LWN.net Weekly Edition for December 20, 2007

Insufficiently free?

Watching an extended flame war between Richard Stallman and Theo de Raadt is an interesting experience. The realization that one can sit back and watch without having to really care about the result brings a sense of profound tranquility and relief. Along the way, one gets to learn things like how mean Theo can be, or that Richard does not use a web browser. It all seems like good fun. Even so, when the discussion reaches levels like this:

it becomes impossible not to wonder if one hasn't wandered into an elementary school yard by mistake. Most observers would probably conclude that Mr. Stallman has chosen to express himself with less childish terms than Mr. de Raadt. Still, this conversation came about as a result of a statement made by Mr. Stallman, one which upset the OpenBSD community greatly. It is worthwhile to look at where the disagreement was.

In particular, Richard Stallman started the discussion by saying that he cannot "recommend" OpenBSD because the "ports" system they use facilitates the installation of certain non-free packages. His reasoning comes down to this:

There are all kinds of things which can be said about the OpenBSD community, but statements that they lack a proper appreciation for freedom are not among them. This community's view of what makes a system truly free differs from that of the Free Software Foundation, but what they produce is undeniably free software. It is, arguably, one of the most free systems available, with careful attention paid to the licensing of even things like firmware blobs which are not part of the system itself. So folks in the OpenBSD community resent this sort of claim, even if they profess to care little about the opinions of the person making it.

Of course, it's not only OpenBSD which fails to pass Mr. Stallman's test. The list of recommended distributions from the GNU web site has grown recently; it now contains gNewSense, Ututo, Dynebolic, Musix, BLAG, and GNUstep. True statistics are hard to come by, of course, but your editor would be most surprised if the combined installed base of these distributions added up to a full 1% of the Linux systems in use. Most of us, in other words, are using systems which Mr. Stallman is unable to recommend.

Many of us will be using distributions like Fedora or Debian which are strongly committed to the creation of free systems. The developers behind these distributions have gone to considerable trouble to be sure that everything which is part of their system is truly free software, even when, as has happened at times, the result has been trouble for users. These distributors have clearly advanced the cause of free software greatly through their efforts over many years. One might well wonder just why Mr. Stallman cannot bring himself to recommend the result of this work.

The OpenBSD developers, though, have been asking a different question: why is the GNU project happy to enable its software to be installed on non-free systems? That is where the charges of hypocrisy come from. Mr. Stallman answered both questions together. It seems that, in his view, there is little risk of leading users astray by letting them install programs like Emacs on proprietary systems:

It would appear, however, that proprietary applications carry a much higher degree of risk:

It is not all that hard to see, embodied within a statement like this, a somewhat condescending view of computer users, who have to be "led" to install the right software. It is a position which disallows the recommendation of completely-free operating systems which most of us use. It places a sort of ideological purity above the vast amounts of work which have gone into the creation of a variety of free systems available for all to run.

It is, in other words, an unreasonable position - as can be seen by the fact that almost no free software users actually follow Mr. Stallman's advice when they choose their systems. Before condemning this unreasonable position, though, it's worth a quick review of the famous George Bernard Shaw quote:

There is no doubt that we have benefited from Mr. Stallman's lengthy, sometimes unreasonable campaign. Certainly he has no doubt on that score, saying "Free operating systems exist today because of the campaign which I started in 1983." But it's worthwhile to remember that free operating systems also exist because thousands of others have put in hard work for many years. It seems appropriate to wonder whether telling those people that their work still is not free enough really helps the cause of free software.

On the other hand, one need not wonder about the value of responding to a "refusal to recommend" with an extensive attack which ventures into pure character assassination. Vitriolic flaming helps nobody's cause. One may not agree with Mr. Stallman's position in this discussion, but one thing should be said: he kept his cool, remained respectful and stayed on-topic when others lost it completely. That is the way to promote free software.

Comments (85 posted)

Ruby on Rails releases 2.0

Rails (aka Ruby on Rails or RoR) is a framework for building web applications. It has gotten a lot of attention – some would say hype – over the past few years as easy to use and learn, while allowing the creation of complex database-backed web services. In the year since Rails 1.2, the team has not been idle, with their work culminating in the release of Rails 2.0 this month.

RoR is based around the idea of using the model-view-controller (MVC) pattern to cleanly separate the user interface from the application logic and data storage. All of the Ruby code written or generated for a Rails application is organized into a directory hierarchy based on what part of the MVC they implement. All of the parts of the application know how to find the others because of this convention, which is in keeping with the two principles that guided the development of RoR.

Fundamentally, RoR is built around two principles. The first is "convention over configuration", which is the idea that only things that deviate from standard practices need to be specified via configuration. One can get surprisingly far by sticking with these standard practices. The other principle is "don't repeat yourself", which means that there is a single place to go to specify something about the application; other places that need it or things derived from it, retrieve it from the canonical place. This is most evident in the specification of database table and column names; they are described in the model and other parts of the application retrieve them as required.

The principles are interrelated, of course, and are two of the innovations that RoR has popularized for web application frameworks. Many previous attempts required a huge amount of configuration information to be specified, often nearly identically in multiple places. Simplifying this configuration headache was explicitly a goal for Rails. It can take a bit of time to come to grips with the conventions used, but once that is done it is straightforward to use the framework.

Generating code to handle simple modifications to the database data, known as scaffolding, is another technique popularized by RoR. From the specification of the data model, Rails will generate an interface to create, read, update, and delete data in that model. It can also generate "migrations" which contain the SQL necessary to create or modify the database tables to reflect changes in the model. Migrations can be used in both a forward and backward direction to keep the database in sync with the state of the application as changes are made.

Rails itself is broken up into multiple components implementing each piece of the MVC architecture: ActiveRecord for the model, ActionPack for the view and controller, along with a number of lesser players. It provides extensive test harness facilities that allow testing of the web application without using a browser or network at all. RoR is a comprehensive solution, with a large number of very vocal supporters.

