A new update is available for Red Hat Enterprise Linux. Here the announcement:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Important: spamassassin security update
Advisory ID: RHSA-2007:0075-02
Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0075.html
Issue date: 2007-03-13
Updated on: 2007-03-14
Product: Red Hat Enterprise Linux
CVE Names: CVE-2007-0451
- ---------------------------------------------------------------------
1. Summary:
Updated spamassassin packages that fix a security issue are now available
for Red Hat Enterprise Linux 5.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
3. Problem description:
SpamAssassin provides a way to reduce unsolicited commercial email (spam)
from incoming email.
A flaw was found in the way SpamAssassin processes HTML email containing
URIs. A carefully crafted mail message could cause SpamAssassin to consume
significant resources. If a number of these messages are sent, this could
lead to a denial of service, potentially delaying or preventing the
delivery of email. (CVE-2007-0451)
Users of SpamAssassin should upgrade to these updated packages which
contain version 3.1.8 which is not vulnerable to these issues.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
5. Bug IDs fixed (http://bugzilla.redhat.com/):
228587 - CVE-2007-0451 Spamassassin DoS
6. RPMs required:
Red Hat Enterprise Linux Desktop (v. 5 client):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/spamassassin-3.1.8-2.el5.src.rpm
1b3d756e97bd37694b8682de4cf2437b spamassassin-3.1.8-2.el5.src.rpm
i386:
46f02b67cfc960bb5d870e53d2c160aa spamassassin-3.1.8-2.el5.i386.rpm
b0d0d32cd64986d8d47e28c638e5c6cb spamassassin-debuginfo-3.1.8-2.el5.i386.rpm
x86_64:
464cc3d1cf3bc0ab2707e2dcb3b250da spamassassin-3.1.8-2.el5.x86_64.rpm
a8516e321cc11bf556735f7824045d24 spamassassin-debuginfo-3.1.8-2.el5.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/spamassassin-3.1.8-2.el5.src.rpm
1b3d756e97bd37694b8682de4cf2437b spamassassin-3.1.8-2.el5.src.rpm
i386:
46f02b67cfc960bb5d870e53d2c160aa spamassassin-3.1.8-2.el5.i386.rpm
b0d0d32cd64986d8d47e28c638e5c6cb spamassassin-debuginfo-3.1.8-2.el5.i386.rpm
ia64:
9c9c9f9d1b05c6f70210d94196661dba spamassassin-3.1.8-2.el5.ia64.rpm
2e467dc6cf71068568748a24281d2f24 spamassassin-debuginfo-3.1.8-2.el5.ia64.rpm
ppc:
d77b85e1c132b88526210bc121e67642 spamassassin-3.1.8-2.el5.ppc.rpm
53f9f1790f2bf708438e6ca89966e873 spamassassin-debuginfo-3.1.8-2.el5.ppc.rpm
s390x:
2c98423a9762e50eb206daa59172b0e7 spamassassin-3.1.8-2.el5.s390x.rpm
faf074eed8e821200108ebf42403eefe spamassassin-debuginfo-3.1.8-2.el5.s390x.rpm
x86_64:
464cc3d1cf3bc0ab2707e2dcb3b250da spamassassin-3.1.8-2.el5.x86_64.rpm
a8516e321cc11bf556735f7824045d24 spamassassin-debuginfo-3.1.8-2.el5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0451
http://www.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2007 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFF+BaAXlSAg2UNWIIRAlYqAJwJeiQpLzi9LfUN1PrmqLA48NxTxQCeLTwD
3PY001qR0EfXau0wtxWcCH4=
=N6Oa
-----END PGP SIGNATURE-----
