This is a list of security announcments that have been released for the current stable version of Frugalware
OpenSSL 0.9.8i and earlier does not properly check the return value from the EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys.
Some vulnerabilities have been reported in Ruby on Rails, which can be exploited by malicious people to conduct SQL injection attacks. The vulnerabilities are caused due to Active Record not properly sanitising the “:offset” and “:limit” parameters before using them in SQL queries. This can be exploited to manipulate SQL queries by injecting SQL code.
Some vulnerabilities have been reported in Mozilla Thunderbird, which can be exploited by malicious people to disclose sensitive information, bypass certain security restrictions, or compromise a user’s system.
This fixes an SQL injection, see http://www.milw0rm.com/exploits/7382 for more info.
Some vulnerabilities have been reported in Drupal, which can be exploited by malicious people to conduct cross-site request forgery and cross-site scripting attacks.
The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain operations (e.g. execute old updates) when a logged-in superuser visits a malicious web site.
Some vulnerabilities have been reported in Drupal 6, which can be exploited by malicious people to conduct cross-site request forgery and cross-site scripting attacks. For more info, see FSA560.
This is a minor security release that adds another check to the XSS filter for an Internet Explorer exploit and fixes unescaped output in the test.php scripts. All users are encouraged to upgrade to this version. In addition all users are encouraged to disable test.php in production, per the install documentation.
Some vulnerabilities have been reported in the Linux kernel, which potentially can be exploited by malicious people to compromise a vulnerable system.
Two vulnerabilities have been reported in Wireshark, which can be exploited by malicious people to cause a DoS (Denial of Service).
Jeremias Reith has reported a vulnerability in WordPress, which can be exploited by malicious people to conduct script insertion attacks. Input passed via the HTTP “Host” header is not properly sanitised before being used. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site if malicious data is viewed. Note: Reportedly, this only affects IP-based virtual servers running on Apache 2.x.