The new release provides a number of new features, some performance enhancements, as well as the requisite bug fixes. The bulk of the changes in 2.0 are in the controllers. The first is better support for "representational state transfer" (REST) style web application APIs, which were introduced in Rails 1.2. Better support for multiple different views based on application criteria were also added, allowing the interface to change based on the device accessing it, for example.

Security enhancements were made as well, with code being added to help protect against cross-site scripting and cross-site request forgery attacks. These two web application flaws are becoming rather popular to exploit, so any assistance a web framework can give is welcome. The default session objects have changed to be cookie-based, rather than stored in a file or the database. This allows snooping of the session data, but the data is hashed to prevent forgery.

Performance and scalability have been the traditional knocks against Rails, and though there were some enhancements, especially to ActiveRecord, that should provide some boost, it is not clear how well Rails handles huge sites. It is something the Rails team is aware of, so, over time, those kinds of problems should be solved. RoR is a very capable framework and the 2.0 release looks very good. The Rails community should find much of use.

Comments (4 posted)

Looking back at 2007

Consistent with our usual practice, LWN will not be publishing a Weekly Edition during the last full week of the year. This is thus the last such for 2007; the next weekly will be published on January 3, 2008. Also consistent with usual practice, you editor will look back on the year which is about to end, with an emphasis on evaluating how his predictions made at the beginning of the year came out. There is amusement to be had in exposing the flaws in one's crystal ball, but there is also value in seeing how one's view of the world has changed over the course of the year.

Your editor bravely predicted that GPLv3 would be finalized and adopted by the FSF; sure enough, that happened right on schedule. Your editor also admitted to having "no clue" of how the FSF would respond to the criticism of the anti-DRM provisions of GPLv3. Certainly it would have been hard to predict the addition of the "user product" language and associated exemptions. So far, the impact of GPLv3 has been relatively small, but use of this license will surely grow over time.

Another prediction said that somebody would be sued for the distribution of proprietary kernel modules. That did not happen - at least, not in a way that the public (or your editor) heard about it. What your editor did not foresee was the burst of energy coming from the Software Freedom Law Center on behalf of the BusyBox developers. Thus far, GPL enforcement activities continue to focus on the relatively clear-cut cases. They also continue to have a very high success rate. Still, going after a company like Verizon is an ambitious move; it will be interesting to see how that one settles out.

The end of SCO was predicted. Your editor thought it might happen in March, when new dispositive motions would once again be entertained by Judge Kimball. Instead, the clear end of SCO happened in August when the court ruled that Novell still owned the Unix source and that SCO owed Novell a chunk of money. Like a fish thrown on the shore, SCO will continue to flop around for a while, but there can be little doubt about its ultimate fate.

The prediction that there would be serious talk of patent reform did not really come through. There were a couple of U.S. court decisions in 2007 which, arguably, raised the bar slightly for patent trolls. In general, though, the software patent situation remains unchanged - and as dangerous as ever.

There were a couple of predictions about closed hardware, together saying, essentially, that the situation would get better but that the problem would not go away. Things clearly got better when AMD decided to open up information about ATI's video hardware and assist with the creation of free drivers for that hardware. The progress toward a viable Atheros wireless chipset driver for Linux is also a happy development. The situation has improved, and will continue to do so.

[PULL QUOTE: Your editor predicted a serious war on bloat as people got tired of running out of memory. Wishful thinking, it seems, is alive and well. END QUOTE] Your editor predicted a serious war on bloat as people got tired of running out of memory. Wishful thinking, it seems, is alive and well. In practice, people just bought more memory; even the OLPC project decided it had to increase the amount of memory in its XO system. Your editor will not be repeating this prediction for 2008.

"Fedora will come into its own as a free, community-oriented distribution" has, beyond any doubt, come true. The Fedora 7 release brought community developers in from the margins, and Fedora 8 solidified the new process. The bulk of the packages in Fedora are now maintained by community developers. Red Hat's controlling hand, while still clearly present, is weaker than before. Fedora leader Max Spevack has presided over a crucial transformation of this important project; he will be moving on to other challenges early in 2008, but will be leaving behind a distribution in far better shape than the one he inherited a few years ago.

Predicting Debian releases is a dangerous business, but, in this case, Debian Etch was close enough to make it a relatively safe proposition. Your editor had also suggested (facetiously) that the Debian developers would subsequently go back to arguing about firmware in the kernel; that quite clearly did not happen.

The prediction that free software would play a larger role in online gaming was, for the most part, wishful thinking again. The release of the Second Life client code was a step in the right direction, but not much happened after that. Your editor still hopes that free software will be at the core of the games of the future, or he may never see his children again.

The Microsoft/Novell deal, predicted your editor, would blow over with relatively few consequences. In many ways that was true. One could argue that the whole "235 patents" routine would have come out anyway - we heard similar claims before Novell signed this deal. Your editor failed to guess that a whole stream of companies (Samsung, Xandros, LG Electronics, Linspire, Turbolinux) would follow Novell into similar agreements, though.

Your editor suggested that the "open source" term would suffer as a result of companies trying to retain higher levels of control over "open source" code. Certainly the OSI's approval of the CPAL "badgeware" license will not have helped in this regard. On the other hand, SugarCRM decided to just go with the GPLv3 in favor of its attribution-required license. As a whole, "open source" means almost what it meant one year ago.

Contrary to prediction, there have not been OLPC systems distributed to millions of children - though thousands should start getting them soon. We are still waiting to see what impact the OLPC project will really have - on free software, and on the world as a whole. Stay tuned.

Finally, the growth of desktop Linux was predicted, though your editor refrained from saying that 2007 would be the year of the Linux desktop. Clearly, progress has been made in that direction - we now have major vendors like Dell selling desktop systems, Wal-Mart's desktop offering sold out in days, and the number of pocket-sized "desktops" running Linux continues to grow.

Perhaps the biggest thing which your editor missed entirely was the fight over Microsoft's proposed OOXML standard. This issue came to light in January of this year, though it had been simmering for a little while before - the ECMA TC45 committee was already considering this proposal in the middle of 2006. The fight over the fast-tracking of OOXML and the ensuing questions on just how the community should work with the standards practice will continue to echo into 2008.

Overall, your editor feels like the predictions went reasonably well. Too well, perhaps; next year's predictions may need to be a little more adventurous. Those predictions will be posted in the January 3 edition. In the mean time, your editor wishes for a great holiday season and new year for everybody in the community; we have accomplished much over the last year and have many things to celebrate.

Comments (9 posted)

Page editor: Jonathan Corbet

Security

The backdooring of SquirrelMail

SquirrelMail advertises itself as "webmail for nuts." It is a PHP-based package which is in wide use; most distributions include a SquirrelMail package. Security problems in SquirrelMail are certainly not unheard-of; even so, the announcement that the source distribution for version 1.4.12 had been compromised raised some eyebrows. Initially the project downplayed the problem:

It only took one day, though, before Uwe Schindler pointed out that, in fact, the changes made to the source opened a remote-execution back door into deployed SquirrelMail systems. Somewhere along the way, the project discovered that the 1.4.11 release had also been tampered with. The SquirrelMail developers released version 1.4.13 to close the vulnerabilities.

There have not been any public reports of systems being compromised by way of this vulnerability. Additionally, it would appear that all of the distributors which shipped the affected versions got their version of the code prior to the attack. So the episode would appear to have ended reasonably well - as far as we know. There are some lessons that one can take from this attack, though.

The downplaying of the problem initially was a potentially fatal mistake. If somebody has been tampering with the sources, there is no excuse not to go into red-alert mode immediately, even if the developers involved do not understand the attack. When a project has been compromised at such a fundamental level, one must assume the worst.

The compromise was discovered after a user noticed that the tarballs on the download site did not match the posted MD5 checksums. Your editor suspects that very few of us actually verify checksums in the packages they take from the net. Doing so more often would be a good exercise in software hygiene for all of us.

That said, the project got lucky this time around. A smarter attacker would have replaced the checksums after adding the back door, making the changes harder to detect. Longer-term, the increasing doubts about the security of MD5 suggest that relying on it to detect changes to tarballs might not be entirely safe. Far better to use public-key signatures; they should have a longer shelf life, and, if the keys are managed properly, they are impossible to replace. It seems that the project has posted GPG signatures for 1.4.13, though the Wayback Machine suggests that this is a recent practice. Your editor was unable to find the public key needed to verify the signatures.

The modifications to the tarballs were done using a compromised developer's account. The specific changes made were not put into the SquirrelMail source repository. The project has said nothing, though, about what has been done to ensure that no other changes were made there. Some sort of statement from the project along these lines would be most reassuring to SquirrelMail's users.

Perhaps the most encouraging conclusion, though, is this: there have been several attempts to compromise source distributions over the years. Many of them have succeeded in getting bad code into high-profile packages. But none of these attacks - so far as we know - have escaped detection for any significant period of time, and none of them have led to any sort of wide-scale exploit. As a whole, we would appear to be reasonably resistant to this kind of attack, even when the front-line defenses fail. With luck, and continued vigilance, that trend will continue. Both will be required, though: there is no doubt that the attackers will keep trying.

Comments (20 posted)

Security news

'You've Got Cross-Site Scripting' (Dark Reading)

Dark Reading reports on a new email alert service for cross-site scripting bugs. "So XSSed.com, a site dedicated to archiving publicly disclosed XSS bugs, is now offering a free email alert service that notifies you as soon as an XSS vulnerability affecting your Website gets indexed to its archive. XSSed claims to have the industry's largest XSS archive, with over 17,000 disclosed vulnerabilities as of this posting."

Comments (2 posted)

New vulnerabilities

clamav: integer overflow and off-by-one

Package(s):	clamav	CVE #(s):	CVE-2007-6335 CVE-2007-6336
Created:	December 19, 2007	Updated:	July 17, 2008
Description:	ClamAV contains integer overflow and off-by-one errors which could be exploited (via specially-crafted email) to execute arbitrary code.
Alerts:	Fedora FEDORA-2008-6422 2008-07-17 Fedora FEDORA-2008-1625 2008-02-13 Fedora FEDORA-2008-1608 2008-02-13 Fedora FEDORA-2008-0115 2008-01-22 Fedora FEDORA-2008-0170 2008-01-22 SuSE SUSE-SR:2008:001 2008-01-09 Mandriva MDVSA-2008:003 2007-01-08 Debian DSA-1435-1 2007-12-19 Gentoo 200712-20 2007-12-29

Comments (none posted)

cups: multiple vulnerabilities

Package(s):	cups	CVE #(s):	CVE-2007-5849 CVE-2007-6358 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393
Created:	December 19, 2007	Updated:	April 3, 2008
Description:	The cups 1.3.5 release fixes a number of vulnerabilities in the PDF filters. Additionally, there is a buffer overflow in the SNMP code and a temporary file vulnerability.
Alerts:	Debian DSA-1537-1 2008-04-02 Mandriva MDVSA-2008:036 2007-02-06 Debian DSA-1480-1 2008-02-05 SuSE SUSE-SR:2008:002 2008-01-25 SuSE SUSE-SA:2008:002 2008-01-10 Ubuntu USN-563-1 2008-01-09 Debian DSA-1437-1 2007-12-26 Gentoo 200712-14 2007-12-18

Comments (none posted)

flash-plugin: lots of problems

Package(s):	flash-plugin	CVE #(s):	CVE-2007-5275 CVE-2007-4324 CVE-2007-4768 CVE-2007-6242 CVE-2007-6243 CVE-2007-6244 CVE-2007-6245 CVE-2007-6246
Created:	December 19, 2007	Updated:	April 18, 2008
Description:	A vast number of vulnerabilities exists in the proprietary Flash plugin for Firefox.
Alerts:	Gentoo 200804-21 2008-04-18 SuSE SUSE-SA:2008:022 2008-04-11 Red Hat RHSA-2008:0221-01 2008-04-08 Gentoo 200801-07:02 2008-01-20 Red Hat RHSA-2007:1126-01 2007-12-18 SuSE SUSE-SA:2007:069 2007-12-21

Comments (3 posted)

IRC Services: denial of service

Package(s):	ircservices	CVE #(s):	CVE-2007-6122
Created:	December 14, 2007	Updated:	December 19, 2007
Description:	loverboy reported that the "default_encrypt()" function in file encrypt.c does not properly handle overly long passwords. A remote attacker could provide an overly long password to the vulnerable server, resulting in a denial of service.
Alerts:	Gentoo 200712-12 2007-12-13

Comments (none posted)

kdebase: denial of service

Package(s):	kdebase	CVE #(s):	CVE-2007-5963
Created:	December 18, 2007	Updated:	December 19, 2007
Description:	The kdebase package is vulnerable to a denial of service in which a local user can render KDM unusable for logins by any user or cause KDM to exceed system resource limits.
Alerts:	rPath rPSA-2007-0268-1 2007-12-17

Comments (none posted)

kernel: denial of service

Package(s):	kernel	CVE #(s):	CVE-2007-5966
Created:	December 19, 2007	Updated:	August 27, 2008
Description:	A bug in high-resolution timers (prior to kernel 2.6.22.15) can cause very long sleeps when large timeout values are used.
Alerts:	Mandriva MDVSA-2008:112 2007-06-12 SuSE SUSE-SA:2008:006 2008-02-07 Ubuntu USN-574-1 2008-02-04 Debian DSA-1436-1 2007-12-20 rPath rPSA-2007-0269-1 2007-12-18 Red Hat RHSA-2008:0585-01 2008-08-26

Comments (none posted)

libexif: integer overflow

Package(s):	libexif	CVE #(s):	CVE-2007-6352
Created:	December 19, 2007	Updated:	February 11, 2008
Description:	From the Red Hat advisory: An integer overflow flaw was found in the way libexif parses Exif image tags. If a victim opens a carefully crafted Exif image file, it could cause the application linked against libexif to execute arbitrary code, or crash.
Alerts:	Debian DSA-1487-1 2008-02-08 SuSE SUSE-SR:2008:002 2008-01-25 Mandriva MDVSA-2008:005 2007-01-09 rPath rPSA-2008-0006-1 2008-01-04 Fedora FEDORA-2007-4667 2007-12-20 Gentoo 200712-15 2007-12-29 Fedora FEDORA-2007-4608 2007-12-20 Red Hat RHSA-2007:1165-01 2007-12-19 Red Hat RHSA-2007:1166-01 2007-12-19

Comments (none posted)

libexif: denial of service

Package(s):	libexif	CVE #(s):	CVE-2007-6351
Created:	December 19, 2007	Updated:	February 11, 2008
Description:	From the Red Hat advisory: An infinite recursion flaw was found in the way libexif parses Exif image tags. If a victim opens a carefully crafted Exif image file, it could cause the application linked against libexif to crash.
Alerts:	Debian DSA-1487-1 2008-02-08 SuSE SUSE-SR:2008:002 2008-01-25 Mandriva MDVSA-2008:005 2007-01-09 rPath rPSA-2008-0006-1 2008-01-04 Gentoo 200712-15 2007-12-29 Fedora FEDORA-2007-4667 2007-12-20 Red Hat RHSA-2007:1165-01 2007-12-19 Fedora FEDORA-2007-4608 2007-12-20

Comments (none posted)

libgd2: buffer overflow

Package(s):	libgd2	CVE #(s):	CVE-2007-3996
Created:	December 19, 2007	Updated:	July 22, 2008
Description:	The GD library does not perform proper bounds checking when creating images; as a result, an attacker could, via crafted input, potentially execute arbitrary code.
Alerts:	Debian DSA-1613-1 2008-07-22 SuSE SUSE-SA:2008:004 2008-01-29 Red Hat RHSA-2007:0891-01 2007-10-25 Red Hat RHSA-2007:0917-01 2007-10-23 Ubuntu USN-557-1 2007-12-18

Comments (none posted)

mysql: privilege escalation

Package(s):	mysql	CVE #(s):	CVE-2007-6303
Created:	December 19, 2007	Updated:	April 7, 2008
Description:	From the CVE entry: MySQL 5.0.x before 5.0.52, 5.1.x before 5.1.23, and 6.0.x before 6.0.4 does not update the DEFINER value of a view when the view is altered, which allows remote authenticated users to gain privileges via a sequence of statements including a CREATE SQL SECURITY DEFINER VIEW statement and an ALTER VIEW statement.
Alerts:	Gentoo 200804-04 2008-04-06 Ubuntu USN-588-2 2008-04-02 Ubuntu USN-588-1 2008-03-19 SuSE SUSE-SR:2008:003 2008-02-07 Mandriva MDVSA-2008:017 2008-01-19 Red Hat RHSA-2007:1157-01 2007-12-19 Fedora FEDORA-2007-4465 2007-12-15 Fedora FEDORA-2007-4471 2007-12-15

Comments (none posted)

portage: information disclosure

Package(s):	portage	CVE #(s):	CVE-2007-6249
Created:	December 14, 2007	Updated:	December 19, 2007
Description:	Mike Frysinger reported that the "etc-update" utility uses temporary files with the standard umask, which results in the files being world-readable when merging configuration files in a default setup. A local attacker could access sensitive information when configuration files are being merged.
Alerts:	Gentoo 200712-11 2007-12-13

Comments (none posted)

squid: denial of service

Package(s):	squid	CVE #(s):	CVE-2007-6239
Created:	December 18, 2007	Updated:	July 7, 2008
Description:	A flaw was found in the way squid stored HTTP headers for cached objects in system memory. An attacker could cause squid to use additional memory, and trigger high CPU usage when processing requests for certain cached objects, possibly leading to a denial of service.
Alerts:	Mandriva MDVSA-2008:134 2007-07-04 Ubuntu USN-601-1 2008-04-14 Red Hat RHSA-2008:0214-01 2008-04-08 Debian DSA-1482-1 2008-02-05 Ubuntu USN-565-1 2008-01-09 Gentoo 200801-05 2008-01-09 SuSE SUSE-SR:2008:001 2008-01-09 Mandriva MDVSA-2008:002 2007-01-04 Fedora FEDORA-2007-4170 2007-12-15 Fedora FEDORA-2007-4161 2007-12-15 Red Hat RHSA-2007:1130-01 2007-12-18

Comments (none posted)

wpa_supplicant: stack-based buffer overflow

Package(s):	wpa_supplicant	CVE #(s):	CVE-2007-6025
Created:	December 14, 2007	Updated:	December 19, 2007
Description:	A stack-based buffer overflow in driver_wext.c in wpa_supplicant 0.6.0 allows remote attackers to cause a denial of service (crash) via crafted TSF data.
Alerts:	Mandriva MDKSA-2007:245 2007-12-13

Comments (1 posted)

Xfce: buffer overflows

Package(s):	xfce4	CVE #(s):
Created:	December 19, 2007	Updated:	December 19, 2007
Description:	The Xfce desktop contains a number of buffer overflow vulnerabilities; they have been fixed in the 4.4.2 release.
Alerts:	Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4385 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15 Fedora FEDORA-2007-4368 2007-12-15

Comments (none posted)

Updated vulnerabilities

apache2: information disclosure

Package(s):	apache	CVE #(s):	CVE-2007-1862
Created:	June 20, 2007	Updated:	February 18, 2008
Description:	From the Mandriva advisory: "The recall_headers function in mod_mem_cache in Apache 2.2.4 does not properly copy all levels of header data, which can cause Apache to return HTTP headers containing previously-used data, which could be used to obtain potentially sensitive information by unauthorized users."
Alerts:	Fedora FEDORA-2008-1711 2008-02-15 Fedora FEDORA-2007-0704 2007-06-26 Mandriva MDKSA-2007:127 2007-06-19

Comments (2 posted)

apache: multiple vulnerabilities

Package(s):	apache	CVE #(s):	CVE-2007-3304 CVE-2006-5752
Created:	June 27, 2007	Updated:	February 18, 2008
Description:	The Apache HTTP Server did not verify that a process was an Apache child process before sending it signals. A local attacker who has the ability to run scripts on the Apache HTTP Server could manipulate the scoreboard and cause arbitrary processes to be terminated, which could lead to a denial of service. (CVE-2007-3304) A flaw was found in the Apache HTTP Server mod_status module. Sites with the server-status page publicly accessible and ExtendedStatus enabled were vulnerable to a cross-site scripting attack. On Red Hat Enterprise Linux the server-status page is not enabled by default and it is best practice to not make this publicly available. (CVE-2006-5752)
Alerts:	Fedora FEDORA-2008-1711 2008-02-15 SuSE SUSE-SA:2007:061 2007-11-19 Fedora FEDORA-2007-2214 2007-09-18 rPath rPSA-2007-0182-1 2007-09-14 Ubuntu USN-499-1 2007-08-16 Red Hat RHSA-2007:0662-01 2007-07-13 Red Hat RHSA-2007:0557-01 2007-07-13 Fedora FEDORA-2007-615 2007-07-12 Mandriva MDKSA-2007:142 2007-07-04 Mandriva MDKSA-2007:141 2007-07-04 Mandriva MDKSA-2007:140 2007-07-04 Fedora FEDORA-2007-617 2007-07-02 rPath rPSA-2007-0136-1 2007-06-27 Red Hat RHSA-2007:0556-01 2007-06-26 Red Hat RHSA-2007:0534-01 2007-06-26 Red Hat RHSA-2007:0533-01 2007-06-27 Red Hat RHSA-2007:0532-01 2007-06-26

Comments (1 posted)

apache: cross-site scripting

Package(s):	apache	CVE #(s):	CVE-2006-3918
Created:	August 9, 2006	Updated:	April 4, 2008
Description:	From the Red Hat advisory: "A bug was found in Apache where an invalid Expect header sent to the server was returned to the user in an unescaped error message. This could allow an attacker to perform a cross-site scripting attack if a victim was tricked into connecting to a site and sending a carefully crafted Expect header."
Alerts:	SuSE SUSE-SA:2008:021 2008-04-04 Ubuntu USN-575-1 2008-02-04 SuSE SUSE-SA:2006:051 2006-09-08 Debian DSA-1167-1 2005-09-04 Red Hat RHSA-2006:0619-01 2006-08-10 Red Hat RHSA-2006:0618-01 2006-08-08

Comments (none posted)

apache2: denial of service

Package(s):	apache2	CVE #(s):	CVE-2007-1863
Created:	November 19, 2007	Updated:	February 18, 2008
Description:	From the CVE entry: cache_util.c in the mod_cache module in Apache HTTP Server (httpd), when caching is enabled and a threaded Multi-Processing Module (MPM) is used, allows remote attackers to cause a denial of service (child processing handler crash) via a request with the (1) s-maxage, (2) max-age, (3) min-fresh, or (4) max-stale Cache-Control headers without a value.
Alerts:	Fedora FEDORA-2008-1711 2008-02-15 SuSE SUSE-SA:2007:061 2007-11-19

Comments (1 posted)

httpd: denial of service, cross-site scripting

Package(s):	apache httpd	CVE #(s):	CVE-2007-3847 CVE-2007-4465
Created:	September 25, 2007	Updated:	February 15, 2008
Description:	A flaw was found in the mod_proxy module. On sites where a reverse proxy is configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. On sites where a forward proxy is configured, an attacker could cause a similar crash if a user could be persuaded to visit a malicious site using the proxy. This could lead to a denial of service if using a threaded Multi-Processing Module. (CVE-2007-3847) A flaw was found in the mod_autoindex module. On sites where directory listings are used, and the AddDefaultCharset directive has been removed from the configuration, a cross-site-scripting attack may be possible against browsers which do not correctly derive the response character set following the rules in RFC 2616. (CVE-2007-4465)
Alerts:	Slackware SSA:2008-045-02 2008-02-15 Ubuntu USN-575-1 2008-02-04 Red Hat RHSA-2008:0008-01 2008-01-15 Red Hat RHSA-2008:0006-01 2008-01-15 Red Hat RHSA-2008:0005-01 2008-01-15 Red Hat RHSA-2008:0004-01 2008-01-15 Mandriva MDKSA-2007:235 2007-12-03 SuSE SUSE-SA:2007:061 2007-11-19 Red Hat RHSA-2007:0747-02 2007-11-15 Gentoo 200711-06 2007-11-07 Red Hat RHSA-2007:0746-04 2007-11-07 Red Hat RHSA-2007:0911-01 2007-10-25 Fedora FEDORA-2007-707 2007-09-24

