-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
________________________________________________________________________
Linux-Mandrake Security Update Advisory
________________________________________________________________________
Package name: Zope
Date: July 28th, 2000
Advisory ID: MDKSA-2000:026
Affected versions: 7.1
________________________________________________________________________
Problem Description:
Previous versions of Zope have a serious security flaw in one of the
base classes in the DocumentTemplate package that is inadequately
protected. This flaw allows the contents of DHTML Documents or DHTML
Methods to be changed remotely or through DHTML code without forcing
proper user authorization.
________________________________________________________________________
Please verify these md5 checksums of the updates prior to upgrading to
ensure the integrity of the downloaded package. You can do this by
running the md5sum program on the downloaded package by using
"md5sum package.rpm".
Linux-Mandrake 7.1:
ad28fb2fb4f0105639a641a7acc98821
7.1/RPMS/Zope-2.1.6-1mdk.i586.rpm
e2b8fd281a2e93cbf5221bcfd3aff65b
7.1/RPMS/Zope-components-2.1.6-1mdk.i586.rpm
ea50788d6f88abc99bfabb190f2ab3ce
7.1/RPMS/Zope-core-2.1.6-1mdk.i586.rpm
95b993149c1c97fe7c9e9d53e4923f31
7.1/RPMS/Zope-pcgi-2.1.6-1mdk.i586.rpm
e74684a03fc61784bfdaec2887e82064
7.1/RPMS/Zope-services-2.1.6-1mdk.i586.rpm
1cae17ae5ffe776a073255ce4cec9661
7.1/RPMS/Zope-zpublisher-2.1.6-1mdk.i586.rpm
7fa38fbf43c8b08a26c4694a0a93857a
7.1/RPMS/Zope-zserver-2.1.6-1mdk.i586.rpm
983471606b95bd60c9d8a5e00e53d90b
7.1/RPMS/Zope-ztemplates-2.1.6-1mdk.i586.rpm
33b2e53429e3b6f588b9fdfb1ab5dc95
7.1/SRPMS/Zope-2.1.6-1mdk.src.rpm
________________________________________________________________________
To upgrade automatically, use « MandrakeUpdate ».
If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and uprade with "rpm -Uvh package_name".
You can download the updates directly from:
ftp://ftp.linux.tucows.com/pub/distributions/Mandrake/Mandrake/updates
ftp://ftp.free.fr/pub/Distributions_Linux/Mandrake/updates
Or try one of the other mirrors listed at:
http://www.linux-mandrake.com/en/ftp.php3.
Updated packages are available in the "updates/[ver]/RPMS/" directory.
For example, if you are looking for an updated RPM package for
Linux-Mandrake 7.1, look for it in "updates/7.1/RPMS/". Updated
source
RPMs are available as well, but you generally do not need to download
them.
Please be aware that sometimes it takes the mirrors a few hours to
update, so if you want an immediate upgrade, please use one of the two
above-listed mirrors.
You can view other security advisories for Linux-Mandrake at:
http://www.linux-mandrake.com/en/fupdates.php3
If you want to report vulnerabilities, please contact
security@linux-mandrake.com
________________________________________________________________________
Linux-Mandrake has two security-related mailing list services that
anyone can subscribe to:
security-announce@linux-mandrake.com
Linux-Mandrake's security announcements mailing list. Only
announcements are sent to this list and it is read-only.
security-discuss@linux-mandrake.com
Linux-Mandrake's security discussion mailing list. This list is open
to anyone to discuss Linux-Mandrake security specifically and Linux
security in general.
To subscribe to either list, send a message to
sympa@linux-mandrake.com
with "subscribe [listname]" in the body of the message.
To remove yourself from either list, send a message to
sympa@linux-mandrake.com
with "unsubscribe [listname]" in the body of the message.
To get more information on either list, send a message to
sympa@linux-mandrake.com
with "info [listname]" in the body of the message.
Optionally, you can use the web interface to subscribe to or unsubscribe
from either list:
http://www.linux-mandrake.com/en/flists.php3#security
________________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
<security@linux-mandrake.com>
- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: For info see http://www.gnupg.org
mQGiBDlp594RBAC2tDozI3ZgQsE7XwxurJCJrX0L5vx7SDByR5GHDdWekGhdiday
L4nfUax+SeR9SCoCgTgPW1xB8vtQc8/sinJlMjp9197a2iKM0FOcPlkpa3HcOdt7
WKJqQhlMrHvRcsivzcgqjH44GBBJIT6sygUF8k0lU6YnMHj5MPc/NGWt8wCg9vKo
P0l5QVAFSsHtqcU9W8cc7wMEAJzQsAlnvPXDBfBLEH6u7ptWFdp0GvbSuG2wRaPl
hynHvRiE01ZvwbJZXsPsKm1z7uVoW+NknKLunWKB5axrNXDHxCYJBzY3jTeFjsqx
PFZkIEAQphLTkeXXelAjQ5u9tEshPswEtMvJvUgNiAfbzHfPYmq8D6x5xOw1IySg
2e/LBACxr2UJYCCB2BZ3p508mAB0RpuLGukq+7UWiOizy+kSskIBg2O7sQkVY/Cs
iyGEo4XvXqZFMY39RBdfm2GY+WB/5NFiTOYJRKjfprP6K1YbtsmctsX8dG+foKsD
LLFs7OuVfaydLQYp1iiN6D+LJDSMPM8/LCWzZsgr9EKJ8NXiyrQ6TGludXggTWFu
ZHJha2UgU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAbGludXgtbWFuZHJha2UuY29t
PohWBBMRAgAWBQI5aefeBAsKBAMDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmK6LAKCy
/NInDsaMSI+WHwrquwC5PZrcnQCeI+v3gUDsNfQfiKBvQSANu1hdulq5AQ0EOWnn
7xAEAOQlTVY4TiNo5V/iP0J1xnqjqlqZsU7yEBKo/gZz6/+hx75RURe1ebiJ9F77
9FQbpJ9Epz1KLSXvq974rnVb813zuGdmgFyk+ryA/rTR2RQ8h+EoNkwmATzRxBXV
Jb57fFQjxOu4eNjZAtfII/YXb0uyXXrdr5dlJ/3eXrcO4p0XAAMFBACCxo6Z269s
+A4v8C6Ui12aarOQcCDlV8cVG9LkyatU3FNTlnasqwo6EkaP572448weJWwN6SCX
Vl+xOYLiK0hL/6Jb/O9Agw75yUVdk+RMM2I4fNEi+y4hmfMh2siBv8yEkEvZjTcl
3TpkTfzYky85tu433wmKaLFOv0WjBFSikohGBBgRAgAGBQI5aefvAAoJEJqo0NAi
RYqYid0AoJgeWzXrEdIClBOSW5Q6FzqJJyaqAKC0Y9YI3UFlE4zSIGjcFlLJEJGX
lA==WxWn
- -----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE5gbV9mqjQ0CJFipgRAp/1AKDHpqrVCqAeKjGypIxARy6ZZtYYEQCdED1d
xRYAKcMqZ7qqA0XVI/KPnx8=H/4e
-----END PGP SIGNATURE-----
From mail@mail.redhat.com Jul 11:08:56 2000 -0400
Received: (qmail 28295 invoked from network); 31 Jul 2000 15:08:56 -0000
Received: from mail.redhat.com (199.183.24.239)
by lists.redhat.com with SMTP; 31 Jul 2000 15:08:56 -0000
Received: from lacrosse.corp.redhat.com (root@lacrosse.corp.redhat.com
[207.175.42.154])
by mail.redhat.com (8.8.7/8.8.7) with ESMTP id LAA06863;
Mon, 31 Jul 2000 11:08:56 -0400
Received: from localhost (porkchop.redhat.com [207.175.42.68])
by lacrosse.corp.redhat.com (8.9.3/8.9.3) with SMTP id LAA03656;
Mon, 31 Jul 2000 11:08:55 -0400
Message-Id: <200007311508.LAA03656@lacrosse.corp.redhat.com>
Subject: [RHSA-2000:046-02] New netscape packages available to fix JPEG problem
Content-transfer-encoding: 8bit
Approved: ewt@redhat.com
To: redhat-watch-list@redhat.com
From: bugzilla@redhat.com
Cc: bugtraq@securityfocus.com, linux-security@redhat.com
Content-type: text/plain; charset="iso-8859-1"
Mime-version: 1.0
Date: Mon, 31 Jul 2000 11:08 -0400
---------------------------------------------------------------------
Red Hat, Inc. Security Advisory
Synopsis: New netscape packages available to fix JPEG problem
Advisory ID: RHSA-2000:046-02
Issue date: 2000-07-28
Updated on: 2000-07-28
Product: Red Hat Linux
Keywords: netscpae JPEG
Cross references: N/A
---------------------------------------------------------------------
1. Topic:
New netscape packages are available that fix a potential
overflow due to improper input verification in netscape's JPEG
processing code. It is recommended that users of netscape update
to the fixed packages. Users of Red Hat Linux 6.0 and 6.1
should use the packages for Red Hat Linux 6.2.
