April 2005
Five Red Hat Security Advisories
ID: 00364
Ref: 338/2005
Date: 29 April 2005:14:56:42
Version: 1
Title: Five Red Hat Security Advisories
Abstract:
Vendors affected: Red Hat
Operating systems affected: Red Hat
Applications affected: Red Hat
Title
=====
Five Red Hat Security Advisories:
1. RHSA-2005:261-01 - Low: glibc security update
2. RHSA-2005:283-01 - Important: kernel security update
3. RHSA-2005:284-01 - Important: kernel security update
4. RHSA-2005:384-01 - Important: Mozilla security update
5. RHSA-2005:405-01 - Moderate: PHP security update
Detail
======
1. The GNU libc packages (known as glibc) contain the standard C libraries
used by applications.
Flaws in the catchsegv and glibcbug scripts were discovered. A local user
could utilize these flaws to overwrite files via a symlink attack on
temporary files. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0968 and CAN-2004-1382 to
these issues.
2. The Linux kernel handles the basic functions of the operating system.
This is the seventh regular kernel update to Red Hat Enterprise Linux 2.1
3. The Linux kernel handles the basic functions of the operating system.
This is the seventh regular kernel update to Red Hat Enterprise Linux 2.1.
4. Mozilla is an open source Web browser, advanced email and newsgroup client,
IRC chat client, and HTML editor.
Several bugs were found with the way Mozilla displays the secure site icon.
It is possible that a malicious website could display the secure site icon
along with incorrect certificate information. (CAN-2005-0143 CAN-2005-0593)
5. PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Web server.
A bug was found in the way PHP processes IFF and JPEG images. It is
possible to cause PHP to consume CPU resources for a short period of time
by supplying a carefully crafted IFF or JPEG image. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
names CAN-2005-0524 and CAN-2005-0525 to these issues.
1.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Low: glibc security update
Advisory ID: RHSA-2005:261-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-261.html
Issue date: 2005-04-28
Updated on: 2005-04-28
Product: Red Hat Enterprise Linux
Keywords: glibc LD_DEBUG catchsegv glibcbug
CVE Names: CAN-2004-0968 CAN-2004-1382 CAN-2004-1453
- - ---------------------------------------------------------------------
1. Summary:
Updated glibc packages that address several bugs are now available.
This update has been rated as having low security impact by the Red Hat
Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
3. Problem description:
The GNU libc packages (known as glibc) contain the standard C libraries
used by applications.
Flaws in the catchsegv and glibcbug scripts were discovered. A local user
could utilize these flaws to overwrite files via a symlink attack on
temporary files. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0968 and CAN-2004-1382 to
these issues.
It was discovered that the use of LD_DEBUG and LD_SHOW_AUXV were not
restricted for a setuid program. A local user could utilize this flaw to
gain information, such as the list of symbols used by the program. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CAN-2004-1453 to this issue.
This erratum also addresses the following bugs in the GNU C Library:
- - - Now avoids calling sigaction (SIGPIPE, ...) in syslog implementation
- - - Fixed poll on Itanium
- - - Now allows setenv/putenv in shared library constructors
Users of glibc are advised to upgrade to these erratum packages that remove
the unecessary glibcbug script and contain backported patches to correct
these other issues.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
5. Bug IDs fixed (http://bugzilla.redhat.com/):
140068 - [RHAS2.1] CAN-2004-0968 temporary file vulnerabilities in catchsegv script
140487 - [RHAS2.1] Bad declaration of __syscall_poll can cause bogus values for
timeout to be passed to the kernel
148814 - CAN-2004-1453 Information leak with LD_DEBUG
148800 - CAN-2004-1382 insecure temporary file usage
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/glibc-2.2.4-32.20.src.rpm
86c397f7614278f57b9b814d6adedace glibc-2.2.4-32.20.src.rpm
i386:
5b601e85eba293c52d9fe15d8e766a12 glibc-2.2.4-32.20.i386.rpm
e1c21533e3d86da39390e93d4b93060e glibc-2.2.4-32.20.i686.rpm
b7eda3e6a3b7f24813415c692bde5cff glibc-common-2.2.4-32.20.i386.rpm
0b39ef1f661609a0346675b1877a6288 glibc-devel-2.2.4-32.20.i386.rpm
88ed7d4adfcf4627478367a253a65989 glibc-profile-2.2.4-32.20.i386.rpm
b3d6d4389676fc0652277f490d47dfec nscd-2.2.4-32.20.i386.rpm
ia64:
158103afa78aec998e3db120d245cd37 glibc-2.2.4-32.20.ia64.rpm
321c25cf3605db040fef49a79c443618 glibc-common-2.2.4-32.20.ia64.rpm
a5eb76dc9b8dbcf8cfd6938d1a957977 glibc-devel-2.2.4-32.20.ia64.rpm
b24148c15938f32f7a5f7df0773eb092 glibc-profile-2.2.4-32.20.ia64.rpm
925478d53517e5cd62762f608b4e26f8 nscd-2.2.4-32.20.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/glibc-2.2.4-32.20.src.rpm
86c397f7614278f57b9b814d6adedace glibc-2.2.4-32.20.src.rpm
ia64:
158103afa78aec998e3db120d245cd37 glibc-2.2.4-32.20.ia64.rpm
321c25cf3605db040fef49a79c443618 glibc-common-2.2.4-32.20.ia64.rpm
a5eb76dc9b8dbcf8cfd6938d1a957977 glibc-devel-2.2.4-32.20.ia64.rpm
b24148c15938f32f7a5f7df0773eb092 glibc-profile-2.2.4-32.20.ia64.rpm
925478d53517e5cd62762f608b4e26f8 nscd-2.2.4-32.20.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/glibc-2.2.4-32.20.src.rpm
86c397f7614278f57b9b814d6adedace glibc-2.2.4-32.20.src.rpm
i386:
5b601e85eba293c52d9fe15d8e766a12 glibc-2.2.4-32.20.i386.rpm
e1c21533e3d86da39390e93d4b93060e glibc-2.2.4-32.20.i686.rpm
b7eda3e6a3b7f24813415c692bde5cff glibc-common-2.2.4-32.20.i386.rpm
0b39ef1f661609a0346675b1877a6288 glibc-devel-2.2.4-32.20.i386.rpm
88ed7d4adfcf4627478367a253a65989 glibc-profile-2.2.4-32.20.i386.rpm
b3d6d4389676fc0652277f490d47dfec nscd-2.2.4-32.20.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/glibc-2.2.4-32.20.src.rpm
86c397f7614278f57b9b814d6adedace glibc-2.2.4-32.20.src.rpm
i386:
5b601e85eba293c52d9fe15d8e766a12 glibc-2.2.4-32.20.i386.rpm
e1c21533e3d86da39390e93d4b93060e glibc-2.2.4-32.20.i686.rpm
b7eda3e6a3b7f24813415c692bde5cff glibc-common-2.2.4-32.20.i386.rpm
0b39ef1f661609a0346675b1877a6288 glibc-devel-2.2.4-32.20.i386.rpm
88ed7d4adfcf4627478367a253a65989 glibc-profile-2.2.4-32.20.i386.rpm
b3d6d4389676fc0652277f490d47dfec nscd-2.2.4-32.20.i386.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0968
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1382
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1453
8. Contact:
The Red Hat security contact is . More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2005 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQFCcP5iXlSAg2UNWIIRAiAfAJ4zWUXUcvyQ+T5IlLh14Sf61ImBEACgoE7l
Tar3vxLww2u0QMfW/biOfFM=
=7I1g
- -----END PGP SIGNATURE-----
2.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Important: kernel security update
Advisory ID: RHSA-2005:283-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-283.html
Issue date: 2005-04-28
Updated on: 2005-04-28
Product: Red Hat Enterprise Linux
CVE Names: CAN-2004-0619 CAN-2005-0384 CAN-2005-0449 CAN-2005-0750
- - ---------------------------------------------------------------------
1. Summary:
Updated kernel packages are now available as part of ongoing support and
maintenance of Red Hat Enterprise Linux version 2.1. This is the seventh
regular update.
This security advisory has been rated as having important security impact
by the Red Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
3. Problem description:
The Linux kernel handles the basic functions of the operating system.
This is the seventh regular kernel update to Red Hat Enterprise Linux 2.1
The following security updates were made:
A flaw in fragment queuing was discovered that affected the Linux 2.4 and
Linux 2.6 kernel netfilter subsystem. On systems configured to filter or
process network packets (for example those configured to do firewalling),
a remote attacker could send a carefully crafted set of fragmented packets
to a machine and cause a denial of service (system crash). In order to
sucessfully exploit this flaw, the attacker would need to know (or guess)
some aspects of the firewall ruleset in place on the target system to be
able to craft the right fragmented packets. (CAN-2005-0449)
A flaw was discovered in the Linux PPP driver. On systems allowing remote
users to connect to a server using ppp, a remote client could cause a
denial of service (system crash). (CAN-2005-0384)
A flaw was discovered in the bluetooth driver system. On system where the
bluetooth modules are loaded, a local user could use this flaw to gain
elevated (root) privileges. (CAN-2005-0750)
An integer overflow flaw was discovered in the ubsec_keysetup function
in the Broadcom 5820 cryptonet driver. On systems using this driver,
a local user could cause a denial of service (crash) or possibly gain
elevated privileges. (CAN-2004-0619) Please note that this update contains
an unpatched kernel module called bcm5820_old for backwards compatibility
which is still vulnerable to CAN-2004-0619.
