-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
[slackware-security] slackware-current security updates (SSA:2005-251-03)
This advisory summarizes recent security fixes in Slackware -current.
Usually security advisories are not issued on problems that exist only within the test version of Slackware (slackware-current), but since it's so close to being released as Slackware 10.2, and since there have been several -cuurent-only issues recently, it has been decided that it would be a good idea to release a summary of all of the security fixes in Slackware -current for the last 2 weeks. Some of these are -current only, and some affect other versions of Slackware (and advisories for these have already been issued).
Here are the details from the Slackware -current ChangeLog: +--------------------------+ ap/groff-1.19.1-i486-3.tgz: Fixed a /tmp bug in groffer. Groffer is a script to display formatted output on the console or X, and is not normally used in other scripts (for printers, etc) like most groff components are. The risk from this bug is probably quite low. The fix was pulled from the just-released groff-1.19.2. With Slackware 10.2 just around the corner it didn't seem prudent to upgrade to that -- the diff from 1.19.1 to 1.19.2 is over a megabyte compressed. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0969 (* Security fix *)
kde/kdebase-3.4.2-i486-2.tgz: Patched a bug in Konqueror's handling of characters such as '*', '[', and '?'. Generated new kdm config files. Added /opt/kde/man to $MANPATH. Patched a security bug in kcheckpass that could allow a local user to gain root privileges. For more information, see: http://www.kde.org/info/security/advisory-20050905-1.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2494 (* Security fix *)
n/mod_ssl-2.8.24_1.3.33-i486-1.tgz: Upgraded to mod_ssl-2.8.24-1.3.33. From the CHANGES file: Fix a security issue (CAN-2005-2700) where "SSLVerifyClient require" was not enforced in per-location context if "SSLVerifyClient optional" was configured in the global virtual host configuration. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2700 (* Security fix *)
n/openssh-4.2p1-i486-1.tgz: Upgraded to openssh-4.2p1. From the OpenSSH 4.2 release announcement: SECURITY: Fix a bug introduced in OpenSSH 4.0 that caused GatewayPorts to be incorrectly activated for dynamic ("-D") port forwardings when no listen address was explicitly specified. (* Security fix *)
kde/kdeedu-3.4.2-i486-2.tgz: Fixed a minor /tmp bug in kvoctrain. (* Security fix *)
n/php-4.4.0-i486-3.tgz: Relinked with the system PCRE library, as the builtin library has a buffer overflow that could be triggered by the processing of a specially crafted regular expression. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2491 (* Security fix *) Upgraded PEAR::XMLRPC to version 1.4.0, which eliminates the use of the insecure eval() function. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2498 (* Security fix *)
xap/gaim-1.5.0-i486-1.tgz: Upgraded to gaim-1.5.0. This fixes some more security issues. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2103 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2102 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2370 (* Security fix *)
testing/packages/php-5.0.4/php-5.0.4-i486-3.tgz: Relinked with the system PCRE library, as the builtin library has a buffer overflow that could be triggered by the processing of a specially crafted regular expression. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2491 (* Security fix *) Upgraded PEAR::XMLRPC to version 1.4.0, which eliminates the use of the insecure eval() function. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2498 (* Security fix *) Recompiled with support for mbstring, cURL, and XSLT. Thanks to Den (aka Diesel) for suggesting XSLT. +--------------------------+
Where to find the new packages: +-----------------------------+
Add of these packages are available in the slackware-current directory on ftp.slackware.com:
groff-1.19.1-i486-3.tgz kdebase-3.4.2-i486-2.tgz mod_ssl-2.8.24_1.3.33-i486-1.tgz openssh-4.2p1-i486-1.tgz kdeedu-3.4.2-i486-2.tgz php-4.4.0-i486-3.tgz gaim-1.5.0-i486-1.tgz php-5.0.4-i486-3.tgz
A .asc file is provided next to each package. This can be used along with 'gpg --verify' to verify the integrity of the packages.
+-----+
Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com
+------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. | +------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.7 (GNU/Linux)
iD8DBQFDILD5akRjwEAQIjMRAkFpAJ0bzfp37eGFhwEcfxrWJ5PbycMzLQCcCIK+ qClc5BB1JSVCvF5BuQDCGD8= =RJpa -----END PGP SIGNATURE-----
|