This is a list of security announcments that have been released for the current stable version of Frugalware
A vulnerability has been reported in xine-ui, which potentially can be exploited by malicious people to compromise a user’s system. The vulnerability is caused due to a format string error within the “errors_create_window()” function in errors.c. This may be exploited to execute arbitrary code by e.g. tricking a user into opening a specially crafted playlist file.
Rapid7 has reported some vulnerabilities in Adobe Flash Player, which can be exploited by malicious people to bypass certain restrictions. Input passed to the “XML.addRequestHeader()” ActionScript function and the “XML.contentType” attribute is not properly sanitised before being used. This can be exploited to bypass certain restrictions via CRLF character sequences and inject arbitrary HTTP headers in a request. Successful exploitation may e.g. make it easier to perform CSRF (Cross-Site Request Forgery) attacks.
Some vulnerabilities have been reported in Samba, which can be exploited by malicious users to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.
Some vulnerabilities have been reported in Wireshark, which can be exploited by malicious people to cause a DoS (Denial of Service). Errors within the TCP, HTTP, IEEE 802.11, and LLT parsers can be exploited to cause a crash or consume large amounts of memory when parsing a specially crafted packet that is either captured off the wire or loaded via a capture file.
Some vulnerabilities have been reported in PostgreSQL, which can be exploited by malicious users to gain knowledge of potentially sensitive information and cause a DoS (Denial of Service).
A vulnerability has been reported in GTK+, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an error within the “GdkPixbufLoader()” when handling certain malformed input. This can be exploited to crash an application using the library by tricking it into processing specially crafted image files.
A vulnerability has been reported in ISC BIND, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an unspecified error, which may cause the named daemon to dereference a freed fetch context. Successful exploitation crashes the named daemon.
Some vulnerabilities have been reported in phpMyAdmin, which can be exploited by malicious people to conduct cross-site scripting attacks and HTTP response splitting attacks.
A vulnerability has been reported in Poppler, which can be exploited by malicious people to cause a DoS (Denial of Service). The vulnerability is caused due to an error within the handling of catalog dictionaries or page attributes that reference an invalid page tree node. This can be exploited to cause an infinite loop by e.g. tricking a user into opening a specially crafted PDF document.
Two vulnerabilities have been reported in Squid, which can be exploited by malicious people to cause a DoS (Denial of Service).
