Juliano Rizzo announced: [1] http://www.ekoparty.org/2011/juliano-rizzo.php

that at ekoparty Security Conference, from 2011-09-21 to 2011-09-23 they will present a new fast block-wise chosen-plaintext attack against SSL/TLS. One application of the attack should allow the adversary to efficiently decrypt and obtain authentication tokens and cookies from HTTPS requests.

The Red Hat Security Response Team is watching progress on this one and once further details are available, we will immediately react to ensure timely manner updates for affected packages.

The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted EXIF IFD in a TIFF image.

Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document.

A flaw was found in the default error response for status code 400. This could be used by an attacker to expose "httpOnly" cookies, when no custom ErrorDocument was specified.

This affects all versions of Apache from 2.2.0 up to and including 2.2.21. It will be fixed upstream in 2.2.22 (via r1235454 [1]).

[1] http://svn.apache.org/viewvc?view=revision&revision=1235454

Apache 2.2 fixed a possible crash on shutdown if a child changes the sbtype field in the scoreboard. Since unprivileged children should not be able to affect the parent in this way, this is treated as a Low severity security issue [1].

The reporter has a nice writeup of the flaw as well [2].

[1] http://svn.apache.org/viewvc?view=revision&revision=1230065 [2] http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/