2. Relevant releases/architectures:
Red Hat Linux 5.2 - i386
Red Hat Linux 6.0 - i386
Red Hat Linux 6.1 - i386
Red Hat Linux 6.2 - i386, alpha
3. Problem description:
Netscape's processing of JPEG comments trusted the length parameter
for comment fields; by manipulating this value, it would be possible
to cause netscape to read in an excessive amount of data, overwriting
memory. Specially designed data could allow a remote site to execute
arbitrary code as the user of netscape.
This vulnerability is fixed in Netscape 4.74.
4. Solution:
For each RPM for your particular architecture, run:
rpm -Fvh [filename]
where filename is the name of the RPM.
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):
10165 - Netscape mail client does not compact folders anymore
13695 - Small glitch in German translation
14506 - Upgrade of netscape-common fails
14657 - /usr/lib/netscape/de_DE: cpio: unlinkfailed
6. RPMs required:
Red Hat Linux 5.2:
i386:
ftp://updates.redhat.com/5.2/i386/netscape-common-4.74-0.5.2.i386.rpm
ftp://updates.redhat.com/5.2/i386/netscape-communicator-4.74-0.5.2.i386.rpm
ftp://updates.redhat.com/5.2/i386/netscape-navigator-4.74-0.5.2.i386.rpm
sources:
ftp://updates.redhat.com/5.2/SRPMS/netscape-4.74-0.5.2.src.rpm
Red Hat Linux 6.2:
alpha:
ftp://updates.redhat.com/6.2/alpha/netscape-common-4.74-1.alpha.rpm
ftp://updates.redhat.com/6.2/alpha/netscape-communicator-4.74-1.alpha.rpm
ftp://updates.redhat.com/6.2/alpha/netscape-navigator-4.74-1.alpha.rpm
i386:
ftp://updates.redhat.com/6.2/i386/netscape-common-4.74-0.6.2.i386.rpm
ftp://updates.redhat.com/6.2/i386/netscape-communicator-4.74-0.6.2.i386.rpm
ftp://updates.redhat.com/6.2/i386/netscape-navigator-4.74-0.6.2.i386.rpm
sources:
ftp://updates.redhat.com/6.2/SRPMS/netscape-alpha-4.74-1.src.rpm
ftp://updates.redhat.com/6.2/SRPMS/netscape-4.74-0.6.2.src.rpm
7. Verification:
MD5 sum Package Name
--------------------------------------------------------------------------
2520f9f234010f483d14ec524898ad29 5.2/SRPMS/netscape-4.74-0.5.2.src.rpm
2dd30f35857c05304e54253e7564634b 5.2/i386/netscape-common-4.74-0.5.2.i386.rpm
765fc5c8be9638560544379a3c7e1004
5.2/i386/netscape-communicator-4.74-0.5.2.i386.rpm
d6ecb766f5d979e2787f239fefcce8fd
5.2/i386/netscape-navigator-4.74-0.5.2.i386.rpm
64999688cbd3b6be723c72d94dcb0f72 6.2/SRPMS/netscape-4.74-0.6.2.src.rpm
e75ad6a500fa4ac0ef919f65aa8871bd 6.2/SRPMS/netscape-alpha-4.74-1.src.rpm
2796178bd0f400800d1fb5fccd39880b 6.2/alpha/netscape-common-4.74-1.alpha.rpm
2f2260eb8030751838f9d14a4eca71ae
6.2/alpha/netscape-communicator-4.74-1.alpha.rpm
db641b2f9b63c3f986dece1ecc482d32 6.2/alpha/netscape-navigator-4.74-1.alpha.rpm
2f2f1be58b481030eb2da12dcd9a6a54 6.2/i386/netscape-common-4.74-0.6.2.i386.rpm
6b2045ecf408024a64962705c6395a1f
6.2/i386/netscape-communicator-4.74-0.6.2.i386.rpm
03b93972ba0f114d4be9ef50a2a21fa5
6.2/i386/netscape-navigator-4.74-0.6.2.i386.rpm
These packages are GPG signed by Red Hat, Inc. for security. Our key
is available at:
http://www.redhat.com/corp/contact.html
You can verify each package with the following command:
rpm --checksig <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
rpm --checksig --nogpg <filename>
8. References:
http://www.securityfocus.com/vdb/bottom.html?vid=15
Copyright(c) 2000 Red Hat, Inc.