The following device drivers have been updated to new versions:
mptfusion: 2.05.16 -> 2.05.16.02
bcm5820: 1.17 -> 1.81
cciss: 2.4.52 -> 2.4.54
qla2x00: 6.04.01 -> 7.01.01
There were many bug fixes in various parts of the kernel. The ongoing
effort to resolve these problems has resulted in a marked improvement
in the reliability and scalability of Red Hat Enterprise Linux 2.1.
Bug fixes include:
- Fixes an incorrect and ever-changing physical_id field in
/proc/cpuinfo.
- Now recognizes a particular e1000 device (PCI ID 8086:1014)
- Fixes a panic in disk quota code
- Fixes a bug in which msync(...MS_SYNC) returns before the data
is written to disk
- Adds new devices to the SCSI scan list so they can
be initialized and handled properly: LSI ProFibre 4000R, HP
HSV200/210, HP MSA, STK OPENstorage D178.
- Fixes a potential format overflow in /proc/partitions
- Restores module parameters to the e100 driver for compatibility with
existing customer scripts.
- Fixes a bug in which cat'ing /proc/mdstat while adding/removing
devices can cause a kernel oops
All Red Hat Enterprise Linux 2.1 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.
Please note that a vulnerability addressed by this update (CAN-2005-0449)
required a change to the kernel module ABI which could cause third party
modules to not work. However, Red Hat is currently not aware of any module
that would be affected by this change.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise
5. Bug IDs fixed (http://bugzilla.redhat.com/):
127256 - CAN-2004-0619 Broadcom 5820 integer overflow
147674 - physical_id field of /proc/cpuinfo contains arbitrary values that change
151803 - CAN-2005-0449 Possible remote Oops/firewall bypass
151242 - CAN-2005-0384 pppd remote DoS
152179 - CAN-2005-0750 bluetooth security flaw
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/kernel-2.4.9-e.62.src.rpm
8bcec230f8895b907a6300626ced0dbf kernel-2.4.9-e.62.src.rpm
i386:
7fa5f91dac379821e1cb6413b5db02ff kernel-2.4.9-e.62.athlon.rpm
41604091576bb1126154035d7c0ae45f kernel-2.4.9-e.62.i686.rpm
ede93e1af6c884488268a4322840341d kernel-BOOT-2.4.9-e.62.i386.rpm
cec5c68f2ce35d8d1e8021c0f29b6dca kernel-debug-2.4.9-e.62.i686.rpm
f9e95fdbdd9a2fd3eb77d9b6106211b1 kernel-doc-2.4.9-e.62.i386.rpm
386b858e5f31f17b0c4e2fdc6dca5413 kernel-enterprise-2.4.9-e.62.i686.rpm
5207e13b01f6d7686f0f71fd97843a12 kernel-headers-2.4.9-e.62.i386.rpm
2f129c38c477f62e934936f6db7a65ba kernel-smp-2.4.9-e.62.athlon.rpm
98bf1e315f5c2b3492dd2ffc83bbe974 kernel-smp-2.4.9-e.62.i686.rpm
e50286b5695891e5b6bd0b54d4ef8986 kernel-source-2.4.9-e.62.i386.rpm
52b00cd6af3f6c50840ea2787073a700 kernel-summit-2.4.9-e.62.i686.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/kernel-2.4.9-e.62.src.rpm
8bcec230f8895b907a6300626ced0dbf kernel-2.4.9-e.62.src.rpm
i386:
7fa5f91dac379821e1cb6413b5db02ff kernel-2.4.9-e.62.athlon.rpm
41604091576bb1126154035d7c0ae45f kernel-2.4.9-e.62.i686.rpm
ede93e1af6c884488268a4322840341d kernel-BOOT-2.4.9-e.62.i386.rpm
cec5c68f2ce35d8d1e8021c0f29b6dca kernel-debug-2.4.9-e.62.i686.rpm
f9e95fdbdd9a2fd3eb77d9b6106211b1 kernel-doc-2.4.9-e.62.i386.rpm
5207e13b01f6d7686f0f71fd97843a12 kernel-headers-2.4.9-e.62.i386.rpm
2f129c38c477f62e934936f6db7a65ba kernel-smp-2.4.9-e.62.athlon.rpm
98bf1e315f5c2b3492dd2ffc83bbe974 kernel-smp-2.4.9-e.62.i686.rpm
e50286b5695891e5b6bd0b54d4ef8986 kernel-source-2.4.9-e.62.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/kernel-2.4.9-e.62.src.rpm
8bcec230f8895b907a6300626ced0dbf kernel-2.4.9-e.62.src.rpm
i386:
7fa5f91dac379821e1cb6413b5db02ff kernel-2.4.9-e.62.athlon.rpm
41604091576bb1126154035d7c0ae45f kernel-2.4.9-e.62.i686.rpm
ede93e1af6c884488268a4322840341d kernel-BOOT-2.4.9-e.62.i386.rpm
cec5c68f2ce35d8d1e8021c0f29b6dca kernel-debug-2.4.9-e.62.i686.rpm
f9e95fdbdd9a2fd3eb77d9b6106211b1 kernel-doc-2.4.9-e.62.i386.rpm
386b858e5f31f17b0c4e2fdc6dca5413 kernel-enterprise-2.4.9-e.62.i686.rpm
5207e13b01f6d7686f0f71fd97843a12 kernel-headers-2.4.9-e.62.i386.rpm
2f129c38c477f62e934936f6db7a65ba kernel-smp-2.4.9-e.62.athlon.rpm
98bf1e315f5c2b3492dd2ffc83bbe974 kernel-smp-2.4.9-e.62.i686.rpm
e50286b5695891e5b6bd0b54d4ef8986 kernel-source-2.4.9-e.62.i386.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0619
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0384
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0449
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0750
8. Contact:
The Red Hat security contact is . More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2005 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQFCcP5zXlSAg2UNWIIRAti0AJ9tm03akxNjs1F4HAK662e+fSDBIQCeILHJ
tJG87/MPBNEgbgKCempsdOY=
=x2ld
- -----END PGP SIGNATURE-----
3.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Important: kernel security update
Advisory ID: RHSA-2005:284-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-284.html
Issue date: 2005-04-28
Updated on: 2005-04-28
Product: Red Hat Enterprise Linux
CVE Names: CAN-2005-0135 CAN-2005-0137 CAN-2005-0384 CAN-2005-0449 CAN-2005-0750
- - ---------------------------------------------------------------------
1. Summary:
Updated kernel packages are now available as part of ongoing support and
maintenance of Red Hat Enterprise Linux version 2.1 for 64-bit
architectures. This is the seventh regular update.
This security advisory has been rated as having important security impact
by the Red Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
3. Problem description:
The Linux kernel handles the basic functions of the operating system.
This is the seventh regular kernel update to Red Hat Enterprise Linux 2.1.
The following security updates were made:
A flaw in fragment queuing was discovered that affected the Linux 2.4 and
Linux 2.6 kernel netfilter subsystem. On systems configured to filter or
process network packets (for example, those configured to do firewalling),
a remote attacker could send a carefully crafted set of fragmented packets
to a machine and cause a denial of service (system crash). In order to
sucessfully exploit this flaw, the attacker would need to know (or guess)
some aspects of the firewall ruleset in place on the target system to be
able to craft the right fragmented packets. (CAN-2005-0449)
A flaw was discovered in the Linux PPP driver. On systems allowing remote
users to connect to a server using ppp, a remote client could cause a
denial of service (system crash). (CAN-2005-0384)
A flaw was discovered in the bluetooth driver system. On systems where the
bluetooth modules are loaded, a local user could use this flaw to gain
elevated (root) privileges. (CAN-2005-0750)
Keith Owens reported a flaw in the Itanium unw_unwind_to_user() function.
A local user could use this flaw to cause a denial of service (system
crash). (CAN-2005-0135)
A missing Itanium syscall table entry could allow an unprivileged
local user to cause a denial of service (system crash). (CAN-2005-0137)
There were several bug fixes in various parts of the kernel. The ongoing
effort to resolve these problems has resulted in a marked improvement
in the reliability and scalability of Red Hat Enterprise Linux 2.1.
Bug fixes for this release include:
- Fixes an incorrect test in RPC for SYN packets when reconnecting
an idle TCP link
- Fixes a memory-corruption bug in the DMA path that can cause
system hangs or unpredictable behavior under heavy I/O load
- Adds new devices to the SCSI scan list so they can
be initialized and handled properly: LSI ProFibre 4000R, HP
HSV200/210, HP MSA, STK OPENstorage D178.
- Fixes a hang under heavy I/O load in the qla1280 driver
- Fixes a panic in disk quota code
- Fixes a potential format overflow in /proc/partitions
- Fixes ipvs calls to ip_defrag()
All Red Hat Enterprise Linux 2.1 users are advised to upgrade their
kernels to the packages associated with their machine architectures
and configurations as listed in this erratum.
Please note that a vulnerability addressed by this update (CAN-2005-0449)
required a change to the kernel module ABI which could cause third party
modules to not work. However, Red Hat is currently not aware of any module
that would be affected by this change.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise
5. Bug IDs fixed (http://bugzilla.redhat.com/):
151804 - CAN-2005-0449 Possible remote Oops/firewall bypass
151243 - CAN-2005-0384 pppd remote DoS (ipf)
152180 - CAN-2005-0750 bluetooth security flaw (ipf)
148870 - CAN-2005-0135 ia64 local DoS
148860 - CAN-2005-0137 ia64 syscall_table DoS
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/kernel-2.4.18-e.56.src.rpm
f365099f940d4e423cc3be53a10116ea kernel-2.4.18-e.56.src.rpm
ia64:
ac9ee030a03260952fce4c72ec8f5ef5 kernel-2.4.18-e.56.ia64.rpm
62460cbfcc0c379434e2e77e39ca9a1a kernel-doc-2.4.18-e.56.ia64.rpm
c001f4b6c8b442a5d81ae2211b8210e2 kernel-smp-2.4.18-e.56.ia64.rpm
a9e199cec346086dcf09e3735a1bcbcd kernel-source-2.4.18-e.56.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/kernel-2.4.18-e.56.src.rpm
f365099f940d4e423cc3be53a10116ea kernel-2.4.18-e.56.src.rpm
ia64:
ac9ee030a03260952fce4c72ec8f5ef5 kernel-2.4.18-e.56.ia64.rpm
62460cbfcc0c379434e2e77e39ca9a1a kernel-doc-2.4.18-e.56.ia64.rpm
c001f4b6c8b442a5d81ae2211b8210e2 kernel-smp-2.4.18-e.56.ia64.rpm
a9e199cec346086dcf09e3735a1bcbcd kernel-source-2.4.18-e.56.ia64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0135
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0137
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0384
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0449
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0750
8. Contact:
The Red Hat security contact is . More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2005 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQFCcP59XlSAg2UNWIIRAqwxAJ0VJgTnAcvrRlMlZMvTCgRWSFGwKACdFyJw
yi7zFEFjsFmAzhrcjeJJIkI=
=qu2h
- -----END PGP SIGNATURE-----
4.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Important: Mozilla security update
Advisory ID: RHSA-2005:384-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-384.html
Issue date: 2005-04-28
Updated on: 2005-04-28
Product: Red Hat Enterprise Linux
CVE Names: CAN-2004-1156 CAN-2005-0142 CAN-2005-0143 CAN-2005-0146 CAN-2005-0231 CAN-2005-0232 CAN-2005-0233 CAN-2005-0401 CAN-2005-0527 CAN-2005-0578 CAN-2005-0584 CAN-2005-0585 CAN-2005-0586 CAN-2005-0588 CAN-2005-0590 CAN-2005-0591 CAN-2005-0593 CAN-2005-0989 CAN-2005-1153 CAN-2005-1154 CAN-2005-1155 CAN-2005-1156 CAN-2005-1157 CAN-2005-1159 CAN-2005-1160
- - ---------------------------------------------------------------------
1. Summary:
Updated Mozilla packages that fix various security bugs are now available.
This update has been rated as having Important security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
3. Problem description:
Mozilla is an open source Web browser, advanced email and newsgroup client,
IRC chat client, and HTML editor.
Several bugs were found with the way Mozilla displays the secure site icon.
It is possible that a malicious website could display the secure site icon
along with incorrect certificate information. (CAN-2005-0143 CAN-2005-0593)
A bug was found in the way Mozilla handles synthetic middle click events.
It is possible for a malicious web page to steal the contents of a victims
clipboard. (CAN-2005-0146)
Several bugs were found with the way Mozilla handles temporary files. A
local user could view sensitive temporary information or delete arbitrary
files. (CAN-2005-0142 CAN-2005-0578)
A bug was found in the way Mozilla handles pop-up windows. It is possible
for a malicious website to control the content in an unrelated site's
pop-up window. (CAN-2004-1156)
A flaw was found in the way Mozilla displays international domain names. It
is possible for an attacker to display a valid URL, tricking the user into
thinking they are viewing a legitimate webpage when they are not.
(CAN-2005-0233)
A bug was found in the way Mozilla processes XUL content. If a malicious
web page can trick a user into dragging an object, it is possible to load
malicious XUL content. (CAN-2005-0401)
A bug was found in the way Mozilla handles xsl:include and xsl:import
directives. It is possible for a malicious website to import XSLT
stylesheets from a domain behind a firewall, leaking information to an
attacker. (CAN-2005-0588)
Several bugs were found in the way Mozilla displays alert dialogs. It is
possible for a malicious webserver or website to trick a user into thinking
the dialog window is being generated from a trusted site. (CAN-2005-0586
CAN-2005-0591 CAN-2005-0585 CAN-2005-0590 CAN-2005-0584)
A bug was found in the Mozilla javascript security manager. If a user drags
a malicious link to a tab, the javascript security manager is bypassed,
which could result in remote code execution or information disclosure.
(CAN-2005-0231)
A bug was found in the way Mozilla allows plug-ins to load privileged
content into a frame. It is possible that a malicious webpage could trick a
user into clicking in certain places to modify configuration settings or
execute arbitrary code. (CAN-2005-0232 and CAN-2005-0527)
A bug was found in the way Mozilla handles anonymous functions during
regular expression string replacement. It is possible for a malicious web
page to capture a random block of browser memory. (CAN-2005-0989)
A bug was found in the way Mozilla displays pop-up windows. If a user
choses to open a pop-up window whose URL is malicious javascript, the
script will be executed with elevated privileges. (CAN-2005-1153)
A bug was found in the way Mozilla installed search plugins. If a user
chooses to install a search plugin from a malicious site, the new plugin
could silently overwrite an existing plugin. This could allow the malicious
plugin to execute arbitrary code and stealm sensitive information.
(CAN-2005-1156 CAN-2005-1157)
Several bugs were found in the Mozilla javascript engine. A malicious web
page could leverage these issues to execute javascript with elevated
privileges or steal sensitive information. (CAN-2005-1154 CAN-2005-1155
CAN-2005-1159 CAN-2005-1160)
Users of Mozilla are advised to upgrade to this updated package which
contains Mozilla version 1.7.7 to correct these issues.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
5. Bug IDs fixed (http://bugzilla.redhat.com/):
142390 - CAN-2004-1156 Frame injection vulnerability.
144080 - CAN-2005-0585 download dialog URL spoofing
145606 - CAN-2005-0142 Opened attachments are temporarily saved world-readable
145607 - CAN-2005-0143 Secure site lock can be spoofed with a binary download
145613 - CAN-2005-0146 Synthetic middle-click event can steal clipboard contents
147397 - homograph spoofing
152580 - CAN-2005-0578 Mozilla issues (CAN-2005-0232 CAN-2005-0527 CAN-2005-0231 CAN-2005-0584 CAN-2005-0585 CAN-2005-0586 CAN-2005-0588 CAN-2005-0590 CAN-2005-0591 CAN-2005-0593)
155117 - CAN-2005-0989 Multiple Mozilla issues. (CAN-2005-1153 CAN-2005-1154 CAN-2005-1155 CAN-2005-1156 CAN-2005-1157 CAN-2005-1159 CAN-2005-1160)
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/galeon-1.2.14-1.2.3.src.rpm
07d56551ec862e8f31a6de9ec9b46485 galeon-1.2.14-1.2.3.src.rpm
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/mozilla-1.7.7-1.1.2.1.src.rpm
4b4ed11ca58571c793c613c4bdddb6cc mozilla-1.7.7-1.1.2.1.src.rpm
i386:
b1666209547c01469430edc30ad56eca galeon-1.2.14-1.2.3.i386.rpm
9c657d56f41bdf683c6e32ee7725f80e mozilla-1.7.7-1.1.2.1.i386.rpm
2790d364098c4967ccaaa2e066910f4d mozilla-chat-1.7.7-1.1.2.1.i386.rpm
2d962e0048ee7bf28fe46b10ff4f7995 mozilla-devel-1.7.7-1.1.2.1.i386.rpm
cb841f2bca59e91836fb9fc789e71b7d mozilla-dom-inspector-1.7.7-1.1.2.1.i386.rpm
3065f5bbddfe2847d5086ec7a9fecf25 mozilla-js-debugger-1.7.7-1.1.2.1.i386.rpm
11a5bebb1e5a2bb03c91bc4af799c63f mozilla-mail-1.7.7-1.1.2.1.i386.rpm
3ff3a556dbeb5e230cfea37a09758a18 mozilla-nspr-1.7.7-1.1.2.1.i386.rpm
75596eac1b481ecbb2cec1b1395f9430 mozilla-nspr-devel-1.7.7-1.1.2.1.i386.rpm
283e705b2bf5b614bb2c06406bb3912d mozilla-nss-1.7.7-1.1.2.1.i386.rpm
8f1be6c41914a462802a7d08f9964dce mozilla-nss-devel-1.7.7-1.1.2.1.i386.rpm
ia64:
24355dff0a64b0e3db3b8dcb42fb0d9f galeon-1.2.14-1.2.3.ia64.rpm
13ed50f691e34fd5c4589731edb3b68c mozilla-1.7.7-1.1.2.1.ia64.rpm
6cd0cc13580862862fd2ed20739f50f0 mozilla-chat-1.7.7-1.1.2.1.ia64.rpm
ec70a66a20196c8bc164f1edbc0ecaad mozilla-devel-1.7.7-1.1.2.1.ia64.rpm
4ddbb18866e5744e53049967d4072e8f mozilla-dom-inspector-1.7.7-1.1.2.1.ia64.rpm
7b8583815c6bd27fc6614a9e8d299e22 mozilla-js-debugger-1.7.7-1.1.2.1.ia64.rpm
9e43b191a19de44c30651a6b7cf435b4 mozilla-mail-1.7.7-1.1.2.1.ia64.rpm
1f76d9355ebb0ff70160f3f10d865c61 mozilla-nspr-1.7.7-1.1.2.1.ia64.rpm
19e27678ace617f22e73c886a56f4c6a mozilla-nspr-devel-1.7.7-1.1.2.1.ia64.rpm
b173b8a89edc37dfab359f1d20c2efa8 mozilla-nss-1.7.7-1.1.2.1.ia64.rpm
d1700e681b74e1653684bd079b8d8bd0 mozilla-nss-devel-1.7.7-1.1.2.1.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/galeon-1.2.14-1.2.3.src.rpm
07d56551ec862e8f31a6de9ec9b46485 galeon-1.2.14-1.2.3.src.rpm
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/mozilla-1.7.7-1.1.2.1.src.rpm
4b4ed11ca58571c793c613c4bdddb6cc mozilla-1.7.7-1.1.2.1.src.rpm
ia64:
24355dff0a64b0e3db3b8dcb42fb0d9f galeon-1.2.14-1.2.3.ia64.rpm
13ed50f691e34fd5c4589731edb3b68c mozilla-1.7.7-1.1.2.1.ia64.rpm
6cd0cc13580862862fd2ed20739f50f0 mozilla-chat-1.7.7-1.1.2.1.ia64.rpm
ec70a66a20196c8bc164f1edbc0ecaad mozilla-devel-1.7.7-1.1.2.1.ia64.rpm
4ddbb18866e5744e53049967d4072e8f mozilla-dom-inspector-1.7.7-1.1.2.1.ia64.rpm
7b8583815c6bd27fc6614a9e8d299e22 mozilla-js-debugger-1.7.7-1.1.2.1.ia64.rpm
9e43b191a19de44c30651a6b7cf435b4 mozilla-mail-1.7.7-1.1.2.1.ia64.rpm
1f76d9355ebb0ff70160f3f10d865c61 mozilla-nspr-1.7.7-1.1.2.1.ia64.rpm
19e27678ace617f22e73c886a56f4c6a mozilla-nspr-devel-1.7.7-1.1.2.1.ia64.rpm
b173b8a89edc37dfab359f1d20c2efa8 mozilla-nss-1.7.7-1.1.2.1.ia64.rpm
d1700e681b74e1653684bd079b8d8bd0 mozilla-nss-devel-1.7.7-1.1.2.1.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/galeon-1.2.14-1.2.3.src.rpm
07d56551ec862e8f31a6de9ec9b46485 galeon-1.2.14-1.2.3.src.rpm
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/mozilla-1.7.7-1.1.2.1.src.rpm
4b4ed11ca58571c793c613c4bdddb6cc mozilla-1.7.7-1.1.2.1.src.rpm
i386:
b1666209547c01469430edc30ad56eca galeon-1.2.14-1.2.3.i386.rpm
9c657d56f41bdf683c6e32ee7725f80e mozilla-1.7.7-1.1.2.1.i386.rpm
2790d364098c4967ccaaa2e066910f4d mozilla-chat-1.7.7-1.1.2.1.i386.rpm
2d962e0048ee7bf28fe46b10ff4f7995 mozilla-devel-1.7.7-1.1.2.1.i386.rpm
cb841f2bca59e91836fb9fc789e71b7d mozilla-dom-inspector-1.7.7-1.1.2.1.i386.rpm
3065f5bbddfe2847d5086ec7a9fecf25 mozilla-js-debugger-1.7.7-1.1.2.1.i386.rpm
11a5bebb1e5a2bb03c91bc4af799c63f mozilla-mail-1.7.7-1.1.2.1.i386.rpm
3ff3a556dbeb5e230cfea37a09758a18 mozilla-nspr-1.7.7-1.1.2.1.i386.rpm
75596eac1b481ecbb2cec1b1395f9430 mozilla-nspr-devel-1.7.7-1.1.2.1.i386.rpm
283e705b2bf5b614bb2c06406bb3912d mozilla-nss-1.7.7-1.1.2.1.i386.rpm
8f1be6c41914a462802a7d08f9964dce mozilla-nss-devel-1.7.7-1.1.2.1.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/galeon-1.2.14-1.2.3.src.rpm
07d56551ec862e8f31a6de9ec9b46485 galeon-1.2.14-1.2.3.src.rpm
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/mozilla-1.7.7-1.1.2.1.src.rpm
4b4ed11ca58571c793c613c4bdddb6cc mozilla-1.7.7-1.1.2.1.src.rpm
i386:
b1666209547c01469430edc30ad56eca galeon-1.2.14-1.2.3.i386.rpm
9c657d56f41bdf683c6e32ee7725f80e mozilla-1.7.7-1.1.2.1.i386.rpm
2790d364098c4967ccaaa2e066910f4d mozilla-chat-1.7.7-1.1.2.1.i386.rpm
2d962e0048ee7bf28fe46b10ff4f7995 mozilla-devel-1.7.7-1.1.2.1.i386.rpm
cb841f2bca59e91836fb9fc789e71b7d mozilla-dom-inspector-1.7.7-1.1.2.1.i386.rpm
3065f5bbddfe2847d5086ec7a9fecf25 mozilla-js-debugger-1.7.7-1.1.2.1.i386.rpm
11a5bebb1e5a2bb03c91bc4af799c63f mozilla-mail-1.7.7-1.1.2.1.i386.rpm
3ff3a556dbeb5e230cfea37a09758a18 mozilla-nspr-1.7.7-1.1.2.1.i386.rpm
75596eac1b481ecbb2cec1b1395f9430 mozilla-nspr-devel-1.7.7-1.1.2.1.i386.rpm
283e705b2bf5b614bb2c06406bb3912d mozilla-nss-1.7.7-1.1.2.1.i386.rpm
8f1be6c41914a462802a7d08f9964dce mozilla-nss-devel-1.7.7-1.1.2.1.i386.rpm
Red Hat Enterprise Linux AS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/mozilla-1.7.7-1.1.3.4.src.rpm
525e2ee941a69669a06b2522e3806f19 mozilla-1.7.7-1.1.3.4.src.rpm
i386:
7c50a099153179bd7e827078bf14c83e mozilla-1.7.7-1.1.3.4.i386.rpm
670951ea2ecd2c7b5d1f25f731128e88 mozilla-chat-1.7.7-1.1.3.4.i386.rpm
43b9801777c7b6bc7864a21cb8ab4152 mozilla-devel-1.7.7-1.1.3.4.i386.rpm
e0adc24c19a8ed053e83160639075b81 mozilla-dom-inspector-1.7.7-1.1.3.4.i386.rpm
a6841f7b1d18f2c896dd9487996f62cb mozilla-js-debugger-1.7.7-1.1.3.4.i386.rpm
0c84662fa8f1e47a643c57df3da44030 mozilla-mail-1.7.7-1.1.3.4.i386.rpm
883d4402fc93a9d7bc625770a283d50a mozilla-nspr-1.7.7-1.1.3.4.i386.rpm
33471adde84e88497d856dfa3dffc92d mozilla-nspr-devel-1.7.7-1.1.3.4.i386.rpm
2de53f7f4895fb721497434e005a3d55 mozilla-nss-1.7.7-1.1.3.4.i386.rpm
87ea0f26e60f94d7af5cfb163136582e mozilla-nss-devel-1.7.7-1.1.3.4.i386.rpm
ia64:
9684baa99edfe6fc6f916ec9b5f28b50 mozilla-1.7.7-1.1.3.4.ia64.rpm
c33f36bcbc038317150e760f67e41d3c mozilla-chat-1.7.7-1.1.3.4.ia64.rpm
cd5961bd88a27043d983af13e1c5cef2 mozilla-devel-1.7.7-1.1.3.4.ia64.rpm
d92e4f6402ff510254c35989d10c2089 mozilla-dom-inspector-1.7.7-1.1.3.4.ia64.rpm
c858591aadf8c93e39fdf90fdef231a0 mozilla-js-debugger-1.7.7-1.1.3.4.ia64.rpm
33788ff7918c7f8f5d9fcfd460021145 mozilla-mail-1.7.7-1.1.3.4.ia64.rpm
52d0b70455ae9b8048f8c4b3c46d9118 mozilla-nspr-1.7.7-1.1.3.4.ia64.rpm
883d4402fc93a9d7bc625770a283d50a mozilla-nspr-1.7.7-1.1.3.4.i386.rpm
4ebb3bac874ee388f192613e89d534ea mozilla-nspr-devel-1.7.7-1.1.3.4.ia64.rpm
d6605e746509e017cd1567eadc74c122 mozilla-nss-1.7.7-1.1.3.4.ia64.rpm
2de53f7f4895fb721497434e005a3d55 mozilla-nss-1.7.7-1.1.3.4.i386.rpm
815c377c2b59e835043f6bf07e7f19fa mozilla-nss-devel-1.7.7-1.1.3.4.ia64.rpm
ppc:
82ce3674b9d9db22222a8b72dd34061d mozilla-1.7.7-1.1.3.4.ppc.rpm
056b8f52aac99b70d84ded1620c95418 mozilla-chat-1.7.7-1.1.3.4.ppc.rpm
082833ec7036f4cb47d6b8ed7814fb54 mozilla-devel-1.7.7-1.1.3.4.ppc.rpm
9b5a4c1c00a8ef9fb9aa63cc175384d6 mozilla-dom-inspector-1.7.7-1.1.3.4.ppc.rpm
f36d4cec9b4ac80f9e2fd785be5b6b23 mozilla-js-debugger-1.7.7-1.1.3.4.ppc.rpm
61106e7cb958bcd8a55e10589c8f1e29 mozilla-mail-1.7.7-1.1.3.4.ppc.rpm
f41cb54d95bbcc44bfdf8a2dbf79b5d5 mozilla-nspr-1.7.7-1.1.3.4.ppc.rpm
cb6ff101259cdf151f0f822f8ca7d44d mozilla-nspr-devel-1.7.7-1.1.3.4.ppc.rpm
7981a23fee3e9ef832e597e0dce30998 mozilla-nss-1.7.7-1.1.3.4.ppc.rpm
c6661a837e3d72bec2b71c29cd71b8b9 mozilla-nss-devel-1.7.7-1.1.3.4.ppc.rpm
s390:
af2e3f29e3ea2b4bb148eecde6bcbbad mozilla-1.7.7-1.1.3.4.s390.rpm
8020d607c3d895e4df7f95727081b86c mozilla-chat-1.7.7-1.1.3.4.s390.rpm
f0eb5fdee9ae6b5cc4f7b963442b2f03 mozilla-devel-1.7.7-1.1.3.4.s390.rpm
12c83501adae55a1566f7c30e621ca66 mozilla-dom-inspector-1.7.7-1.1.3.4.s390.rpm
ff17631810875a25fc7c6830e9fe0a91 mozilla-js-debugger-1.7.7-1.1.3.4.s390.rpm
66f9bb37047ffeb94d10e3f2097b9f2e mozilla-mail-1.7.7-1.1.3.4.s390.rpm
7712acaf8bbf1dd5358f8cc320cf65a0 mozilla-nspr-1.7.7-1.1.3.4.s390.rpm
486f77b46386a97165388dc783fb39d0 mozilla-nspr-devel-1.7.7-1.1.3.4.s390.rpm
5e2c404600d52830bd877f43ebee10b1 mozilla-nss-1.7.7-1.1.3.4.s390.rpm
c986626308a59c958bae9c57cdc41976 mozilla-nss-devel-1.7.7-1.1.3.4.s390.rpm
s390x:
cc71398c2c966c772557e475d7c1c87f mozilla-1.7.7-1.1.3.4.s390x.rpm
1c2d3e25a90bcfc349323755ded97980 mozilla-chat-1.7.7-1.1.3.4.s390x.rpm
a628dee5c31f9751649a35c4e27d433a mozilla-devel-1.7.7-1.1.3.4.s390x.rpm
960fcdabcba69c0c5f522ebf595602ef mozilla-dom-inspector-1.7.7-1.1.3.4.s390x.rpm
85d780a2fcbddbd801a66199ad1b9963 mozilla-js-debugger-1.7.7-1.1.3.4.s390x.rpm
d7ca7fdafffd021e48b5bb0b96f796fb mozilla-mail-1.7.7-1.1.3.4.s390x.rpm
a64c95f8bd0a75495fe80e3aae854a8e mozilla-nspr-1.7.7-1.1.3.4.s390x.rpm
7712acaf8bbf1dd5358f8cc320cf65a0 mozilla-nspr-1.7.7-1.1.3.4.s390.rpm
a1722ffbd1b54fa6afafce7715810e00 mozilla-nspr-devel-1.7.7-1.1.3.4.s390x.rpm
15f771ca3258ae5960ed88971fc5b068 mozilla-nss-1.7.7-1.1.3.4.s390x.rpm
5e2c404600d52830bd877f43ebee10b1 mozilla-nss-1.7.7-1.1.3.4.s390.rpm
2614becf48fa3034c34b817a9dfbb05e mozilla-nss-devel-1.7.7-1.1.3.4.s390x.rpm
x86_64:
ed19956043c95bec234e018203544860 mozilla-1.7.7-1.1.3.4.x86_64.rpm
7c50a099153179bd7e827078bf14c83e mozilla-1.7.7-1.1.3.4.i386.rpm
5677542c97ad598ebfc6df1889820e74 mozilla-chat-1.7.7-1.1.3.4.x86_64.rpm
8aa3920fbb6d18630efb9d03aa645e89 mozilla-devel-1.7.7-1.1.3.4.x86_64.rpm
168c85ac07b7b4c5f264c08d5dd38181 mozilla-dom-inspector-1.7.7-1.1.3.4.x86_64.rpm
9d8f08e81e14ddacb3b5da8c713cf853 mozilla-js-debugger-1.7.7-1.1.3.4.x86_64.rpm
91dfca37aa00624af1fed85f366a8536 mozilla-mail-1.7.7-1.1.3.4.x86_64.rpm
87250e5cf971736d8351f246a51398ca mozilla-nspr-1.7.7-1.1.3.4.x86_64.rpm
883d4402fc93a9d7bc625770a283d50a mozilla-nspr-1.7.7-1.1.3.4.i386.rpm
cf03afb1121b772e306548f225c05c10 mozilla-nspr-devel-1.7.7-1.1.3.4.x86_64.rpm
75eb06b5cb399d672708d614d610e748 mozilla-nss-1.7.7-1.1.3.4.x86_64.rpm
2de53f7f4895fb721497434e005a3d55 mozilla-nss-1.7.7-1.1.3.4.i386.rpm
c84d40146508befb92293ca2e922a5cc mozilla-nss-devel-1.7.7-1.1.3.4.x86_64.rpm
Red Hat Desktop version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/mozilla-1.7.7-1.1.3.4.src.rpm
525e2ee941a69669a06b2522e3806f19 mozilla-1.7.7-1.1.3.4.src.rpm
i386:
7c50a099153179bd7e827078bf14c83e mozilla-1.7.7-1.1.3.4.i386.rpm
670951ea2ecd2c7b5d1f25f731128e88 mozilla-chat-1.7.7-1.1.3.4.i386.rpm
43b9801777c7b6bc7864a21cb8ab4152 mozilla-devel-1.7.7-1.1.3.4.i386.rpm
e0adc24c19a8ed053e83160639075b81 mozilla-dom-inspector-1.7.7-1.1.3.4.i386.rpm
a6841f7b1d18f2c896dd9487996f62cb mozilla-js-debugger-1.7.7-1.1.3.4.i386.rpm
0c84662fa8f1e47a643c57df3da44030 mozilla-mail-1.7.7-1.1.3.4.i386.rpm
883d4402fc93a9d7bc625770a283d50a mozilla-nspr-1.7.7-1.1.3.4.i386.rpm
33471adde84e88497d856dfa3dffc92d mozilla-nspr-devel-1.7.7-1.1.3.4.i386.rpm
2de53f7f4895fb721497434e005a3d55 mozilla-nss-1.7.7-1.1.3.4.i386.rpm
87ea0f26e60f94d7af5cfb163136582e mozilla-nss-devel-1.7.7-1.1.3.4.i386.rpm
x86_64:
ed19956043c95bec234e018203544860 mozilla-1.7.7-1.1.3.4.x86_64.rpm
7c50a099153179bd7e827078bf14c83e mozilla-1.7.7-1.1.3.4.i386.rpm
5677542c97ad598ebfc6df1889820e74 mozilla-chat-1.7.7-1.1.3.4.x86_64.rpm
8aa3920fbb6d18630efb9d03aa645e89 mozilla-devel-1.7.7-1.1.3.4.x86_64.rpm
168c85ac07b7b4c5f264c08d5dd38181 mozilla-dom-inspector-1.7.7-1.1.3.4.x86_64.rpm
9d8f08e81e14ddacb3b5da8c713cf853 mozilla-js-debugger-1.7.7-1.1.3.4.x86_64.rpm
91dfca37aa00624af1fed85f366a8536 mozilla-mail-1.7.7-1.1.3.4.x86_64.rpm
87250e5cf971736d8351f246a51398ca mozilla-nspr-1.7.7-1.1.3.4.x86_64.rpm
883d4402fc93a9d7bc625770a283d50a mozilla-nspr-1.7.7-1.1.3.4.i386.rpm
cf03afb1121b772e306548f225c05c10 mozilla-nspr-devel-1.7.7-1.1.3.4.x86_64.rpm
75eb06b5cb399d672708d614d610e748 mozilla-nss-1.7.7-1.1.3.4.x86_64.rpm
2de53f7f4895fb721497434e005a3d55 mozilla-nss-1.7.7-1.1.3.4.i386.rpm
c84d40146508befb92293ca2e922a5cc mozilla-nss-devel-1.7.7-1.1.3.4.x86_64.rpm
Red Hat Enterprise Linux ES version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/mozilla-1.7.7-1.1.3.4.src.rpm
525e2ee941a69669a06b2522e3806f19 mozilla-1.7.7-1.1.3.4.src.rpm
i386:
7c50a099153179bd7e827078bf14c83e mozilla-1.7.7-1.1.3.4.i386.rpm
670951ea2ecd2c7b5d1f25f731128e88 mozilla-chat-1.7.7-1.1.3.4.i386.rpm
43b9801777c7b6bc7864a21cb8ab4152 mozilla-devel-1.7.7-1.1.3.4.i386.rpm
e0adc24c19a8ed053e83160639075b81 mozilla-dom-inspector-1.7.7-1.1.3.4.i386.rpm
a6841f7b1d18f2c896dd9487996f62cb mozilla-js-debugger-1.7.7-1.1.3.4.i386.rpm
0c84662fa8f1e47a643c57df3da44030 mozilla-mail-1.7.7-1.1.3.4.i386.rpm
883d4402fc93a9d7bc625770a283d50a mozilla-nspr-1.7.7-1.1.3.4.i386.rpm
33471adde84e88497d856dfa3dffc92d mozilla-nspr-devel-1.7.7-1.1.3.4.i386.rpm
2de53f7f4895fb721497434e005a3d55 mozilla-nss-1.7.7-1.1.3.4.i386.rpm
87ea0f26e60f94d7af5cfb163136582e mozilla-nss-devel-1.7.7-1.1.3.4.i386.rpm
ia64:
9684baa99edfe6fc6f916ec9b5f28b50 mozilla-1.7.7-1.1.3.4.ia64.rpm
c33f36bcbc038317150e760f67e41d3c mozilla-chat-1.7.7-1.1.3.4.ia64.rpm
cd5961bd88a27043d983af13e1c5cef2 mozilla-devel-1.7.7-1.1.3.4.ia64.rpm
d92e4f6402ff510254c35989d10c2089 mozilla-dom-inspector-1.7.7-1.1.3.4.ia64.rpm
c858591aadf8c93e39fdf90fdef231a0 mozilla-js-debugger-1.7.7-1.1.3.4.ia64.rpm
33788ff7918c7f8f5d9fcfd460021145 mozilla-mail-1.7.7-1.1.3.4.ia64.rpm
52d0b70455ae9b8048f8c4b3c46d9118 mozilla-nspr-1.7.7-1.1.3.4.ia64.rpm
883d4402fc93a9d7bc625770a283d50a mozilla-nspr-1.7.7-1.1.3.4.i386.rpm
4ebb3bac874ee388f192613e89d534ea mozilla-nspr-devel-1.7.7-1.1.3.4.ia64.rpm
d6605e746509e017cd1567eadc74c122 mozilla-nss-1.7.7-1.1.3.4.ia64.rpm
2de53f7f4895fb721497434e005a3d55 mozilla-nss-1.7.7-1.1.3.4.i386.rpm
815c377c2b59e835043f6bf07e7f19fa mozilla-nss-devel-1.7.7-1.1.3.4.ia64.rpm
x86_64:
ed19956043c95bec234e018203544860 mozilla-1.7.7-1.1.3.4.x86_64.rpm
7c50a099153179bd7e827078bf14c83e mozilla-1.7.7-1.1.3.4.i386.rpm
5677542c97ad598ebfc6df1889820e74 mozilla-chat-1.7.7-1.1.3.4.x86_64.rpm
8aa3920fbb6d18630efb9d03aa645e89 mozilla-devel-1.7.7-1.1.3.4.x86_64.rpm
168c85ac07b7b4c5f264c08d5dd38181 mozilla-dom-inspector-1.7.7-1.1.3.4.x86_64.rpm
9d8f08e81e14ddacb3b5da8c713cf853 mozilla-js-debugger-1.7.7-1.1.3.4.x86_64.rpm
91dfca37aa00624af1fed85f366a8536 mozilla-mail-1.7.7-1.1.3.4.x86_64.rpm
87250e5cf971736d8351f246a51398ca mozilla-nspr-1.7.7-1.1.3.4.x86_64.rpm
883d4402fc93a9d7bc625770a283d50a mozilla-nspr-1.7.7-1.1.3.4.i386.rpm
cf03afb1121b772e306548f225c05c10 mozilla-nspr-devel-1.7.7-1.1.3.4.x86_64.rpm
75eb06b5cb399d672708d614d610e748 mozilla-nss-1.7.7-1.1.3.4.x86_64.rpm
2de53f7f4895fb721497434e005a3d55 mozilla-nss-1.7.7-1.1.3.4.i386.rpm
c84d40146508befb92293ca2e922a5cc mozilla-nss-devel-1.7.7-1.1.3.4.x86_64.rpm
Red Hat Enterprise Linux WS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/mozilla-1.7.7-1.1.3.4.src.rpm
525e2ee941a69669a06b2522e3806f19 mozilla-1.7.7-1.1.3.4.src.rpm
i386:
7c50a099153179bd7e827078bf14c83e mozilla-1.7.7-1.1.3.4.i386.rpm
670951ea2ecd2c7b5d1f25f731128e88 mozilla-chat-1.7.7-1.1.3.4.i386.rpm
43b9801777c7b6bc7864a21cb8ab4152 mozilla-devel-1.7.7-1.1.3.4.i386.rpm
e0adc24c19a8ed053e83160639075b81 mozilla-dom-inspector-1.7.7-1.1.3.4.i386.rpm
a6841f7b1d18f2c896dd9487996f62cb mozilla-js-debugger-1.7.7-1.1.3.4.i386.rpm
0c84662fa8f1e47a643c57df3da44030 mozilla-mail-1.7.7-1.1.3.4.i386.rpm
883d4402fc93a9d7bc625770a283d50a mozilla-nspr-1.7.7-1.1.3.4.i386.rpm
33471adde84e88497d856dfa3dffc92d mozilla-nspr-devel-1.7.7-1.1.3.4.i386.rpm
2de53f7f4895fb721497434e005a3d55 mozilla-nss-1.7.7-1.1.3.4.i386.rpm
87ea0f26e60f94d7af5cfb163136582e mozilla-nss-devel-1.7.7-1.1.3.4.i386.rpm
ia64:
9684baa99edfe6fc6f916ec9b5f28b50 mozilla-1.7.7-1.1.3.4.ia64.rpm
c33f36bcbc038317150e760f67e41d3c mozilla-chat-1.7.7-1.1.3.4.ia64.rpm
cd5961bd88a27043d983af13e1c5cef2 mozilla-devel-1.7.7-1.1.3.4.ia64.rpm
d92e4f6402ff510254c35989d10c2089 mozilla-dom-inspector-1.7.7-1.1.3.4.ia64.rpm
c858591aadf8c93e39fdf90fdef231a0 mozilla-js-debugger-1.7.7-1.1.3.4.ia64.rpm
33788ff7918c7f8f5d9fcfd460021145 mozilla-mail-1.7.7-1.1.3.4.ia64.rpm
52d0b70455ae9b8048f8c4b3c46d9118 mozilla-nspr-1.7.7-1.1.3.4.ia64.rpm
883d4402fc93a9d7bc625770a283d50a mozilla-nspr-1.7.7-1.1.3.4.i386.rpm
4ebb3bac874ee388f192613e89d534ea mozilla-nspr-devel-1.7.7-1.1.3.4.ia64.rpm
d6605e746509e017cd1567eadc74c122 mozilla-nss-1.7.7-1.1.3.4.ia64.rpm
2de53f7f4895fb721497434e005a3d55 mozilla-nss-1.7.7-1.1.3.4.i386.rpm
815c377c2b59e835043f6bf07e7f19fa mozilla-nss-devel-1.7.7-1.1.3.4.ia64.rpm
x86_64:
ed19956043c95bec234e018203544860 mozilla-1.7.7-1.1.3.4.x86_64.rpm
7c50a099153179bd7e827078bf14c83e mozilla-1.7.7-1.1.3.4.i386.rpm
5677542c97ad598ebfc6df1889820e74 mozilla-chat-1.7.7-1.1.3.4.x86_64.rpm
8aa3920fbb6d18630efb9d03aa645e89 mozilla-devel-1.7.7-1.1.3.4.x86_64.rpm
168c85ac07b7b4c5f264c08d5dd38181 mozilla-dom-inspector-1.7.7-1.1.3.4.x86_64.rpm
9d8f08e81e14ddacb3b5da8c713cf853 mozilla-js-debugger-1.7.7-1.1.3.4.x86_64.rpm
91dfca37aa00624af1fed85f366a8536 mozilla-mail-1.7.7-1.1.3.4.x86_64.rpm
87250e5cf971736d8351f246a51398ca mozilla-nspr-1.7.7-1.1.3.4.x86_64.rpm
883d4402fc93a9d7bc625770a283d50a mozilla-nspr-1.7.7-1.1.3.4.i386.rpm
cf03afb1121b772e306548f225c05c10 mozilla-nspr-devel-1.7.7-1.1.3.4.x86_64.rpm
75eb06b5cb399d672708d614d610e748 mozilla-nss-1.7.7-1.1.3.4.x86_64.rpm
2de53f7f4895fb721497434e005a3d55 mozilla-nss-1.7.7-1.1.3.4.i386.rpm
c84d40146508befb92293ca2e922a5cc mozilla-nss-devel-1.7.7-1.1.3.4.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1156
