Frugalware Security Announcements (FSAs)

This is a list of security announcments that have been released for the current stable version of Frugalware

gnutls

  • Vulnerable: 2.2.0-1
  • Unaffected: 2.2.5-1kalgan1

Some vulnerabilities have been reported in GnuTLS, which can be exploited by malicious people to cause a DoS (Denial of Service) or to potentially compromise an application using the library.

  1. A boundary error exists in the processing “Client Hello” messages containing a “Server Name” extension. This can be exploited to cause a heap-based buffer overflow via a specially crafted TLS packet. Successful exploitation may allow execution of arbitrary code.
  2. A NULL-pointer dereference error in the processing of TLS packets containing multiple “Client Hello” messages can be exploited to crash an affected application.
  3. A signedness error exists within the “_gnutls_ciphertext2compressed()” function in lib/gnutls_cipher.c. This can be exploited to cause an out of bounds read and crash an affected application via specially crafted, encrypted TLS data.

CVEs:

qemu

  • Vulnerable: 0.9.1-2
  • Unaffected: 0.9.1-3kalgan1

A vulnerability has been reported in QEMU, which can be exploited by malicious, local users to bypass certain security restrictions. The vulnerability is caused due to the “drive_init()” function in vl.c determining the format of a disk from data contained in the disk’s header. This can be exploited by a malicious user in a guest system to e.g. read arbitrary files on the host by writing a fake header to a raw formatted disk image.

audacity

  • Vulnerable: 1.3.3-2
  • Unaffected: 1.3.5-1kalgan1

Viktor Griph has reported a security issue in Audacity, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or to delete arbitrary files and directories. The security issue is caused due to the “AudacityApp::OnInit()” method in src/AudacityApp.cpp handling temporary files in an insecure manner. This can be exploited to delete arbitrary files and directories via symlink attacks, or to cause a deadlock.

graphicsmagick

  • Vulnerable: 1.1.11-1
  • Unaffected: 1.1.12-1kalgan1

A security issue has been reported in GraphicsMagick, which can be exploited by malicious people to bypass certain security restrictions. The security issue is caused due to the improper processing of file extensions and can be exploited to e.g. access X11 or to invoke certain delegate programs. Successful exploitation requires that a user is tricked into processing a malicious file with a specific file extension.

CVEs:

php

  • Vulnerable: 5.2.5-2
  • Unaffected: 5.2.6-1kalgan1

Some vulnerabilities have been reported in PHP, where some have unknown impacts and others can be exploited by malicious users to bypass certain security restrictions, and potentially by malicious people to cause a DoS (Denial of Service) or to compromise a vulnerable system.

  1. An unspecified error in the FastCGI SAPI can be exploited to cause a stack-based buffer overflow.
  2. An error in the processing of multibyte characters within the “escapeshellcmd()” and “escapeshellarg()” functions can be exploited to escape the inserted backslash or quote characters via certain multibyte characters. Successful exploitation allows to bypass the “safe_mode_exec_dir” and “disable_functions” directives, and potentially to inject arbitrary shell commands via user controlled input, but requires that the shell uses a locale with a variable width character (e.g. GBK, EUC-KR, SJIS).
  3. A vulnerability is caused due to an error during path translation in cgi_main.c. This can potentially be exploited to execute arbitrary code, but depends on how a targeted application is using PHP.
  4. An error in cURL can be exploited to bypass the “safe_mode” directive.
  5. A boundary error in PCRE can potentially be exploited by malicious people to cause a DoS or compromise a vulnerable system.

CVEs:

rdesktop

  • Vulnerable: 1.5.0-2
  • Unaffected: 1.6.0-1kalgan1

Some vulnerabilities have been reported in rdesktop, which can be exploited by malicious people to compromise a user’s system.

  1. An integer underflow error in iso.c when processing RDP requests can be exploited to cause a heap-based buffer overflow.
  2. An input validation error in rdp.c when processing RDP redirect requests can be exploited to cause a BSS-based buffer overflow.
  3. A signedness error within “xrealloc()” in rdesktop.c can be exploited to cause a heap-based buffer overflow. Successful exploitation allows execution of arbitrary code but requires that a user is tricked into connecting to a malicious RDP server.

CVEs:

eterm

  • Vulnerable: 0.9.4-2
  • Unaffected: 0.9.4-3kalgan1

A security issue has been reported in Eterm, which can be exploited by malicious, local users to gain escalated privileges. Eterm 0.9.4 opens a terminal window on :0 if -display is not specified and the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.

CVEs: