Frugalware Security Announcements (FSAs)

This is a list of security announcments that have been released for the current stable version of Frugalware

libxfont

  • Author: kikadf
  • Vulnerable: 1.4.5-2arcturus2
  • Unaffected: 1.4.5-2arcturus3

Integer overflow of allocations in font metadata file parsing could allow a local user who is already authenticated to the X server to overwrite other memory in the heap. Libxfont does not validate length fields when parsing xfs protocol replies allowing to write past the bounds of allocated memory when storing the returned data from the font server. Integer overflows calculating memory needs for xfs replies could result in allocating too little memory and then writing the returned data from the font server past the end of the allocated buffer.

libtiff

  • Author: kikadf
  • Vulnerable: 3.9.5-1
  • Unaffected: 3.9.5-2arcturus1

It was discovered that LibTIFF incorrectly handled certain malformed images when using the gif2tiff tool. If a user or automated system were tricked into opening a specially crafted GIF image, a remote attacker could crash the application, leading to a denial of service, or possibly execute arbitrary code with user privileges.

CVEs:

openssl

  • Author: kikadf
  • Vulnerable: 1.0.1-5arcturus3
  • Unaffected: 1.0.1-5arcturus4

It was discovered that OpenSSL incorrectly handled memory in the do_ssl3_write() function. A remote attacker could use this issue to possibly cause OpenSSL to crash, resulting in a denial of service.

CVEs:

drupal6

  • Author: kikadf
  • Vulnerable: 6.30-1arcturus1
  • Unaffected: 6.31-1arcturus1

An information disclosure vulnerability was discovered in Drupal, a fully-featured content management framework. When pages are cached for anonymous users, form state may leak between anonymous users. Sensitive or private information recorded for one anonymous user could thus be disclosed to other users interacting with the same form at the same time.

CVEs:

drupal7

  • Author: kikadf
  • Vulnerable: 7.22-2arcturus1
  • Unaffected: 7.22-2arcturus2

An information disclosure vulnerability was discovered in Drupal, a fully-featured content management framework. When pages are cached for anonymous users, form state may leak between anonymous users. Sensitive or private information recorded for one anonymous user could thus be disclosed to other users interacting with the same form at the same time.

CVEs: