Security advisories for Wednesday

[Posted May 13, 2015 by ris]

Arch Linux has updated firefox (multiple vulnerabilities) and tomcat6 (denial of service).

CentOS has updated firefox (C7; C6: multiple vulnerabilities), kexec-tools (C7: file overwrites), pcs (C7; C6: privilege escalation), tomcat (C7: HTTP request smuggling), and tomcat6 (C6: HTTP request smuggling).

Debian has updated quassel (SQL injection).

Fedora has updated clamav (F20: multiple vulnerabilities), dpkg (F21; F20: two vulnerabilities), kernel (F21: two vulnerabilities), texlive (F21: predictable filenames), and wpa_supplicant (F20: code execution).

Gentoo has updated ettercap (multiple vulnerabilities).

Mageia has updated dnsmasq (information disclosure), flash-player-plugin (multiple vulnerabilities), hostapd (denial of service), netcf (denial of service), pam (two vulnerabilities), and testdisk (multiple vulnerabilities).

Oracle has updated firefox (OL7; OL5: multiple vulnerabilities), kernel (OL7: two vulnerabilities), kexec-tools (OL7: file overwrites), tomcat (OL7: HTTP request smuggling), and tomcat6 (OL6: HTTP request smuggling).

Red Hat has updated firefox (RHEL5,6,7: multiple vulnerabilities), flash-plugin (RHEL5,6: multiple vulnerabilities), java-1.6.0-ibm (RHEL5,6: multiple vulnerabilities), java-1.7.0-ibm (RHEL5: multiple vulnerabilities), kernel (RHEL7: privilege escalation), kernel-rt (RHEL7; RHEMRG2.5: privilege escalation), kexec-tools (RHEL7: file overwrites), kvm (RHEL5: code execution), pcs (RHEL7; RHEL6: privilege escalation), qemu-kvm (RHEL7; RHEL6: code execution), qemu-kvm-rhev (RHEL7, RHEL6, RHEL OSP4,5,6: code execution), tomcat (RHEL7: HTTP request smuggling), tomcat6 (RHEL6: HTTP request smuggling), and xen (RHEL5: code execution).

Scientific Linux has updated kvm (SL5: code execution) and xen (SL5: code execution).

Slackware has updated mozilla (multiple vulnerabilities).

SUSE has updated php5 (SLE12: multiple vulnerabilities).

Security advisories for Wednesday

Posted May 14, 2015 3:17 UTC (Thu) by imgx64 (guest, #78590) [Link] (6 responses)

Why does Fedora even have dpkg? Can it actually install deb packages?

Security advisories for Wednesday

Posted May 14, 2015 6:06 UTC (Thu) by mchapman (subscriber, #66589) [Link] (1 responses)

> Why does Fedora even have dpkg?

It's a dependent of "alien", the package format converter.

Security advisories for Wednesday

Posted May 14, 2015 9:01 UTC (Thu) by imgx64 (guest, #78590) [Link]

Ah, I see. Makes sense.

Fedora has dpkg. Debian has rpm. Nothing new here...

Posted May 17, 2015 12:57 UTC (Sun) by pr1268 (guest, #24648) [Link] (3 responses)

I suppose Fedora having dpkg is no more unusual than Debian having rpm—after all, they'd put the kitchen sink in either distro if someone made an .rpm or .deb for it. ;-)

Fedora has dpkg. Debian has rpm. Nothing new here...

Posted May 17, 2015 16:46 UTC (Sun) by rahulsundaram (subscriber, #21946) [Link] (2 responses)

Not quite. Fedora doesn't support third party kernel modules in the repository, no alternative init systems, no alternative libc etc. Some of it banned by policy. Others simply because noone has shown up with the interest and commitment to do the work involved but Debian repository tends to be more all encompassing than Fedora is and that is partly by design.

Fedora has dpkg. Debian has rpm. Nothing new here...

Posted May 18, 2015 11:25 UTC (Mon) by pr1268 (guest, #24648) [Link] (1 responses)

Well, I was being facetious. But your comment had me thinking about how I've historically (past 10-15 years or so) thought of Debian as being the more restrictive distro in this regard.

I guess things aren't always what they seem...

Fedora has dpkg. Debian has rpm. Nothing new here...

Posted May 18, 2015 18:34 UTC (Mon) by mathstuf (subscriber, #69389) [Link]

Debian is more restrictive about trademarks (see Iceweasel and friends).