonkey-js-debugger-1.0.9-0.40.el3.s390.rpm
seamonkey-mail-1.0.9-0.40.el3.s390.rpm
seamonkey-nspr-1.0.9-0.40.el3.s390.rpm
seamonkey-nspr-devel-1.0.9-0.40.el3.s390.rpm
seamonkey-nss-1.0.9-0.40.el3.s390.rpm
seamonkey-nss-devel-1.0.9-0.40.el3.s390.rpm

s390x:
seamonkey-1.0.9-0.40.el3.s390x.rpm
seamonkey-chat-1.0.9-0.40.el3.s390x.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.s390.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.s390x.rpm
seamonkey-devel-1.0.9-0.40.el3.s390x.rpm
seamonkey-dom-inspector-1.0.9-0.40.el3.s390x.rpm
seamonkey-js-debugger-1.0.9-0.40.el3.s390x.rpm
seamonkey-mail-1.0.9-0.40.el3.s390x.rpm
seamonkey-nspr-1.0.9-0.40.el3.s390.rpm
seamonkey-nspr-1.0.9-0.40.el3.s390x.rpm
seamonkey-nspr-devel-1.0.9-0.40.el3.s390x.rpm
seamonkey-nss-1.0.9-0.40.el3.s390.rpm
seamonkey-nss-1.0.9-0.40.el3.s390x.rpm
seamonkey-nss-devel-1.0.9-0.40.el3.s390x.rpm

x86_64:
seamonkey-1.0.9-0.40.el3.i386.rpm
seamonkey-1.0.9-0.40.el3.x86_64.rpm
seamonkey-chat-1.0.9-0.40.el3.x86_64.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.x86_64.rpm
seamonkey-devel-1.0.9-0.40.el3.x86_64.rpm
seamonkey-dom-inspector-1.0.9-0.40.el3.x86_64.rpm
seamonkey-js-debugger-1.0.9-0.40.el3.x86_64.rpm
seamonkey-mail-1.0.9-0.40.el3.x86_64.rpm
seamonkey-nspr-1.0.9-0.40.el3.i386.rpm
seamonkey-nspr-1.0.9-0.40.el3.x86_64.rpm
seamonkey-nspr-devel-1.0.9-0.40.el3.x86_64.rpm
seamonkey-nss-1.0.9-0.40.el3.i386.rpm
seamonkey-nss-1.0.9-0.40.el3.x86_64.rpm
seamonkey-nss-devel-1.0.9-0.40.el3.x86_64.rpm

Red Hat Desktop version 3:

Source:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/seamonkey-1.0.9-0.40.el3.src.rpm

i386:
seamonkey-1.0.9-0.40.el3.i386.rpm
seamonkey-chat-1.0.9-0.40.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.i386.rpm
seamonkey-devel-1.0.9-0.40.el3.i386.rpm
seamonkey-dom-inspector-1.0.9-0.40.el3.i386.rpm
seamonkey-js-debugger-1.0.9-0.40.el3.i386.rpm
seamonkey-mail-1.0.9-0.40.el3.i386.rpm
seamonkey-nspr-1.0.9-0.40.el3.i386.rpm
seamonkey-nspr-devel-1.0.9-0.40.el3.i386.rpm
seamonkey-nss-1.0.9-0.40.el3.i386.rpm
seamonkey-nss-devel-1.0.9-0.40.el3.i386.rpm

x86_64:
seamonkey-1.0.9-0.40.el3.i386.rpm
seamonkey-1.0.9-0.40.el3.x86_64.rpm
seamonkey-chat-1.0.9-0.40.el3.x86_64.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.x86_64.rpm
seamonkey-devel-1.0.9-0.40.el3.x86_64.rpm
seamonkey-dom-inspector-1.0.9-0.40.el3.x86_64.rpm
seamonkey-js-debugger-1.0.9-0.40.el3.x86_64.rpm
seamonkey-mail-1.0.9-0.40.el3.x86_64.rpm
seamonkey-nspr-1.0.9-0.40.el3.i386.rpm
seamonkey-nspr-1.0.9-0.40.el3.x86_64.rpm
seamonkey-nspr-devel-1.0.9-0.40.el3.x86_64.rpm
seamonkey-nss-1.0.9-0.40.el3.i386.rpm
seamonkey-nss-1.0.9-0.40.el3.x86_64.rpm
seamonkey-nss-devel-1.0.9-0.40.el3.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

Source:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/seamonkey-1.0.9-0.40.el3.src.rpm

i386:
seamonkey-1.0.9-0.40.el3.i386.rpm
seamonkey-chat-1.0.9-0.40.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.i386.rpm
seamonkey-devel-1.0.9-0.40.el3.i386.rpm
seamonkey-dom-inspector-1.0.9-0.40.el3.i386.rpm
seamonkey-js-debugger-1.0.9-0.40.el3.i386.rpm
seamonkey-mail-1.0.9-0.40.el3.i386.rpm
seamonkey-nspr-1.0.9-0.40.el3.i386.rpm
seamonkey-nspr-devel-1.0.9-0.40.el3.i386.rpm
seamonkey-nss-1.0.9-0.40.el3.i386.rpm
seamonkey-nss-devel-1.0.9-0.40.el3.i386.rpm

ia64:
seamonkey-1.0.9-0.40.el3.ia64.rpm
seamonkey-chat-1.0.9-0.40.el3.ia64.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.ia64.rpm
seamonkey-devel-1.0.9-0.40.el3.ia64.rpm
seamonkey-dom-inspector-1.0.9-0.40.el3.ia64.rpm
seamonkey-js-debugger-1.0.9-0.40.el3.ia64.rpm
seamonkey-mail-1.0.9-0.40.el3.ia64.rpm
seamonkey-nspr-1.0.9-0.40.el3.i386.rpm
seamonkey-nspr-1.0.9-0.40.el3.ia64.rpm
seamonkey-nspr-devel-1.0.9-0.40.el3.ia64.rpm
seamonkey-nss-1.0.9-0.40.el3.i386.rpm
seamonkey-nss-1.0.9-0.40.el3.ia64.rpm
seamonkey-nss-devel-1.0.9-0.40.el3.ia64.rpm

x86_64:
seamonkey-1.0.9-0.40.el3.i386.rpm
seamonkey-1.0.9-0.40.el3.x86_64.rpm
seamonkey-chat-1.0.9-0.40.el3.x86_64.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.x86_64.rpm
seamonkey-devel-1.0.9-0.40.el3.x86_64.rpm
seamonkey-dom-inspector-1.0.9-0.40.el3.x86_64.rpm
seamonkey-js-debugger-1.0.9-0.40.el3.x86_64.rpm
seamonkey-mail-1.0.9-0.40.el3.x86_64.rpm
seamonkey-nspr-1.0.9-0.40.el3.i386.rpm
seamonkey-nspr-1.0.9-0.40.el3.x86_64.rpm
seamonkey-nspr-devel-1.0.9-0.40.el3.x86_64.rpm
seamonkey-nss-1.0.9-0.40.el3.i386.rpm
seamonkey-nss-1.0.9-0.40.el3.x86_64.rpm
seamonkey-nss-devel-1.0.9-0.40.el3.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

Source:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/seamonkey-1.0.9-0.40.el3.src.rpm

i386:
seamonkey-1.0.9-0.40.el3.i386.rpm
seamonkey-chat-1.0.9-0.40.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.i386.rpm
seamonkey-devel-1.0.9-0.40.el3.i386.rpm
seamonkey-dom-inspector-1.0.9-0.40.el3.i386.rpm
seamonkey-js-debugger-1.0.9-0.40.el3.i386.rpm
seamonkey-mail-1.0.9-0.40.el3.i386.rpm
seamonkey-nspr-1.0.9-0.40.el3.i386.rpm
seamonkey-nspr-devel-1.0.9-0.40.el3.i386.rpm
seamonkey-nss-1.0.9-0.40.el3.i386.rpm
seamonkey-nss-devel-1.0.9-0.40.el3.i386.rpm

ia64:
seamonkey-1.0.9-0.40.el3.ia64.rpm
seamonkey-chat-1.0.9-0.40.el3.ia64.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.ia64.rpm
seamonkey-devel-1.0.9-0.40.el3.ia64.rpm
seamonkey-dom-inspector-1.0.9-0.40.el3.ia64.rpm
seamonkey-js-debugger-1.0.9-0.40.el3.ia64.rpm
seamonkey-mail-1.0.9-0.40.el3.ia64.rpm
seamonkey-nspr-1.0.9-0.40.el3.i386.rpm
seamonkey-nspr-1.0.9-0.40.el3.ia64.rpm
seamonkey-nspr-devel-1.0.9-0.40.el3.ia64.rpm
seamonkey-nss-1.0.9-0.40.el3.i386.rpm
seamonkey-nss-1.0.9-0.40.el3.ia64.rpm
seamonkey-nss-devel-1.0.9-0.40.el3.ia64.rpm

x86_64:
seamonkey-1.0.9-0.40.el3.i386.rpm
seamonkey-1.0.9-0.40.el3.x86_64.rpm
seamonkey-chat-1.0.9-0.40.el3.x86_64.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.40.el3.x86_64.rpm
seamonkey-devel-1.0.9-0.40.el3.x86_64.rpm
seamonkey-dom-inspector-1.0.9-0.40.el3.x86_64.rpm
seamonkey-js-debugger-1.0.9-0.40.el3.x86_64.rpm
seamonkey-mail-1.0.9-0.40.el3.x86_64.rpm
seamonkey-nspr-1.0.9-0.40.el3.i386.rpm
seamonkey-nspr-1.0.9-0.40.el3.x86_64.rpm
seamonkey-nspr-devel-1.0.9-0.40.el3.x86_64.rpm
seamonkey-nss-1.0.9-0.40.el3.i386.rpm
seamonkey-nss-1.0.9-0.40.el3.x86_64.rpm
seamonkey-nss-devel-1.0.9-0.40.el3.x86_64.rpm

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/seamonkey-1.0.9-45.el4_8.src.rpm

i386:
seamonkey-1.0.9-45.el4_8.i386.rpm
seamonkey-chat-1.0.9-45.el4_8.i386.rpm
seamonkey-debuginfo-1.0.9-45.el4_8.i386.rpm
seamonkey-devel-1.0.9-45.el4_8.i386.rpm
seamonkey-dom-inspector-1.0.9-45.el4_8.i386.rpm
seamonkey-js-debugger-1.0.9-45.el4_8.i386.rpm
seamonkey-mail-1.0.9-45.el4_8.i386.rpm

ia64:
seamonkey-1.0.9-45.el4_8.ia64.rpm
seamonkey-chat-1.0.9-45.el4_8.ia64.rpm
seamonkey-debuginfo-1.0.9-45.el4_8.ia64.rpm
seamonkey-devel-1.0.9-45.el4_8.ia64.rpm
seamonkey-dom-inspector-1.0.9-45.el4_8.ia64.rpm
seamonkey-js-debugger-1.0.9-45.el4_8.ia64.rpm
seamonkey-mail-1.0.9-45.el4_8.ia64.rpm

ppc:
seamonkey-1.0.9-45.el4_8.ppc.rpm
seamonkey-chat-1.0.9-45.el4_8.ppc.rpm
seamonkey-debuginfo-1.0.9-45.el4_8.ppc.rpm
seamonkey-devel-1.0.9-45.el4_8.ppc.rpm
seamonkey-dom-inspector-1.0.9-45.el4_8.ppc.rpm
seamonkey-js-debugger-1.0.9-45.el4_8.ppc.rpm
seamonkey-mail-1.0.9-45.el4_8.ppc.rpm

s390:
seamonkey-1.0.9-45.el4_8.s390.rpm
seamonkey-chat-1.0.9-45.el4_8.s390.rpm
seamonkey-debuginfo-1.0.9-45.el4_8.s390.rpm
seamonkey-devel-1.0.9-45.el4_8.s390.rpm
seamonkey-dom-inspector-1.0.9-45.el4_8.s390.rpm
seamonkey-js-debugger-1.0.9-45.el4_8.s390.rpm
seamonkey-mail-1.0.9-45.el4_8.s390.rpm

s390x:
seamonkey-1.0.9-45.el4_8.s390x.rpm
seamonkey-chat-1.0.9-45.el4_8.s390x.rpm
seamonkey-debuginfo-1.0.9-45.el4_8.s390x.rpm
seamonkey-devel-1.0.9-45.el4_8.s390x.rpm
seamonkey-dom-inspector-1.0.9-45.el4_8.s390x.rpm
seamonkey-js-debugger-1.0.9-45.el4_8.s390x.rpm
seamonkey-mail-1.0.9-45.el4_8.s390x.rpm

x86_64:
seamonkey-1.0.9-45.el4_8.x86_64.rpm
seamonkey-chat-1.0.9-45.el4_8.x86_64.rpm
seamonkey-debuginfo-1.0.9-45.el4_8.x86_64.rpm
seamonkey-devel-1.0.9-45.el4_8.x86_64.rpm
seamonkey-dom-inspector-1.0.9-45.el4_8.x86_64.rpm
seamonkey-js-debugger-1.0.9-45.el4_8.x86_64.rpm
seamonkey-mail-1.0.9-45.el4_8.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/seamonkey-1.0.9-45.el4_8.src.rpm

i386:
seamonkey-1.0.9-45.el4_8.i386.rpm
seamonkey-chat-1.0.9-45.el4_8.i386.rpm
seamonkey-debuginfo-1.0.9-45.el4_8.i386.rpm
seamonkey-devel-1.0.9-45.el4_8.i386.rpm
seamonkey-dom-inspector-1.0.9-45.el4_8.i386.rpm
seamonkey-js-debugger-1.0.9-45.el4_8.i386.rpm
seamonkey-mail-1.0.9-45.el4_8.i386.rpm

x86_64:
seamonkey-1.0.9-45.el4_8.x86_64.rpm
seamonkey-chat-1.0.9-45.el4_8.x86_64.rpm
seamonkey-debuginfo-1.0.9-45.el4_8.x86_64.rpm
seamonkey-devel-1.0.9-45.el4_8.x86_64.rpm
seamonkey-dom-inspector-1.0.9-45.el4_8.x86_64.rpm
seamonkey-js-debugger-1.0.9-45.el4_8.x86_64.rpm
seamonkey-mail-1.0.9-45.el4_8.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/seamonkey-1.0.9-45.el4_8.src.rpm

i386:
seamonkey-1.0.9-45.el4_8.i386.rpm
seamonkey-chat-1.0.9-45.el4_8.i386.rpm
seamonkey-debuginfo-1.0.9-45.el4_8.i386.rpm
seamonkey-devel-1.0.9-45.el4_8.i386.rpm
seamonkey-dom-inspector-1.0.9-45.el4_8.i386.rpm
seamonkey-js-debugger-1.0.9-45.el4_8.i386.rpm
seamonkey-mail-1.0.9-45.el4_8.i386.rpm

ia64:
seamonkey-1.0.9-45.el4_8.ia64.rpm
seamonkey-chat-1.0.9-45.el4_8.ia64.rpm
seamonkey-debuginfo-1.0.9-45.el4_8.ia64.rpm
seamonkey-devel-1.0.9-45.el4_8.ia64.rpm
seamonkey-dom-inspector-1.0.9-45.el4_8.ia64.rpm
seamonkey-js-debugger-1.0.9-45.el4_8.ia64.rpm
seamonkey-mail-1.0.9-45.el4_8.ia64.rpm

x86_64:
seamonkey-1.0.9-45.el4_8.x86_64.rpm
seamonkey-chat-1.0.9-45.el4_8.x86_64.rpm
seamonkey-debuginfo-1.0.9-45.el4_8.x86_64.rpm
seamonkey-devel-1.0.9-45.el4_8.x86_64.rpm
seamonkey-dom-inspector-1.0.9-45.el4_8.x86_64.rpm
seamonkey-js-debugger-1.0.9-45.el4_8.x86_64.rpm
seamonkey-mail-1.0.9-45.el4_8.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/seamonkey-1.0.9-45.el4_8.src.rpm

i386:
seamonkey-1.0.9-45.el4_8.i386.rpm
seamonkey-chat-1.0.9-45.el4_8.i386.rpm
seamonkey-debuginfo-1.0.9-45.el4_8.i386.rpm
seamonkey-devel-1.0.9-45.el4_8.i386.rpm
seamonkey-dom-inspector-1.0.9-45.el4_8.i386.rpm
seamonkey-js-debugger-1.0.9-45.el4_8.i386.rpm
seamonkey-mail-1.0.9-45.el4_8.i386.rpm

ia64:
seamonkey-1.0.9-45.el4_8.ia64.rpm
seamonkey-chat-1.0.9-45.el4_8.ia64.rpm
seamonkey-debuginfo-1.0.9-45.el4_8.ia64.rpm
seamonkey-devel-1.0.9-45.el4_8.ia64.rpm
seamonkey-dom-inspector-1.0.9-45.el4_8.ia64.rpm
seamonkey-js-debugger-1.0.9-45.el4_8.ia64.rpm
seamonkey-mail-1.0.9-45.el4_8.ia64.rpm

x86_64:
seamonkey-1.0.9-45.el4_8.x86_64.rpm
seamonkey-chat-1.0.9-45.el4_8.x86_64.rpm
seamonkey-debuginfo-1.0.9-45.el4_8.x86_64.rpm
seamonkey-devel-1.0.9-45.el4_8.x86_64.rpm
seamonkey-dom-inspector-1.0.9-45.el4_8.x86_64.rpm
seamonkey-js-debugger-1.0.9-45.el4_8.x86_64.rpm
seamonkey-mail-1.0.9-45.el4_8.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2462
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2463
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2466
http://www.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKZmwSXlSAg2UNWIIRArz0AJ0Z4mUXQv67qWRVQBlOaQC836A8IACfZSSK
sH9gMsEyLxbNQ+eMRKGibMI=
=aJP0
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Wed Jul 22 01:32:41 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Tue, 21 Jul 2009 21:32:41 -0400
Subject: [RHSA-2009:1164-01] Important: tomcat security update
Message-ID: <200907220132.n6M1Wfh4009283@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: tomcat security update
Advisory ID:       RHSA-2009:1164-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1164.html
Issue date:        2009-07-21
Keywords:          Security
CVE Names:         CVE-2007-5333 CVE-2008-5515 CVE-2009-0033 
                   CVE-2009-0580 CVE-2009-0781 CVE-2009-0783 
=====================================================================

