Frugalware Security Announcements (FSAs)

This is a list of security announcments that have been released for the current stable version of Frugalware

thunderbird

  • Author: voroskoi
  • Vulnerable: 1.5.0.5-2
  • Unaffected: 1.5.0.7-1siwenna1

Some vulnerabilities have been reported in Mozilla Thunderbird, which can be exploited by malicious people to conduct man-in-the-middle attacks, bypass certain security restrictions, and potentially compromise a user’s system.

CVEs:

gzip

  • Author: voroskoi
  • Vulnerable: 1.2.4b-1
  • Unaffected: 1.2.4b-2siwenna1

Tavis Ormandy from the Google Security Team discovered several vulnerabilities in gzip, the GNU compression utility.

CVEs:

nss

  • Author: voroskoi
  • Vulnerable: 3.11.3-2siwenna1
  • Unaffected: 3.11.3-3siwenna1

Two vulnerabilities have been reported in Network Security Services (NSS), which potentially can be exploited by malicious people to compromise a vulnerable system.

  1. An integer underflow error when processing SSLv2 server messages can be exploited to cause a heap-based buffer overflow via a certificate with a public key too small to encrypt the “Master Secret”.
  2. An integer underflow error when processing SSLv2 client master keys can be exploited to cause a stack-based buffer overflow via specially crafted parameters during an SSLv2 handshake. Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

CVEs: