Skip Navigation

  • Home
  • Contact us
  • FAQ
  • Glossary
  • Public key
  • Sitemap
  • Cymraeg
  • What's new
CPNI - Centre for the Protection of National Infastructure

Advanced search

  • About CPNI
  • The threats
  • Security planning
  • Methods of attack
  • Protecting your assets
  • Products and services
    • CSIRTUK advisories
      • Advisories archive
    • General protective security publications
    • InfoSec briefings
    • InfoSec technical notes
    • InfoSec vulnerability disclosures
    • Good practice guidelines
    • Viewpoints
    • Information exchanges
    • Risk Management Delivery Group
  • Research
Home > Products and services > CSIRTUK advisories > Advisories archive > March 2005 > Four Red Hat Security Advisories: 1. RHSA-2005:070-01 - ImageMagick security update 2. RHSA-2005:232-01 - ipsec-tools security update 3. RHSA-2005:320-01 - ImageMagick security update 4. RHSA-2005:325-01 - kdelibs security update

March 2005

Four Red Hat Security Advisories: 1. RHSA-2005:070-01 - ImageMagick security update 2. RHSA-2005:232-01 - ipsec-tools security update 3. RHSA-2005:320-01 - ImageMagick security update 4. RHSA-2005:325-01 - kdelibs security update

ID: 00237
Ref: 216/2005
Date: 23 March 2005:12:05:51
Version: 1
Title: Four Red Hat Security Advisories: 1. RHSA-2005:070-01 - ImageMagick security update 2. RHSA-2005:232-01 - ipsec-tools security update 3. RHSA-2005:320-01 - ImageMagick security update 4. RHSA-2005:325-01 - kdelibs security update
Abstract:
Vendors affected: Red Hat
Operating systems affected: Red Hat
Applications affected: Red Hat
Title
=====

Four Red Hat Security Advisories:

1. RHSA-2005:070-01 - ImageMagick security update

2. RHSA-2005:232-01 - ipsec-tools security update

3. RHSA-2005:320-01 - ImageMagick security update

4. RHSA-2005:325-01 - kdelibs security update


Detail
======

1. ImageMagick is an image display and manipulation tool for the X Window
System.
Andrei Nigmatulin discovered a heap based buffer overflow flaw in the
ImageMagick image handler. An attacker could create a carefully crafted
Photoshop Document (PSD) image in such a way that it would cause
ImageMagick to execute arbitrary code when processing the image. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2005-0005 to this issue.

2. The ipsec-tools package is used in conjunction with the IPsec functionality
in the linux kernel. The ipsec-tools package includes:
- - - setkey, a program to directly manipulate policies and SAs
- - - racoon, an IKEv1 keying daemon
A bug was found in the way the racoon daemon handled incoming ISAKMP
requests. It is possible that an attacker could crash the racoon daemon by
sending a specially crafted ISAKMP packet. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2005-0398 to
this issue.

3. ImageMagick(TM) is an image display and manipulation tool for the X Window
System which can read and write multiple image formats.
A format string bug was found in the way ImageMagick handles filenames. An
attacker could execute arbitrary code on a victim's machine if they were
able to trick the victim into opening a file with a specially crafted name.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-0397 to this issue.

4. The kdelibs package provides libraries for the K Desktop Environment.
The International Domain Name (IDN) support in the Konqueror browser
allowed remote attackers to spoof domain names using punycode encoded
domain names. Such domain names are decoded in URLs and SSL certificates
in a way that uses homograph characters from other character sets, which
facilitates phishing attacks. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2005-0237 to this issue.




1.



- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ---------------------------------------------------------------------
Red Hat Security Advisory

Synopsis: Moderate: ImageMagick security update
Advisory ID: RHSA-2005:070-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-070.html
Issue date: 2005-03-23
Updated on: 2005-03-23
Product: Red Hat Enterprise Linux
CVE Names: CAN-2005-0005 CAN-2005-0397 CAN-2005-0759 CAN-2005-0760
CAN-2005-0761 CAN-2005-0762
- - ---------------------------------------------------------------------

1. Summary:

Updated ImageMagick packages that fix a heap based buffer overflow are now
available.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

3. Problem description:

ImageMagick is an image display and manipulation tool for the X Window
System.

Andrei Nigmatulin discovered a heap based buffer overflow flaw in the
ImageMagick image handler. An attacker could create a carefully crafted
Photoshop Document (PSD) image in such a way that it would cause
ImageMagick to execute arbitrary code when processing the image. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2005-0005 to this issue.

A format string bug was found in the way ImageMagick handles filenames. An
attacker could execute arbitrary code on a victim's machine if they were
able to trick the victim into opening a file with a specially crafted name.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-0397 to this issue.

A bug was found in the way ImageMagick handles TIFF tags. It is possible
that a TIFF image file with an invalid tag could cause ImageMagick to
crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-0759 to this issue.

A bug was found in ImageMagick's TIFF decoder. It is possible that a
specially crafted TIFF image file could cause ImageMagick to crash. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CAN-2005-0760 to this issue.

A bug was found in the way ImageMagick parses PSD files. It is possible
that a specially crafted PSD file could cause ImageMagick to crash. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CAN-2005-0761 to this issue.

A heap overflow bug was found in ImageMagick's SGI parser. It is possible
that an attacker could execute arbitrary code by tricking a user into
opening a specially crafted SGI image file. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2005-0762 to
this issue.

Users of ImageMagick should upgrade to these updated packages, which
contain backported patches, and are not vulnerable to these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

5. Bug IDs fixed (http://bugzilla.redhat.com/):

145111 - CAN-2005-0005 buffer overflow in ImageMagick
150185 - CAN-2005-0397 ImageMagick format string flaw
150312 - CAN-2005-0759 Denial of Service in .tiff images with invalid TAG
150315 - CAN-2005-0760 Accessing memory outside of image during decoding of TIFF
150323 - CAN-2005-0761 Bug in parsing PSD files
150327 - CAN-2005-0762 Buffer overflow in SGI parser

6. RPMs required:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/ImageMagick-5.3.8-10.src.rpm
7ea876dd7ef145131e227b93c9477c3c ImageMagick-5.3.8-10.src.rpm

i386:
e79b17a0964f3242afe48ea977cba811 ImageMagick-5.3.8-10.i386.rpm
e613edc5a641b2826a17a014d23b561d ImageMagick-c++-5.3.8-10.i386.rpm
73699f8ab694fc27c901dd4b24c9bbd6 ImageMagick-c++-devel-5.3.8-10.i386.rpm
208653fea7be46c37dedb8f335d9bd29 ImageMagick-devel-5.3.8-10.i386.rpm
dfef04e0cc1b1e411a79e67b03b905ac ImageMagick-perl-5.3.8-10.i386.rpm

ia64:
de0ab5db6c53da4abc76ef97fd0983ec ImageMagick-5.3.8-10.ia64.rpm
dc987dc03c1aba45a59051c59db887e0 ImageMagick-c++-5.3.8-10.ia64.rpm
313eab6adc60421b639c2cf76714f55a ImageMagick-c++-devel-5.3.8-10.ia64.rpm
e964030f316ac822f1749352fa38a225 ImageMagick-devel-5.3.8-10.ia64.rpm
12124b283bc60518963483d957f71fb1 ImageMagick-perl-5.3.8-10.ia64.rpm

Red Hat Linux Advanced Workstation 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/ImageMagick-5.3.8-10.src.rpm
7ea876dd7ef145131e227b93c9477c3c ImageMagick-5.3.8-10.src.rpm

ia64:
de0ab5db6c53da4abc76ef97fd0983ec ImageMagick-5.3.8-10.ia64.rpm
dc987dc03c1aba45a59051c59db887e0 ImageMagick-c++-5.3.8-10.ia64.rpm
313eab6adc60421b639c2cf76714f55a ImageMagick-c++-devel-5.3.8-10.ia64.rpm
e964030f316ac822f1749352fa38a225 ImageMagick-devel-5.3.8-10.ia64.rpm
12124b283bc60518963483d957f71fb1 ImageMagick-perl-5.3.8-10.ia64.rpm

Red Hat Enterprise Linux ES version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/ImageMagick-5.3.8-10.src.rpm
7ea876dd7ef145131e227b93c9477c3c ImageMagick-5.3.8-10.src.rpm

i386:
e79b17a0964f3242afe48ea977cba811 ImageMagick-5.3.8-10.i386.rpm
e613edc5a641b2826a17a014d23b561d ImageMagick-c++-5.3.8-10.i386.rpm
73699f8ab694fc27c901dd4b24c9bbd6 ImageMagick-c++-devel-5.3.8-10.i386.rpm
208653fea7be46c37dedb8f335d9bd29 ImageMagick-devel-5.3.8-10.i386.rpm
dfef04e0cc1b1e411a79e67b03b905ac ImageMagick-perl-5.3.8-10.i386.rpm

Red Hat Enterprise Linux WS version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/ImageMagick-5.3.8-10.src.rpm
7ea876dd7ef145131e227b93c9477c3c ImageMagick-5.3.8-10.src.rpm

i386:
e79b17a0964f3242afe48ea977cba811 ImageMagick-5.3.8-10.i386.rpm
e613edc5a641b2826a17a014d23b561d ImageMagick-c++-5.3.8-10.i386.rpm
73699f8ab694fc27c901dd4b24c9bbd6 ImageMagick-c++-devel-5.3.8-10.i386.rpm
208653fea7be46c37dedb8f335d9bd29 ImageMagick-devel-5.3.8-10.i386.rpm
dfef04e0cc1b1e411a79e67b03b905ac ImageMagick-perl-5.3.8-10.i386.rpm

Red Hat Enterprise Linux AS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/ImageMagick-5.5.6-13.src.rpm
c9df74ebf9e921c9a254015e9a60da68 ImageMagick-5.5.6-13.src.rpm

i386:
e96c043b59ad808214398d62765884b3 ImageMagick-5.5.6-13.i386.rpm
ca5a5de88dbce63e4b68d0813dd0aa0b ImageMagick-c++-5.5.6-13.i386.rpm
571d4b8252cd09388e811dab7b7d420a ImageMagick-c++-devel-5.5.6-13.i386.rpm
d52da9fea241e7069834e43870d6e305 ImageMagick-devel-5.5.6-13.i386.rpm
0c410c10953a8641a2c58cdd79590318 ImageMagick-perl-5.5.6-13.i386.rpm

ia64:
57266d92716e2e72c4758df06c7078b1 ImageMagick-5.5.6-13.ia64.rpm
e96c043b59ad808214398d62765884b3 ImageMagick-5.5.6-13.i386.rpm
97caf495f60b7d27b2da35e17d91b806 ImageMagick-c++-5.5.6-13.ia64.rpm
ca5a5de88dbce63e4b68d0813dd0aa0b ImageMagick-c++-5.5.6-13.i386.rpm
439e8b7a4c60e7a8d3f21438aa400667 ImageMagick-c++-devel-5.5.6-13.ia64.rpm
50f8e9f478f5888153ddc4a5542250b0 ImageMagick-devel-5.5.6-13.ia64.rpm
99c88878747e363fcb12ba1edb15bb76 ImageMagick-perl-5.5.6-13.ia64.rpm

ppc:
f5c8817d0a4c7cfc309ffc91f88536cf ImageMagick-5.5.6-13.ppc.rpm
9d50784dc7ba6f7442d91d19d4ced50d ImageMagick-5.5.6-13.ppc64.rpm
6ec612e90b6a29e49fc9dad40632e05b ImageMagick-c++-5.5.6-13.ppc.rpm
4307b341167d18b89ec07477044da9cf ImageMagick-c++-5.5.6-13.ppc64.rpm
2a110d90ccf8fe7de4f7c21c95076d8a ImageMagick-c++-devel-5.5.6-13.ppc.rpm
b7497b642ca0781a97ada5078d8c82d3 ImageMagick-devel-5.5.6-13.ppc.rpm
f50e182783d0fe2a316e44f77813501f ImageMagick-perl-5.5.6-13.ppc.rpm

s390:
ffdc5754ae7f12c66b1f4dba743678df ImageMagick-5.5.6-13.s390.rpm
5ab787e7742193fd5ab09d70306afda1 ImageMagick-c++-5.5.6-13.s390.rpm
fa6a3166f01de5e3af7f6dffa4c61378 ImageMagick-c++-devel-5.5.6-13.s390.rpm
a4efd895558315a4b37b977c07e392c2 ImageMagick-devel-5.5.6-13.s390.rpm
8ef03012a946a11d29c8990d782f5160 ImageMagick-perl-5.5.6-13.s390.rpm

s390x:
29cb46983c1f8e6efe0663b0a2b8a6d4 ImageMagick-5.5.6-13.s390x.rpm
ffdc5754ae7f12c66b1f4dba743678df ImageMagick-5.5.6-13.s390.rpm
68fba7343df00dad18bfd44da9fd86fc ImageMagick-c++-5.5.6-13.s390x.rpm
5ab787e7742193fd5ab09d70306afda1 ImageMagick-c++-5.5.6-13.s390.rpm
b2856e4eea04fc5113213361ae38e492 ImageMagick-c++-devel-5.5.6-13.s390x.rpm
159972f15e0e249ab2ef742400f7fedd ImageMagick-devel-5.5.6-13.s390x.rpm
aabd863febeffaafb913d0513f9152c4 ImageMagick-perl-5.5.6-13.s390x.rpm

x86_64:
d4e3cfc3f690b5f0a96660eb8f15857f ImageMagick-5.5.6-13.x86_64.rpm
e96c043b59ad808214398d62765884b3 ImageMagick-5.5.6-13.i386.rpm
aabcec7ef0e8545b170a86246114bc64 ImageMagick-c++-5.5.6-13.x86_64.rpm
ca5a5de88dbce63e4b68d0813dd0aa0b ImageMagick-c++-5.5.6-13.i386.rpm
70e707a934f7c674180d144dc54750c7 ImageMagick-c++-devel-5.5.6-13.x86_64.rpm
3a17b125eb8909661f2d0790c788cf4b ImageMagick-devel-5.5.6-13.x86_64.rpm
9581f193326fb69a826aba2db00c6d98 ImageMagick-perl-5.5.6-13.x86_64.rpm

Red Hat Desktop version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/ImageMagick-5.5.6-13.src.rpm
c9df74ebf9e921c9a254015e9a60da68 ImageMagick-5.5.6-13.src.rpm

i386:
e96c043b59ad808214398d62765884b3 ImageMagick-5.5.6-13.i386.rpm
ca5a5de88dbce63e4b68d0813dd0aa0b ImageMagick-c++-5.5.6-13.i386.rpm
571d4b8252cd09388e811dab7b7d420a ImageMagick-c++-devel-5.5.6-13.i386.rpm
d52da9fea241e7069834e43870d6e305 ImageMagick-devel-5.5.6-13.i386.rpm
0c410c10953a8641a2c58cdd79590318 ImageMagick-perl-5.5.6-13.i386.rpm

x86_64:
d4e3cfc3f690b5f0a96660eb8f15857f ImageMagick-5.5.6-13.x86_64.rpm
e96c043b59ad808214398d62765884b3 ImageMagick-5.5.6-13.i386.rpm
aabcec7ef0e8545b170a86246114bc64 ImageMagick-c++-5.5.6-13.x86_64.rpm
ca5a5de88dbce63e4b68d0813dd0aa0b ImageMagick-c++-5.5.6-13.i386.rpm
70e707a934f7c674180d144dc54750c7 ImageMagick-c++-devel-5.5.6-13.x86_64.rpm
3a17b125eb8909661f2d0790c788cf4b ImageMagick-devel-5.5.6-13.x86_64.rpm
9581f193326fb69a826aba2db00c6d98 ImageMagick-perl-5.5.6-13.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/ImageMagick-5.5.6-13.src.rpm
c9df74ebf9e921c9a254015e9a60da68 ImageMagick-5.5.6-13.src.rpm

i386:
e96c043b59ad808214398d62765884b3 ImageMagick-5.5.6-13.i386.rpm
ca5a5de88dbce63e4b68d0813dd0aa0b ImageMagick-c++-5.5.6-13.i386.rpm
571d4b8252cd09388e811dab7b7d420a ImageMagick-c++-devel-5.5.6-13.i386.rpm
d52da9fea241e7069834e43870d6e305 ImageMagick-devel-5.5.6-13.i386.rpm
0c410c10953a8641a2c58cdd79590318 ImageMagick-perl-5.5.6-13.i386.rpm

ia64:
57266d92716e2e72c4758df06c7078b1 ImageMagick-5.5.6-13.ia64.rpm
e96c043b59ad808214398d62765884b3 ImageMagick-5.5.6-13.i386.rpm
97caf495f60b7d27b2da35e17d91b806 ImageMagick-c++-5.5.6-13.ia64.rpm
ca5a5de88dbce63e4b68d0813dd0aa0b ImageMagick-c++-5.5.6-13.i386.rpm
439e8b7a4c60e7a8d3f21438aa400667 ImageMagick-c++-devel-5.5.6-13.ia64.rpm
50f8e9f478f5888153ddc4a5542250b0 ImageMagick-devel-5.5.6-13.ia64.rpm
99c88878747e363fcb12ba1edb15bb76 ImageMagick-perl-5.5.6-13.ia64.rpm

x86_64:
d4e3cfc3f690b5f0a96660eb8f15857f ImageMagick-5.5.6-13.x86_64.rpm
e96c043b59ad808214398d62765884b3 ImageMagick-5.5.6-13.i386.rpm
aabcec7ef0e8545b170a86246114bc64 ImageMagick-c++-5.5.6-13.x86_64.rpm
ca5a5de88dbce63e4b68d0813dd0aa0b ImageMagick-c++-5.5.6-13.i386.rpm
70e707a934f7c674180d144dc54750c7 ImageMagick-c++-devel-5.5.6-13.x86_64.rpm
3a17b125eb8909661f2d0790c788cf4b ImageMagick-devel-5.5.6-13.x86_64.rpm
9581f193326fb69a826aba2db00c6d98 ImageMagick-perl-5.5.6-13.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/ImageMagick-5.5.6-13.src.rpm
c9df74ebf9e921c9a254015e9a60da68 ImageMagick-5.5.6-13.src.rpm

i386:
e96c043b59ad808214398d62765884b3 ImageMagick-5.5.6-13.i386.rpm
ca5a5de88dbce63e4b68d0813dd0aa0b ImageMagick-c++-5.5.6-13.i386.rpm
571d4b8252cd09388e811dab7b7d420a ImageMagick-c++-devel-5.5.6-13.i386.rpm
d52da9fea241e7069834e43870d6e305 ImageMagick-devel-5.5.6-13.i386.rpm
0c410c10953a8641a2c58cdd79590318 ImageMagick-perl-5.5.6-13.i386.rpm

ia64:
57266d92716e2e72c4758df06c7078b1 ImageMagick-5.5.6-13.ia64.rpm
e96c043b59ad808214398d62765884b3 ImageMagick-5.5.6-13.i386.rpm
97caf495f60b7d27b2da35e17d91b806 ImageMagick-c++-5.5.6-13.ia64.rpm
ca5a5de88dbce63e4b68d0813dd0aa0b ImageMagick-c++-5.5.6-13.i386.rpm
439e8b7a4c60e7a8d3f21438aa400667 ImageMagick-c++-devel-5.5.6-13.ia64.rpm
50f8e9f478f5888153ddc4a5542250b0 ImageMagick-devel-5.5.6-13.ia64.rpm
99c88878747e363fcb12ba1edb15bb76 ImageMagick-perl-5.5.6-13.ia64.rpm

x86_64:
d4e3cfc3f690b5f0a96660eb8f15857f ImageMagick-5.5.6-13.x86_64.rpm
e96c043b59ad808214398d62765884b3 ImageMagick-5.5.6-13.i386.rpm
aabcec7ef0e8545b170a86246114bc64 ImageMagick-c++-5.5.6-13.x86_64.rpm
ca5a5de88dbce63e4b68d0813dd0aa0b ImageMagick-c++-5.5.6-13.i386.rpm
70e707a934f7c674180d144dc54750c7 ImageMagick-c++-devel-5.5.6-13.x86_64.rpm
3a17b125eb8909661f2d0790c788cf4b ImageMagick-devel-5.5.6-13.x86_64.rpm
9581f193326fb69a826aba2db00c6d98 ImageMagick-perl-5.5.6-13.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0005
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0397
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0759
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0760
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0761
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0762

8. Contact:

The Red Hat security contact is . More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2005 Red Hat, Inc.

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFCQUC1XlSAg2UNWIIRAruBAJ0bjRd+wfQqpRMYNLLOMFUQzHbNcACgm20t
+RsvoFnqnvaPCMpBvZA3BKg=
=0KrU
- -----END PGP SIGNATURE-----



2.


- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ---------------------------------------------------------------------
Red Hat Security Advisory

Synopsis: Moderate: ipsec-tools security update
Advisory ID: RHSA-2005:232-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-232.html
Issue date: 2005-03-23
Updated on: 2005-03-23
Product: Red Hat Enterprise Linux
CVE Names: CAN-2005-0398
- - ---------------------------------------------------------------------

1. Summary:

An updated ipsec-tools package that fixes a bug in parsing of ISAKMP headers
is now available.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

The ipsec-tools package is used in conjunction with the IPsec functionality
in the linux kernel. The ipsec-tools package includes:

- - - setkey, a program to directly manipulate policies and SAs
- - - racoon, an IKEv1 keying daemon

A bug was found in the way the racoon daemon handled incoming ISAKMP
requests. It is possible that an attacker could crash the racoon daemon by
sending a specially crafted ISAKMP packet. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2005-0398 to
this issue.

Additionally, the following issues have been fixed:
- - - racoon mishandled restarts in the presence of stale administration sockets.
- - - on Red Hat Enterprise Linux 4, racoon and setkey did not properly set up
forward policies, which prevented tunnels from working.

Users of ipsec-tools should upgrade to this updated package, which contains
backported patches, and is not vulnerable to these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

5. Bug IDs fixed (http://bugzilla.redhat.com/):

145531 - EMBARGOED CAN-2005-0398 multiple issues with racoon
145535 - EMBARGOED CAN-2005-0398 multiple issues with racoon
148950 - racoon unable to start with stale socket /tmp/.racoon
150179 - ipsec/racoon/setkey does not properly forward packets to vpn peer

6. RPMs required:

Red Hat Enterprise Linux AS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/ipsec-tools-0.2.5-0.7.src.rpm
04fc5b942ed112aa3d8ecd3e6e527e87 ipsec-tools-0.2.5-0.7.src.rpm

i386:
55373f7613bd894b051137eca8c799fb ipsec-tools-0.2.5-0.7.i386.rpm

ia64:
b646a3cc587fbc09f357fc034a023b50 ipsec-tools-0.2.5-0.7.ia64.rpm

ppc:
429e2466025454529bd6c5db6dac8463 ipsec-tools-0.2.5-0.7.ppc.rpm

s390:
fbfda4852a54348abcd7d7e474195782 ipsec-tools-0.2.5-0.7.s390.rpm

s390x:
39fef41381e2bb472937ba83aaa956af ipsec-tools-0.2.5-0.7.s390x.rpm

x86_64:
4335033d7b3726c4ce1ff9a51747756a ipsec-tools-0.2.5-0.7.x86_64.rpm

Red Hat Desktop version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/ipsec-tools-0.2.5-0.7.src.rpm
04fc5b942ed112aa3d8ecd3e6e527e87 ipsec-tools-0.2.5-0.7.src.rpm

i386:
55373f7613bd894b051137eca8c799fb ipsec-tools-0.2.5-0.7.i386.rpm

x86_64:
4335033d7b3726c4ce1ff9a51747756a ipsec-tools-0.2.5-0.7.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/ipsec-tools-0.2.5-0.7.src.rpm
04fc5b942ed112aa3d8ecd3e6e527e87 ipsec-tools-0.2.5-0.7.src.rpm

i386:
55373f7613bd894b051137eca8c799fb ipsec-tools-0.2.5-0.7.i386.rpm

ia64:
b646a3cc587fbc09f357fc034a023b50 ipsec-tools-0.2.5-0.7.ia64.rpm

x86_64:
4335033d7b3726c4ce1ff9a51747756a ipsec-tools-0.2.5-0.7.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/ipsec-tools-0.2.5-0.7.src.rpm
04fc5b942ed112aa3d8ecd3e6e527e87 ipsec-tools-0.2.5-0.7.src.rpm

i386:
55373f7613bd894b051137eca8c799fb ipsec-tools-0.2.5-0.7.i386.rpm

ia64:
b646a3cc587fbc09f357fc034a023b50 ipsec-tools-0.2.5-0.7.ia64.rpm

x86_64:
4335033d7b3726c4ce1ff9a51747756a ipsec-tools-0.2.5-0.7.x86_64.rpm

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/ipsec-tools-0.3.3-6.src.rpm
6d465bb4084c165d8471ae457a1627d8 ipsec-tools-0.3.3-6.src.rpm

i386:
5e608be5a2d36e626451905cdca79252 ipsec-tools-0.3.3-6.i386.rpm

ia64:
eb21e0073264ad7010a2b5a4e66538e9 ipsec-tools-0.3.3-6.ia64.rpm

ppc:
f99ca70bb00a40ea4d4d5fc4397ad953 ipsec-tools-0.3.3-6.ppc.rpm

s390:
f4d588f28fcdb8a543a556a0712ab627 ipsec-tools-0.3.3-6.s390.rpm

s390x:
4c65730a3848f3ac85db031c33de24a9 ipsec-tools-0.3.3-6.s390x.rpm

x86_64:
18fbd03935536494294326a7b1895ff6 ipsec-tools-0.3.3-6.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/ipsec-tools-0.3.3-6.src.rpm
6d465bb4084c165d8471ae457a1627d8 ipsec-tools-0.3.3-6.src.rpm

i386:
5e608be5a2d36e626451905cdca79252 ipsec-tools-0.3.3-6.i386.rpm

x86_64:
18fbd03935536494294326a7b1895ff6 ipsec-tools-0.3.3-6.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/ipsec-tools-0.3.3-6.src.rpm
6d465bb4084c165d8471ae457a1627d8 ipsec-tools-0.3.3-6.src.rpm

i386:
5e608be5a2d36e626451905cdca79252 ipsec-tools-0.3.3-6.i386.rpm

ia64:
eb21e0073264ad7010a2b5a4e66538e9 ipsec-tools-0.3.3-6.ia64.rpm

x86_64:
18fbd03935536494294326a7b1895ff6 ipsec-tools-0.3.3-6.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/ipsec-tools-0.3.3-6.src.rpm
6d465bb4084c165d8471ae457a1627d8 ipsec-tools-0.3.3-6.src.rpm

i386:
5e608be5a2d36e626451905cdca79252 ipsec-tools-0.3.3-6.i386.rpm

ia64:
eb21e0073264ad7010a2b5a4e66538e9 ipsec-tools-0.3.3-6.ia64.rpm

x86_64:
18fbd03935536494294326a7b1895ff6 ipsec-tools-0.3.3-6.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0398

8. Contact:

The Red Hat security contact is . More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2005 Red Hat, Inc.

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFCQUDIXlSAg2UNWIIRAsSvAJ9RPtm7MOYA7lTWx3oyVWMwQ7L7vACgrVR0
8yxFngihwUZqrxi72MARFZk=
=r8uT
- -----END PGP SIGNATURE-----


3.


- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ---------------------------------------------------------------------
Red Hat Security Advisory

Synopsis: Moderate: ImageMagick security update
Advisory ID: RHSA-2005:320-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-320.html
Issue date: 2005-03-23
Updated on: 2005-03-23
Product: Red Hat Enterprise Linux
CVE Names: CAN-2005-0397
- - ---------------------------------------------------------------------

1. Summary:

Updated ImageMagick packages that fix a format string bug are now available
for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

ImageMagick(TM) is an image display and manipulation tool for the X Window
System which can read and write multiple image formats.

A format string bug was found in the way ImageMagick handles filenames. An
attacker could execute arbitrary code on a victim's machine if they were
able to trick the victim into opening a file with a specially crafted name.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-0397 to this issue.

Additionally, a bug was fixed which caused ImageMagick(TM) to occasionally
segfault when writing TIFF images to standard output.

Users of ImageMagick should upgrade to these updated packages, which
contain a backported patch, and are not vulnerable to these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

5. Bug IDs fixed (http://bugzilla.redhat.com/):

142045 - Segmentation fault on conversion to TIFF (possible libtiff bug)
150185 - CAN-2005-0397 ImageMagick format string flaw

6. RPMs required:

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/ImageMagick-6.0.7.1-10.src.rpm
983a85a6a04cd419b211542237f624fd ImageMagick-6.0.7.1-10.src.rpm

i386:
c49a75c5604dc6c91dd7644d5f8f1317 ImageMagick-6.0.7.1-10.i386.rpm
703a14542bc4d191d1e8e4eabdb12c7f ImageMagick-c++-6.0.7.1-10.i386.rpm
2f7c6aaff730080c5df1a0e5a81fd4c7 ImageMagick-c++-devel-6.0.7.1-10.i386.rpm
c2b40c33bdc90235538bc40e14b293f9 ImageMagick-devel-6.0.7.1-10.i386.rpm
6f8508bdf55102434b3d734e66a0e8f3 ImageMagick-perl-6.0.7.1-10.i386.rpm

ia64:
001bda657397f288044e64e0bc05b70b ImageMagick-6.0.7.1-10.ia64.rpm
7d931c803bc50137ce838b4abcbd2429 ImageMagick-c++-6.0.7.1-10.ia64.rpm
4a305e0d3d43b5c4819577d52cb3665b ImageMagick-c++-devel-6.0.7.1-10.ia64.rpm
2a86fc9da66f0e6d0e96b3069ca2a657 ImageMagick-devel-6.0.7.1-10.ia64.rpm
a2604e4a1e0e05077e4710a73beeb4c0 ImageMagick-perl-6.0.7.1-10.ia64.rpm

ppc:
12be580ec878b85766fb395b12594ef3 ImageMagick-6.0.7.1-10.ppc.rpm
0231e95c9d3d20a4ec33bb840f6b95c0 ImageMagick-c++-6.0.7.1-10.ppc.rpm
73d33cc0070d616f04fcc30dddf98db7 ImageMagick-c++-devel-6.0.7.1-10.ppc.rpm
0775ecaf973f9985e195d7d088e3a342 ImageMagick-devel-6.0.7.1-10.ppc.rpm
e59efdba147068fdec313afef97dcb5b ImageMagick-perl-6.0.7.1-10.ppc.rpm

s390:
dcbb2aedbc432f9291314079a4c2ff7d ImageMagick-6.0.7.1-10.s390.rpm
4745e6e2e665afbc7b1cac91cddbbc9d ImageMagick-c++-6.0.7.1-10.s390.rpm
2c4f816ab3892f6914986b2217e2c73e ImageMagick-c++-devel-6.0.7.1-10.s390.rpm
67adaba9d191ede734f758aec0cd9b5c ImageMagick-devel-6.0.7.1-10.s390.rpm
2a9a4922e589877e70e2c2e918b05b0f ImageMagick-perl-6.0.7.1-10.s390.rpm

s390x:
6dea39358712b8575da76e27ff671924 ImageMagick-6.0.7.1-10.s390x.rpm
7e6df039cba4a3cf7fbf5b550dd7a4d1 ImageMagick-c++-6.0.7.1-10.s390x.rpm
87f2a92001e88334cf6f55e82e54529a ImageMagick-c++-devel-6.0.7.1-10.s390x.rpm
377ad1d4145efd9ae1556f7498564d4d ImageMagick-devel-6.0.7.1-10.s390x.rpm
b55a7bf0fe172df9936f3628722fc14e ImageMagick-perl-6.0.7.1-10.s390x.rpm

x86_64:
672a0fe5f9ba36d3a5398262a2ab4339 ImageMagick-6.0.7.1-10.x86_64.rpm
409c209e120fa43e39c33cacda54c917 ImageMagick-c++-6.0.7.1-10.x86_64.rpm
70aaee17027423dcc49895e31889741f ImageMagick-c++-devel-6.0.7.1-10.x86_64.rpm
db06e770f7f2b943a0ec9a368adc5fa9 ImageMagick-devel-6.0.7.1-10.x86_64.rpm
c144f3cbc8398fda48fac46e2faadeb7 ImageMagick-perl-6.0.7.1-10.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/ImageMagick-6.0.7.1-10.src.rpm
983a85a6a04cd419b211542237f624fd ImageMagick-6.0.7.1-10.src.rpm

i386:
c49a75c5604dc6c91dd7644d5f8f1317 ImageMagick-6.0.7.1-10.i386.rpm
703a14542bc4d191d1e8e4eabdb12c7f ImageMagick-c++-6.0.7.1-10.i386.rpm
2f7c6aaff730080c5df1a0e5a81fd4c7 ImageMagick-c++-devel-6.0.7.1-10.i386.rpm
c2b40c33bdc90235538bc40e14b293f9 ImageMagick-devel-6.0.7.1-10.i386.rpm
6f8508bdf55102434b3d734e66a0e8f3 ImageMagick-perl-6.0.7.1-10.i386.rpm

x86_64:
672a0fe5f9ba36d3a5398262a2ab4339 ImageMagick-6.0.7.1-10.x86_64.rpm
409c209e120fa43e39c33cacda54c917 ImageMagick-c++-6.0.7.1-10.x86_64.rpm
70aaee17027423dcc49895e31889741f ImageMagick-c++-devel-6.0.7.1-10.x86_64.rpm
db06e770f7f2b943a0ec9a368adc5fa9 ImageMagick-devel-6.0.7.1-10.x86_64.rpm
c144f3cbc8398fda48fac46e2faadeb7 ImageMagick-perl-6.0.7.1-10.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/ImageMagick-6.0.7.1-10.src.rpm
983a85a6a04cd419b211542237f624fd ImageMagick-6.0.7.1-10.src.rpm

i386:
c49a75c5604dc6c91dd7644d5f8f1317 ImageMagick-6.0.7.1-10.i386.rpm
703a14542bc4d191d1e8e4eabdb12c7f ImageMagick-c++-6.0.7.1-10.i386.rpm
2f7c6aaff730080c5df1a0e5a81fd4c7 ImageMagick-c++-devel-6.0.7.1-10.i386.rpm
c2b40c33bdc90235538bc40e14b293f9 ImageMagick-devel-6.0.7.1-10.i386.rpm
6f8508bdf55102434b3d734e66a0e8f3 ImageMagick-perl-6.0.7.1-10.i386.rpm

ia64:
001bda657397f288044e64e0bc05b70b ImageMagick-6.0.7.1-10.ia64.rpm
7d931c803bc50137ce838b4abcbd2429 ImageMagick-c++-6.0.7.1-10.ia64.rpm
4a305e0d3d43b5c4819577d52cb3665b ImageMagick-c++-devel-6.0.7.1-10.ia64.rpm
2a86fc9da66f0e6d0e96b3069ca2a657 ImageMagick-devel-6.0.7.1-10.ia64.rpm
a2604e4a1e0e05077e4710a73beeb4c0 ImageMagick-perl-6.0.7.1-10.ia64.rpm

x86_64:
672a0fe5f9ba36d3a5398262a2ab4339 ImageMagick-6.0.7.1-10.x86_64.rpm
409c209e120fa43e39c33cacda54c917 ImageMagick-c++-6.0.7.1-10.x86_64.rpm
70aaee17027423dcc49895e31889741f ImageMagick-c++-devel-6.0.7.1-10.x86_64.rpm
db06e770f7f2b943a0ec9a368adc5fa9 ImageMagick-devel-6.0.7.1-10.x86_64.rpm
c144f3cbc8398fda48fac46e2faadeb7 ImageMagick-perl-6.0.7.1-10.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/ImageMagick-6.0.7.1-10.src.rpm
983a85a6a04cd419b211542237f624fd ImageMagick-6.0.7.1-10.src.rpm

i386:
c49a75c5604dc6c91dd7644d5f8f1317 ImageMagick-6.0.7.1-10.i386.rpm
703a14542bc4d191d1e8e4eabdb12c7f ImageMagick-c++-6.0.7.1-10.i386.rpm
2f7c6aaff730080c5df1a0e5a81fd4c7 ImageMagick-c++-devel-6.0.7.1-10.i386.rpm
c2b40c33bdc90235538bc40e14b293f9 ImageMagick-devel-6.0.7.1-10.i386.rpm
6f8508bdf55102434b3d734e66a0e8f3 ImageMagick-perl-6.0.7.1-10.i386.rpm

ia64:
001bda657397f288044e64e0bc05b70b ImageMagick-6.0.7.1-10.ia64.rpm
7d931c803bc50137ce838b4abcbd2429 ImageMagick-c++-6.0.7.1-10.ia64.rpm
4a305e0d3d43b5c4819577d52cb3665b ImageMagick-c++-devel-6.0.7.1-10.ia64.rpm
2a86fc9da66f0e6d0e96b3069ca2a657 ImageMagick-devel-6.0.7.1-10.ia64.rpm
a2604e4a1e0e05077e4710a73beeb4c0 ImageMagick-perl-6.0.7.1-10.ia64.rpm

x86_64:
672a0fe5f9ba36d3a5398262a2ab4339 ImageMagick-6.0.7.1-10.x86_64.rpm
409c209e120fa43e39c33cacda54c917 ImageMagick-c++-6.0.7.1-10.x86_64.rpm
70aaee17027423dcc49895e31889741f ImageMagick-c++-devel-6.0.7.1-10.x86_64.rpm
db06e770f7f2b943a0ec9a368adc5fa9 ImageMagick-devel-6.0.7.1-10.x86_64.rpm
c144f3cbc8398fda48fac46e2faadeb7 ImageMagick-perl-6.0.7.1-10.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0397

8. Contact:

The Red Hat security contact is . More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2005 Red Hat, Inc.

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFCQUDmXlSAg2UNWIIRAg8ZAKCffK5dfZ0jV36Vckkj9aZBlRp5mwCgoY1V
/E7+3tpNFs312jjL2izBqmQ=
=+tXl
- -----END PGP SIGNATURE-----


4.


- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ---------------------------------------------------------------------
Red Hat Security Advisory

Synopsis: Important: kdelibs security update
Advisory ID: RHSA-2005:325-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-325.html
Issue date: 2005-03-23
Updated on: 2005-03-23
Product: Red Hat Enterprise Linux
CVE Names: CAN-2005-0237 CAN-2005-0365 CAN-2005-0396
- - ---------------------------------------------------------------------

1. Summary:

Updated kdelibs packages that fix several security issues are now available
for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

The kdelibs package provides libraries for the K Desktop Environment.

The International Domain Name (IDN) support in the Konqueror browser
allowed remote attackers to spoof domain names using punycode encoded
domain names. Such domain names are decoded in URLs and SSL certificates
in a way that uses homograph characters from other character sets, which
facilitates phishing attacks. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2005-0237 to this issue.

Sebastian Krahmer discovered a flaw in dcopserver, the KDE Desktop
Communication Protocol (DCOP) daemon. A local user could use this flaw to
stall the DCOP authentication process, affecting any local desktop users
and causing a reduction in their desktop functionality. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2005-0396 to this issue.

A flaw in the dcopidlng script was discovered. The dcopidlng script would
create temporary files with predictable filenames which could allow local
users to overwrite arbitrary files via a symlink attack. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CAN-2005-0365 to this issue.

Users of KDE should upgrade to these erratum packages which contain
backported patches to correct these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

5. Bug IDs fixed (http://bugzilla.redhat.com/):

147405 - CAN-2005-0237 homograph spoofing
148822 - CAN-2005-0365 dcopidlng insecure temporary file usage
150090 - CAN-2005-0396 kdelibs DCOP DoS

6. RPMs required:

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/kdelibs-3.3.1-3.6.src.rpm
6ccf8717107ecc6d72b35704aaa9e07e kdelibs-3.3.1-3.6.src.rpm

i386:
105b9b5875503e735f0ee528b98b503b kdelibs-3.3.1-3.6.i386.rpm
1af694976c9994ff3bc42b04ed122684 kdelibs-devel-3.3.1-3.6.i386.rpm

ia64:
aeac4b10cefa2eb651331da7d7543688 kdelibs-3.3.1-3.6.ia64.rpm
105b9b5875503e735f0ee528b98b503b kdelibs-3.3.1-3.6.i386.rpm
86c14fcc2971949ae7d2bf6d4dc64ceb kdelibs-devel-3.3.1-3.6.ia64.rpm

ppc:
d7b5bea6a04c878784dcbf7753cd0b41 kdelibs-3.3.1-3.6.ppc.rpm
b42f3377c51e8de4370f41daec826078 kdelibs-3.3.1-3.6.ppc64.rpm
63f50dac91194f9964f7c6cfad306be5 kdelibs-devel-3.3.1-3.6.ppc.rpm

s390:
69622bbacd11c294bd01e98434a5b13b kdelibs-3.3.1-3.6.s390.rpm
e54406f8e75005d869539b701bddbe4f kdelibs-devel-3.3.1-3.6.s390.rpm

s390x:
6898fa8e5397b0c634a88f09872cd348 kdelibs-3.3.1-3.6.s390x.rpm
69622bbacd11c294bd01e98434a5b13b kdelibs-3.3.1-3.6.s390.rpm
65d18f1af50501dd67c477ea4e1fc3a5 kdelibs-devel-3.3.1-3.6.s390x.rpm

x86_64:
1a99bb1ca25663786baca88582364276 kdelibs-3.3.1-3.6.x86_64.rpm
105b9b5875503e735f0ee528b98b503b kdelibs-3.3.1-3.6.i386.rpm
918fbe7a0df8853c16213e9cc85311ca kdelibs-devel-3.3.1-3.6.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/kdelibs-3.3.1-3.6.src.rpm
6ccf8717107ecc6d72b35704aaa9e07e kdelibs-3.3.1-3.6.src.rpm

i386:
105b9b5875503e735f0ee528b98b503b kdelibs-3.3.1-3.6.i386.rpm
1af694976c9994ff3bc42b04ed122684 kdelibs-devel-3.3.1-3.6.i386.rpm

x86_64:
1a99bb1ca25663786baca88582364276 kdelibs-3.3.1-3.6.x86_64.rpm
105b9b5875503e735f0ee528b98b503b kdelibs-3.3.1-3.6.i386.rpm
918fbe7a0df8853c16213e9cc85311ca kdelibs-devel-3.3.1-3.6.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/kdelibs-3.3.1-3.6.src.rpm
6ccf8717107ecc6d72b35704aaa9e07e kdelibs-3.3.1-3.6.src.rpm

i386:
105b9b5875503e735f0ee528b98b503b kdelibs-3.3.1-3.6.i386.rpm
1af694976c9994ff3bc42b04ed122684 kdelibs-devel-3.3.1-3.6.i386.rpm

ia64:
aeac4b10cefa2eb651331da7d7543688 kdelibs-3.3.1-3.6.ia64.rpm
105b9b5875503e735f0ee528b98b503b kdelibs-3.3.1-3.6.i386.rpm
86c14fcc2971949ae7d2bf6d4dc64ceb kdelibs-devel-3.3.1-3.6.ia64.rpm

x86_64:
1a99bb1ca25663786baca88582364276 kdelibs-3.3.1-3.6.x86_64.rpm
105b9b5875503e735f0ee528b98b503b kdelibs-3.3.1-3.6.i386.rpm
918fbe7a0df8853c16213e9cc85311ca kdelibs-devel-3.3.1-3.6.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/kdelibs-3.3.1-3.6.src.rpm
6ccf8717107ecc6d72b35704aaa9e07e kdelibs-3.3.1-3.6.src.rpm

i386:
105b9b5875503e735f0ee528b98b503b kdelibs-3.3.1-3.6.i386.rpm
1af694976c9994ff3bc42b04ed122684 kdelibs-devel-3.3.1-3.6.i386.rpm

ia64:
aeac4b10cefa2eb651331da7d7543688 kdelibs-3.3.1-3.6.ia64.rpm
105b9b5875503e735f0ee528b98b503b kdelibs-3.3.1-3.6.i386.rpm
86c14fcc2971949ae7d2bf6d4dc64ceb kdelibs-devel-3.3.1-3.6.ia64.rpm

x86_64:
1a99bb1ca25663786baca88582364276 kdelibs-3.3.1-3.6.x86_64.rpm
105b9b5875503e735f0ee528b98b503b kdelibs-3.3.1-3.6.i386.rpm
918fbe7a0df8853c16213e9cc85311ca kdelibs-devel-3.3.1-3.6.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://www.kde.org/info/security/advisory-20050316-3.txt
http://www.kde.org/info/security/advisory-20050316-2.txt
http://www.kde.org/info/security/advisory-20050316-1.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0237
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0365
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0396

8. Contact:

The Red Hat security contact is . More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2005 Red Hat, Inc.

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFCQUMrXlSAg2UNWIIRAprFAJ9hFjKtSzbyo6Cbaw6RN3qfn88ynQCdEWVf
nawkiiiGU7S7FC69F0FKeXE=
=iav2
- -----END PGP SIGNATURE-----
  • Accessibility |
  • Terms and conditions |
  • Privacy statement |
  • Data protection act |
  • Freedom of information |