[slackware-security] mc (SSA:2004-136-01)

From: Slackware Security Team (security_at_slackware.com)
Date: 05/17/04

  • Next message: Waldo Bastian: "KDE Security Advisory: URI Handler Vulnerabilities" 
    Date: Mon, 17 May 2004 02:27:55 -0700 (PDT)
To: slackware-security@slackware.com

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    [slackware-security] mc (SSA:2004-136-01)

    New mc packages are available for Slackware 9.0, 9.1, and -current to
    fix security issues that These could lead to a denial of service or the
    execution of arbitrary code as the user running mc.

    Sites that use mc should upgrade to the new mc package.

    More details about this issue may be found in the Common
    Vulnerabilities and Exposures (CVE) database:

      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0226
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0231
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0232

    Here are the details from the Slackware 9.1 ChangeLog:
    +--------------------------+
    Fri May 14 15:11:37 PDT 2004
    patches/packages/mc-4.6.0-i486-2.tgz: Patched to fix buffer overflow,
      format string, and temporary file creation vulnerabilities found by
      Andrew V. Samoilov and Pavel Roskin. These could lead to a denial of
      service or the execution of arbitrary code as the user running mc.
      For more details, see:
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0226
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0231
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0232
      (* Security fix *)
    +--------------------------+

    Where to find the new packages:
    +-----------------------------+

    Updated package for Slackware 9.0:
    ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/mc-4.6.0-i386-2.tgz

    Updated package for Slackware 9.1:
    ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/mc-4.6.0-i486-2.tgz

    Updated package for Slackware -current:
    ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/mc-4.6.0-i486-2.tgz

    MD5 signatures:
    +-------------+

    Slackware 9.0 package:
    e74a8dcdd90f2846e4bbac75a154ad39 mc-4.6.0-i386-2.tgz

    Slackware 9.1 package:
    ac580a4f3556aaae92be0fd754866a55 mc-4.6.0-i486-2.tgz

    Slackware -current package:
    ce9b9ab338ee114c5d9038e8420db1e7 mc-4.6.0-i486-2.tgz

    Installation instructions:
    +------------------------+

    Upgrade the mc package as root:
    # upgradepkg mc-4.6.0-i486-2.tgz

    +-----+

    Slackware Linux Security Team
    http://slackware.com/gpg-key
    security@slackware.com

    +------------------------------------------------------------------------+
    | To leave the slackware-security mailing list: |
    +------------------------------------------------------------------------+
    | Send an email to majordomo@slackware.com with this text in the body of |
    | the email message: |
    | |
    | unsubscribe slackware-security |
    | |
    | You will get a confirmation message back containing instructions to |
    | complete the process. Please do not reply to this email address. |
    +------------------------------------------------------------------------+

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.4 (GNU/Linux)

    iD8DBQFAqAviakRjwEAQIjMRAgJ1AJ9K2JdVaoRxaD94OJ4gwkFX2PQV0QCeObkG
    /gRKw+TO3RsJ89RRvb7jfcQ=
    =EuJI
    -----END PGP SIGNATURE-----

  • Next message: Waldo Bastian: "KDE Security Advisory: URI Handler Vulnerabilities"

    Relevant Pages

    • [slackware-security] kdelibs (SSA:2004-238-01)
      ... to fix security issues with URI handling. ... Here are the details from the Slackware 9.1 ChangeLog: ... Updated package for Slackware 9.0: ...
      (Bugtraq)
    • [slackware-security] lftp security update (SSA:2003-346-01)
      ... A security problem with lftp has been corrected with the release ... Here are the details from the Slackware 9.1 ChangeLog: ... this includes "security fixes in html ... WHERE TO FIND THE NEW PACKAGE: ...
      (Bugtraq)
    • [slackware-security] sysklogd update (SSA:2004-124-02)
      ... to fix a security issue where a user could cause syslogd to crash. ... Here are the details from the Slackware 9.1 ChangeLog: ... Updated package for Slackware 8.1: ...
      (Bugtraq)
    • [slackware-security] apache (SSA:2004-133-01)
      ... We recommend that sites running Apache upgrade ... Here are the details from the Slackware 9.1 ChangeLog: ... These security fixes were backported from Apache 1.3.31: ... Updated package for Slackware 8.1: ...
      (Bugtraq)
    • Re: machine
      ... You can use Slackware's package management system, ... installpkg - Install a Slackware package ... You can compile the program from the source. ... > install something, something else had to get uninstalled, ...
      (alt.os.linux)
    • Quantcast