1. Summary:

Updated tomcat packages that fix several security issues are now available
for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Description:

Apache Tomcat is a servlet container for the Java Servlet and JavaServer
Pages (JSP) technologies.

It was discovered that the Red Hat Security Advisory RHSA-2007:0871 did not
address all possible flaws in the way Tomcat handles certain characters and
character sequences in cookie values. A remote attacker could use this flaw
to obtain sensitive information, such as session IDs, and then use this
information for session hijacking attacks. (CVE-2007-5333)

Note: The fix for the CVE-2007-5333 flaw changes the default cookie
processing behavior: with this update, version 0 cookies that contain
values that must be quoted to be valid are automatically changed to version
1 cookies. To reactivate the previous, but insecure behavior, add the
following entry to the "/etc/tomcat5/catalina.properties" file:

org.apache.tomcat.util.http.ServerCookie.VERSION_SWITCH=false

It was discovered that request dispatchers did not properly normalize user
requests that have trailing query strings, allowing remote attackers to
send specially-crafted requests that would cause an information leak.
(CVE-2008-5515)

A flaw was found in the way the Tomcat AJP (Apache JServ Protocol)
connector processes AJP connections. An attacker could use this flaw to
send specially-crafted requests that would cause a temporary denial of
service. (CVE-2009-0033)

It was discovered that the error checking methods of certain authentication
classes did not have sufficient error checking, allowing remote attackers
to enumerate (via brute force methods) usernames registered with
applications running on Tomcat when FORM-based authentication was used.
(CVE-2009-0580)

A cross-site scripting (XSS) flaw was found in the examples calendar
application. With some web browsers, remote attackers could use this flaw
to inject arbitrary web script or HTML via the "time" parameter.
(CVE-2009-0781)

It was discovered that web applications containing their own XML parsers
could replace the XML parser Tomcat uses to parse configuration files. A
malicious web application running on a Tomcat instance could read or,
potentially, modify the configuration and XML-based data of other web
applications deployed on the same Tomcat instance. (CVE-2009-0783)

Users of Tomcat should upgrade to these updated packages, which contain
backported patches to resolve these issues. Tomcat must be restarted for
this update to take effect.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

427766 - CVE-2007-5333 Improve cookie parsing for tomcat5
489028 - CVE-2009-0781 tomcat: XSS in Apache Tomcat calendar application
493381 - CVE-2009-0033 tomcat6 Denial-Of-Service with AJP connection
503978 - CVE-2009-0580 tomcat6 Information disclosure in authentication classes
504153 - CVE-2009-0783 tomcat XML parser information disclosure
504753 - CVE-2008-5515 tomcat request dispatcher information disclosure vulnerability

6. Package List:

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/tomcat5-5.5.23-0jpp.7.el5_3.2.src.rpm

i386:
tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-servlet-2.4-api-5.5.23-0jpp.7.el5_3.2.i386.rpm

x86_64:
tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-servlet-2.4-api-5.5.23-0jpp.7.el5_3.2.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/tomcat5-5.5.23-0jpp.7.el5_3.2.src.rpm

i386:
tomcat5-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-admin-webapps-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-common-lib-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-jasper-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-jasper-javadoc-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-server-lib-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-webapps-5.5.23-0jpp.7.el5_3.2.i386.rpm

x86_64:
tomcat5-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-admin-webapps-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-common-lib-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-jasper-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-jasper-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-server-lib-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-webapps-5.5.23-0jpp.7.el5_3.2.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/tomcat5-5.5.23-0jpp.7.el5_3.2.src.rpm

i386:
tomcat5-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-admin-webapps-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-common-lib-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-jasper-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-jasper-javadoc-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-server-lib-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-servlet-2.4-api-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.7.el5_3.2.i386.rpm
tomcat5-webapps-5.5.23-0jpp.7.el5_3.2.i386.rpm

ia64:
tomcat5-5.5.23-0jpp.7.el5_3.2.ia64.rpm
tomcat5-admin-webapps-5.5.23-0jpp.7.el5_3.2.ia64.rpm
tomcat5-common-lib-5.5.23-0jpp.7.el5_3.2.ia64.rpm
tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.ia64.rpm
tomcat5-jasper-5.5.23-0jpp.7.el5_3.2.ia64.rpm
tomcat5-jasper-javadoc-5.5.23-0jpp.7.el5_3.2.ia64.rpm
tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.ia64.rpm
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.7.el5_3.2.ia64.rpm
tomcat5-server-lib-5.5.23-0jpp.7.el5_3.2.ia64.rpm
tomcat5-servlet-2.4-api-5.5.23-0jpp.7.el5_3.2.ia64.rpm
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.7.el5_3.2.ia64.rpm
tomcat5-webapps-5.5.23-0jpp.7.el5_3.2.ia64.rpm

ppc:
tomcat5-5.5.23-0jpp.7.el5_3.2.ppc.rpm
tomcat5-5.5.23-0jpp.7.el5_3.2.ppc64.rpm
tomcat5-admin-webapps-5.5.23-0jpp.7.el5_3.2.ppc.rpm
tomcat5-common-lib-5.5.23-0jpp.7.el5_3.2.ppc.rpm
tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.ppc.rpm
tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.ppc64.rpm
tomcat5-jasper-5.5.23-0jpp.7.el5_3.2.ppc.rpm
tomcat5-jasper-javadoc-5.5.23-0jpp.7.el5_3.2.ppc.rpm
tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.ppc.rpm
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.7.el5_3.2.ppc.rpm
tomcat5-server-lib-5.5.23-0jpp.7.el5_3.2.ppc.rpm
tomcat5-servlet-2.4-api-5.5.23-0jpp.7.el5_3.2.ppc.rpm
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.7.el5_3.2.ppc.rpm
tomcat5-webapps-5.5.23-0jpp.7.el5_3.2.ppc.rpm

s390x:
tomcat5-5.5.23-0jpp.7.el5_3.2.s390x.rpm
tomcat5-admin-webapps-5.5.23-0jpp.7.el5_3.2.s390x.rpm
tomcat5-common-lib-5.5.23-0jpp.7.el5_3.2.s390x.rpm
tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.s390x.rpm
tomcat5-jasper-5.5.23-0jpp.7.el5_3.2.s390x.rpm
tomcat5-jasper-javadoc-5.5.23-0jpp.7.el5_3.2.s390x.rpm
tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.s390x.rpm
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.7.el5_3.2.s390x.rpm
tomcat5-server-lib-5.5.23-0jpp.7.el5_3.2.s390x.rpm
tomcat5-servlet-2.4-api-5.5.23-0jpp.7.el5_3.2.s390x.rpm
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.7.el5_3.2.s390x.rpm
tomcat5-webapps-5.5.23-0jpp.7.el5_3.2.s390x.rpm

x86_64:
tomcat5-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-admin-webapps-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-common-lib-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-debuginfo-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-jasper-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-jasper-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-jsp-2.0-api-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-jsp-2.0-api-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-server-lib-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-servlet-2.4-api-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-servlet-2.4-api-javadoc-5.5.23-0jpp.7.el5_3.2.x86_64.rpm
tomcat5-webapps-5.5.23-0jpp.7.el5_3.2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5333
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5515
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0033
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0580
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0781
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0783
http://tomcat.apache.org/security-5.html
http://www.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKZmwkXlSAg2UNWIIRAuiZAKCl0RGKySFNZXzn2yP++DUeo8UV/wCfc/yd
gciYRj4h4oJ7znufBR/BjDk=
=wR3r
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Mon Jul 27 11:15:22 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Mon, 27 Jul 2009 07:15:22 -0400
Subject: [RHSA-2009:1176-01] Moderate: python security update
Message-ID: <200907271115.n6RBFM4q024488@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: python security update
Advisory ID:       RHSA-2009:1176-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1176.html
Issue date:        2009-07-27
CVE Names:         CVE-2007-2052 CVE-2007-4965 CVE-2008-1721 
                   CVE-2008-1887 CVE-2008-2315 CVE-2008-3142 
                   CVE-2008-3143 CVE-2008-3144 CVE-2008-4864 
                   CVE-2008-5031 
=====================================================================

1. Summary:

Updated python packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Description:

Python is an interpreted, interactive, object-oriented programming
language.

When the assert() system call was disabled, an input sanitization flaw was
revealed in the Python string object implementation that led to a buffer
overflow. The missing check for negative size values meant the Python
memory allocator could allocate less memory than expected. This could
result in arbitrary code execution with the Python interpreter's
privileges. (CVE-2008-1887)

Multiple buffer and integer overflow flaws were found in the Python Unicode
string processing and in the Python Unicode and string object
implementations. An attacker could use these flaws to cause a denial of
service (Python application crash). (CVE-2008-3142, CVE-2008-5031)

Multiple integer overflow flaws were found in the Python imageop module. If
a Python application used the imageop module to process untrusted images,
it could cause the application to disclose sensitive information, crash or,
potentially, execute arbitrary code with the Python interpreter's
privileges. (CVE-2007-4965, CVE-2008-4864)

Multiple integer underflow and overflow flaws were found in the Python
snprintf() wrapper implementation. An attacker could use these flaws to
cause a denial of service (memory corruption). (CVE-2008-3144)

Multiple integer overflow flaws were found in various Python modules. An
attacker could use these flaws to cause a denial of service (Python
application crash). (CVE-2008-2315, CVE-2008-3143)

An integer signedness error, leading to a buffer overflow, was found
in the Python zlib extension module. If a Python application requested
the negative byte count be flushed for a decompression stream, it could
cause the application to crash or, potentially, execute arbitrary code
with the Python interpreter's privileges. (CVE-2008-1721)

A flaw was discovered in the strxfrm() function of the Python locale
module. Strings generated by this function were not properly
NULL-terminated, which could possibly cause disclosure of data stored in
the memory of a Python application using this function. (CVE-2007-2052)

Red Hat would like to thank David Remahl of the Apple Product Security team
for responsibly reporting the CVE-2008-2315 issue.

All Python users should upgrade to these updated packages, which contain
backported patches to correct these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

235093 - CVE-2007-2052 python off-by-one locale.strxfrm() (possible memory disclosure)
295971 - CVE-2007-4965 python imageop module heap corruption
442005 - CVE-2008-1721 python: integer signedness error in the zlib extension module
443810 - CVE-2008-1887 python: PyString_FromStringAndSize does not check for negative size values
454990 - CVE-2008-3142 python: Multiple buffer overflows in unicode processing
455008 - CVE-2008-2315 python: Multiple integer overflows in python core
455013 - CVE-2008-3143 python: Multiple integer overflows discovered by Google
455018 - CVE-2008-3144 python: Potential integer underflow and overflow in the PyOS_vsnprintf C API function
469656 - CVE-2008-4864 python: imageop module multiple integer overflows
470915 - CVE-2008-5031 python: stringobject, unicodeobject integer overflows

6. Package List:

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/python-2.4.3-24.el5_3.6.src.rpm

i386:
python-2.4.3-24.el5_3.6.i386.rpm
python-debuginfo-2.4.3-24.el5_3.6.i386.rpm
python-tools-2.4.3-24.el5_3.6.i386.rpm
tkinter-2.4.3-24.el5_3.6.i386.rpm

x86_64:
python-2.4.3-24.el5_3.6.x86_64.rpm
python-debuginfo-2.4.3-24.el5_3.6.x86_64.rpm
python-tools-2.4.3-24.el5_3.6.x86_64.rpm
tkinter-2.4.3-24.el5_3.6.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/python-2.4.3-24.el5_3.6.src.rpm

i386:
python-debuginfo-2.4.3-24.el5_3.6.i386.rpm
python-devel-2.4.3-24.el5_3.6.i386.rpm

x86_64:
python-debuginfo-2.4.3-24.el5_3.6.i386.rpm
python-debuginfo-2.4.3-24.el5_3.6.x86_64.rpm
python-devel-2.4.3-24.el5_3.6.i386.rpm
python-devel-2.4.3-24.el5_3.6.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/python-2.4.3-24.el5_3.6.src.rpm

i386:
python-2.4.3-24.el5_3.6.i386.rpm
python-debuginfo-2.4.3-24.el5_3.6.i386.rpm
python-devel-2.4.3-24.el5_3.6.i386.rpm
python-tools-2.4.3-24.el5_3.6.i386.rpm
tkinter-2.4.3-24.el5_3.6.i386.rpm

ia64:
python-2.4.3-24.el5_3.6.ia64.rpm
python-debuginfo-2.4.3-24.el5_3.6.ia64.rpm
python-devel-2.4.3-24.el5_3.6.ia64.rpm
python-tools-2.4.3-24.el5_3.6.ia64.rpm
tkinter-2.4.3-24.el5_3.6.ia64.rpm

ppc:
python-2.4.3-24.el5_3.6.ppc.rpm
python-debuginfo-2.4.3-24.el5_3.6.ppc.rpm
python-debuginfo-2.4.3-24.el5_3.6.ppc64.rpm
python-devel-2.4.3-24.el5_3.6.ppc.rpm
python-devel-2.4.3-24.el5_3.6.ppc64.rpm
python-tools-2.4.3-24.el5_3.6.ppc.rpm
tkinter-2.4.3-24.el5_3.6.ppc.rpm

s390x:
python-2.4.3-24.el5_3.6.s390x.rpm
python-debuginfo-2.4.3-24.el5_3.6.s390.rpm
python-debuginfo-2.4.3-24.el5_3.6.s390x.rpm
python-devel-2.4.3-24.el5_3.6.s390.rpm
python-devel-2.4.3-24.el5_3.6.s390x.rpm
python-tools-2.4.3-24.el5_3.6.s390x.rpm
tkinter-2.4.3-24.el5_3.6.s390x.rpm

x86_64:
python-2.4.3-24.el5_3.6.x86_64.rpm
python-debuginfo-2.4.3-24.el5_3.6.i386.rpm
python-debuginfo-2.4.3-24.el5_3.6.x86_64.rpm
python-devel-2.4.3-24.el5_3.6.i386.rpm
python-devel-2.4.3-24.el5_3.6.x86_64.rpm
python-tools-2.4.3-24.el5_3.6.x86_64.rpm
tkinter-2.4.3-24.el5_3.6.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2052
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4965
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1721
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1887
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2315
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3142
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3143
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3144
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4864
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5031
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKbYwvXlSAg2UNWIIRAqSnAJwIqfP8AFKHLT3nsa/DpasILxx6PwCeM7Sy
O+IpJin8qcW+vuUDj557fDM=
=oPYs
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Mon Jul 27 11:15:42 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Mon, 27 Jul 2009 07:15:42 -0400
Subject: [RHSA-2009:1177-01] Moderate: python security update
Message-ID: <200907271115.n6RBFgPF024882@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: python security update
Advisory ID:       RHSA-2009:1177-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1177.html
Issue date:        2009-07-27
CVE Names:         CVE-2008-1679 CVE-2008-1721 CVE-2008-1887 
                   CVE-2008-2315 CVE-2008-3142 CVE-2008-3143 
                   CVE-2008-3144 CVE-2008-4864 CVE-2008-5031 
=====================================================================

1. Summary:

Updated python packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Description:

Python is an interpreted, interactive, object-oriented programming
language.

When the assert() system call was disabled, an input sanitization flaw was
revealed in the Python string object implementation that led to a buffer
overflow. The missing check for negative size values meant the Python
memory allocator could allocate less memory than expected. This could
result in arbitrary code execution with the Python interpreter's
privileges. (CVE-2008-1887)

Multiple buffer and integer overflow flaws were found in the Python Unicode
string processing and in the Python Unicode and string object
implementations. An attacker could use these flaws to cause a denial of
service (Python application crash). (CVE-2008-3142, CVE-2008-5031)

Multiple integer overflow flaws were found in the Python imageop module. If
a Python application used the imageop module to process untrusted images,
it could cause the application to crash or, potentially, execute arbitrary
code with the Python interpreter's privileges. (CVE-2008-1679,
CVE-2008-4864)

Multiple integer underflow and overflow flaws were found in the Python
snprintf() wrapper implementation. An attacker could use these flaws to
cause a denial of service (memory corruption). (CVE-2008-3144)

Multiple integer overflow flaws were found in various Python modules. An
attacker could use these flaws to cause a denial of service (Python
application crash). (CVE-2008-2315, CVE-2008-3143)

An integer signedness error, leading to a buffer overflow, was found
in the Python zlib extension module. If a Python application requested
the negative byte count be flushed for a decompression stream, it could
cause the application to crash or, potentially, execute arbitrary code
with the Python interpreter's privileges. (CVE-2008-1721)

Red Hat would like to thank David Remahl of the Apple Product Security team
for responsibly reporting the CVE-2008-1679 and CVE-2008-2315 issues.

All Python users should upgrade to these updated packages, which contain
backported patches to correct these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

441306 - CVE-2008-1679 python: imageop module integer overflows
442005 - CVE-2008-1721 python: integer signedness error in the zlib extension module
443810 - CVE-2008-1887 python: PyString_FromStringAndSize does not check for negative size values
454990 - CVE-2008-3142 python: Multiple buffer overflows in unicode processing
455008 - CVE-2008-2315 python: Multiple integer overflows in python core
455013 - CVE-2008-3143 python: Multiple integer overflows discovered by Google
455018 - CVE-2008-3144 python: Potential integer underflow and overflow in the PyOS_vsnprintf C API function
469656 - CVE-2008-4864 python: imageop module multiple integer overflows
470915 - CVE-2008-5031 python: stringobject, unicodeobject integer overflows

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/python-2.3.4-14.7.el4_8.2.src.rpm

i386:
python-2.3.4-14.7.el4_8.2.i386.rpm
python-debuginfo-2.3.4-14.7.el4_8.2.i386.rpm
python-devel-2.3.4-14.7.el4_8.2.i386.rpm
python-docs-2.3.4-14.7.el4_8.2.i386.rpm
python-tools-2.3.4-14.7.el4_8.2.i386.rpm
tkinter-2.3.4-14.7.el4_8.2.i386.rpm

ia64:
python-2.3.4-14.7.el4_8.2.ia64.rpm
python-debuginfo-2.3.4-14.7.el4_8.2.ia64.rpm
python-devel-2.3.4-14.7.el4_8.2.ia64.rpm
python-docs-2.3.4-14.7.el4_8.2.ia64.rpm
python-tools-2.3.4-14.7.el4_8.2.ia64.rpm
tkinter-2.3.4-14.7.el4_8.2.ia64.rpm

ppc:
python-2.3.4-14.7.el4_8.2.ppc.rpm
python-debuginfo-2.3.4-14.7.el4_8.2.ppc.rpm
python-devel-2.3.4-14.7.el4_8.2.ppc.rpm
python-docs-2.3.4-14.7.el4_8.2.ppc.rpm
python-tools-2.3.4-14.7.el4_8.2.ppc.rpm
tkinter-2.3.4-14.7.el4_8.2.ppc.rpm

s390:
python-2.3.4-14.7.el4_8.2.s390.rpm
python-debuginfo-2.3.4-14.7.el4_8.2.s390.rpm
python-devel-2.3.4-14.7.el4_8.2.s390.rpm
python-docs-2.3.4-14.7.el4_8.2.s390.rpm
python-tools-2.3.4-14.7.el4_8.2.s390.rpm
tkinter-2.3.4-14.7.el4_8.2.s390.rpm

s390x:
python-2.3.4-14.7.el4_8.2.s390x.rpm
python-debuginfo-2.3.4-14.7.el4_8.2.s390x.rpm
python-devel-2.3.4-14.7.el4_8.2.s390x.rpm
python-docs-2.3.4-14.7.el4_8.2.s390x.rpm
python-tools-2.3.4-14.7.el4_8.2.s390x.rpm
tkinter-2.3.4-14.7.el4_8.2.s390x.rpm

x86_64:
python-2.3.4-14.7.el4_8.2.x86_64.rpm
python-debuginfo-2.3.4-14.7.el4_8.2.x86_64.rpm
python-devel-2.3.4-14.7.el4_8.2.x86_64.rpm
python-docs-2.3.4-14.7.el4_8.2.x86_64.rpm
python-tools-2.3.4-14.7.el4_8.2.x86_64.rpm
tkinter-2.3.4-14.7.el4_8.2.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/python-2.3.4-14.7.el4_8.2.src.rpm

i386:
python-2.3.4-14.7.el4_8.2.i386.rpm
python-debuginfo-2.3.4-14.7.el4_8.2.i386.rpm
python-devel-2.3.4-14.7.el4_8.2.i386.rpm
python-docs-2.3.4-14.7.el4_8.2.i386.rpm
python-tools-2.3.4-14.7.el4_8.2.i386.rpm
tkinter-2.3.4-14.7.el4_8.2.i386.rpm

x86_64:
python-2.3.4-14.7.el4_8.2.x86_64.rpm
python-debuginfo-2.3.4-14.7.el4_8.2.x86_64.rpm
python-devel-2.3.4-14.7.el4_8.2.x86_64.rpm
python-docs-2.3.4-14.7.el4_8.2.x86_64.rpm
python-tools-2.3.4-14.7.el4_8.2.x86_64.rpm
tkinter-2.3.4-14.7.el4_8.2.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/python-2.3.4-14.7.el4_8.2.src.rpm

i386:
python-2.3.4-14.7.el4_8.2.i386.rpm
python-debuginfo-2.3.4-14.7.el4_8.2.i386.rpm
python-devel-2.3.4-14.7.el4_8.2.i386.rpm
python-docs-2.3.4-14.7.el4_8.2.i386.rpm
python-tools-2.3.4-14.7.el4_8.2.i386.rpm
tkinter-2.3.4-14.7.el4_8.2.i386.rpm

ia64:
python-2.3.4-14.7.el4_8.2.ia64.rpm
python-debuginfo-2.3.4-14.7.el4_8.2.ia64.rpm
python-devel-2.3.4-14.7.el4_8.2.ia64.rpm
python-docs-2.3.4-14.7.el4_8.2.ia64.rpm
python-tools-2.3.4-14.7.el4_8.2.ia64.rpm
tkinter-2.3.4-14.7.el4_8.2.ia64.rpm

x86_64:
python-2.3.4-14.7.el4_8.2.x86_64.rpm
python-debuginfo-2.3.4-14.7.el4_8.2.x86_64.rpm
python-devel-2.3.4-14.7.el4_8.2.x86_64.rpm
python-docs-2.3.4-14.7.el4_8.2.x86_64.rpm
python-tools-2.3.4-14.7.el4_8.2.x86_64.rpm
tkinter-2.3.4-14.7.el4_8.2.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/python-2.3.4-14.7.el4_8.2.src.rpm

i386:
python-2.3.4-14.7.el4_8.2.i386.rpm
python-debuginfo-2.3.4-14.7.el4_8.2.i386.rpm
python-devel-2.3.4-14.7.el4_8.2.i386.rpm
python-docs-2.3.4-14.7.el4_8.2.i386.rpm
python-tools-2.3.4-14.7.el4_8.2.i386.rpm
tkinter-2.3.4-14.7.el4_8.2.i386.rpm

ia64:
python-2.3.4-14.7.el4_8.2.ia64.rpm
python-debuginfo-2.3.4-14.7.el4_8.2.ia64.rpm
python-devel-2.3.4-14.7.el4_8.2.ia64.rpm
python-docs-2.3.4-14.7.el4_8.2.ia64.rpm
python-tools-2.3.4-14.7.el4_8.2.ia64.rpm
tkinter-2.3.4-14.7.el4_8.2.ia64.rpm

x86_64:
python-2.3.4-14.7.el4_8.2.x86_64.rpm
python-debuginfo-2.3.4-14.7.el4_8.2.x86_64.rpm
python-devel-2.3.4-14.7.el4_8.2.x86_64.rpm
python-docs-2.3.4-14.7.el4_8.2.x86_64.rpm
python-tools-2.3.4-14.7.el4_8.2.x86_64.rpm
tkinter-2.3.4-14.7.el4_8.2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1679
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1721
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1887
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2315
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3142
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3143
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3144
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4864
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5031
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKbYxQXlSAg2UNWIIRAm5iAKCOsespzDcQHy0owl12JEemOpRPxwCgm/Iw
oPv/jBa+fQ/3pog/8tKEeXc=
=feg9
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Mon Jul 27 11:16:05 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Mon, 27 Jul 2009 07:16:05 -0400
Subject: [RHSA-2009:1178-02] Moderate: python security update
Message-ID: <200907271116.n6RBG5hj025078@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: python security update
Advisory ID:       RHSA-2009:1178-02
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1178.html
Issue date:        2009-07-27
CVE Names:         CVE-2008-1679 CVE-2008-1887 CVE-2008-2315 
                   CVE-2008-3142 CVE-2008-3143 CVE-2008-3144 
                   CVE-2008-4864 CVE-2008-5031 
=====================================================================

1. Summary:

Updated python packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

3. Description:

Python is an interpreted, interactive, object-oriented programming
language.

When the assert() system call was disabled, an input sanitization flaw was
revealed in the Python string object implementation that led to a buffer
overflow. The missing check for negative size values meant the Python
memory allocator could allocate less memory than expected. This could
result in arbitrary code execution with the Python interpreter's
privileges. (CVE-2008-1887)

Multiple buffer and integer overflow flaws were found in the Python Unicode
string processing and in the Python Unicode and string object
implementations. An attacker could use these flaws to cause a denial of
service (Python application crash). (CVE-2008-3142, CVE-2008-5031)

Multiple integer overflow flaws were found in the Python imageop module. If
a Python application used the imageop module to process untrusted images,
it could cause the application to crash or, potentially, execute arbitrary
code with the Python interpreter's privileges. (CVE-2008-1679,
CVE-2008-4864)

Multiple integer underflow and overflow flaws were found in the Python
snprintf() wrapper implementation. An attacker could use these flaws to
cause a denial of service (memory corruption). (CVE-2008-3144)

Multiple integer overflow flaws were found in various Python modules. An
attacker could use these flaws to cause a denial of service (Python
application crash). (CVE-2008-2315, CVE-2008-3143)

Red Hat would like to thank David Remahl of the Apple Product Security team
for responsibly reporting the CVE-2008-1679 and CVE-2008-2315 issues.

All Python users should upgrade to these updated packages, which contain
backported patches to correct these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

441306 - CVE-2008-1679 python: imageop module integer overflows
443810 - CVE-2008-1887 python: PyString_FromStringAndSize does not check for negative size values
454990 - CVE-2008-3142 python: Multiple buffer overflows in unicode processing
455008 - CVE-2008-2315 python: Multiple integer overflows in python core
455013 - CVE-2008-3143 python: Multiple integer overflows discovered by Google
455018 - CVE-2008-3144 python: Potential integer underflow and overflow in the PyOS_vsnprintf C API function
469656 - CVE-2008-4864 python: imageop module multiple integer overflows
470915 - CVE-2008-5031 python: stringobject, unicodeobject integer overflows

6. Package List:

Red Hat Enterprise Linux AS version 3:

Source:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/python-2.2.3-6.11.src.rpm

i386:
python-2.2.3-6.11.i386.rpm
python-debuginfo-2.2.3-6.11.i386.rpm
python-devel-2.2.3-6.11.i386.rpm
python-tools-2.2.3-6.11.i386.rpm
tkinter-2.2.3-6.11.i386.rpm

ia64:
python-2.2.3-6.11.ia64.rpm
python-debuginfo-2.2.3-6.11.ia64.rpm
python-devel-2.2.3-6.11.ia64.rpm
python-tools-2.2.3-6.11.ia64.rpm
tkinter-2.2.3-6.11.ia64.rpm

ppc:
python-2.2.3-6.11.ppc.rpm
python-debuginfo-2.2.3-6.11.ppc.rpm
python-devel-2.2.3-6.11.ppc.rpm
python-tools-2.2.3-6.11.ppc.rpm
tkinter-2.2.3-6.11.ppc.rpm

s390:
python-2.2.3-6.11.s390.rpm
python-debuginfo-2.2.3-6.11.s390.rpm
python-devel-2.2.3-6.11.s390.rpm
python-tools-2.2.3-6.11.s390.rpm
tkinter-2.2.3-6.11.s390.rpm

s390x:
python-2.2.3-6.11.s390x.rpm
python-debuginfo-2.2.3-6.11.s390x.rpm
python-devel-2.2.3-6.11.s390x.rpm
python-tools-2.2.3-6.11.s390x.rpm
tkinter-2.2.3-6.11.s390x.rpm

x86_64:
python-2.2.3-6.11.x86_64.rpm
python-debuginfo-2.2.3-6.11.x86_64.rpm
python-devel-2.2.3-6.11.x86_64.rpm
python-tools-2.2.3-6.11.x86_64.rpm
tkinter-2.2.3-6.11.x86_64.rpm

Red Hat Desktop version 3:

Source:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/python-2.2.3-6.11.src.rpm

i386:
python-2.2.3-6.11.i386.rpm
python-debuginfo-2.2.3-6.11.i386.rpm
python-devel-2.2.3-6.11.i386.rpm
python-tools-2.2.3-6.11.i386.rpm
tkinter-2.2.3-6.11.i386.rpm

x86_64:
python-2.2.3-6.11.x86_64.rpm
python-debuginfo-2.2.3-6.11.x86_64.rpm
python-devel-2.2.3-6.11.x86_64.rpm
python-tools-2.2.3-6.11.x86_64.rpm
tkinter-2.2.3-6.11.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

Source:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/python-2.2.3-6.11.src.rpm

i386:
python-2.2.3-6.11.i386.rpm
python-debuginfo-2.2.3-6.11.i386.rpm
python-devel-2.2.3-6.11.i386.rpm
python-tools-2.2.3-6.11.i386.rpm
tkinter-2.2.3-6.11.i386.rpm

ia64:
python-2.2.3-6.11.ia64.rpm
python-debuginfo-2.2.3-6.11.ia64.rpm
python-devel-2.2.3-6.11.ia64.rpm
python-tools-2.2.3-6.11.ia64.rpm
tkinter-2.2.3-6.11.ia64.rpm

x86_64:
python-2.2.3-6.11.x86_64.rpm
python-debuginfo-2.2.3-6.11.x86_64.rpm
python-devel-2.2.3-6.11.x86_64.rpm
python-tools-2.2.3-6.11.x86_64.rpm
tkinter-2.2.3-6.11.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

Source:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/python-2.2.3-6.11.src.rpm

i386:
python-2.2.3-6.11.i386.rpm
python-debuginfo-2.2.3-6.11.i386.rpm
python-devel-2.2.3-6.11.i386.rpm
python-tools-2.2.3-6.11.i386.rpm
tkinter-2.2.3-6.11.i386.rpm

ia64:
python-2.2.3-6.11.ia64.rpm
python-debuginfo-2.2.3-6.11.ia64.rpm
python-devel-2.2.3-6.11.ia64.rpm
python-tools-2.2.3-6.11.ia64.rpm
tkinter-2.2.3-6.11.ia64.rpm

x86_64:
python-2.2.3-6.11.x86_64.rpm
python-debuginfo-2.2.3-6.11.x86_64.rpm
python-devel-2.2.3-6.11.x86_64.rpm
python-tools-2.2.3-6.11.x86_64.rpm
tkinter-2.2.3-6.11.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1679
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1887
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2315
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3142
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3143
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3144
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4864
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5031
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKbYxlXlSAg2UNWIIRAvzOAKDDzUCHcrgwWchAMcGg6JKQdt3F+ACfVhSK
lj7TkpspKqtNeqcRopBcAWE=
=TXrO
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Thu Jul 30 00:11:32 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Wed, 29 Jul 2009 20:11:32 -0400
Subject: [RHSA-2009:1179-02] Important: bind security update
Message-ID: <200907300011.n6U0BWk2002545@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: bind security update
Advisory ID:       RHSA-2009:1179-02
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1179.html
Issue date:        2009-07-29
CVE Names:         CVE-2009-0696 
=====================================================================

1. Summary:

Updated bind packages that fix a security issue are now available for Red
Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

[Updated 29th July 2009]
The packages in this erratum have been updated to also correct this issue
in the bind-sdb package.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Description:

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain
Name System (DNS) protocols. BIND includes a DNS server (named); a resolver
library (routines for applications to use when interfacing with DNS); and
tools for verifying that the DNS server is operating correctly.

A flaw was found in the way BIND handles dynamic update message packets
containing the "ANY" record type. A remote attacker could use this flaw to
send a specially-crafted dynamic update packet that could cause named to
exit with an assertion failure. (CVE-2009-0696)

Note: even if named is not configured for dynamic updates, receiving such
a specially-crafted dynamic update packet could still cause named to exit
unexpectedly.

All BIND users are advised to upgrade to these updated packages, which
contain a backported patch to resolve this issue. After installing the
update, the BIND daemon (named) will be restarted automatically.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

514292 - CVE-2009-0696 bind: DoS (assertion failure) via nsupdate packets

6. Package List:

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/bind-9.3.4-10.P1.el5_3.3.src.rpm

i386:
bind-9.3.4-10.P1.el5_3.3.i386.rpm
bind-debuginfo-9.3.4-10.P1.el5_3.3.i386.rpm
bind-libs-9.3.4-10.P1.el5_3.3.i386.rpm
bind-sdb-9.3.4-10.P1.el5_3.3.i386.rpm
bind-utils-9.3.4-10.P1.el5_3.3.i386.rpm

x86_64:
bind-9.3.4-10.P1.el5_3.3.x86_64.rpm
bind-debuginfo-9.3.4-10.P1.el5_3.3.i386.rpm
bind-debuginfo-9.3.4-10.P1.el5_3.3.x86_64.rpm
bind-libs-9.3.4-10.P1.el5_3.3.i386.rpm
bind-libs-9.3.4-10.P1.el5_3.3.x86_64.rpm
bind-sdb-9.3.4-10.P1.el5_3.3.x86_64.rpm
bind-utils-9.3.4-10.P1.el5_3.3.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/bind-9.3.4-10.P1.el5_3.3.src.rpm

i386:
bind-chroot-9.3.4-10.P1.el5_3.3.i386.rpm
bind-debuginfo-9.3.4-10.P1.el5_3.3.i386.rpm
bind-devel-9.3.4-10.P1.el5_3.3.i386.rpm
bind-libbind-devel-9.3.4-10.P1.el5_3.3.i386.rpm
caching-nameserver-9.3.4-10.P1.el5_3.3.i386.rpm

x86_64:
bind-chroot-9.3.4-10.P1.el5_3.3.x86_64.rpm
bind-debuginfo-9.3.4-10.P1.el5_3.3.i386.rpm
bind-debuginfo-9.3.4-10.P1.el5_3.3.x86_64.rpm
bind-devel-9.3.4-10.P1.el5_3.3.i386.rpm
bind-devel-9.3.4-10.P1.el5_3.3.x86_64.rpm
bind-libbind-devel-9.3.4-10.P1.el5_3.3.i386.rpm
bind-libbind-devel-9.3.4-10.P1.el5_3.3.x86_64.rpm
caching-nameserver-9.3.4-10.P1.el5_3.3.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/bind-9.3.4-10.P1.el5_3.3.src.rpm

i386:
bind-9.3.4-10.P1.el5_3.3.i386.rpm
bind-chroot-9.3.4-10.P1.el5_3.3.i386.rpm
bind-debuginfo-9.3.4-10.P1.el5_3.3.i386.rpm
bind-devel-9.3.4-10.P1.el5_3.3.i386.rpm
bind-libbind-devel-9.3.4-10.P1.el5_3.3.i386.rpm
bind-libs-9.3.4-10.P1.el5_3.3.i386.rpm
bind-sdb-9.3.4-10.P1.el5_3.3.i386.rpm
bind-utils-9.3.4-10.P1.el5_3.3.i386.rpm
caching-nameserver-9.3.4-10.P1.el5_3.3.i386.rpm

ia64:
bind-9.3.4-10.P1.el5_3.3.ia64.rpm
bind-chroot-9.3.4-10.P1.el5_3.3.ia64.rpm
bind-debuginfo-9.3.4-10.P1.el5_3.3.i386.rpm
bind-debuginfo-9.3.4-10.P1.el5_3.3.ia64.rpm
bind-devel-9.3.4-10.P1.el5_3.3.ia64.rpm
bind-libbind-devel-9.3.4-10.P1.el5_3.3.ia64.rpm
bind-libs-9.3.4-10.P1.el5_3.3.i386.rpm
bind-libs-9.3.4-10.P1.el5_3.3.ia64.rpm
bind-sdb-9.3.4-10.P1.el5_3.3.ia64.rpm
bind-utils-9.3.4-10.P1.el5_3.3.ia64.rpm
caching-nameserver-9.3.4-10.P1.el5_3.3.ia64.rpm

ppc:
bind-9.3.4-10.P1.el5_3.3.ppc.rpm
bind-chroot-9.3.4-10.P1.el5_3.3.ppc.rpm
bind-debuginfo-9.3.4-10.P1.el5_3.3.ppc.rpm
bind-debuginfo-9.3.4-10.P1.el5_3.3.ppc64.rpm
bind-devel-9.3.4-10.P1.el5_3.3.ppc.rpm
bind-devel-9.3.4-10.P1.el5_3.3.ppc64.rpm
bind-libbind-devel-9.3.4-10.P1.el5_3.3.ppc.rpm
bind-libbind-devel-9.3.4-10.P1.el5_3.3.ppc64.rpm
bind-libs-9.3.4-10.P1.el5_3.3.ppc.rpm
bind-libs-9.3.4-10.P1.el5_3.3.ppc64.rpm
bind-sdb-9.3.4-10.P1.el5_3.3.ppc.rpm
bind-utils-9.3.4-10.P1.el5_3.3.ppc.rpm
caching-nameserver-9.3.4-10.P1.el5_3.3.ppc.rpm

s390x:
bind-9.3.4-10.P1.el5_3.3.s390x.rpm
bind-chroot-9.3.4-10.P1.el5_3.3.s390x.rpm
bind-debuginfo-9.3.4-10.P1.el5_3.3.s390.rpm
bind-debuginfo-9.3.4-10.P1.el5_3.3.s390x.rpm
bind-devel-9.3.4-10.P1.el5_3.3.s390.rpm
bind-devel-9.3.4-10.P1.el5_3.3.s390x.rpm
bind-libbind-devel-9.3.4-10.P1.el5_3.3.s390.rpm
bind-libbind-devel-9.3.4-10.P1.el5_3.3.s390x.rpm
bind-libs-9.3.4-10.P1.el5_3.3.s390.rpm
bind-libs-9.3.4-10.P1.el5_3.3.s390x.rpm
bind-sdb-9.3.4-10.P1.el5_3.3.s390x.rpm
bind-utils-9.3.4-10.P1.el5_3.3.s390x.rpm
caching-nameserver-9.3.4-10.P1.el5_3.3.s390x.rpm

x86_64:
bind-9.3.4-10.P1.el5_3.3.x86_64.rpm
bind-chroot-9.3.4-10.P1.el5_3.3.x86_64.rpm
bind-debuginfo-9.3.4-10.P1.el5_3.3.i386.rpm
bind-debuginfo-9.3.4-10.P1.el5_3.3.x86_64.rpm
bind-devel-9.3.4-10.P1.el5_3.3.i386.rpm
bind-devel-9.3.4-10.P1.el5_3.3.x86_64.rpm
bind-libbind-devel-9.3.4-10.P1.el5_3.3.i386.rpm
bind-libbind-devel-9.3.4-10.P1.el5_3.3.x86_64.rpm
bind-libs-9.3.4-10.P1.el5_3.3.i386.rpm
bind-libs-9.3.4-10.P1.el5_3.3.x86_64.rpm
bind-sdb-9.3.4-10.P1.el5_3.3.x86_64.rpm
bind-utils-9.3.4-10.P1.el5_3.3.x86_64.rpm
caching-nameserver-9.3.4-10.P1.el5_3.3.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0696
http://www.redhat.com/security/updates/classification/#important
https://www.isc.org/node/474

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKcOUnXlSAg2UNWIIRAgjTAJ9gTxT2/kED8Fho4amQj4FCRTD0UgCeOkEy
envYRnabnwMKJ10bbe/uNBQ=
=pwJM
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Thu Jul 30 00:11:44 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Wed, 29 Jul 2009 20:11:44 -0400
Subject: [RHSA-2009:1180-01] Important: bind security and bug fix update
Message-ID: <200907300011.n6U0Biac002587@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: bind security and bug fix update
Advisory ID:       RHSA-2009:1180-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1180.html
Issue date:        2009-07-29
CVE Names:         CVE-2009-0696 
=====================================================================

1. Summary:

Updated bind packages that fix a security issue and a bug are now available
for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Description:

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain
Name System (DNS) protocols. BIND includes a DNS server (named); a resolver
library (routines for applications to use when interfacing with DNS); and
tools for verifying that the DNS server is operating correctly.

A flaw was found in the way BIND handles dynamic update message packets
containing the "ANY" record type. A remote attacker could use this flaw to
send a specially-crafted dynamic update packet that could cause named to
exit with an assertion failure. (CVE-2009-0696)

Note: even if named is not configured for dynamic updates, receiving such
a specially-crafted dynamic update packet could still cause named to exit
unexpectedly.

This update also fixes the following bug:

* when running on a system receiving a large number of (greater than 4,000)
DNS requests per second, the named DNS nameserver became unresponsive, and
the named service had to be restarted in order for it to continue serving
requests. This was caused by a deadlock occurring between two threads that
led to the inability of named to continue to service requests. This
deadlock has been resolved with these updated packages so that named no
longer becomes unresponsive under heavy load. (BZ#512668)

All BIND users are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues. After installing the
update, the BIND daemon (named) will be restarted automatically.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

512668 - bind gets hung with 4000 accesses / sec
514292 - CVE-2009-0696 bind: DoS (assertion failure) via nsupdate packets

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/bind-9.2.4-30.el4_8.4.src.rpm

i386:
bind-9.2.4-30.el4_8.4.i386.rpm
bind-chroot-9.2.4-30.el4_8.4.i386.rpm
bind-debuginfo-9.2.4-30.el4_8.4.i386.rpm
bind-devel-9.2.4-30.el4_8.4.i386.rpm
bind-libs-9.2.4-30.el4_8.4.i386.rpm
bind-utils-9.2.4-30.el4_8.4.i386.rpm

ia64:
bind-9.2.4-30.el4_8.4.ia64.rpm
bind-chroot-9.2.4-30.el4_8.4.ia64.rpm
bind-debuginfo-9.2.4-30.el4_8.4.i386.rpm
bind-debuginfo-9.2.4-30.el4_8.4.ia64.rpm
bind-devel-9.2.4-30.el4_8.4.ia64.rpm
bind-libs-9.2.4-30.el4_8.4.i386.rpm
bind-libs-9.2.4-30.el4_8.4.ia64.rpm
bind-utils-9.2.4-30.el4_8.4.ia64.rpm

ppc:
bind-9.2.4-30.el4_8.4.ppc.rpm
bind-chroot-9.2.4-30.el4_8.4.ppc.rpm
bind-debuginfo-9.2.4-30.el4_8.4.ppc.rpm
bind-debuginfo-9.2.4-30.el4_8.4.ppc64.rpm
bind-devel-9.2.4-30.el4_8.4.ppc.rpm
bind-libs-9.2.4-30.el4_8.4.ppc.rpm
bind-libs-9.2.4-30.el4_8.4.ppc64.rpm
bind-utils-9.2.4-30.el4_8.4.ppc.rpm

s390:
bind-9.2.4-30.el4_8.4.s390.rpm
bind-chroot-9.2.4-30.el4_8.4.s390.rpm
bind-debuginfo-9.2.4-30.el4_8.4.s390.rpm
bind-devel-9.2.4-30.el4_8.4.s390.rpm
bind-libs-9.2.4-30.el4_8.4.s390.rpm
bind-utils-9.2.4-30.el4_8.4.s390.rpm

s390x:
bind-9.2.4-30.el4_8.4.s390x.rpm
bind-chroot-9.2.4-30.el4_8.4.s390x.rpm
bind-debuginfo-9.2.4-30.el4_8.4.s390.rpm
bind-debuginfo-9.2.4-30.el4_8.4.s390x.rpm
bind-devel-9.2.4-30.el4_8.4.s390x.rpm
bind-libs-9.2.4-30.el4_8.4.s390.rpm
bind-libs-9.2.4-30.el4_8.4.s390x.rpm
bind-utils-9.2.4-30.el4_8.4.s390x.rpm

x86_64:
bind-9.2.4-30.el4_8.4.x86_64.rpm
bind-chroot-9.2.4-30.el4_8.4.x86_64.rpm
bind-debuginfo-9.2.4-30.el4_8.4.i386.rpm
bind-debuginfo-9.2.4-30.el4_8.4.x86_64.rpm
bind-devel-9.2.4-30.el4_8.4.x86_64.rpm
bind-libs-9.2.4-30.el4_8.4.i386.rpm
bind-libs-9.2.4-30.el4_8.4.x86_64.rpm
bind-utils-9.2.4-30.el4_8.4.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/bind-9.2.4-30.el4_8.4.src.rpm

i386:
bind-9.2.4-30.el4_8.4.i386.rpm
bind-chroot-9.2.4-30.el4_8.4.i386.rpm
bind-debuginfo-9.2.4-30.el4_8.4.i386.rpm
bind-devel-9.2.4-30.el4_8.4.i386.rpm
bind-libs-9.2.4-30.el4_8.4.i386.rpm
bind-utils-9.2.4-30.el4_8.4.i386.rpm

x86_64:
bind-9.2.4-30.el4_8.4.x86_64.rpm
bind-chroot-9.2.4-30.el4_8.4.x86_64.rpm
bind-debuginfo-9.2.4-30.el4_8.4.i386.rpm
bind-debuginfo-9.2.4-30.el4_8.4.x86_64.rpm
bind-devel-9.2.4-30.el4_8.4.x86_64.rpm
bind-libs-9.2.4-30.el4_8.4.i386.rpm
bind-libs-9.2.4-30.el4_8.4.x86_64.rpm
bind-utils-9.2.4-30.el4_8.4.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/bind-9.2.4-30.el4_8.4.src.rpm

