Edgeos - New Vulnerabilities

DSA1592 DSA-1592-1 linux-2.6 - (Found June 29, 2008 )

Critical Risk -- Two vulnerabilities have been discovered in the Linux kernel that maylead to a denial of service or arbitrary code execution. The CommonVulnerabilities and Exposures project identifies the followingproblems: Wei Wang from McAfee reported a potential heap overflow in the ASN.1 decode code that is used by the SNMP NAT and CIFS subsystem. Exploitation of this issue may lead to arbitrary code execution. This issue is not believed to be exploitable with the pre-built..
http://www.edgeos.com/threats/33173

SuSE Security Update: Security update for X.org (xorg-x11-Xnest-5321) - (Found June 29, 2008 )

Critical Risk -- This update fixes multiple vulnerabilities reported byiDefense:- CVE-2008-2360 - RENDER Extension heap buffer overflow- CVE-2008-2361 - RENDER Extension crash- CVE-2008-2362 - RENDER Extension memory corruption - CVE-2008-1379 - MIT-SHM arbitrary memory read- CVE-2008-1377 - RECORD and Security extensions memory corruption
http://www.edgeos.com/threats/33164

SuSE Security Update: qemu: fixed CVE-2008-2004 (qemu-5270) - (Found June 29, 2008 )

Critical Risk -- Local attackers could use raw formatted disk images toaccess the hosting environment. CVE-2008-2004 has beenassigned to this issue.
http://www.edgeos.com/threats/33163

RHSA-2008-0522: perl - (Found June 29, 2008 )

Critical Risk -- Updated perl packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Perl is a high-level programming language commonly used for system administration utilities and Web programming. A flaw was found in Perl's regular expression engine. A specially crafted regular expression with Unicode characters could trigger a buffer overflow, ...
http://www.edgeos.com/threats/33155

RHSA-2008-0528: ucd - (Found June 29, 2008 )

Critical Risk -- Updated ucd-snmp packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Simple Network Management Protocol (SNMP) is a protocol used for network management. A flaw was found in the way ucd-snmp checked an SNMPv3 packet's Keyed-Hash Message Authentication Code (HMAC). An attacker could use this flaw to spoof an authenticated SNMPv3...
http://www.edgeos.com/threats/33156

RHSA-2008-0529: net - (Found June 29, 2008 )

Critical Risk -- Updated net-snmp packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Simple Network Management Protocol (SNMP) is a protocol used for network management. A flaw was found in the way Net-SNMP checked an SNMPv3 packet's Keyed-Hash Message Authentication Code (HMAC). An attacker could use this flaw to spoof an authenticated...
http://www.edgeos.com/threats/33157

SuSE Security Update: Security update for cups (cups-5201) - (Found June 29, 2008 )

Critical Risk -- - specially crafted PNG files could cause an integer overflow in the png filter (CVE-2008-1693).- specially crafted pdf files with embedded fonts could crash pdftops (CVE-2008-1693).
http://www.edgeos.com/threats/33158

SuSE Security Update: cups security update (cups-5202) - (Found June 29, 2008 )

Critical Risk -- - specially crafted PNG files could cause an integer overflow in the png filter (CVE-2008-1693).- specially crafted pdf files with embedded fonts could crash pdftops (CVE-2008-1693).
http://www.edgeos.com/threats/33159

SuSE Security Update: Security update for gstreamer010-plugins (gstreamer010-plugins-good-5185) - (Found June 29, 2008 )

Critical Risk -- Specially crafted files or streams could potentially beabused to trick applications that support speex intoexecuting arbitrary code (CVE-2008-1686).
http://www.edgeos.com/threats/33160

SuSE Security Update: gstreamer010-plugins-good security update (gstreamer010-plugins-good-5195) - (Found June 29, 2008 )

Critical Risk -- Specially crafted files or streams could potentially beabused to trick applications that support speex intoexecuting arbitrary code (CVE-2008-1686).
http://www.edgeos.com/threats/33161