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0142
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0143
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0146
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0231
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0232
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0233
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0401
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0527
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0578
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0584
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0585
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0586
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0588
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0590
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0591
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0593
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0989
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1153
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1154
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1155
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1156
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1157
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1159
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1160
8. Contact:
The Red Hat security contact is . More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2005 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQFCcTWsXlSAg2UNWIIRAv0+AJ9juypcelIXCj9HLCEpdzfQpoEAmgCfeUJo
sbDkFZLCI8+LoMBHOWLt5Do=
=UE8k
- -----END PGP SIGNATURE-----
5.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Moderate: PHP security update
Advisory ID: RHSA-2005:405-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-405.html
Issue date: 2005-04-28
Updated on: 2005-04-28
Product: Red Hat Enterprise Linux
CVE Names: CAN-2004-1392 CAN-2005-0524 CAN-2005-0525 CAN-2005-1042 CAN-2005-1043
- - ---------------------------------------------------------------------
1. Summary:
Updated PHP packages that fix various security issues are now available.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
3. Problem description:
PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Web server.
A bug was found in the way PHP processes IFF and JPEG images. It is
possible to cause PHP to consume CPU resources for a short period of time
by supplying a carefully crafted IFF or JPEG image. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
names CAN-2005-0524 and CAN-2005-0525 to these issues.
A buffer overflow bug was also found in the way PHP processes EXIF image
headers. It is possible for an attacker to construct an image file in such
a way that it could execute arbitrary instructions when processed by PHP.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-1042 to this issue.
A denial of service bug was found in the way PHP processes EXIF image
headers. It is possible for an attacker to cause PHP to enter an infinite
loop for a short period of time by supplying a carefully crafted image file
to PHP for processing. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2005-1043 to this issue.
Several bug fixes are also included in this update:
- - - The security fixes in RHSA-2004-687 to the "unserializer" code introduced
some performance issues.
- - - In the gd extension, the "imagecopymerge" function did not correctly
handle transparency. The original image was being obscured in the
resultant image.
- - - In the curl extension, safe mode was not enforced for 'file:///' URL
lookups (CAN-2004-1392).
Users of PHP should upgrade to these updated packages, which contain
backported fixes for these issues.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
5. Bug IDs fixed (http://bugzilla.redhat.com/):
145436 - PHP pages slow, HTTPD eating cpu
147808 - php curl open_basedir bypass
149873 - make PHP oci8 driver support Oracle Instant Client RPM
149946 - PHP GD ImageCopyMerge broken
153140 - CAN-2005-0524 PHP getimagesize() Multiple Denial of Service Vulnerabilities CAN-2005-0525
154021 - CAN-2005-1042 PHP exif buffer overflow
154025 - CAN-2005-1043 PHP exif infinite stack recursion
6. RPMs required:
Red Hat Enterprise Linux AS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/php-4.3.2-23.ent.src.rpm
58f0cca1256d18f4146f2ec006dc4fd5 php-4.3.2-23.ent.src.rpm
i386:
90b3771b6440bd401c5c33d915806fc4 php-4.3.2-23.ent.i386.rpm
fb284c7c36219ac32f9a8adee7c13d4c php-devel-4.3.2-23.ent.i386.rpm
6ca14b0b08f188e34e833017affe5a2e php-imap-4.3.2-23.ent.i386.rpm
ee3952c56bc244a825035f7e7facda68 php-ldap-4.3.2-23.ent.i386.rpm
bbe31e769f917c47da06b6f864bd4d0f php-mysql-4.3.2-23.ent.i386.rpm
dd9118b190805f299c24a3e3e5154cd4 php-odbc-4.3.2-23.ent.i386.rpm
28b2599fcc44d5cff95670fd29cb49ce php-pgsql-4.3.2-23.ent.i386.rpm
ia64:
ae30b9198b8908dd0e42e54f5cc094e5 php-4.3.2-23.ent.ia64.rpm
c02c359cf20fc772088e9d1df5549d8b php-devel-4.3.2-23.ent.ia64.rpm
2506f030c45ddb1ccc6ddce44e17fc08 php-imap-4.3.2-23.ent.ia64.rpm
0529fd8d9cbc47d16d5f3f81639b985f php-ldap-4.3.2-23.ent.ia64.rpm
f39b5fcc428e67a85d3ea91de36c0f0f php-mysql-4.3.2-23.ent.ia64.rpm
7f72f5cca6c29fa56e71641fa60aa133 php-odbc-4.3.2-23.ent.ia64.rpm
0df7c3e84d8b818565a30a11e5303b6d php-pgsql-4.3.2-23.ent.ia64.rpm
ppc:
1d106837f13833934d36cd40b1656a31 php-4.3.2-23.ent.ppc.rpm
3a490c937d75c426adad35e2a28f308d php-devel-4.3.2-23.ent.ppc.rpm
048861f82d2596f722bd1af0edb43e2c php-imap-4.3.2-23.ent.ppc.rpm
48838c0212c8647f4e13f0a8bd13924b php-ldap-4.3.2-23.ent.ppc.rpm
8d414fd1c5cc0b8f847d2aec8a7c5cdd php-mysql-4.3.2-23.ent.ppc.rpm
de5cccba75b024dc074b0e532cc8da62 php-odbc-4.3.2-23.ent.ppc.rpm
33c39c6dde048b7ee2b86ffd00cca63b php-pgsql-4.3.2-23.ent.ppc.rpm
s390:
de50da7e22ae20bcc603c5a15fd21c61 php-4.3.2-23.ent.s390.rpm
f88a6cd9638f37243f9195474b0a621c php-devel-4.3.2-23.ent.s390.rpm
