Security advisories for Monday

[Posted June 6, 2011 by ris]

Debian has updated fontforge (code execution), oprofile (command injection/privilege escalation), and libxml2 (arbitrary code execution).

Fedora has updated F15: phpmyadmin (unspecified vulnerability), F15: rdesktop (directory traversal), F14: drupal7 (multiple vulnerabilities), apr (F14; F13: denial of service), and drupal6 (F14; F13: multiple vulnerabilities).

Mandriva has updated subversion (multiple vulnerabilities).

openSUSE has updated gimp (arbitrary code execution).

Red Hat has updated flash-plugin (cross-site scripting).

Ubuntu has updated subversion (multiple vulnerabilities).

libxml2 in Debian Lenny

Posted Jun 6, 2011 19:27 UTC (Mon) by dfsmith (guest, #20302) [Link] (4 responses)

Is should go without saying but....

The Debian libxml2 update did not restart the three applications that were using the old version. (sudo lsof|grep libxml2 -> postgre, bind9 and apache2).

Manual restart of these was needed.

libxml2 in Debian Lenny

Posted Jun 6, 2011 23:11 UTC (Mon) by dtlin (subscriber, #36537) [Link] (3 responses)

More generally,

# lsof / | grep DEL

If you see something like

kdm       21259              root  DEL       REG                9,1              1294484 /usr/lib64/libkrb5.so.3.3

then you know PID 21259 is using a library that has been replaced. IIRC Debian does have post-triggers to restart some services on libc updates, but not for most others.

libxml2 in Debian Lenny

Posted Jun 7, 2011 2:24 UTC (Tue) by pabs (subscriber, #43278) [Link] (2 responses)

Even better, install debian-goodies and run checkrestart, which will give you a list of `/etc/init.d/foo restart` commands to run and a list of processes to kill that it couldn't associate with an init script. Unfortunately it doesn't do anything in the case of interpreted programs (eg Python/Ruby) and security issues in their dependencies.

libxml2 in Debian Lenny

Posted Jun 7, 2011 20:38 UTC (Tue) by dfsmith (guest, #20302) [Link] (1 responses)

That's really neat. I wonder why this isn't run automatically after a command line apt-get/aptitude?

libxml2 in Debian Lenny

Posted Jun 8, 2011 3:32 UTC (Wed) by pabs (subscriber, #43278) [Link]

Not every system has it installed. Plus it should be the sysadmin's job to decide when/if daemons are restarted. And more probably the maintainer didn't think of doing that and if they did probably they don't have time to implement it.

You might want to file a bug/patch asking for debian-goodies to add an apt hook that runs checkrestart and prompts about restarting daemons.