i386:
bind-9.2.4-30.el4_8.4.i386.rpm
bind-chroot-9.2.4-30.el4_8.4.i386.rpm
bind-debuginfo-9.2.4-30.el4_8.4.i386.rpm
bind-devel-9.2.4-30.el4_8.4.i386.rpm
bind-libs-9.2.4-30.el4_8.4.i386.rpm
bind-utils-9.2.4-30.el4_8.4.i386.rpm

ia64:
bind-9.2.4-30.el4_8.4.ia64.rpm
bind-chroot-9.2.4-30.el4_8.4.ia64.rpm
bind-debuginfo-9.2.4-30.el4_8.4.i386.rpm
bind-debuginfo-9.2.4-30.el4_8.4.ia64.rpm
bind-devel-9.2.4-30.el4_8.4.ia64.rpm
bind-libs-9.2.4-30.el4_8.4.i386.rpm
bind-libs-9.2.4-30.el4_8.4.ia64.rpm
bind-utils-9.2.4-30.el4_8.4.ia64.rpm

x86_64:
bind-9.2.4-30.el4_8.4.x86_64.rpm
bind-chroot-9.2.4-30.el4_8.4.x86_64.rpm
bind-debuginfo-9.2.4-30.el4_8.4.i386.rpm
bind-debuginfo-9.2.4-30.el4_8.4.x86_64.rpm
bind-devel-9.2.4-30.el4_8.4.x86_64.rpm
bind-libs-9.2.4-30.el4_8.4.i386.rpm
bind-libs-9.2.4-30.el4_8.4.x86_64.rpm
bind-utils-9.2.4-30.el4_8.4.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/bind-9.2.4-30.el4_8.4.src.rpm

i386:
bind-9.2.4-30.el4_8.4.i386.rpm
bind-chroot-9.2.4-30.el4_8.4.i386.rpm
bind-debuginfo-9.2.4-30.el4_8.4.i386.rpm
bind-devel-9.2.4-30.el4_8.4.i386.rpm
bind-libs-9.2.4-30.el4_8.4.i386.rpm
bind-utils-9.2.4-30.el4_8.4.i386.rpm

ia64:
bind-9.2.4-30.el4_8.4.ia64.rpm
bind-chroot-9.2.4-30.el4_8.4.ia64.rpm
bind-debuginfo-9.2.4-30.el4_8.4.i386.rpm
bind-debuginfo-9.2.4-30.el4_8.4.ia64.rpm
bind-devel-9.2.4-30.el4_8.4.ia64.rpm
bind-libs-9.2.4-30.el4_8.4.i386.rpm
bind-libs-9.2.4-30.el4_8.4.ia64.rpm
bind-utils-9.2.4-30.el4_8.4.ia64.rpm

x86_64:
bind-9.2.4-30.el4_8.4.x86_64.rpm
bind-chroot-9.2.4-30.el4_8.4.x86_64.rpm
bind-debuginfo-9.2.4-30.el4_8.4.i386.rpm
bind-debuginfo-9.2.4-30.el4_8.4.x86_64.rpm
bind-devel-9.2.4-30.el4_8.4.x86_64.rpm
bind-libs-9.2.4-30.el4_8.4.i386.rpm
bind-libs-9.2.4-30.el4_8.4.x86_64.rpm
bind-utils-9.2.4-30.el4_8.4.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0696
http://www.redhat.com/security/updates/classification/#important
https://www.isc.org/node/474

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKcOU3XlSAg2UNWIIRAkgtAJ4muSVcescu8SeZRZCvJvlhp6b4/gCfTVK+
AezcSXwu8x5EQ1guGePfdnQ=
=fKaB
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Thu Jul 30 00:12:00 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Wed, 29 Jul 2009 20:12:00 -0400
Subject: [RHSA-2009:1181-01] Important: bind security and bug fix update
Message-ID: <200907300012.n6U0C0vs002727@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: bind security and bug fix update
Advisory ID:       RHSA-2009:1181-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1181.html
Issue date:        2009-07-29
CVE Names:         CVE-2009-0696 
=====================================================================

1. Summary:

Updated bind packages that fix a security issue and a bug are now available
for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

3. Description:

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain
Name System (DNS) protocols. BIND includes a DNS server (named); a resolver
library (routines for applications to use when interfacing with DNS); and
tools for verifying that the DNS server is operating correctly.

A flaw was found in the way BIND handles dynamic update message packets
containing the "ANY" record type. A remote attacker could use this flaw to
send a specially-crafted dynamic update packet that could cause named to
exit with an assertion failure. (CVE-2009-0696)

Note: even if named is not configured for dynamic updates, receiving such
a specially-crafted dynamic update packet could still cause named to exit
unexpectedly.

This update also fixes the following bug:

* the following message could have been logged: "internal_accept: fcntl()
failed: Too many open files". With these updated packages, timeout queries
are aborted in order to reduce the number of open UDP sockets, and when the
accept() function returns an EMFILE error value, that situation is now
handled gracefully, thus resolving the issue. (BZ#498164)

All BIND users are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues. After installing the
update, the BIND daemon (named) will be restarted automatically.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

498164 - bind-9.2.4-22.el3 and too many open files
514292 - CVE-2009-0696 bind: DoS (assertion failure) via nsupdate packets

6. Package List:

Red Hat Enterprise Linux AS version 3:

Source:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/bind-9.2.4-25.el3.src.rpm

i386:
bind-9.2.4-25.el3.i386.rpm
bind-chroot-9.2.4-25.el3.i386.rpm
bind-debuginfo-9.2.4-25.el3.i386.rpm
bind-devel-9.2.4-25.el3.i386.rpm
bind-libs-9.2.4-25.el3.i386.rpm
bind-utils-9.2.4-25.el3.i386.rpm

ia64:
bind-9.2.4-25.el3.ia64.rpm
bind-chroot-9.2.4-25.el3.ia64.rpm
bind-debuginfo-9.2.4-25.el3.ia64.rpm
bind-devel-9.2.4-25.el3.ia64.rpm
bind-libs-9.2.4-25.el3.ia64.rpm
bind-utils-9.2.4-25.el3.ia64.rpm

ppc:
bind-9.2.4-25.el3.ppc.rpm
bind-chroot-9.2.4-25.el3.ppc.rpm
bind-debuginfo-9.2.4-25.el3.ppc.rpm
bind-devel-9.2.4-25.el3.ppc.rpm
bind-libs-9.2.4-25.el3.ppc.rpm
bind-utils-9.2.4-25.el3.ppc.rpm

s390:
bind-9.2.4-25.el3.s390.rpm
bind-chroot-9.2.4-25.el3.s390.rpm
bind-debuginfo-9.2.4-25.el3.s390.rpm
bind-devel-9.2.4-25.el3.s390.rpm
bind-libs-9.2.4-25.el3.s390.rpm
bind-utils-9.2.4-25.el3.s390.rpm

s390x:
bind-9.2.4-25.el3.s390x.rpm
bind-chroot-9.2.4-25.el3.s390x.rpm
bind-debuginfo-9.2.4-25.el3.s390x.rpm
bind-devel-9.2.4-25.el3.s390x.rpm
bind-libs-9.2.4-25.el3.s390x.rpm
bind-utils-9.2.4-25.el3.s390x.rpm

x86_64:
bind-9.2.4-25.el3.x86_64.rpm
bind-chroot-9.2.4-25.el3.x86_64.rpm
bind-debuginfo-9.2.4-25.el3.x86_64.rpm
bind-devel-9.2.4-25.el3.x86_64.rpm
bind-libs-9.2.4-25.el3.x86_64.rpm
bind-utils-9.2.4-25.el3.x86_64.rpm

Red Hat Desktop version 3:

Source:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/bind-9.2.4-25.el3.src.rpm

i386:
bind-9.2.4-25.el3.i386.rpm
bind-chroot-9.2.4-25.el3.i386.rpm
bind-debuginfo-9.2.4-25.el3.i386.rpm
bind-devel-9.2.4-25.el3.i386.rpm
bind-libs-9.2.4-25.el3.i386.rpm
bind-utils-9.2.4-25.el3.i386.rpm

x86_64:
bind-9.2.4-25.el3.x86_64.rpm
bind-chroot-9.2.4-25.el3.x86_64.rpm
bind-debuginfo-9.2.4-25.el3.x86_64.rpm
bind-devel-9.2.4-25.el3.x86_64.rpm
bind-libs-9.2.4-25.el3.x86_64.rpm
bind-utils-9.2.4-25.el3.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

Source:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/bind-9.2.4-25.el3.src.rpm

i386:
bind-9.2.4-25.el3.i386.rpm
bind-chroot-9.2.4-25.el3.i386.rpm
bind-debuginfo-9.2.4-25.el3.i386.rpm
bind-devel-9.2.4-25.el3.i386.rpm
bind-libs-9.2.4-25.el3.i386.rpm
bind-utils-9.2.4-25.el3.i386.rpm

ia64:
bind-9.2.4-25.el3.ia64.rpm
bind-chroot-9.2.4-25.el3.ia64.rpm
bind-debuginfo-9.2.4-25.el3.ia64.rpm
bind-devel-9.2.4-25.el3.ia64.rpm
bind-libs-9.2.4-25.el3.ia64.rpm
bind-utils-9.2.4-25.el3.ia64.rpm

x86_64:
bind-9.2.4-25.el3.x86_64.rpm
bind-chroot-9.2.4-25.el3.x86_64.rpm
bind-debuginfo-9.2.4-25.el3.x86_64.rpm
bind-devel-9.2.4-25.el3.x86_64.rpm
bind-libs-9.2.4-25.el3.x86_64.rpm
bind-utils-9.2.4-25.el3.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

Source:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/bind-9.2.4-25.el3.src.rpm

i386:
bind-9.2.4-25.el3.i386.rpm
bind-chroot-9.2.4-25.el3.i386.rpm
bind-debuginfo-9.2.4-25.el3.i386.rpm
bind-devel-9.2.4-25.el3.i386.rpm
bind-libs-9.2.4-25.el3.i386.rpm
bind-utils-9.2.4-25.el3.i386.rpm

ia64:
bind-9.2.4-25.el3.ia64.rpm
bind-chroot-9.2.4-25.el3.ia64.rpm
bind-debuginfo-9.2.4-25.el3.ia64.rpm
bind-devel-9.2.4-25.el3.ia64.rpm
bind-libs-9.2.4-25.el3.ia64.rpm
bind-utils-9.2.4-25.el3.ia64.rpm

x86_64:
bind-9.2.4-25.el3.x86_64.rpm
bind-chroot-9.2.4-25.el3.x86_64.rpm
bind-debuginfo-9.2.4-25.el3.x86_64.rpm
bind-devel-9.2.4-25.el3.x86_64.rpm
bind-libs-9.2.4-25.el3.x86_64.rpm
bind-utils-9.2.4-25.el3.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0696
http://www.redhat.com/security/updates/classification/#important
https://www.isc.org/node/474

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKcOVGXlSAg2UNWIIRAvYfAKCrHpZMjUlf9S610OOUc8LpQKulQwCgjv4Q
NE4PF2F7XzJRJiIrsfeHbws=
=EzZB
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Thu Jul 30 22:12:44 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Thu, 30 Jul 2009 18:12:44 -0400
Subject: [RHSA-2009:1184-01] Critical: nspr and nss security and bug fix
	update
Message-ID: <200907302212.n6UMCihe015073@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: nspr and nss security and bug fix update
Advisory ID:       RHSA-2009:1184-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1184.html
Issue date:        2009-07-30
CVE Names:         CVE-2009-2404 CVE-2009-2408 CVE-2009-2409 
=====================================================================

1. Summary:

Updated nspr and nss packages that fix security issues and a bug are now
available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Description:

Netscape Portable Runtime (NSPR) provides platform independence for non-GUI
operating system facilities. These facilities include threads, thread
synchronization, normal file and network I/O, interval timing, calendar
time, basic memory management (malloc and free), and shared library linking.

Network Security Services (NSS) is a set of libraries designed to support
the cross-platform development of security-enabled client and server
applications. Applications built with NSS can support SSLv2, SSLv3, TLS,
and other security standards.

These updated packages upgrade NSS from the previous version, 3.12.2, to a
prerelease of version 3.12.4. The version of NSPR has also been upgraded
from 4.7.3 to 4.7.4. 

Moxie Marlinspike reported a heap overflow flaw in a regular expression
parser in the NSS library used by browsers such as Mozilla Firefox to match
common names in certificates. A malicious website could present a
carefully-crafted certificate in such a way as to trigger the heap
overflow, leading to a crash or, possibly, arbitrary code execution with
the permissions of the user running the browser. (CVE-2009-2404)

Note: in order to exploit this issue without further user interaction in
Firefox, the carefully-crafted certificate would need to be signed by a
Certificate Authority trusted by Firefox, otherwise Firefox presents the
victim with a warning that the certificate is untrusted. Only if the user
then accepts the certificate will the overflow take place.

Dan Kaminsky discovered flaws in the way browsers such as Firefox handle
NULL characters in a certificate. If an attacker is able to get a
carefully-crafted certificate signed by a Certificate Authority trusted by
Firefox, the attacker could use the certificate during a man-in-the-middle
attack and potentially confuse Firefox into accepting it by mistake.
(CVE-2009-2408)

Dan Kaminsky found that browsers still accept certificates with MD2 hash
signatures, even though MD2 is no longer considered a cryptographically
strong algorithm. This could make it easier for an attacker to create a
malicious certificate that would be treated as trusted by a browser. NSS
now disables the use of MD2 and MD4 algorithms inside signatures by
default. (CVE-2009-2409)

These version upgrades also provide a fix for the following bug:

* SSL client authentication failed against an Apache server when it was 
using the mod_nss module and configured for NSSOCSP. On the client side,
the user agent received an error message that referenced "Error Code:
- -12271" and stated that establishing an encrypted connection had failed
because the certificate had been rejected by the host.

On the server side, the nss_error_log under /var/log/httpd/ contained the
following message:

[error] Re-negotiation handshake failed: Not accepted by client!?

Also, /var/log/httpd/error_log contained this error:

SSL Library Error: -8071 The OCSP server experienced an internal error

With these updated packages, the dependency problem which caused this
failure has been resolved so that SSL client authentication with an
Apache web server using mod_nss which is configured for NSSOCSP succeeds
as expected. Note that if the presented client certificate is expired,
then access is denied, the user agent is presented with an error message
about the invalid certificate, and the OCSP queries are seen in the OCSP
responder. Also, similar OCSP status verification happens for SSL server
certificates used in Apache upon instance start or restart. (BZ#508027)

All users of nspr and nss are advised to upgrade to these updated packages,
which resolve these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

508027 - rhcs80beta TPS and mod_nss with NSSOCSP has ssl errors and unable to use agent service
510197 - CVE-2009-2409 deprecate MD2 in SSL cert validation (Kaminsky)
510251 - CVE-2009-2408 firefox/nss: doesn't handle NULL in Common Name properly
512912 - CVE-2009-2404 nss regexp heap overflow

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/nspr-4.7.4-1.el4_8.1.src.rpm
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/nss-3.12.3.99.3-1.el4_8.2.src.rpm

i386:
nspr-4.7.4-1.el4_8.1.i386.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.i386.rpm
nspr-devel-4.7.4-1.el4_8.1.i386.rpm
nss-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-devel-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-tools-3.12.3.99.3-1.el4_8.2.i386.rpm

ia64:
nspr-4.7.4-1.el4_8.1.i386.rpm
nspr-4.7.4-1.el4_8.1.ia64.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.i386.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.ia64.rpm
nspr-devel-4.7.4-1.el4_8.1.ia64.rpm
nss-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-3.12.3.99.3-1.el4_8.2.ia64.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.ia64.rpm
nss-devel-3.12.3.99.3-1.el4_8.2.ia64.rpm
nss-tools-3.12.3.99.3-1.el4_8.2.ia64.rpm

ppc:
nspr-4.7.4-1.el4_8.1.ppc.rpm
nspr-4.7.4-1.el4_8.1.ppc64.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.ppc.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.ppc64.rpm
nspr-devel-4.7.4-1.el4_8.1.ppc.rpm
nss-3.12.3.99.3-1.el4_8.2.ppc.rpm
nss-3.12.3.99.3-1.el4_8.2.ppc64.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.ppc.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.ppc64.rpm
nss-devel-3.12.3.99.3-1.el4_8.2.ppc.rpm
nss-tools-3.12.3.99.3-1.el4_8.2.ppc.rpm

s390:
nspr-4.7.4-1.el4_8.1.s390.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.s390.rpm
nspr-devel-4.7.4-1.el4_8.1.s390.rpm
nss-3.12.3.99.3-1.el4_8.2.s390.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.s390.rpm
nss-devel-3.12.3.99.3-1.el4_8.2.s390.rpm
nss-tools-3.12.3.99.3-1.el4_8.2.s390.rpm

s390x:
nspr-4.7.4-1.el4_8.1.s390.rpm
nspr-4.7.4-1.el4_8.1.s390x.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.s390.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.s390x.rpm
nspr-devel-4.7.4-1.el4_8.1.s390x.rpm
nss-3.12.3.99.3-1.el4_8.2.s390.rpm
nss-3.12.3.99.3-1.el4_8.2.s390x.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.s390.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.s390x.rpm
nss-devel-3.12.3.99.3-1.el4_8.2.s390x.rpm
nss-tools-3.12.3.99.3-1.el4_8.2.s390x.rpm

x86_64:
nspr-4.7.4-1.el4_8.1.i386.rpm
nspr-4.7.4-1.el4_8.1.x86_64.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.i386.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.x86_64.rpm
nspr-devel-4.7.4-1.el4_8.1.x86_64.rpm
nss-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-3.12.3.99.3-1.el4_8.2.x86_64.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.x86_64.rpm
nss-devel-3.12.3.99.3-1.el4_8.2.x86_64.rpm
nss-tools-3.12.3.99.3-1.el4_8.2.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/nspr-4.7.4-1.el4_8.1.src.rpm
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/nss-3.12.3.99.3-1.el4_8.2.src.rpm

i386:
nspr-4.7.4-1.el4_8.1.i386.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.i386.rpm
nspr-devel-4.7.4-1.el4_8.1.i386.rpm
nss-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-devel-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-tools-3.12.3.99.3-1.el4_8.2.i386.rpm

x86_64:
nspr-4.7.4-1.el4_8.1.i386.rpm
nspr-4.7.4-1.el4_8.1.x86_64.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.i386.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.x86_64.rpm
nspr-devel-4.7.4-1.el4_8.1.x86_64.rpm
nss-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-3.12.3.99.3-1.el4_8.2.x86_64.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.x86_64.rpm
nss-devel-3.12.3.99.3-1.el4_8.2.x86_64.rpm
nss-tools-3.12.3.99.3-1.el4_8.2.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/nspr-4.7.4-1.el4_8.1.src.rpm
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/nss-3.12.3.99.3-1.el4_8.2.src.rpm

i386:
nspr-4.7.4-1.el4_8.1.i386.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.i386.rpm
nspr-devel-4.7.4-1.el4_8.1.i386.rpm
nss-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-devel-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-tools-3.12.3.99.3-1.el4_8.2.i386.rpm

ia64:
nspr-4.7.4-1.el4_8.1.i386.rpm
nspr-4.7.4-1.el4_8.1.ia64.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.i386.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.ia64.rpm
nspr-devel-4.7.4-1.el4_8.1.ia64.rpm
nss-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-3.12.3.99.3-1.el4_8.2.ia64.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.ia64.rpm
nss-devel-3.12.3.99.3-1.el4_8.2.ia64.rpm
nss-tools-3.12.3.99.3-1.el4_8.2.ia64.rpm

x86_64:
nspr-4.7.4-1.el4_8.1.i386.rpm
nspr-4.7.4-1.el4_8.1.x86_64.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.i386.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.x86_64.rpm
nspr-devel-4.7.4-1.el4_8.1.x86_64.rpm
nss-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-3.12.3.99.3-1.el4_8.2.x86_64.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.x86_64.rpm
nss-devel-3.12.3.99.3-1.el4_8.2.x86_64.rpm
nss-tools-3.12.3.99.3-1.el4_8.2.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/nspr-4.7.4-1.el4_8.1.src.rpm
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/nss-3.12.3.99.3-1.el4_8.2.src.rpm

i386:
nspr-4.7.4-1.el4_8.1.i386.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.i386.rpm
nspr-devel-4.7.4-1.el4_8.1.i386.rpm
nss-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-devel-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-tools-3.12.3.99.3-1.el4_8.2.i386.rpm

ia64:
nspr-4.7.4-1.el4_8.1.i386.rpm
nspr-4.7.4-1.el4_8.1.ia64.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.i386.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.ia64.rpm
nspr-devel-4.7.4-1.el4_8.1.ia64.rpm
nss-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-3.12.3.99.3-1.el4_8.2.ia64.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.ia64.rpm
nss-devel-3.12.3.99.3-1.el4_8.2.ia64.rpm
nss-tools-3.12.3.99.3-1.el4_8.2.ia64.rpm

x86_64:
nspr-4.7.4-1.el4_8.1.i386.rpm
nspr-4.7.4-1.el4_8.1.x86_64.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.i386.rpm
nspr-debuginfo-4.7.4-1.el4_8.1.x86_64.rpm
nspr-devel-4.7.4-1.el4_8.1.x86_64.rpm
nss-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-3.12.3.99.3-1.el4_8.2.x86_64.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el4_8.2.x86_64.rpm
nss-devel-3.12.3.99.3-1.el4_8.2.x86_64.rpm
nss-tools-3.12.3.99.3-1.el4_8.2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2404
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2408
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2409
http://www.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKchrOXlSAg2UNWIIRAoz1AJ9fozK1rJeLJp+k3zYsf0KLk+TRCQCdFzAt
h+4gaFtyB1SekEF7spzypxY=
=H715
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Thu Jul 30 22:19:31 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Thu, 30 Jul 2009 18:19:31 -0400
Subject: [RHSA-2009:1185-01] Critical: seamonkey security update
Message-ID: <200907302219.n6UMJVwv019524@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: seamonkey security update
Advisory ID:       RHSA-2009:1185-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1185.html
Issue date:        2009-07-30
CVE Names:         CVE-2009-2404 
=====================================================================

1. Summary:

Updated seamonkey packages that fix a security issue are now available for
Red Hat Enterprise Linux 3.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

3. Description:

SeaMonkey is an open source Web browser, email and newsgroup client, IRC
chat client, and HTML editor.

Moxie Marlinspike reported a heap overflow flaw in a regular expression
parser in the NSS library (provided by SeaMonkey) used to match common
names in certificates. A malicious website could present a
carefully-crafted certificate in such a way as to trigger the heap
overflow, leading to a crash or, possibly, arbitrary code execution with
the permissions of the user running SeaMonkey. (CVE-2009-2404)

Note: in order to exploit this issue without further user interaction, the
carefully-crafted certificate would need to be signed by a Certificate
Authority trusted by SeaMonkey, otherwise SeaMonkey presents the victim
with a warning that the certificate is untrusted. Only if the user then
accepts the certificate will the overflow take place.

All SeaMonkey users should upgrade to these updated packages, which contain
a backported patch to correct this issue. After installing the updated
packages, SeaMonkey must be restarted for the update to take effect.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

512912 - CVE-2009-2404 nss regexp heap overflow

6. Package List:

Red Hat Enterprise Linux AS version 3:

Source:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/seamonkey-1.0.9-0.41.el3.src.rpm

i386:
seamonkey-1.0.9-0.41.el3.i386.rpm
seamonkey-chat-1.0.9-0.41.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.i386.rpm
seamonkey-devel-1.0.9-0.41.el3.i386.rpm
seamonkey-dom-inspector-1.0.9-0.41.el3.i386.rpm
seamonkey-js-debugger-1.0.9-0.41.el3.i386.rpm
seamonkey-mail-1.0.9-0.41.el3.i386.rpm
seamonkey-nspr-1.0.9-0.41.el3.i386.rpm
seamonkey-nspr-devel-1.0.9-0.41.el3.i386.rpm
seamonkey-nss-1.0.9-0.41.el3.i386.rpm
seamonkey-nss-devel-1.0.9-0.41.el3.i386.rpm

ia64:
seamonkey-1.0.9-0.41.el3.ia64.rpm
seamonkey-chat-1.0.9-0.41.el3.ia64.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.ia64.rpm
seamonkey-devel-1.0.9-0.41.el3.ia64.rpm
seamonkey-dom-inspector-1.0.9-0.41.el3.ia64.rpm
seamonkey-js-debugger-1.0.9-0.41.el3.ia64.rpm
seamonkey-mail-1.0.9-0.41.el3.ia64.rpm
seamonkey-nspr-1.0.9-0.41.el3.i386.rpm
seamonkey-nspr-1.0.9-0.41.el3.ia64.rpm
seamonkey-nspr-devel-1.0.9-0.41.el3.ia64.rpm
seamonkey-nss-1.0.9-0.41.el3.i386.rpm
seamonkey-nss-1.0.9-0.41.el3.ia64.rpm
seamonkey-nss-devel-1.0.9-0.41.el3.ia64.rpm

ppc:
seamonkey-1.0.9-0.41.el3.ppc.rpm
seamonkey-chat-1.0.9-0.41.el3.ppc.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.ppc.rpm
seamonkey-devel-1.0.9-0.41.el3.ppc.rpm
seamonkey-dom-inspector-1.0.9-0.41.el3.ppc.rpm
seamonkey-js-debugger-1.0.9-0.41.el3.ppc.rpm
seamonkey-mail-1.0.9-0.41.el3.ppc.rpm
seamonkey-nspr-1.0.9-0.41.el3.ppc.rpm
seamonkey-nspr-devel-1.0.9-0.41.el3.ppc.rpm
seamonkey-nss-1.0.9-0.41.el3.ppc.rpm
seamonkey-nss-devel-1.0.9-0.41.el3.ppc.rpm

s390:
seamonkey-1.0.9-0.41.el3.s390.rpm
seamonkey-chat-1.0.9-0.41.el3.s390.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.s390.rpm
seamonkey-devel-1.0.9-0.41.el3.s390.rpm
seamonkey-dom-inspector-1.0.9-0.41.el3.s390.rpm
seamonkey-js-debugger-1.0.9-0.41.el3.s390.rpm
seamonkey-mail-1.0.9-0.41.el3.s390.rpm
seamonkey-nspr-1.0.9-0.41.el3.s390.rpm
seamonkey-nspr-devel-1.0.9-0.41.el3.s390.rpm
seamonkey-nss-1.0.9-0.41.el3.s390.rpm
seamonkey-nss-devel-1.0.9-0.41.el3.s390.rpm

s390x:
seamonkey-1.0.9-0.41.el3.s390x.rpm
seamonkey-chat-1.0.9-0.41.el3.s390x.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.s390.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.s390x.rpm
seamonkey-devel-1.0.9-0.41.el3.s390x.rpm
seamonkey-dom-inspector-1.0.9-0.41.el3.s390x.rpm
seamonkey-js-debugger-1.0.9-0.41.el3.s390x.rpm
seamonkey-mail-1.0.9-0.41.el3.s390x.rpm
seamonkey-nspr-1.0.9-0.41.el3.s390.rpm
seamonkey-nspr-1.0.9-0.41.el3.s390x.rpm
seamonkey-nspr-devel-1.0.9-0.41.el3.s390x.rpm
seamonkey-nss-1.0.9-0.41.el3.s390.rpm
seamonkey-nss-1.0.9-0.41.el3.s390x.rpm
seamonkey-nss-devel-1.0.9-0.41.el3.s390x.rpm

x86_64:
seamonkey-1.0.9-0.41.el3.i386.rpm
seamonkey-1.0.9-0.41.el3.x86_64.rpm
seamonkey-chat-1.0.9-0.41.el3.x86_64.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.x86_64.rpm
seamonkey-devel-1.0.9-0.41.el3.x86_64.rpm
seamonkey-dom-inspector-1.0.9-0.41.el3.x86_64.rpm
seamonkey-js-debugger-1.0.9-0.41.el3.x86_64.rpm
seamonkey-mail-1.0.9-0.41.el3.x86_64.rpm
seamonkey-nspr-1.0.9-0.41.el3.i386.rpm
seamonkey-nspr-1.0.9-0.41.el3.x86_64.rpm
seamonkey-nspr-devel-1.0.9-0.41.el3.x86_64.rpm
seamonkey-nss-1.0.9-0.41.el3.i386.rpm
seamonkey-nss-1.0.9-0.41.el3.x86_64.rpm
seamonkey-nss-devel-1.0.9-0.41.el3.x86_64.rpm

Red Hat Desktop version 3:

Source:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/seamonkey-1.0.9-0.41.el3.src.rpm

i386:
seamonkey-1.0.9-0.41.el3.i386.rpm
seamonkey-chat-1.0.9-0.41.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.i386.rpm
seamonkey-devel-1.0.9-0.41.el3.i386.rpm
seamonkey-dom-inspector-1.0.9-0.41.el3.i386.rpm
seamonkey-js-debugger-1.0.9-0.41.el3.i386.rpm
seamonkey-mail-1.0.9-0.41.el3.i386.rpm
seamonkey-nspr-1.0.9-0.41.el3.i386.rpm
seamonkey-nspr-devel-1.0.9-0.41.el3.i386.rpm
seamonkey-nss-1.0.9-0.41.el3.i386.rpm
seamonkey-nss-devel-1.0.9-0.41.el3.i386.rpm

x86_64:
seamonkey-1.0.9-0.41.el3.i386.rpm
seamonkey-1.0.9-0.41.el3.x86_64.rpm
seamonkey-chat-1.0.9-0.41.el3.x86_64.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.x86_64.rpm
seamonkey-devel-1.0.9-0.41.el3.x86_64.rpm
seamonkey-dom-inspector-1.0.9-0.41.el3.x86_64.rpm
seamonkey-js-debugger-1.0.9-0.41.el3.x86_64.rpm
seamonkey-mail-1.0.9-0.41.el3.x86_64.rpm
seamonkey-nspr-1.0.9-0.41.el3.i386.rpm
seamonkey-nspr-1.0.9-0.41.el3.x86_64.rpm
seamonkey-nspr-devel-1.0.9-0.41.el3.x86_64.rpm
seamonkey-nss-1.0.9-0.41.el3.i386.rpm
seamonkey-nss-1.0.9-0.41.el3.x86_64.rpm
seamonkey-nss-devel-1.0.9-0.41.el3.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

Source:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/seamonkey-1.0.9-0.41.el3.src.rpm

i386:
seamonkey-1.0.9-0.41.el3.i386.rpm
seamonkey-chat-1.0.9-0.41.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.i386.rpm
seamonkey-devel-1.0.9-0.41.el3.i386.rpm
seamonkey-dom-inspector-1.0.9-0.41.el3.i386.rpm
seamonkey-js-debugger-1.0.9-0.41.el3.i386.rpm
seamonkey-mail-1.0.9-0.41.el3.i386.rpm
seamonkey-nspr-1.0.9-0.41.el3.i386.rpm
seamonkey-nspr-devel-1.0.9-0.41.el3.i386.rpm
seamonkey-nss-1.0.9-0.41.el3.i386.rpm
seamonkey-nss-devel-1.0.9-0.41.el3.i386.rpm

ia64:
seamonkey-1.0.9-0.41.el3.ia64.rpm
seamonkey-chat-1.0.9-0.41.el3.ia64.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.ia64.rpm
seamonkey-devel-1.0.9-0.41.el3.ia64.rpm
seamonkey-dom-inspector-1.0.9-0.41.el3.ia64.rpm
seamonkey-js-debugger-1.0.9-0.41.el3.ia64.rpm
seamonkey-mail-1.0.9-0.41.el3.ia64.rpm
seamonkey-nspr-1.0.9-0.41.el3.i386.rpm
seamonkey-nspr-1.0.9-0.41.el3.ia64.rpm
seamonkey-nspr-devel-1.0.9-0.41.el3.ia64.rpm
seamonkey-nss-1.0.9-0.41.el3.i386.rpm
seamonkey-nss-1.0.9-0.41.el3.ia64.rpm
seamonkey-nss-devel-1.0.9-0.41.el3.ia64.rpm

x86_64:
seamonkey-1.0.9-0.41.el3.i386.rpm
seamonkey-1.0.9-0.41.el3.x86_64.rpm
seamonkey-chat-1.0.9-0.41.el3.x86_64.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.x86_64.rpm
seamonkey-devel-1.0.9-0.41.el3.x86_64.rpm
seamonkey-dom-inspector-1.0.9-0.41.el3.x86_64.rpm
seamonkey-js-debugger-1.0.9-0.41.el3.x86_64.rpm
seamonkey-mail-1.0.9-0.41.el3.x86_64.rpm
seamonkey-nspr-1.0.9-0.41.el3.i386.rpm
seamonkey-nspr-1.0.9-0.41.el3.x86_64.rpm
seamonkey-nspr-devel-1.0.9-0.41.el3.x86_64.rpm
seamonkey-nss-1.0.9-0.41.el3.i386.rpm
seamonkey-nss-1.0.9-0.41.el3.x86_64.rpm
seamonkey-nss-devel-1.0.9-0.41.el3.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