44908647a1bf7b8699004eab78641d85 php-imap-4.3.2-23.ent.s390.rpm
061712561bf04e2177608f9723d6fd68 php-ldap-4.3.2-23.ent.s390.rpm
2578b30d28ee9248d49d559b05f79a66 php-mysql-4.3.2-23.ent.s390.rpm
0a1073d9e67bd75ad884b0c984789d8f php-odbc-4.3.2-23.ent.s390.rpm
ce8aba6f8f7e5daebffb85f5b3917e47 php-pgsql-4.3.2-23.ent.s390.rpm
s390x:
30126ffe1094416d939a7aff262fc5ce php-4.3.2-23.ent.s390x.rpm
8dcced2d4c6a2a7c0418957852f8468b php-devel-4.3.2-23.ent.s390x.rpm
1306bcf14591153e6cb1063c27fad644 php-imap-4.3.2-23.ent.s390x.rpm
48e652c080759211c0b9365577a3b6b7 php-ldap-4.3.2-23.ent.s390x.rpm
41ddbec77c5d9654544291aeae04658f php-mysql-4.3.2-23.ent.s390x.rpm
56a28dffb575117d3299e5bf3b73a106 php-odbc-4.3.2-23.ent.s390x.rpm
39acc8cd2e58ea675485e6d7c17b54cc php-pgsql-4.3.2-23.ent.s390x.rpm
x86_64:
c65c9126a358d58c66caf072cef65ecd php-4.3.2-23.ent.x86_64.rpm
c0a73dfa0b22cec4b3d1ecaaa37fc26d php-devel-4.3.2-23.ent.x86_64.rpm
ec5f608371824dc3306738f6d51c9677 php-imap-4.3.2-23.ent.x86_64.rpm
4f4229af5ccdca0feda092dba5d50ea7 php-ldap-4.3.2-23.ent.x86_64.rpm
4e902c4400e3d472df8d5dbc6c8126d2 php-mysql-4.3.2-23.ent.x86_64.rpm
93a762b570dea3a35a8461a3ad43632c php-odbc-4.3.2-23.ent.x86_64.rpm
be166ccd9909d1eba95d3fadc0aad6a3 php-pgsql-4.3.2-23.ent.x86_64.rpm
Red Hat Desktop version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/php-4.3.2-23.ent.src.rpm
58f0cca1256d18f4146f2ec006dc4fd5 php-4.3.2-23.ent.src.rpm
i386:
90b3771b6440bd401c5c33d915806fc4 php-4.3.2-23.ent.i386.rpm
fb284c7c36219ac32f9a8adee7c13d4c php-devel-4.3.2-23.ent.i386.rpm
6ca14b0b08f188e34e833017affe5a2e php-imap-4.3.2-23.ent.i386.rpm
ee3952c56bc244a825035f7e7facda68 php-ldap-4.3.2-23.ent.i386.rpm
bbe31e769f917c47da06b6f864bd4d0f php-mysql-4.3.2-23.ent.i386.rpm
dd9118b190805f299c24a3e3e5154cd4 php-odbc-4.3.2-23.ent.i386.rpm
28b2599fcc44d5cff95670fd29cb49ce php-pgsql-4.3.2-23.ent.i386.rpm
x86_64:
c65c9126a358d58c66caf072cef65ecd php-4.3.2-23.ent.x86_64.rpm
c0a73dfa0b22cec4b3d1ecaaa37fc26d php-devel-4.3.2-23.ent.x86_64.rpm
ec5f608371824dc3306738f6d51c9677 php-imap-4.3.2-23.ent.x86_64.rpm
4f4229af5ccdca0feda092dba5d50ea7 php-ldap-4.3.2-23.ent.x86_64.rpm
4e902c4400e3d472df8d5dbc6c8126d2 php-mysql-4.3.2-23.ent.x86_64.rpm
93a762b570dea3a35a8461a3ad43632c php-odbc-4.3.2-23.ent.x86_64.rpm
be166ccd9909d1eba95d3fadc0aad6a3 php-pgsql-4.3.2-23.ent.x86_64.rpm
Red Hat Enterprise Linux ES version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/php-4.3.2-23.ent.src.rpm
58f0cca1256d18f4146f2ec006dc4fd5 php-4.3.2-23.ent.src.rpm
i386:
90b3771b6440bd401c5c33d915806fc4 php-4.3.2-23.ent.i386.rpm
fb284c7c36219ac32f9a8adee7c13d4c php-devel-4.3.2-23.ent.i386.rpm
6ca14b0b08f188e34e833017affe5a2e php-imap-4.3.2-23.ent.i386.rpm
ee3952c56bc244a825035f7e7facda68 php-ldap-4.3.2-23.ent.i386.rpm
bbe31e769f917c47da06b6f864bd4d0f php-mysql-4.3.2-23.ent.i386.rpm
dd9118b190805f299c24a3e3e5154cd4 php-odbc-4.3.2-23.ent.i386.rpm
28b2599fcc44d5cff95670fd29cb49ce php-pgsql-4.3.2-23.ent.i386.rpm
ia64:
ae30b9198b8908dd0e42e54f5cc094e5 php-4.3.2-23.ent.ia64.rpm
c02c359cf20fc772088e9d1df5549d8b php-devel-4.3.2-23.ent.ia64.rpm
2506f030c45ddb1ccc6ddce44e17fc08 php-imap-4.3.2-23.ent.ia64.rpm
0529fd8d9cbc47d16d5f3f81639b985f php-ldap-4.3.2-23.ent.ia64.rpm
f39b5fcc428e67a85d3ea91de36c0f0f php-mysql-4.3.2-23.ent.ia64.rpm
7f72f5cca6c29fa56e71641fa60aa133 php-odbc-4.3.2-23.ent.ia64.rpm
0df7c3e84d8b818565a30a11e5303b6d php-pgsql-4.3.2-23.ent.ia64.rpm
x86_64:
c65c9126a358d58c66caf072cef65ecd php-4.3.2-23.ent.x86_64.rpm
c0a73dfa0b22cec4b3d1ecaaa37fc26d php-devel-4.3.2-23.ent.x86_64.rpm
ec5f608371824dc3306738f6d51c9677 php-imap-4.3.2-23.ent.x86_64.rpm
4f4229af5ccdca0feda092dba5d50ea7 php-ldap-4.3.2-23.ent.x86_64.rpm
4e902c4400e3d472df8d5dbc6c8126d2 php-mysql-4.3.2-23.ent.x86_64.rpm
93a762b570dea3a35a8461a3ad43632c php-odbc-4.3.2-23.ent.x86_64.rpm
be166ccd9909d1eba95d3fadc0aad6a3 php-pgsql-4.3.2-23.ent.x86_64.rpm
Red Hat Enterprise Linux WS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/php-4.3.2-23.ent.src.rpm
58f0cca1256d18f4146f2ec006dc4fd5 php-4.3.2-23.ent.src.rpm
i386:
90b3771b6440bd401c5c33d915806fc4 php-4.3.2-23.ent.i386.rpm
fb284c7c36219ac32f9a8adee7c13d4c php-devel-4.3.2-23.ent.i386.rpm
6ca14b0b08f188e34e833017affe5a2e php-imap-4.3.2-23.ent.i386.rpm
ee3952c56bc244a825035f7e7facda68 php-ldap-4.3.2-23.ent.i386.rpm
bbe31e769f917c47da06b6f864bd4d0f php-mysql-4.3.2-23.ent.i386.rpm
dd9118b190805f299c24a3e3e5154cd4 php-odbc-4.3.2-23.ent.i386.rpm
28b2599fcc44d5cff95670fd29cb49ce php-pgsql-4.3.2-23.ent.i386.rpm
ia64:
ae30b9198b8908dd0e42e54f5cc094e5 php-4.3.2-23.ent.ia64.rpm
c02c359cf20fc772088e9d1df5549d8b php-devel-4.3.2-23.ent.ia64.rpm
2506f030c45ddb1ccc6ddce44e17fc08 php-imap-4.3.2-23.ent.ia64.rpm
0529fd8d9cbc47d16d5f3f81639b985f php-ldap-4.3.2-23.ent.ia64.rpm
f39b5fcc428e67a85d3ea91de36c0f0f php-mysql-4.3.2-23.ent.ia64.rpm
7f72f5cca6c29fa56e71641fa60aa133 php-odbc-4.3.2-23.ent.ia64.rpm
0df7c3e84d8b818565a30a11e5303b6d php-pgsql-4.3.2-23.ent.ia64.rpm
x86_64:
c65c9126a358d58c66caf072cef65ecd php-4.3.2-23.ent.x86_64.rpm
c0a73dfa0b22cec4b3d1ecaaa37fc26d php-devel-4.3.2-23.ent.x86_64.rpm
ec5f608371824dc3306738f6d51c9677 php-imap-4.3.2-23.ent.x86_64.rpm
4f4229af5ccdca0feda092dba5d50ea7 php-ldap-4.3.2-23.ent.x86_64.rpm
4e902c4400e3d472df8d5dbc6c8126d2 php-mysql-4.3.2-23.ent.x86_64.rpm
93a762b570dea3a35a8461a3ad43632c php-odbc-4.3.2-23.ent.x86_64.rpm
be166ccd9909d1eba95d3fadc0aad6a3 php-pgsql-4.3.2-23.ent.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1392
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0524
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0525
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1042
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1043
8. Contact:
The Red Hat security contact is . More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2005 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQFCcTXOXlSAg2UNWIIRAnfgAJ4vRFTtMW/dOyRTzYzHJWQ790F33ACfR5iL
xKCJFeaQ3VyxJ0FYEYgVY/I=
=1CJU
- -----END PGP SIGNATURE-----