rhsa-2003:066
Vulnerability from csaf_redhat
Published
2003-06-25 15:52
Modified
2024-11-21 22:40
Summary
Red Hat Security Advisory: : Updated XFree86 packages provide security and bug fixes

Notes

Topic
XFree86 is an implementation of the X Window System providing the core graphical user interface and video drivers. Updated XFree86 packages for Red Hat Linux 7.3 are now available which include several security fixes, bug fixes, enhancements, and driver updates.
Details
Security fixes: - Xterm, provides an escape sequence for reporting the current window title. This escape sequence takes the current title and places it directly on the command line. An attacker can craft an escape sequence that sets the victim's Xterm window title to an arbitrary command, and then reports it to the command line. Since it is not possible to embed a carriage return into the window title, the attacker would then have to convince the victim to press Enter for the shell to process the title as a command, although the attacker could craft other escape sequences that might convince the victim to do so. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0063 to this issue. - It is possible to lock up versions of Xterm by sending an invalid DEC UDK escape sequence. (CAN-2003-0071) - XFree86 4.2.1 also contains an updated fix for CAN-2002-0164, a vulnerability in the MIT-SHM extension of the X server that allows local users to read and write arbitrary shared memory. The original fix did not cover the case where the X server is started from xdm. - The X server was setting the /dev/dri directory permissions incorrectly, which resulted in the directory being world writable. (CAN-2001-1409) Driver updates and additions: - Savage driver updated to Tim Roberts' latest version 1.1.27t - New "cyrix" driver which works better on MediaGX hardware. - New input drivers for Fujitsu Stylistic (fpit), Palmax PD1000/PD1100 Input driver (palmax), Union Reality UR-98 head tracker (ur98) - Backported apm driver, DPMS support enhancements, and a few accel fixes - Backported chips driver, with hardware mouse cursor and 2D acceleration fixes - Backported cirrus, i740, siliconmotion, and ark drivers Various bug fixes and enhancements: - Stability improvements to RENDER extension and libraries - Various fixes to the Xaw library - Fix a long standing problem in the X server where the mouse, keyboard, or video would hang, or the server to go into an endless loop whenever the system time was changed backwards - Fix a crash in the Radeon and Rage 128 drivers using VMware with DGA when DRI is enabled - Work around some multihead and RENDER exention problems in the Matrox "mga" driver - fc-cache is now run upon font package installation in all font directories containing fonts managed by fontconfig/Xft - mkfontdir now forces the permissions of the files it generates to be mode 0644 to ensure they are world readable independant of umask - A new option "ForceLegacyCRT" to the radeon driver allows use of legacy VGA monitors which can not be detected automatically. This option is only safe to use in single-head setups and may cause serious problems if used with dual-head. - xterm session management is now enabled by default, whereas the stock XFree86 default in 4.2.0/4.2.1 was accidentally disabled upstream - Removed and obsoleted the XFree86-xtrap-clients package, now merged into the main XFree86 package - Added support for previously unsupported ATI Rage 128 video hardware - Fixed Polish euro support - Added neomagic Xvideo support which may work for some users - Added fix for deadkey-quotedbl in ISO8859-15 - Disabled debug messages in Cirrus Logic driver - Fixed a bug in the VESA driver, where the X server would crash with an FPE when the DisplaySize option was used - Fix to ATI Mach64 support which was out of PCI specs causing problems on some Dell and IBM servers - Fix a problem which caused certain combinations of Radeon and Rage 128 hardware and particular motherboards to hang, due to bus mastering getting disabled when VT switching. There are various other fixes included which users can review by examining the RPM package changelog of any of the new XFree86 packages. Users are advised to upgrade to these updated XFree86 4.2.1 packages, which are not vulnerable to the previously mentioned security issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "XFree86 is an implementation of the X Window System providing the\ncore graphical user interface and video drivers.\n\nUpdated XFree86 packages for Red Hat Linux 7.3 are now available which\ninclude several security fixes, bug fixes, enhancements, and driver updates.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Security fixes:\n\n- Xterm, provides an escape sequence for reporting the current window\ntitle. This escape sequence takes the current title and places it directly\non the command line. An attacker can craft an escape sequence that sets the\nvictim\u0027s Xterm window title to an arbitrary command, and then reports it to\nthe command line. Since it is not possible to embed a carriage return into\nthe window title, the attacker would then have to convince the victim to\npress Enter for the shell to process the title as a command, although the\nattacker could craft other escape sequences that might convince the victim\nto do so. The Common Vulnerabilities and Exposures project (cve.mitre.org)\nhas assigned the name CAN-2003-0063 to this issue.\n\n- It is possible to lock up versions of Xterm by sending an invalid DEC\nUDK escape sequence. (CAN-2003-0071)\n\n- XFree86 4.2.1 also contains an updated fix for CAN-2002-0164, a\nvulnerability in the MIT-SHM extension of the X server that allows local\nusers to read and write arbitrary shared memory. The original fix did not\ncover the case where the X server is started from xdm.\n\n- The X server was setting the /dev/dri directory permissions incorrectly,\nwhich resulted in the directory being world writable. (CAN-2001-1409)\n\nDriver updates and additions:\n\n- Savage driver updated to Tim Roberts\u0027 latest version 1.1.27t\n\n- New \"cyrix\" driver which works better on MediaGX hardware.\n\n- New input drivers for Fujitsu Stylistic (fpit), Palmax   \n  PD1000/PD1100 Input driver (palmax), Union Reality UR-98 head tracker   \n  (ur98)\n\n- Backported apm driver, DPMS support enhancements, and a few accel fixes\n\n- Backported chips driver, with hardware mouse cursor and 2D acceleration \n  fixes\n\n- Backported cirrus, i740, siliconmotion, and ark drivers\n\nVarious bug fixes and enhancements:\n\n- Stability improvements to RENDER extension and libraries\n\n- Various fixes to the Xaw library\n\n- Fix a long standing problem in the X server where the mouse, keyboard, or  \n  video would hang, or the server to go into an endless loop whenever the  \n  system time was changed backwards\n\n- Fix a crash in the Radeon and Rage 128 drivers using VMware with DGA \n  when DRI is enabled\n\n- Work around some multihead and RENDER exention problems in the Matrox \n  \"mga\" driver\n\n- fc-cache is now run upon font package installation in all font\n  directories containing fonts managed by fontconfig/Xft\n\n- mkfontdir now forces the permissions of the files it generates to be mode \n  0644 to ensure they are world readable independant of umask\n\n- A new option \"ForceLegacyCRT\" to the radeon driver allows use \n  of legacy VGA monitors which can not be detected automatically.  This \n  option is only safe to use in single-head setups and may cause serious \n  problems if used with dual-head.\n\n- xterm session management is now enabled by default, whereas the stock\n  XFree86 default in 4.2.0/4.2.1 was accidentally disabled upstream\n\n- Removed and obsoleted the XFree86-xtrap-clients package, now merged\n  into the main XFree86 package\n\n- Added support for previously unsupported ATI Rage 128 video hardware\n\n- Fixed Polish euro support\n\n- Added neomagic Xvideo support which may work for some users\n\n- Added fix for deadkey-quotedbl in ISO8859-15\n\n- Disabled debug messages in Cirrus Logic driver\n\n- Fixed a bug in the VESA driver, where the X server would crash with\n  an FPE when the DisplaySize option was used\n\n- Fix to ATI Mach64 support which was out of PCI specs causing problems  \n  on some Dell and IBM servers\n\n- Fix a problem which caused certain combinations of Radeon and Rage 128\n  hardware and particular motherboards to hang, due to bus mastering\n  getting disabled when VT switching.\n\nThere are various other fixes included which users can review by examining\nthe RPM package changelog of any of the new XFree86 packages.\n\nUsers are advised to upgrade to these updated XFree86 4.2.1 packages, which\nare not vulnerable to the previously mentioned security issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2003:066",
        "url": "https://access.redhat.com/errata/RHSA-2003:066"
      },
      {
        "category": "external",
        "summary": "40729",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=40729"
      },
      {
        "category": "external",
        "summary": "50282",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=50282"
      },
      {
        "category": "external",
        "summary": "53231",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=53231"
      },
      {
        "category": "external",
        "summary": "53329",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=53329"
      },
      {
        "category": "external",
        "summary": "58188",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=58188"
      },
      {
        "category": "external",
        "summary": "60895",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=60895"
      },
      {
        "category": "external",
        "summary": "62171",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=62171"
      },
      {
        "category": "external",
        "summary": "62442",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=62442"
      },
      {
        "category": "external",
        "summary": "62820",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=62820"
      },
      {
        "category": "external",
        "summary": "63593",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=63593"
      },
      {
        "category": "external",
        "summary": "63609",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=63609"
      },
      {
        "category": "external",
        "summary": "64559",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=64559"
      },
      {
        "category": "external",
        "summary": "64970",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=64970"
      },
      {
        "category": "external",
        "summary": "65136",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=65136"
      },
      {
        "category": "external",
        "summary": "65330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=65330"
      },
      {
        "category": "external",
        "summary": "65704",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=65704"
      },
      {
        "category": "external",
        "summary": "69743",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=69743"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_066.json"
      }
    ],
    "title": "Red Hat Security Advisory: : Updated XFree86 packages provide security and bug fixes",
    "tracking": {
      "current_release_date": "2024-11-21T22:40:05+00:00",
      "generator": {
        "date": "2024-11-21T22:40:05+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2003:066",
      "initial_release_date": "2003-06-25T15:52:00+00:00",
      "revision_history": [
        {
          "date": "2003-06-25T15:52:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2003-06-25T00:00:00+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-21T22:40:05+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Linux 7.3",
                "product": {
                  "name": "Red Hat Linux 7.3",
                  "product_id": "Red Hat Linux 7.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:linux:7.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2001-1409",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616706"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "dexconf in XFree86 Xserver 4.1.0-2 creates the /dev/dri directory with insecure permissions (666), which allows local users to replace or create files in the root file system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2001-1409"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616706",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616706"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2001-1409",
          "url": "https://www.cve.org/CVERecord?id=CVE-2001-1409"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409"
        }
      ],
      "release_date": "2001-08-28T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-06-25T15:52:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2003:066"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-0164",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616747"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Vulnerability in the MIT-SHM extension of the X server on Linux (XFree86) 4.2.1 and earlier allows local users to read and write arbitrary shared memory, possibly to cause a denial of service or gain privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-0164"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616747",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616747"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-0164",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-0164"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164"
        }
      ],
      "release_date": "2002-05-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-06-25T15:52:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2003:066"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2002-1472",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616917"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Untrusted search path vulnerability in libX11.so in xfree86, when used in setuid or setgid programs, allows local users to gain root privileges via a modified LD_PRELOAD environment variable that points to a malicious module.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2002-1472"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616917",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616917"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2002-1472",
          "url": "https://www.cve.org/CVERecord?id=CVE-2002-1472"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1472",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1472"
        }
      ],
      "release_date": "2002-09-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-06-25T15:52:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2003:066"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2003-0063",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616948"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2003-0063"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616948",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616948"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2003-0063",
          "url": "https://www.cve.org/CVERecord?id=CVE-2003-0063"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063"
        }
      ],
      "release_date": "2003-02-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-06-25T15:52:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2003:066"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "security flaw"
    },
    {
      "cve": "CVE-2003-0071",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1616952"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The DEC UDK processing feature in the xterm terminal emulator in XFree86 4.2.99.4 and earlier allows attackers to cause a denial of service via a certain character escape sequence that causes the terminal to enter a tight loop.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "security flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Linux 7.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2003-0071"
        },
        {
          "category": "external",
          "summary": "RHBZ#1616952",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616952"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2003-0071",
          "url": "https://www.cve.org/CVERecord?id=CVE-2003-0071"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071"
        }
      ],
      "release_date": "2003-02-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2003-06-25T15:52:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade.  Only those\nRPMs which are currently installed will be updated.  Those RPMs which are\nnot installed but included in the list will not be updated.  Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network.  Many\npeople find this an easier way to apply updates.  To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
          "product_ids": [
            "Red Hat Linux 7.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2003:066"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "security flaw"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.