[CLA-2005:942] Conectiva Security Announcement - ethereal

From: Conectiva Updates (secure_at_conectiva.com.br)
Date: 03/28/05

Next message: Sune Kloppenborg Jeppesen: "[ GLSA 200503-34 ] mpg321: Format string vulnerability"

Previous message: iDEFENSE Labs: "iDEFENSE Security Advisory 03.28.05: Multiple Telnet Client slc_add_reply() Buffer Overflow Vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Mon, 28 Mar 2005 13:56:33 -0300
To: conectiva-updates@papaleguas.conectiva.com.br, lwn@lwn.net, bugtraq@securityfocus.com, security-alerts@linuxsecurity.com, linsec@lists.seifried.org

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------

PACKAGE : ethereal
SUMMARY : Fixes for security vulnerabilities in ethereal
DATE : 2005-03-28 13:52:00
ID : CLA-2005:942
RELEVANT
RELEASES : 9, 10

- -------------------------------------------------------------------------

DESCRIPTION
Ethereal[1] is a powerful network traffic analyzer with a graphical
user interface (GUI).

This update fixes several vulnerabilities[2,3] in ethereal:

CAN-2005-0006[4]: The COPS dissector could go into an infinite loop.

CAN-2005-0007[5]: The DLSw dissector could cause an assertion, making
Ethereal exit prematurely.

CAN-2005-0008[6]: The DNP dissector could cause memory corruption.

CAN-2005-0009[7]: The Gnutella dissector could cause an assertion,
making Ethereal exit prematurely.

CAN-2005-0010[8]: The MMSE dissector could free static memory.

CAN-2005-0084[9]: The X11 protocol dissector is vulnerable to a
string buffer overflow.

CAN-2005-0699[10]: Diego Giago discovered a buffer overflow in the
3GPP2 A11 dissector.

CAN-2005-0704[11]: Matevz Pustisek discovered a buffer overflow in
the Etheric dissector.

CAN-2005-0705[12]: The GPRS-LLC dissector could crash if the "ignore
cipher bit" option was enabled.

CAN-2005-0739[13]: Leon Juranic discovered a buffer overflow in the
IAPP dissector.

Also, it fixes other two issues: a bug in the JXTA and sFlow
dissectors that could make Ethereal crash.

ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:

- run: apt-get update
- after that, execute: apt-get upgrade

Detailed instructions regarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
Copyright (c) 2004 Conectiva Inc.
http://www.conectiva.com

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQFCSDc/42jd0JmAcZARAtT2AJ9CfAnH48ketSlgLrjR/iKLyPdoWACg1rXe
eI8d4mT9sAyuc3Im4fqCwyI=
=tztA
-----END PGP SIGNATURE-----

Next message: Sune Kloppenborg Jeppesen: "[ GLSA 200503-34 ] mpg321: Format string vulnerability"

Previous message: iDEFENSE Labs: "iDEFENSE Security Advisory 03.28.05: Multiple Telnet Client slc_add_reply() Buffer Overflow Vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

[CLA-2004:882] Conectiva Security Announcement - squid
... SUMMARY: Fixes for squid vulnerabilities ... This announcement fixes a denial of service vulnerabilityin squid ... UPDATED PACKAGES ... Detailed instructions regarding the use of apt and upgrade examples ...
(Bugtraq)
[CLA-2004:821] Conectiva Security Announcement - XFree86
... Greg MacManus from iDEFENSE Labs discoveredtwo vulnerabilities ... in the way the X server deals with font files. ... It is recommended that all XFree86 users upgrade their packages. ... Detailed instructions regarding the use of apt and upgrade examples ...
(Bugtraq)
[CLA-2002:519] Conectiva Linux Security Announcement - kde
... X.509 certificate check vulnerability and other fixes ... This is a full update of the KDE desktop to the 3.0.3 version, ... It is recommended that all KDE users upgrade their packages. ... Detailed instructions reagarding the use of apt and upgrade examples ...
(Bugtraq)
[CLA-2004:847] Conectiva Security Announcement - php4
... Remote arbitrary code execution vulnerabilities and other ... It is recommended that all PHP users upgrade their packages. ... Detailed instructions regarding the use of apt and upgrade examples ...
(Bugtraq)
[CLA-2005:917] Conectiva Security Announcement - krb5
... It is recommended that all Kerberos users in Conectiva Linux upgrade ... UPDATED PACKAGES ... Detailed instructions regarding the use of apt and upgrade examples ...
(Bugtraq)