[security] slackware-security

[Lorenzo Iannuzzi]

New libpng packages are available for Slackware 9.0, 9.1, and -current to
fix an issue where libpng could be caused to crash, perhaps creating a denial
of service issue if network services are linked with it.

More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0421

New xine-lib packages are available for Slackware 9.1 and -current to fix a
security issue where playing a specially crafted Real RTSP stream could run
malicious code as the user playing the stream.

More details about this issue may be found in this advisory:
    http://www.xinehq.de/index.php/security/XSA-2004-3

New rsync packages are available for Slackware 8.1, 9.0, 9.1, and -current to
fix a security issue.  When running an rsync server without the chroot option
it is possible for an attacker to write outside of the allowed directory.
Any sites running rsync in that mode should upgrade right away (and should
probably look into using the chroot option as well).

More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0426
-- 

Ciao e alla prossima!
Lorenzo