Comments (none posted)

asterisk: possible SQL injection

Package(s):	asterisk	CVE #(s):	CVE-2007-6170
Created:	December 3, 2007	Updated:	April 15, 2008
Description:	Tilghman Lesher discovered that the logging engine of Asterisk, a free software PBX and telephony toolkit, performs insufficient sanitizing of call-related data, which may lead to SQL injection.
Alerts:	Gentoo 200804-13 2008-04-14 SuSE SUSE-SR:2008:005 2008-03-06 Debian DSA-1417-1 2007-12-02

Comments (none posted)

autofs: insecure default configuration

Package(s):	autofs	CVE #(s):	CVE-2007-5964
Created:	December 12, 2007	Updated:	January 14, 2008
Description:	Versions of the autofs automounter daemon as shipped by Red Hat (and possibly other distributors) are installed with an insecure configuration; in particular, the "hosts" map lacks the "nosuid" option, allowing an attacker who has control over an NFS server to run setuid programs on vulnerable systems.
Alerts:	Mandriva MDVSA-2008:009-1 2007-01-12 Mandriva MDVSA-2008:009 2007-01-11 Fedora FEDORA-2007-4707 2007-12-21 Fedora FEDORA-2007-4469 2007-12-15 Fedora FEDORA-2007-4532 2007-12-15 Red Hat RHSA-2007:1129-01 2007-12-12 Fedora FEDORA-2007-4709 2007-12-21 Red Hat RHSA-2007:1128-01 2007-12-12

Comments (none posted)

cacti: SQL injection vulnerability

Package(s):	cacti	CVE #(s):	CVE-2007-6035
Created:	November 22, 2007	Updated:	February 18, 2008
Description:	Versions of Cacti prior to 0.8.7a have an SQL injection vulnerability. Remote attackers can execute arbitrary SQL commands via unspecified vectors.
Alerts:	Fedora FEDORA-2008-1737 2008-02-15 Fedora FEDORA-2008-1699 2008-02-15 Debian DSA-1418-1 2007-12-02 Mandriva MDKSA-2007:231 2007-11-22 Fedora FEDORA-2007-3683 2007-11-22 Gentoo 200712-02:02 2007-12-05 SuSE SUSE-SR:2007:024 2007-11-22 Fedora FEDORA-2007-3667 2007-11-22

Comments (none posted)

cacti: denial of service

Package(s):	cacti	CVE #(s):	CVE-2007-3112 CVE-2007-3113
Created:	September 18, 2007	Updated:	February 18, 2008
Description:	A vulnerability in Cacti 0.8.6i and earlier versions allows remote authenticated users to cause a denial of service (CPU consumption) via large values of the graph_start, graph_end, graph_height, or graph_width parameters.
Alerts:	Fedora FEDORA-2008-1737 2008-02-15 Fedora FEDORA-2007-3683 2007-11-22 Fedora FEDORA-2007-2199 2007-09-18 Mandriva MDKSA-2007:184 2007-09-17

Comments (none posted)

cairo: integer overflow

Package(s):	Cairo	CVE #(s):	CVE-2007-5503
Created:	November 29, 2007	Updated:	April 10, 2008
Description:	Cairo has an integer overflow vulnerability in the PNG image processing code. If a user processes a specially crafted PNG image with an application that is linked against cairo, arbitrary code can be executed with the user's privileges.
Alerts:	Debian DSA-1542-1 2008-04-09 SuSE SUSE-SR:2008:003 2008-02-07 Mandriva MDVSA-2008:019 2007-01-21 Fedora FEDORA-2007-3818 2008-01-16 rPath rPSA-2008-0015-1 2008-01-15 Ubuntu USN-550-3 2007-12-13 Ubuntu USN-550-2 2007-12-10 Gentoo 200712-04 2007-12-09 Ubuntu USN-550-1 2007-12-03 Slackware SSA:2007-337-01 2007-12-04 Red Hat RHSA-2007:1078-02 2007-11-29

Comments (none posted)

centericq: buffer overflows

Package(s):	centericq	CVE #(s):	CVE-2007-3713
Created:	July 20, 2007	Updated:	December 17, 2007
Description:	Multiple buffer overflows in Konst CenterICQ 4.9.11 through 4.21 allow remote attackers to execute arbitrary code via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this might overlap CVE-2007-0160.
Alerts:	Debian DSA-1433-1 2007-12-16 Debian-Testing DTSA-55-1 2007-09-03 Fedora FEDORA-2007-1160 2007-07-19

Comments (none posted)

clamav: denial of service

Package(s):	clamav	CVE #(s):	CVE-2007-3725
Created:	July 24, 2007	Updated:	February 27, 2008
Description:	A NULL pointer dereference has been discovered in the RAR VM of Clam Antivirus (ClamAV) which allows user-assisted remote attackers to cause a denial of service via a specially crafted RAR archives.
Alerts:	SuSE SUSE-SR:2007:015 2007-08-03 Gentoo 200708-04 2007-08-09 Mandriva MDKSA-2007:150 2007-07-25 Debian DSA-1340-1 2007-07-24

Comments (none posted)

clamav: multiple vulnerabilities

Package(s):	clamav	CVE #(s):	CVE-2007-4510 CVE-2007-4560
Created:	September 3, 2007	Updated:	February 13, 2008
Description:	Several remote vulnerabilities have been discovered in the Clam anti-virus toolkit. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2007-4510: It was discovered that the RTF and RFC2397 parsers can be tricked into dereferencing a NULL pointer, resulting in denial of service. CVE-2007-4560: It was discovered clamav-milter performs insufficient input sanitizing, resulting in the execution of arbitrary shell commands.
Alerts:	Fedora FEDORA-2008-1608 2008-02-13 Fedora FEDORA-2008-0170 2008-01-22 Gentoo 200709-14 2007-09-20 Fedora FEDORA-2007-2050 2007-09-07 Mandriva MDKSA-2007:172 2007-08-31 Debian DSA-1366-1 2007-09-01

Comments (none posted)

cups: denial of service

Package(s):	cups	CVE #(s):	CVE-2007-0720
Created:	March 26, 2007	Updated:	February 7, 2008
Description:	Previous versions of the cups package could be forced to hang via a client "partially negotiating" an ssl connection. In this state, cups would not allow other connections to be made, a denial of service.
Alerts:	Mandriva MDVSA-2008:036 2007-02-06 Mandriva MDKSA-2007:086 2007-04-16 Red Hat RHSA-2007:0123-01 2007-04-16 Gentoo 200703-28 2007-03-31 Foresight FLEA-2007-0003-1 2007-03-25

Comments (none posted)

debian-goodies: privilege escalation

Package(s):	debian-goodies	CVE #(s):	CVE-2007-3912
Created:	October 5, 2007	Updated:	March 24, 2008
Description:	Thomas de Grenier de Latour discovered that the checkrestart program included in debian-goodies did not correctly handle shell meta-characters. A local attacker could exploit this to gain the privileges of the user running checkrestart.
Alerts:	Debian DSA-1527-1 2008-03-24 Ubuntu USN-526-1 2007-10-04

Comments (none posted)

Django: denial of service

Package(s):	Django	CVE #(s):	CVE-2007-5712
Created:	November 12, 2007	Updated:	May 21, 2008
Description:	From the CVE notice: The internationalization (i18n) framework in Django 0.91, 0.95, 0.95.1, and 0.96, and as used in other products such as PyLucid, when the USE_I18N option and the i18n component are enabled, allows remote attackers to cause a denial of service (memory consumption) via many HTTP requests with large Accept-Language headers.
Alerts:	Fedora FEDORA-2007-2788 2007-11-09 Fedora FEDORA-2007-3157 2007-11-09

Comments (none posted)

dovecot: privilege escalation

Package(s):	dovecot	CVE #(s):	CVE-2007-4211
Created:	August 15, 2007	Updated:	May 21, 2008
Description:	From the rPath advisory: "Previous versions of the dovecot package are vulnerable to a minor privilege escalation attack in which an authenticated user may exploit an ACL plugin weakness to save message flags without having proper permissions."
Alerts:	Red Hat RHSA-2008:0297-02 2008-05-21 Fedora FEDORA-2007-664 2007-08-20 rPath rPSA-2007-0161-1 2007-08-14

Comments (none posted)

dovecot: directory traversal

Package(s):	dovecot	CVE #(s):	CVE-2007-2231
Created:	May 8, 2007	Updated:	May 21, 2008
Description:	Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) sequence in the mailbox name.
Alerts:	Red Hat RHSA-2008:0297-02 2008-05-21 Debian DSA-1359-1 2007-08-28 Ubuntu USN-487-1 2007-07-17 Fedora FEDORA-2007-493 2007-05-07

Comments (none posted)

e2fsprogs: integer overflows

Package(s):	e2fsprogs	CVE #(s):	CVE-2007-5497
Created:	December 7, 2007	Updated:	February 12, 2008
Description:	Rafal Wojtczuk of McAfee AVERT Research discovered that e2fsprogs, ext2 file system utilities and libraries, contained multiple integer overflows in memory allocations, based on sizes taken directly from filesystem information. These could result in heap-based overflows potentially allowing the execution of arbitrary code.
Alerts:	Foresight FLEA-2008-0005-1 2008-02-11 Fedora FEDORA-2007-4447 2008-01-16 Fedora FEDORA-2007-4461 2008-01-16 Red Hat RHSA-2008:0003-01 2008-01-07 Gentoo 200712-13 2007-12-18 rPath rPSA-2007-0262-1 2007-12-11 Debian DSA-1422 2007-12-07 Mandriva MDKSA-2007:242 2007-12-10 Ubuntu USN-555-1 2007-12-08

Comments (none posted)

eggdrop: stack-based buffer overflow

Package(s):	eggdrop	CVE #(s):	CVE-2007-2807
Created:	September 7, 2007	Updated:	January 7, 2008
Description:	A stack-based buffer overflow in mod/server.mod/servrmsg.c in Eggdrop 1.6.18, and possibly earlier, allows user-assisted, malicious remote IRC servers to execute arbitrary code via a long private message.
Alerts:	Debian DSA-1448-1 2008-01-05 Fedora FEDORA-2007-4325 2007-12-10 Fedora FEDORA-2007-4305 2007-12-10 Gentoo 200709-07 2007-09-15 Mandriva MDKSA-2007:175 2007-09-06

Comments (none posted)

emacs: buffer overflow

Package(s):	emacs	CVE #(s):	CVE-2007-6109
Created:	December 10, 2007	Updated:	May 6, 2008
Description:	From the National Vulnerability Database: Buffer overflow in emacs allows attackers to have an unknown impact, as demonstrated via a vector involving the command line.
Alerts:	Ubuntu USN-607-1 2008-05-06 SuSE SUSE-SR:2008:003 2008-02-07 Mandriva MDVSA-2008:034 2007-02-04 Gentoo 200712-03 2007-12-09

Comments (none posted)

emacs: command execution via local variables

Package(s):	emacs	CVE #(s):	CVE-2007-5795
Created:	November 14, 2007	Updated:	February 5, 2008
Description:	From the original Debian problem report: "In Debian's version of GNU Emacs 22.1+1-2, the `hack-local-variables' function does not behave correctly when `enable-local-variables' is set to :safe. The documentation of `enable-local-variables' states that the value :safe means to set only safe variables, as determined by `safe-local-variable-p' and `risky-local-variable-p' (and the data driving them), but Emacs ignores this and instead sets all the local variables." When this setting (which is not the default) is in effect, opening a hostile file could lead to the execution of arbitrary commands.
Alerts:	Mandriva MDVSA-2008:034 2007-02-04 Gentoo 200712-03 2007-12-09 Ubuntu USN-541-1 2007-11-13 Fedora FEDORA-2007-2946 2007-11-17 Fedora FEDORA-2007-3056 2007-11-17

Comments (1 posted)

emul-linux-x86-qtlibs: arbitrary code execution

Package(s):	emul-linux-x86-qtlibs	CVE #(s):
Created:	December 10, 2007	Updated:	December 12, 2007
Description:	From the Gentoo advisory: An attacker could trigger one of the vulnerabilities by causing a Qt application to parse specially crafted text or Unicode strings, which may lead to the execution of arbitrary code with the privileges of the user running the application.
Alerts:	Gentoo 200712-08 2007-12-09

Comments (none posted)

evolution: format string error

Package(s):	evolution	CVE #(s):	CVE-2007-1002
Created:	March 27, 2007	Updated:	February 27, 2008
Description:	A format string error in the "write_html()" function in calendar/gui/ e-cal-component-memo-preview.c when displaying a memo's categories can potentially be exploited to execute arbitrary code via a specially crafted shared memo containing format specifiers.
Alerts:	SuSE SUSE-SR:2007:015 2007-08-03 Gentoo 200706-02 2007-06-06 Red Hat RHSA-2007:0158-01 2007-05-03 Foresight FLEA-2007-0010-1 2007-04-05 Fedora FEDORA-2007-404 2007-04-04 Fedora FEDORA-2007-393 2007-04-04 Mandriva MDKSA-2007:070 2007-03-27

Comments (1 posted)

firebird: arbitrary code execution

Package(s):	firebird	CVE #(s):	CVE-2007-4992 CVE-2007-5246
Created:	December 10, 2007	Updated:	December 12, 2007
Description:	From the Gentoo advisory: Adriano Lima and Ramon de Carvalho Valle reported that functions isc_attach_database() and isc_create_database() do not perform proper boundary checking when processing their input. A remote attacker could send specially crafted requests to the Firebird server on TCP port 3050, possibly resulting in the execution of arbitrary code with the privileges of the user running Firebird (usually firebird).
Alerts:	Gentoo 200712-06 2007-12-09

Comments (none posted)

firebird: buffer overflow

Package(s):	firebird	CVE #(s):	CVE-2007-3181
Created:	July 2, 2007	Updated:	March 27, 2008
Description:	The Firebird DBMS has a buffer overflow vulnerability involving the processing of connect requests with an overly large p_cnct_count value. Remote attackers can send a specially crafted request to the server in order to potentially execute arbitrary code with the permissions of the Firebird user.
Alerts:	Debian DSA-1529-1 2008-03-24 Gentoo 200707-01 2007-07-01

Comments (none posted)

firefox: multiple vulnerabilities

Package(s):	firefox	CVE #(s):	CVE-2007-3844 CVE-2007-3845
Created:	August 1, 2007	Updated:	February 20, 2008
Description:	A flaw was discovered in handling of "about:blank" windows used by addons. A malicious web site could exploit this to modify the contents, or steal confidential data (such as passwords), of other web pages. (CVE-2007-3844) Jesper Johansson discovered that spaces and double-quotes were not correctly handled when launching external programs. In rare configurations, after tricking a user into opening a malicious web page, an attacker could execute helpers with arbitrary arguments with the user's privileges. (CVE-2007-3845)
Alerts:	Mandriva MDVSA-2007:047 2007-02-19 Fedora FEDORA-2007-3414 2007-11-16 Fedora FEDORA-2007-3431 2007-11-16 Red Hat RHSA-2007:0981-01 2007-10-19 Red Hat RHSA-2007:0980-01 2007-10-19 Red Hat RHSA-2007:0979-01 2007-10-19 Debian DSA-1391-1 2007-10-19 Gentoo 200708-09 2007-08-14 rPath rPSA-2007-0157-1 2007-08-10 Slackware SSA:2007-215-01 2007-08-06 Debian DSA-1346-1 2007-08-04 Debian DSA-1345-1 2007-08-04 Debian DSA-1344-1 2007-08-03 Foresight FLEA-2007-0040-1 2007-08-03 Slackware SSA:2007-213-01 2007-08-02 Mandriva MDKSA-2007:152 2007-08-01 Foresight FLEA-2007-0039-1 2007-08-01 Ubuntu USN-493-1 2007-07-31

Comments (none posted)

firefox: multiple vulnerabilities

Package(s):	firefox seamonkey	CVE #(s):	CVE-2007-5947 CVE-2007-5959 CVE-2007-5960
Created:	November 27, 2007	Updated:	March 3, 2008
Description:	A cross-site scripting flaw was found in the way Firefox handled the jar: URI scheme. It was possible for a malicious website to leverage this flaw and conduct a cross-site scripting attack against a user running Firefox. (CVE-2007-5947) Several flaws were found in the way Firefox processed certain malformed web content. A webpage containing malicious content could cause Firefox to crash, or potentially execute arbitrary code as the user running Firefox. (CVE-2007-5959) A race condition existed when Firefox set the "window.location" property for a webpage. This flaw could allow a webpage to set an arbitrary Referer header, which may lead to a Cross-site Request Forgery (CSRF) attack against websites that rely only on the Referer header for protection. (CVE-2007-5960)
Alerts:	rPath rPSA-2008-0093-1 2008-02-29 Foresight FLEA-2008-0001-1 2008-02-11 Gentoo 200712-21 2007-12-29 Red Hat RHSA-2007:1083-01