Another vulnerability has been discovered in the CGI library (cgi.rb) that ships with Ruby which could be used by a malicious user to create a denial of service attack (DoS).

Updated packages have been patched to correct this issue.

Buffer overflow in the asmrp_eval function for the Real Media input plugin allows remote attackers to cause a denial of service and possibly execute arbitrary code via a rulebook with a large number of rulematches.

Updated packages have been patched to correct this issue.

Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv 3.6.2, and possibly earlier versions, allows user-assisted attackers to execute arbitrary code via a PostScript (PS) file with certain headers that contain long comments, as demonstrated using the DocumentMedia header.

Packages have been patched to correct this issue.

Update:

The patch used in the previous update still left the possibility of causing X to consume unusual amounts of memory if gv is used to view a carefully crafted image designed to exploit CVE-2006-5864. This update uses an improved patch to address this issue.

Multiple buffer overflows in Imagemagick 6.0 before 6.0.6.2, and 6.2 before 6.2.4.5, has unknown impact and user-assisted attack vectors via a crafted SGI image.

Updated packages have been patched to correct this issue.

An integer overflow was discovered in KOffice's filtering code. By tricking a user into opening a specially crafted PPT file, attackers could crash KOffice or possibly execute arbitrary code with the user's privileges.

The updated packages have been patched to correct this issue.

There are no known security issues with clamav-0.88.5, which was included in the last update (MDKSA-2006:184). Upstream has released a new stable 0.88.6, with some bugfixes. This update is to address user reports with regards to clamav's behavior of producing output such as:

WARNING: Your ClamAV installation is OUTDATED! WARNING: Current functionality level = 9, recommended = 10 DON'T PANIC! Read http://www.clamav.net/faq.html

If one is not running the latest release.

Buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages that cause the make_printable_string function to return a longer string than expected while constructing a prompt.

Updated packages have been patched to correct this issue.

"infamous41md" discovered a heap buffer overflow vulnerability in libgsf, a GNOME library for reading and writing structured file formats, which could lead to the execution of arbitrary code.

The updated packages have been patched to correct this problem.

A stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier, allows remote attackers to cause a denial of service, as demonstrated by vd_proftpd.pm, a "ProFTPD remote exploit." (CVE-2006-5815)

Buffer overflow in the tls_x509_name_oneline function in the mod_tls module, as used in ProFTPD 1.3.0a and earlier, and possibly other products, allows remote attackers to execute arbitrary code via a large data length argument, a different vulnerability than CVE-2006-5815. (CVE-2006-6170)

ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow. NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an error stemming from an initial vague disclosure. NOTE: ProFTPD developers dispute this issue, saying that the relevant memory location is overwritten by assignment before further use within the affected function, so this is not a vulnerability. (CVE-2006-6171)

Packages have been patched to correct these issues.

Update:

The previous update incorrectly linked the vd_proftd.pm issue with the CommandBufferSize issue. These are two distinct issues and the previous update only addressed CommandBufferSize (CVE-2006-6171), and the mod_tls issue (CVE-2006-6170).

Several bugs were fixed in drakxtools:

• it was not possible to start rpmdrake from the menu (#26383) - it was

not possible to set up updates media and then distro media (or the reverse) in edit-urpm-sources - drakauth: o add encrypted home and pam_mount support o hide password when calling "net join" or "net ads join" (pixel) - drakbackup: o fix archiver detection/config file replace (stew, #26705, #27180) o do not backup the backups (Adamw) - drakboot: support Xen with lilo using mbootpack - drakfirewall: really disable services (#27295) - drakvpn: o add pkcs11 token support for openvpn o ask password/PIN if needed - drakconnect/drakroam: o detect wireless interfaces with unknown driver, e.g. rt61 o do not check for ipw3945 kernel module packages o do not wrongly tell that acx100-firmware can be found in Club or commercial editions (#26475) o use iwpriv commands to configure WPA on rt2570 and rt61 chipsets o update madwifi URL which was old - finish-install: add encrypted home and pam_mount support - printerdrake: due to changes in the format of HPLIP's device description XML files, scanner functionality was not recognized any more (#26567).