| |||||||||||||
Trustix alert TSLSA-2006-0016 (curl kernel)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Trustix Secure Linux Security Advisory #2006-0016 Package names: curl, kernel Summary: Multiple vulnerabilities Date: 2006-03-24 Affected versions: Trustix Secure Linux 2.2 Trustix Secure Linux 3.0 - -------------------------------------------------------------------------- Package description: curl Curl is a client to get documents/files from servers, using any of the supported protocols. The command is designed to work without user interaction or any kind of interactivity. Curl offers a busload of useful tricks like proxy support, user authentication, ftp upload, HTTP post, file transfer resume and more. kernel The kernel package contains the Linux kernel (vmlinuz), the core of your Trustix Secure Linux operating system. The kernel handles the basic functions of the operating system: memory allocation, process allocation, device input and output, etc. Problem description: curl < TSL 3.0 > < TSL 2.2 > - New Upstream. - SECURITY Fix: Ulf Harnhammar has reported a vulnerability in cURL caused due to a boundary error within the parsing of a URL that contains the TFTP protocol prefix "tftp://". This can be exploited to cause a heap-based buffer overflow via a specially-crafted URL that consist of a valid hostname and a path that is longer than 512 bytes. The Common Vulnerabilities and Exposures project has assigned the name CVE-2006-1061 to this issue. kernel < TSL 3.0 > - New Upstream. - Upgraded 3ware 9xxx RAID driver. - SECURITY Fix: An integer overflow error exists within the "do_replace()" function in Netfilter. This can be exploited to cause a buffer overflow and allows the overwrite of arbitrary amounts of kernel memory when data is copied from user space. - Insufficient memory allocation in "drivers/usb/gadget/rndis.c" when handling NDIS response to OID_GEN_SUPPORTED_LIST may cause kernel memory corruption. Action: We recommend that all systems with this package installed be upgraded. Please note that if you do not need the functionality provided by this package, you may want to remove it from your system. Location: All Trustix Secure Linux updates are available from <URI:http://http.trustix.org/pub/trustix/updates/> <URI:ftp://ftp.trustix.org/pub/trustix/updates/> About Trustix Secure Linux: Trustix Secure Linux is a small Linux distribution for servers. With focus on security and stability, the system is painlessly kept safe and up to date from day one using swup, the automated software updater. Automatic updates: Users of the SWUP tool can enjoy having updates automatically installed using 'swup --upgrade'. Questions? Check out our mailing lists: <URI:http://www.trustix.org/support/> Verification: This advisory along with all Trustix packages are signed with the TSL sign key. This key is available from: <URI:http://www.trustix.org/TSL-SIGN-KEY> The advisory itself is available from the errata pages at <URI:http://www.trustix.org/errata/trustix-2.2/> and <URI:http://www.trustix.org/errata/trustix-3.0/> or directly at <URI:http://www.trustix.org/errata/2006/0016/> MD5sums of the packages: - -------------------------------------------------------------------------- 6fce50e6035dbc3ab0ca578927844415 3.0/rpms/curl-7.15.3-1tr.i586.rpm ba3003155801b89b93fb177db6e07f5e 3.0/rpms/curl-devel-7.15.3-1tr.i586.rpm 4bc68c32d094eda0ae60ae933180fdd2 3.0/rpms/kernel-2.6.16-1tr.i586.rpm 98e1697712799b460909414755dd94c4 3.0/rpms/kernel-doc-2.6.16-1tr.i586.rpm 218e3140d646b56c98c3d70c7b1745e2 3.0/rpms/kernel-headers-2.6.16-1tr.i586.rpm 2a7db5d25906e63849ceb25d3525ab15 3.0/rpms/kernel-smp-2.6.16-1tr.i586.rpm acd6e200b71765f84a12ccdc76376723 3.0/rpms/kernel-smp-headers-2.6.16-1tr.i586.rpm b113bbb4c13e02318aed8d3fca9b946f 3.0/rpms/kernel-source-2.6.16-1tr.i586.rpm 46240360c9c165dd56c3adced2e650d9 3.0/rpms/kernel-utils-2.6.16-1tr.i586.rpm 514b06393d2ba282231b25854a66ffca 2.2/rpms/curl-7.15.3-1tr.i586.rpm a10c16ca3b9fadbd477a9aa414f9e8fe 2.2/rpms/curl-devel-7.15.3-1tr.i586.rpm - -------------------------------------------------------------------------- Trustix Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) iD8DBQFEI+UMi8CEzsK9IksRAqLmAJ9GtBPHmzB+ix8CcOslJUHti36eYACdFINE BKD67VkTnXyWleFR+ZOu1R8= =QVXJ -----END PGP SIGNATURE----- _______________________________________________ tsl-announce mailing list tsl-announce@lists.trustix.org http://lists.trustix.org/mailman/listinfo/tsl-announce (Log in to post comments)
|
|||||||||||||