| Description: | Description:
The remote host is missing updates announced in
advisory TSLSA-2006-0061.
mutt < TSL 3.0 > < TSL 2.2 > < TSEL 2 >
- SECURITY Fix: A race condition in the safe_open function, when
creating temporary files in an NFS filesystem, allows local users
to overwrite arbitrary files due to limitations of the use of the
O_EXCL flag on NFS filesystems.
- The mutt_adv_mktemp function does not properly verify that temporary
files that have been created with restricted permissions, which might
allow local users to create files with weak permissions via a race
condition between the mktemp and safe_fopen function calls.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CVE-2006-5297 and CVE-2006-5298 to these issue.
pam_ldap < TSL 3.0 > < TSL 2.2 >
- New upstream.
- SECURITY Fix: Steve Rigler has reported a security issue which
can be exploited by malicious people to bypass certain security
restrictions. The issue is caused due to an error within the
handling of PasswordPolicyResponse control messages when
authenticating against an LDAP server. This causes the
pam_authenticate() function to always succeed, even if the
previous authentication failed.
The common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CVE-2006-5170 to this issue.
php < TSL 3.0 > < TSL 2.2 >
- New Upstream.
- SECURITY Fix: Some vulnerabilities have been reported in PHP,
caused due to boundary errors within the htmlentities() and
htmlspecialchars() functions. If a PHP application uses these
functions to process user-supplied input, this can be exploited
to cause buffer overflows by passing specially crafted data to
the affected application.
The Common Vulnerabilities and Exposures project has assigned the
name CVE-2006-5465 to this issue.
- Added support for mcrypt, Bug #1956.
- Added support for pdo-sqlite, pdo-mysql and sqlite, Bug #1959.
- Included openssl support, Bug #1958.
- Added buildrequires expat-devel and fontconfig-devel, Bug #2011.
Solution:
Update your system with the packages as indicated in
the referenced security advisory.
http://www.securityspace.com/smysecure/catid.html?in=TSLSA-2006-0061
Risk factor : High
CVSS Score:
7.5
|
