| |||||||||||||
Red Hat alert RHSA-2006:0648-01 (kdegraphics)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: kdegraphics security update Advisory ID: RHSA-2006:0648-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2006-0648.html Issue date: 2006-08-28 Updated on: 2006-08-28 Product: Red Hat Enterprise Linux CVE Names: CVE-2006-3459 CVE-2006-3460 CVE-2006-3461 CVE-2006-3462 CVE-2006-3463 CVE-2006-3464 CVE-2006-3465 - --------------------------------------------------------------------- 1. Summary: Updated kdegraphics packages that fix several security flaws in kfax are now available for Red Hat Enterprise Linux 2.1, and 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 3. Problem description: The kdegraphics package contains graphics applications for the K Desktop Environment. Tavis Ormandy of Google discovered a number of flaws in libtiff during a security audit. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these flaws. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. (CVE-2006-3459, CVE-2006-3460, CVE-2006-3461, CVE-2006-3462, CVE-2006-3463, CVE-2006-3464, CVE-2006-3465) Red Hat Enterprise Linux 4 is not vulnerable to these issues as kfax uses the shared libtiff library which has been fixed in a previous update. Users of kfax should upgrade to these updated packages, which contain backported patches and are not vulnerable to this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 201313 - CVE-2006-3459 kfax affected by libtiff flaws (CVE-2006-3460 CVE-2006-3461 CVE-2006-3462 CVE-2006-3463 CVE-2006-3464 CVE-2006-3465) 6. RPMs required: Red Hat Enterprise Linux AS (Advanced Server) version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/kde... 7e02f00c6f0f04f4b2d344a4ec023d8f kdegraphics-2.2.2-4.4.src.rpm i386: 95b171e3e34fb770f40ca342201b8530 kdegraphics-2.2.2-4.4.i386.rpm 92d41638599ce40f99bd4dae53d4557d kdegraphics-devel-2.2.2-4.4.i386.rpm ia64: b60111c884c0c11fe38c014fd2aa20a4 kdegraphics-2.2.2-4.4.ia64.rpm 8d3017d74b4c39ca38c6840127134b7d kdegraphics-devel-2.2.2-4.4.ia64.rpm Red Hat Linux Advanced Workstation 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/kde... 7e02f00c6f0f04f4b2d344a4ec023d8f kdegraphics-2.2.2-4.4.src.rpm ia64: b60111c884c0c11fe38c014fd2aa20a4 kdegraphics-2.2.2-4.4.ia64.rpm 8d3017d74b4c39ca38c6840127134b7d kdegraphics-devel-2.2.2-4.4.ia64.rpm Red Hat Enterprise Linux ES version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/kde... 7e02f00c6f0f04f4b2d344a4ec023d8f kdegraphics-2.2.2-4.4.src.rpm i386: 95b171e3e34fb770f40ca342201b8530 kdegraphics-2.2.2-4.4.i386.rpm 92d41638599ce40f99bd4dae53d4557d kdegraphics-devel-2.2.2-4.4.i386.rpm Red Hat Enterprise Linux WS version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/kde... 7e02f00c6f0f04f4b2d344a4ec023d8f kdegraphics-2.2.2-4.4.src.rpm i386: 95b171e3e34fb770f40ca342201b8530 kdegraphics-2.2.2-4.4.i386.rpm 92d41638599ce40f99bd4dae53d4557d kdegraphics-devel-2.2.2-4.4.i386.rpm Red Hat Enterprise Linux AS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/kdegr... ef88572cbd568315228054297655ef86 kdegraphics-3.1.3-3.10.src.rpm i386: 854050e9b33c97244bb7d7c9e5448257 kdegraphics-3.1.3-3.10.i386.rpm 5b947fa999294d0458c4f9e28204609d kdegraphics-debuginfo-3.1.3-3.10.i386.rpm 5da00f57f88c1f99308ede725c43c73c kdegraphics-devel-3.1.3-3.10.i386.rpm ia64: 26bd834fd42ee5aeeab12cb1e7255f4f kdegraphics-3.1.3-3.10.ia64.rpm c1de4ef881ce270b2927afd8153b5d8e kdegraphics-debuginfo-3.1.3-3.10.ia64.rpm 7186b1f5ca78824f67b73cf9b83351d7 kdegraphics-devel-3.1.3-3.10.ia64.rpm ppc: 9f6cdd9650db6608f972c42c76e8a4de kdegraphics-3.1.3-3.10.ppc.rpm 966ce65766809c0839f90bc7ee319f6d kdegraphics-debuginfo-3.1.3-3.10.ppc.rpm b452e2ef7748b702aa75b10dcc33f17c kdegraphics-devel-3.1.3-3.10.ppc.rpm s390: 866768918b02cd3601a304a59d15ad51 kdegraphics-3.1.3-3.10.s390.rpm ce2c5282ee6694998f105b322107489c kdegraphics-debuginfo-3.1.3-3.10.s390.rpm a3055e2cf71f6e7620a9c84a6058be7f kdegraphics-devel-3.1.3-3.10.s390.rpm s390x: 522c7089c601e9ed8d01e478503a795a kdegraphics-3.1.3-3.10.s390x.rpm e6e1f1c463c44748d85e1a073a96c30e kdegraphics-debuginfo-3.1.3-3.10.s390x.rpm 893a3ad832cfdc2e65ec585536717ca0 kdegraphics-devel-3.1.3-3.10.s390x.rpm x86_64: ce51d29598cdc0ac9aa433a669f37d7f kdegraphics-3.1.3-3.10.x86_64.rpm 0e243626db71c4d70fe76055684af12f kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm f83a0c0a9cedf3728b6cc02f12cac6e6 kdegraphics-devel-3.1.3-3.10.x86_64.rpm Red Hat Desktop version 3: SRPMS: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/... ef88572cbd568315228054297655ef86 kdegraphics-3.1.3-3.10.src.rpm i386: 854050e9b33c97244bb7d7c9e5448257 kdegraphics-3.1.3-3.10.i386.rpm 5b947fa999294d0458c4f9e28204609d kdegraphics-debuginfo-3.1.3-3.10.i386.rpm 5da00f57f88c1f99308ede725c43c73c kdegraphics-devel-3.1.3-3.10.i386.rpm x86_64: ce51d29598cdc0ac9aa433a669f37d7f kdegraphics-3.1.3-3.10.x86_64.rpm 0e243626db71c4d70fe76055684af12f kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm f83a0c0a9cedf3728b6cc02f12cac6e6 kdegraphics-devel-3.1.3-3.10.x86_64.rpm Red Hat Enterprise Linux ES version 3: SRPMS: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/kdegr... ef88572cbd568315228054297655ef86 kdegraphics-3.1.3-3.10.src.rpm i386: 854050e9b33c97244bb7d7c9e5448257 kdegraphics-3.1.3-3.10.i386.rpm 5b947fa999294d0458c4f9e28204609d kdegraphics-debuginfo-3.1.3-3.10.i386.rpm 5da00f57f88c1f99308ede725c43c73c kdegraphics-devel-3.1.3-3.10.i386.rpm ia64: 26bd834fd42ee5aeeab12cb1e7255f4f kdegraphics-3.1.3-3.10.ia64.rpm c1de4ef881ce270b2927afd8153b5d8e kdegraphics-debuginfo-3.1.3-3.10.ia64.rpm 7186b1f5ca78824f67b73cf9b83351d7 kdegraphics-devel-3.1.3-3.10.ia64.rpm x86_64: ce51d29598cdc0ac9aa433a669f37d7f kdegraphics-3.1.3-3.10.x86_64.rpm 0e243626db71c4d70fe76055684af12f kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm f83a0c0a9cedf3728b6cc02f12cac6e6 kdegraphics-devel-3.1.3-3.10.x86_64.rpm Red Hat Enterprise Linux WS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/kdegr... ef88572cbd568315228054297655ef86 kdegraphics-3.1.3-3.10.src.rpm i386: 854050e9b33c97244bb7d7c9e5448257 kdegraphics-3.1.3-3.10.i386.rpm 5b947fa999294d0458c4f9e28204609d kdegraphics-debuginfo-3.1.3-3.10.i386.rpm 5da00f57f88c1f99308ede725c43c73c kdegraphics-devel-3.1.3-3.10.i386.rpm ia64: 26bd834fd42ee5aeeab12cb1e7255f4f kdegraphics-3.1.3-3.10.ia64.rpm c1de4ef881ce270b2927afd8153b5d8e kdegraphics-debuginfo-3.1.3-3.10.ia64.rpm 7186b1f5ca78824f67b73cf9b83351d7 kdegraphics-devel-3.1.3-3.10.ia64.rpm x86_64: ce51d29598cdc0ac9aa433a669f37d7f kdegraphics-3.1.3-3.10.x86_64.rpm 0e243626db71c4d70fe76055684af12f kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm f83a0c0a9cedf3728b6cc02f12cac6e6 kdegraphics-devel-3.1.3-3.10.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3459 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3460 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3461 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3462 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3463 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3464 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3465 http://www.redhat.com/security/updates/classification/#mo... 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/ Copyright 2006 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQFE8uTyXlSAg2UNWIIRAqozAJ415P8NQEd17yEn6pvMCW+S2XQDUQCeNGsT aJzT9G/eEPRFHU3SieZ4zFM= =cEPk -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list Enterprise-watch-list@redhat.com https://www.redhat.com/mailman/listinfo/enterprise-watch-... (Log in to post comments)
|
|||||||||||||