Source:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/seamonkey-1.0.9-0.41.el3.src.rpm

i386:
seamonkey-1.0.9-0.41.el3.i386.rpm
seamonkey-chat-1.0.9-0.41.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.i386.rpm
seamonkey-devel-1.0.9-0.41.el3.i386.rpm
seamonkey-dom-inspector-1.0.9-0.41.el3.i386.rpm
seamonkey-js-debugger-1.0.9-0.41.el3.i386.rpm
seamonkey-mail-1.0.9-0.41.el3.i386.rpm
seamonkey-nspr-1.0.9-0.41.el3.i386.rpm
seamonkey-nspr-devel-1.0.9-0.41.el3.i386.rpm
seamonkey-nss-1.0.9-0.41.el3.i386.rpm
seamonkey-nss-devel-1.0.9-0.41.el3.i386.rpm

ia64:
seamonkey-1.0.9-0.41.el3.ia64.rpm
seamonkey-chat-1.0.9-0.41.el3.ia64.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.ia64.rpm
seamonkey-devel-1.0.9-0.41.el3.ia64.rpm
seamonkey-dom-inspector-1.0.9-0.41.el3.ia64.rpm
seamonkey-js-debugger-1.0.9-0.41.el3.ia64.rpm
seamonkey-mail-1.0.9-0.41.el3.ia64.rpm
seamonkey-nspr-1.0.9-0.41.el3.i386.rpm
seamonkey-nspr-1.0.9-0.41.el3.ia64.rpm
seamonkey-nspr-devel-1.0.9-0.41.el3.ia64.rpm
seamonkey-nss-1.0.9-0.41.el3.i386.rpm
seamonkey-nss-1.0.9-0.41.el3.ia64.rpm
seamonkey-nss-devel-1.0.9-0.41.el3.ia64.rpm

x86_64:
seamonkey-1.0.9-0.41.el3.i386.rpm
seamonkey-1.0.9-0.41.el3.x86_64.rpm
seamonkey-chat-1.0.9-0.41.el3.x86_64.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.i386.rpm
seamonkey-debuginfo-1.0.9-0.41.el3.x86_64.rpm
seamonkey-devel-1.0.9-0.41.el3.x86_64.rpm
seamonkey-dom-inspector-1.0.9-0.41.el3.x86_64.rpm
seamonkey-js-debugger-1.0.9-0.41.el3.x86_64.rpm
seamonkey-mail-1.0.9-0.41.el3.x86_64.rpm
seamonkey-nspr-1.0.9-0.41.el3.i386.rpm
seamonkey-nspr-1.0.9-0.41.el3.x86_64.rpm
seamonkey-nspr-devel-1.0.9-0.41.el3.x86_64.rpm
seamonkey-nss-1.0.9-0.41.el3.i386.rpm
seamonkey-nss-1.0.9-0.41.el3.x86_64.rpm
seamonkey-nss-devel-1.0.9-0.41.el3.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2404
http://www.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKchxtXlSAg2UNWIIRAjtnAKCTn6vCqT/K6fjna0B1v9/eqhMVBgCgoXOD
vPaeGlcz5WQAWhhjPgeD478=
=Fw0+
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Thu Jul 30 22:21:05 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Thu, 30 Jul 2009 18:21:05 -0400
Subject: [RHSA-2009:1186-01] Critical: nspr and nss security, bug fix,
	and enhancement update
Message-ID: <200907302221.n6UML54r021255@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: nspr and nss security, bug fix, and enhancement update
Advisory ID:       RHSA-2009:1186-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1186.html
Issue date:        2009-07-30
CVE Names:         CVE-2009-2404 CVE-2009-2408 CVE-2009-2409 
=====================================================================

1. Summary:

Updated nspr and nss packages that fix security issues, bugs, and add an
enhancement are now available for Red Hat Enterprise Linux 5.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

The packages with this update are identical to the packages released by
RHBA-2009:1161 on the 20th of July 2009. They are being reissued as a Red
Hat Security Advisory as they fixed a number of security issues that were
made public today. If you are installing these packages for the first time,
they also provide a number of bug fixes and add an enhancement, as detailed
in RHBA-2009:1161. Since the packages are identical, there is no need to
install this update if RHBA-2009:1161 has already been installed.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Description:

Netscape Portable Runtime (NSPR) provides platform independence for non-GUI
operating system facilities. These facilities include threads, thread
synchronization, normal file and network I/O, interval timing, calendar
time, basic memory management (malloc and free), and shared library linking.

Network Security Services (NSS) is a set of libraries designed to support
the cross-platform development of security-enabled client and server
applications. Applications built with NSS can support SSLv2, SSLv3, TLS,
and other security standards.

These updated packages upgrade NSS from the previous version, 3.12.2, to a
prerelease of version 3.12.4. The version of NSPR has also been upgraded
from 4.7.3 to 4.7.4. 

Moxie Marlinspike reported a heap overflow flaw in a regular expression
parser in the NSS library used by browsers such as Mozilla Firefox to match
common names in certificates. A malicious website could present a
carefully-crafted certificate in such a way as to trigger the heap
overflow, leading to a crash or, possibly, arbitrary code execution with
the permissions of the user running the browser. (CVE-2009-2404)

Note: in order to exploit this issue without further user interaction in
Firefox, the carefully-crafted certificate would need to be signed by a
Certificate Authority trusted by Firefox, otherwise Firefox presents the
victim with a warning that the certificate is untrusted. Only if the user
then accepts the certificate will the overflow take place.

Dan Kaminsky discovered flaws in the way browsers such as Firefox handle
NULL characters in a certificate. If an attacker is able to get a
carefully-crafted certificate signed by a Certificate Authority trusted by
Firefox, the attacker could use the certificate during a man-in-the-middle
attack and potentially confuse Firefox into accepting it by mistake.
(CVE-2009-2408)

Dan Kaminsky found that browsers still accept certificates with MD2 hash
signatures, even though MD2 is no longer considered a cryptographically
strong algorithm. This could make it easier for an attacker to create a
malicious certificate that would be treated as trusted by a browser. NSS
now disables the use of MD2 and MD4 algorithms inside signatures by
default. (CVE-2009-2409)

All users of nspr and nss are advised to upgrade to these updated packages,
which resolve these issues and add an enhancement.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

510197 - CVE-2009-2409 deprecate MD2 in SSL cert validation (Kaminsky)
510251 - CVE-2009-2408 firefox/nss: doesn't handle NULL in Common Name properly
512912 - CVE-2009-2404 nss regexp heap overflow

6. Package List:

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/nspr-4.7.4-1.el5_3.1.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/nss-3.12.3.99.3-1.el5_3.2.src.rpm

i386:
nspr-4.7.4-1.el5_3.1.i386.rpm
nspr-debuginfo-4.7.4-1.el5_3.1.i386.rpm
nss-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-tools-3.12.3.99.3-1.el5_3.2.i386.rpm

x86_64:
nspr-4.7.4-1.el5_3.1.i386.rpm
nspr-4.7.4-1.el5_3.1.x86_64.rpm
nspr-debuginfo-4.7.4-1.el5_3.1.i386.rpm
nspr-debuginfo-4.7.4-1.el5_3.1.x86_64.rpm
nss-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-3.12.3.99.3-1.el5_3.2.x86_64.rpm
nss-debuginfo-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el5_3.2.x86_64.rpm
nss-tools-3.12.3.99.3-1.el5_3.2.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/nspr-4.7.4-1.el5_3.1.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/nss-3.12.3.99.3-1.el5_3.2.src.rpm

i386:
nspr-debuginfo-4.7.4-1.el5_3.1.i386.rpm
nspr-devel-4.7.4-1.el5_3.1.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-devel-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-pkcs11-devel-3.12.3.99.3-1.el5_3.2.i386.rpm

x86_64:
nspr-debuginfo-4.7.4-1.el5_3.1.i386.rpm
nspr-debuginfo-4.7.4-1.el5_3.1.x86_64.rpm
nspr-devel-4.7.4-1.el5_3.1.i386.rpm
nspr-devel-4.7.4-1.el5_3.1.x86_64.rpm
nss-debuginfo-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el5_3.2.x86_64.rpm
nss-devel-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-devel-3.12.3.99.3-1.el5_3.2.x86_64.rpm
nss-pkcs11-devel-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-pkcs11-devel-3.12.3.99.3-1.el5_3.2.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/nspr-4.7.4-1.el5_3.1.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/nss-3.12.3.99.3-1.el5_3.2.src.rpm

i386:
nspr-4.7.4-1.el5_3.1.i386.rpm
nspr-debuginfo-4.7.4-1.el5_3.1.i386.rpm
nspr-devel-4.7.4-1.el5_3.1.i386.rpm
nss-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-devel-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-pkcs11-devel-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-tools-3.12.3.99.3-1.el5_3.2.i386.rpm

ia64:
nspr-4.7.4-1.el5_3.1.i386.rpm
nspr-4.7.4-1.el5_3.1.ia64.rpm
nspr-debuginfo-4.7.4-1.el5_3.1.i386.rpm
nspr-debuginfo-4.7.4-1.el5_3.1.ia64.rpm
nspr-devel-4.7.4-1.el5_3.1.ia64.rpm
nss-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-3.12.3.99.3-1.el5_3.2.ia64.rpm
nss-debuginfo-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el5_3.2.ia64.rpm
nss-devel-3.12.3.99.3-1.el5_3.2.ia64.rpm
nss-pkcs11-devel-3.12.3.99.3-1.el5_3.2.ia64.rpm
nss-tools-3.12.3.99.3-1.el5_3.2.ia64.rpm

ppc:
nspr-4.7.4-1.el5_3.1.ppc.rpm
nspr-4.7.4-1.el5_3.1.ppc64.rpm
nspr-debuginfo-4.7.4-1.el5_3.1.ppc.rpm
nspr-debuginfo-4.7.4-1.el5_3.1.ppc64.rpm
nspr-devel-4.7.4-1.el5_3.1.ppc.rpm
nspr-devel-4.7.4-1.el5_3.1.ppc64.rpm
nss-3.12.3.99.3-1.el5_3.2.ppc.rpm
nss-3.12.3.99.3-1.el5_3.2.ppc64.rpm
nss-debuginfo-3.12.3.99.3-1.el5_3.2.ppc.rpm
nss-debuginfo-3.12.3.99.3-1.el5_3.2.ppc64.rpm
nss-devel-3.12.3.99.3-1.el5_3.2.ppc.rpm
nss-devel-3.12.3.99.3-1.el5_3.2.ppc64.rpm
nss-pkcs11-devel-3.12.3.99.3-1.el5_3.2.ppc.rpm
nss-pkcs11-devel-3.12.3.99.3-1.el5_3.2.ppc64.rpm
nss-tools-3.12.3.99.3-1.el5_3.2.ppc.rpm

s390x:
nspr-4.7.4-1.el5_3.1.s390.rpm
nspr-4.7.4-1.el5_3.1.s390x.rpm
nspr-debuginfo-4.7.4-1.el5_3.1.s390.rpm
nspr-debuginfo-4.7.4-1.el5_3.1.s390x.rpm
nspr-devel-4.7.4-1.el5_3.1.s390.rpm
nspr-devel-4.7.4-1.el5_3.1.s390x.rpm
nss-3.12.3.99.3-1.el5_3.2.s390.rpm
nss-3.12.3.99.3-1.el5_3.2.s390x.rpm
nss-debuginfo-3.12.3.99.3-1.el5_3.2.s390.rpm
nss-debuginfo-3.12.3.99.3-1.el5_3.2.s390x.rpm
nss-devel-3.12.3.99.3-1.el5_3.2.s390.rpm
nss-devel-3.12.3.99.3-1.el5_3.2.s390x.rpm
nss-pkcs11-devel-3.12.3.99.3-1.el5_3.2.s390.rpm
nss-pkcs11-devel-3.12.3.99.3-1.el5_3.2.s390x.rpm
nss-tools-3.12.3.99.3-1.el5_3.2.s390x.rpm

x86_64:
nspr-4.7.4-1.el5_3.1.i386.rpm
nspr-4.7.4-1.el5_3.1.x86_64.rpm
nspr-debuginfo-4.7.4-1.el5_3.1.i386.rpm
nspr-debuginfo-4.7.4-1.el5_3.1.x86_64.rpm
nspr-devel-4.7.4-1.el5_3.1.i386.rpm
nspr-devel-4.7.4-1.el5_3.1.x86_64.rpm
nss-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-3.12.3.99.3-1.el5_3.2.x86_64.rpm
nss-debuginfo-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el5_3.2.x86_64.rpm
nss-devel-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-devel-3.12.3.99.3-1.el5_3.2.x86_64.rpm
nss-pkcs11-devel-3.12.3.99.3-1.el5_3.2.i386.rpm
nss-pkcs11-devel-3.12.3.99.3-1.el5_3.2.x86_64.rpm
nss-tools-3.12.3.99.3-1.el5_3.2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2404
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2408
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2409
http://www.redhat.com/security/updates/classification/#critical
http://rhn.redhat.com/errata/RHBA-2009-1161.html

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKchzOXlSAg2UNWIIRAsnAAKDDShJh1sq+AagpSz8mAQT9uRaYlQCgjU3a
h9xMbjaBYt5vrqGr/q5+xtQ=
=YRmO
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Fri Jul 31 14:22:38 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Fri, 31 Jul 2009 10:22:38 -0400
Subject: [RHSA-2009:1188-01] Critical: flash-plugin security update
Message-ID: <200907311422.n6VEMcIv015002@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: flash-plugin security update
Advisory ID:       RHSA-2009:1188-01
Product:           Red Hat Enterprise Linux Extras
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1188.html
Issue date:        2009-07-31
CVE Names:         CVE-2009-1862 CVE-2009-1863 CVE-2009-1864 
                   CVE-2009-1865 CVE-2009-1866 CVE-2009-1867 
                   CVE-2009-1868 CVE-2009-1869 CVE-2009-1870 
=====================================================================

1. Summary:

An updated Adobe Flash Player package that fixes multiple security issues
is now available for Red Hat Enterprise Linux 5 Supplementary.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

RHEL Desktop Supplementary (v. 5 client) - i386, x86_64
RHEL Supplementary (v. 5 server) - i386, x86_64

3. Description:

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash
Player web browser plug-in.

Multiple security flaws were found in the way Flash Player displayed
certain SWF content. An attacker could use these flaws to create a
specially-crafted SWF file that would cause flash-plugin to crash or,
possibly, execute arbitrary code when the victim loaded a page containing
the specially-crafted SWF content. (CVE-2009-1862, CVE-2009-1863,
CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1868, CVE-2009-1869)

A clickjacking flaw was discovered in Flash Player. A specially-crafted
SWF file could trick a user into unintentionally or mistakenly clicking a
link or a dialog. (CVE-2009-1867)

A flaw was found in the Flash Player local sandbox. A specially-crafted
SWF file could cause information disclosure when it was saved to the hard
drive. (CVE-2009-1870)

All users of Adobe Flash Player should install this updated package, which
upgrades Flash Player to version 10.0.32.18.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

513362 - CVE-2009-1862 acroread, flash-plugin: Remote code execution vulnerability via malicious SWF (Shockwave Flash) content
514874 - flash-plugin: multiple code execution flaws (APSB09-10)
514877 - flash-plugin: multiple information disclosure flaws (APSB09-10)

6. Package List:

RHEL Desktop Supplementary (v. 5 client):

i386:
flash-plugin-10.0.32.18-2.el5.i386.rpm

x86_64:
flash-plugin-10.0.32.18-2.el5.i386.rpm

RHEL Supplementary (v. 5 server):

i386:
flash-plugin-10.0.32.18-2.el5.i386.rpm

x86_64:
flash-plugin-10.0.32.18-2.el5.i386.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1862
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1863
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1864
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1865
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1866
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1867
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1868
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1869
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1870
http://www.redhat.com/security/updates/classification/#critical
http://www.adobe.com/support/security/bulletins/apsb09-10.html

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKcv4OXlSAg2UNWIIRAuFaAKDCqgHA1X6OefSZeF9nmGxvzCgf8ACgjVi0
xpZtMOkfkm+AiPdFr9DWxRM=
=5ej0
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Fri Jul 31 14:23:01 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Fri, 31 Jul 2009 10:23:01 -0400
Subject: [RHSA-2009:1189-01] Critical: flash-plugin security update
Message-ID: <200907311423.n6VEN1iq015172@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: flash-plugin security update
Advisory ID:       RHSA-2009:1189-01
Product:           Red Hat Enterprise Linux Extras
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1189.html
Issue date:        2009-07-31
CVE Names:         CVE-2009-1862 CVE-2009-1863 CVE-2009-1864 
                   CVE-2009-1865 CVE-2009-1866 CVE-2009-1867 
                   CVE-2009-1868 CVE-2009-1869 CVE-2009-1870 
=====================================================================

1. Summary:

An updated Adobe Flash Player package that fixes multiple security issues
is now available for Red Hat Enterprise Linux 3 and 4 Extras.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 Extras - i386
Red Hat Desktop version 3 Extras - i386
Red Hat Enterprise Linux ES version 3 Extras - i386
Red Hat Enterprise Linux WS version 3 Extras - i386
Red Hat Enterprise Linux AS version 4 Extras - i386
Red Hat Desktop version 4 Extras - i386
Red Hat Enterprise Linux ES version 4 Extras - i386
Red Hat Enterprise Linux WS version 4 Extras - i386

3. Description:

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash
Player web browser plug-in.

Multiple security flaws were found in the way Flash Player displayed
certain SWF content. An attacker could use these flaws to create a
specially-crafted SWF file that would cause flash-plugin to crash or,
possibly, execute arbitrary code when the victim loaded a page containing
the specially-crafted SWF content. (CVE-2009-1862, CVE-2009-1863,
CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1868, CVE-2009-1869)

A clickjacking flaw was discovered in Flash Player. A specially-crafted
SWF file could trick a user into unintentionally or mistakenly clicking a
link or a dialog. (CVE-2009-1867)

A flaw was found in the Flash Player local sandbox. A specially-crafted
SWF file could cause information disclosure when it was saved to the hard
drive. (CVE-2009-1870)

All users of Adobe Flash Player should install this updated package, which
upgrades Flash Player to version 9.0.246.0.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

513362 - CVE-2009-1862 acroread, flash-plugin: Remote code execution vulnerability via malicious SWF (Shockwave Flash) content
514874 - flash-plugin: multiple code execution flaws (APSB09-10)
514877 - flash-plugin: multiple information disclosure flaws (APSB09-10)

6. Package List:

Red Hat Enterprise Linux AS version 3 Extras:

i386:
flash-plugin-9.0.246.0-2.el3.with.oss.i386.rpm

Red Hat Desktop version 3 Extras:

i386:
flash-plugin-9.0.246.0-2.el3.with.oss.i386.rpm

Red Hat Enterprise Linux ES version 3 Extras:

i386:
flash-plugin-9.0.246.0-2.el3.with.oss.i386.rpm

Red Hat Enterprise Linux WS version 3 Extras:

i386:
flash-plugin-9.0.246.0-2.el3.with.oss.i386.rpm

Red Hat Enterprise Linux AS version 4 Extras:

i386:
flash-plugin-9.0.246.0-2.el4.i386.rpm

Red Hat Desktop version 4 Extras:

i386:
flash-plugin-9.0.246.0-2.el4.i386.rpm

Red Hat Enterprise Linux ES version 4 Extras:

i386:
flash-plugin-9.0.246.0-2.el4.i386.rpm

Red Hat Enterprise Linux WS version 4 Extras:

i386:
flash-plugin-9.0.246.0-2.el4.i386.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1862
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1863
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1864
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1865
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1866
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1867
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1868
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1869
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1870
http://www.redhat.com/security/updates/classification/#critical
http://www.adobe.com/support/security/bulletins/apsb09-10.html

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKcv4yXlSAg2UNWIIRAhj8AKCDEy8jsi9pHixVsemh9PRUaNiSTgCgmvZ/
l7fNPGzayJoz2s1uNLUGfSY=
=/ZX8
-----END PGP SIGNATURE-----




From bugzilla at redhat.com  Fri Jul 31 14:31:41 2009
From: bugzilla at redhat.com (bugzilla at redhat.com)
Date: Fri, 31 Jul 2009 10:31:41 -0400
Subject: [RHSA-2009:1190-01] Critical: nspr and nss security and bug fix
	update
Message-ID: <200907311431.n6VEVfs7023219@int-mx1.corp.redhat.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Critical: nspr and nss security and bug fix update
Advisory ID:       RHSA-2009:1190-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2009-1190.html
Issue date:        2009-07-31
CVE Names:         CVE-2009-2404 CVE-2009-2408 CVE-2009-2409 
=====================================================================

1. Summary:

Updated nspr and nss packages that fix security issues and bugs are now
available for Red Hat Enterprise Linux 4.7 Extended Update Support.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4.7.z - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux ES version 4.7.z - i386, ia64, x86_64

3. Description:

Netscape Portable Runtime (NSPR) provides platform independence for non-GUI
operating system facilities. These facilities include threads, thread
synchronization, normal file and network I/O, interval timing, calendar
time, basic memory management (malloc and free), and shared library linking.

Network Security Services (NSS) is a set of libraries designed to support
the cross-platform development of security-enabled client and server
applications. Applications built with NSS can support SSLv2, SSLv3, TLS,
and other security standards.

These updated packages upgrade NSS from the previous version, 3.12.2, to a
prerelease of version 3.12.4. The version of NSPR has also been upgraded
from 4.7.3 to 4.7.4.

Moxie Marlinspike reported a heap overflow flaw in a regular expression
parser in the NSS library used by browsers such as Mozilla Firefox to match
common names in certificates. A malicious website could present a
carefully-crafted certificate in such a way as to trigger the heap
overflow, leading to a crash or, possibly, arbitrary code execution with
the permissions of the user running the browser. (CVE-2009-2404)

Note: in order to exploit this issue without further user interaction in
Firefox, the carefully-crafted certificate would need to be signed by a
Certificate Authority trusted by Firefox, otherwise Firefox presents the
victim with a warning that the certificate is untrusted. Only if the user
then accepts the certificate will the overflow take place.

Dan Kaminsky discovered flaws in the way browsers such as Firefox handle
NULL characters in a certificate. If an attacker is able to get a
carefully-crafted certificate signed by a Certificate Authority trusted by
Firefox, the attacker could use the certificate during a man-in-the-middle
attack and potentially confuse Firefox into accepting it by mistake.
(CVE-2009-2408)

Dan Kaminsky found that browsers still accept certificates with MD2 hash
signatures, even though MD2 is no longer considered a cryptographically
strong algorithm. This could make it easier for an attacker to create a
malicious certificate that would be treated as trusted by a browser. NSS
now disables the use of MD2 and MD4 algorithms inside signatures by
default. (CVE-2009-2409)

These version upgrades also provide fixes for the following bugs:

* SSL client authentication failed against an Apache server when it was 
using the mod_nss module and configured for NSSOCSP. On the client side,
the user agent received an error message that referenced "Error Code:
- -12271" and stated that establishing an encrypted connection had failed
because the certificate had been rejected by the host.

On the server side, the nss_error_log under /var/log/httpd/ contained the
following message:

[error] Re-negotiation handshake failed: Not accepted by client!?

Also, /var/log/httpd/error_log contained this error:

SSL Library Error: -8071 The OCSP server experienced an internal error

With these updated packages, the dependency problem which caused this
failure has been resolved so that SSL client authentication with an
Apache web server using mod_nss which is configured for NSSOCSP succeeds
as expected. Note that if the presented client certificate is expired,
then access is denied, the user agent is presented with an error message
about the invalid certificate, and the OCSP queries are seen in the OCSP
responder. Also, similar OCSP status verification happens for SSL server
certificates used in Apache upon instance start or restart. (BZ#508026)

* NSS uses a software integrity test to detect code corruption. RPM
transactions and system link optimization daemons (such as prelink) can
change the contents of libraries, causing the software integrity test to
fail. In combination with the updated prelink package (RHBA-2009:1041),
these updated packages can now prevent software integrity test failures.
(BZ#495938)

All users of nspr and nss are advised to upgrade to these updated packages,
which resolve these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network.  Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

495938 - seamonkey/nss FIPS mode failure, update prelink and nss
508026 - rhcs80beta TPS and mod_nss with NSSOCSP has ssl errors and unable to use agent service
510197 - CVE-2009-2409 deprecate MD2 in SSL cert validation (Kaminsky)
510251 - CVE-2009-2408 firefox/nss: doesn't handle NULL in Common Name properly
512912 - CVE-2009-2404 nss regexp heap overflow

6. Package List:

Red Hat Enterprise Linux AS version 4.7.z:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/nspr-4.7.4-1.el4_7.1.src.rpm
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/nss-3.12.3.99.3-1.el4_7.6.src.rpm

i386:
nspr-4.7.4-1.el4_7.1.i386.rpm
nspr-debuginfo-4.7.4-1.el4_7.1.i386.rpm
nspr-devel-4.7.4-1.el4_7.1.i386.rpm
nss-3.12.3.99.3-1.el4_7.6.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el4_7.6.i386.rpm
nss-devel-3.12.3.99.3-1.el4_7.6.i386.rpm

ia64:
nspr-4.7.4-1.el4_7.1.i386.rpm
nspr-4.7.4-1.el4_7.1.ia64.rpm
nspr-debuginfo-4.7.4-1.el4_7.1.i386.rpm
nspr-debuginfo-4.7.4-1.el4_7.1.ia64.rpm
nspr-devel-4.7.4-1.el4_7.1.ia64.rpm
nss-3.12.3.99.3-1.el4_7.6.i386.rpm
nss-3.12.3.99.3-1.el4_7.6.ia64.rpm
nss-debuginfo-3.12.3.99.3-1.el4_7.6.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el4_7.6.ia64.rpm
nss-devel-3.12.3.99.3-1.el4_7.6.ia64.rpm

ppc:
nspr-4.7.4-1.el4_7.1.ppc.rpm
nspr-4.7.4-1.el4_7.1.ppc64.rpm
nspr-debuginfo-4.7.4-1.el4_7.1.ppc.rpm
nspr-debuginfo-4.7.4-1.el4_7.1.ppc64.rpm
nspr-devel-4.7.4-1.el4_7.1.ppc.rpm
nss-3.12.3.99.3-1.el4_7.6.ppc.rpm
nss-3.12.3.99.3-1.el4_7.6.ppc64.rpm
nss-debuginfo-3.12.3.99.3-1.el4_7.6.ppc.rpm
nss-debuginfo-3.12.3.99.3-1.el4_7.6.ppc64.rpm
nss-devel-3.12.3.99.3-1.el4_7.6.ppc.rpm

s390:
nspr-4.7.4-1.el4_7.1.s390.rpm
nspr-debuginfo-4.7.4-1.el4_7.1.s390.rpm
nspr-devel-4.7.4-1.el4_7.1.s390.rpm
nss-3.12.3.99.3-1.el4_7.6.s390.rpm
nss-debuginfo-3.12.3.99.3-1.el4_7.6.s390.rpm
nss-devel-3.12.3.99.3-1.el4_7.6.s390.rpm

s390x:
nspr-4.7.4-1.el4_7.1.s390.rpm
nspr-4.7.4-1.el4_7.1.s390x.rpm
nspr-debuginfo-4.7.4-1.el4_7.1.s390.rpm
nspr-debuginfo-4.7.4-1.el4_7.1.s390x.rpm
nspr-devel-4.7.4-1.el4_7.1.s390x.rpm
nss-3.12.3.99.3-1.el4_7.6.s390.rpm
nss-3.12.3.99.3-1.el4_7.6.s390x.rpm
nss-debuginfo-3.12.3.99.3-1.el4_7.6.s390.rpm
nss-debuginfo-3.12.3.99.3-1.el4_7.6.s390x.rpm
nss-devel-3.12.3.99.3-1.el4_7.6.s390x.rpm

x86_64:
nspr-4.7.4-1.el4_7.1.i386.rpm
nspr-4.7.4-1.el4_7.1.x86_64.rpm
nspr-debuginfo-4.7.4-1.el4_7.1.i386.rpm
nspr-debuginfo-4.7.4-1.el4_7.1.x86_64.rpm
nspr-devel-4.7.4-1.el4_7.1.x86_64.rpm
nss-3.12.3.99.3-1.el4_7.6.i386.rpm
nss-3.12.3.99.3-1.el4_7.6.x86_64.rpm
nss-debuginfo-3.12.3.99.3-1.el4_7.6.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el4_7.6.x86_64.rpm
nss-devel-3.12.3.99.3-1.el4_7.6.x86_64.rpm

Red Hat Enterprise Linux ES version 4.7.z:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/nspr-4.7.4-1.el4_7.1.src.rpm
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/nss-3.12.3.99.3-1.el4_7.6.src.rpm

i386:
nspr-4.7.4-1.el4_7.1.i386.rpm
nspr-debuginfo-4.7.4-1.el4_7.1.i386.rpm
nspr-devel-4.7.4-1.el4_7.1.i386.rpm
nss-3.12.3.99.3-1.el4_7.6.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el4_7.6.i386.rpm
nss-devel-3.12.3.99.3-1.el4_7.6.i386.rpm

ia64:
nspr-4.7.4-1.el4_7.1.i386.rpm
nspr-4.7.4-1.el4_7.1.ia64.rpm
nspr-debuginfo-4.7.4-1.el4_7.1.i386.rpm
nspr-debuginfo-4.7.4-1.el4_7.1.ia64.rpm
nspr-devel-4.7.4-1.el4_7.1.ia64.rpm
nss-3.12.3.99.3-1.el4_7.6.i386.rpm
nss-3.12.3.99.3-1.el4_7.6.ia64.rpm
nss-debuginfo-3.12.3.99.3-1.el4_7.6.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el4_7.6.ia64.rpm
nss-devel-3.12.3.99.3-1.el4_7.6.ia64.rpm

x86_64:
nspr-4.7.4-1.el4_7.1.i386.rpm
nspr-4.7.4-1.el4_7.1.x86_64.rpm
nspr-debuginfo-4.7.4-1.el4_7.1.i386.rpm
nspr-debuginfo-4.7.4-1.el4_7.1.x86_64.rpm
nspr-devel-4.7.4-1.el4_7.1.x86_64.rpm
nss-3.12.3.99.3-1.el4_7.6.i386.rpm
nss-3.12.3.99.3-1.el4_7.6.x86_64.rpm
nss-debuginfo-3.12.3.99.3-1.el4_7.6.i386.rpm
nss-debuginfo-3.12.3.99.3-1.el4_7.6.x86_64.rpm
nss-devel-3.12.3.99.3-1.el4_7.6.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2404
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2408
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2409
http://www.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is <secalert at redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2009 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFKcwBEXlSAg2UNWIIRArN5AJ47ciB1Dng1ZFtF41T4DqseC4ZDnQCfdHqg
v8yaaDxeDeDmJI6VArJCVdA=
=9q4C
-----END PGP SIGNATURE-----