Ubuntu 4.10 : exim4 vulnerabilities (USN-56-1)

A flaw has been found in the hostaton function, which can overflow a buffer if it is presented with an illegal IPv6 address that has more than 8 components. When supplying certain command line parameters, the input was not checked, so that a local attacker could possibly exploit the buffer overfl...

Ubuntu 4.10 : libgd2 vulnerabilities (USN-11-1)

Several buffer overflows have been discovered in libgd's PNG handling functions. If an attacker tricked a user into loading a malicious PNG image, they could leverage this into executing arbitrary code in the context of the user opening image. Most importantly, this library is commonly used in PH...

Ubuntu 4.10 : xpdf vulnerabilities (USN-2-1)

Chris Evans discovered several integer overflow vulnerabilities in xpdf, a viewer for PDF files. The Common UNIX Printing System CUPS also uses the same code to print PDF files. In either case, these vulnerabilities could be exploited by an attacker by providing a specially crafted PDF file which...

Ubuntu 4.10 : vim vulnerabilities (USN-61-1)

Javier Fernandez-Sanguino Pena noticed that the auxillary scripts 'tcltags' and 'vimspell.sh' created temporary files in an insecure manner. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the script either by calling it...

Ubuntu 4.10 : squid vulnerability (USN-93-1)

A race condition was discovered in the handling of 'Set-Cookie' headers. If the obsolete Netscape recommendation was used for handling cookies in the cache, it was possible for an attacker to steal the cookies of other users. Note that Tenable Network Security has extracted the preceding...

Ubuntu 4.10 : imagemagick vulnerabilities (USN-35-1)

Markus Meissner discovered several potential buffer overflows in some image decoding functions of ImageMagick. Decoding a malicious BMP or DIB image or AVI video might result in execution of arbitrary code with the user's privileges. Since imagemagick can be used in custom printing systems, this...

Ubuntu 4.10 : mailman vulnerabilities (USN-78-1)

An path traversal vulnerability has been discovered in the 'private' module of Mailman. A flawed path sanitation algorithm allowed the construction of URLS to arbitrary files readable by Mailman. This allowed a remote attacker to retrieve configuration and password databases, private list archive...

Ubuntu 4.10 : linux-source-2.6.8.1 vulnerabilities (USN-47-1)

Georgi Guninski discovered two Denial of Service vulnerabilities in the Linux kernel. An integer overflow in the vcresize function caused the memory allocation for the new screen being too short, thus causing a buffer overflow and a kernel crash. There was also a memory leak in the ipoptionsget...

Ubuntu 4.10 / 5.04 : tcpdump vulnerability (USN-141-1)

It was discovered that certain invalid BGP packets triggered an infinite loop in tcpdump, which caused tcpdump to stop working. This could be abused by a remote attacker to bypass tcpdump analysis of network traffic. Note that Tenable Network Security has extracted the preceding description block...

Ubuntu 4.10 : xpdf, tetex-bin vulnerabilities (USN-48-1)

A potential buffer overflow has been found in the xpdf viewer. An insufficient input validation could be exploited by an attacker providing a specially crafted PDF file which, when processed by xpdf, could result in abnormal program termination or the execution of attacker supplied program code...

Ubuntu 4.10 : sharutils vulnerability (USN-104-1)

Joey Hess discovered that 'unshar' created temporary files in an insecure manner. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the program. Note that Tenable Network Security has extracted the preceding description block...

Ubuntu 4.10 / 5.04 / 5.10 : lynx regression fix (USN-206-2)

USN-206-1 fixed a security vulnerability in lynx. Unfortunately the fix contained an error that caused lynx to crash under certain circumstances. The updated packages fix this. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security...

Ubuntu 4.10 : php4 vulnerabilities (USN-66-1)

FraMe from kernelpanik.org reported that the cURL module does not respect openbasedir restrictions. As a result, scripts which used cURL to open files with an user-specified path could read arbitrary local files outside of the openbasedir directory. Stefano Di Paola discovered a vulnerability in...

Ubuntu 4.10 / 5.04 : squid vulnerability (USN-129-1)

It was discovered that Squid did not verify the validity of DNS server responses. When Squid is started, it opens a DNS client UDP port whose number is randomly assigned by the operating system. Unless your network firewall is configured to accept DNS responses only from known good nameservers,...

Ubuntu 4.10 : php4 vulnerabilities (USN-99-2)

USN-99-1 fixed a safe mode bypass which allowed malicious PHP scripts to circumvent path restrictions by creating a specially crafted directory whose length exceeded the capacity of the realpath function CAN-2004-1064. However, this caused severe regressions, some applications like SquirrelMail a...

Ubuntu 4.10 : openslp vulnerabilities (USN-98-1)

The SuSE Security Team discovered several buffer overflows in the OpenSLP server and client library. By sending specially crafted SLP packets, a remote attacker could exploit this to crash the SLP server or execute arbitrary code with the privileges of the 'daemon' user. Likewise, a malicious SLP...

Ubuntu 4.10 : emacs21 vulnerability (USN-76-1)

Max Vozeler discovered a format string vulnerability in the 'movemail' utility of Emacs. By sending specially crafted packets, a malicious POP3 server could cause a buffer overflow, which could have been exploited to execute arbitrary code with the privileges of the user and the 'mail' group sinc...

Ubuntu 4.10 : imlib+png2 vulnerabilities (USN-53-1)

Pavel Kankovsky discovered several buffer overflows in imlib. If an attacker tricked a user into loading a malicious image, he could exploit this to execute arbitrary code in the context of the user opening the image. Note that Tenable Network Security has extracted the preceding description bloc...

Ubuntu 4.10 : cyrus21-imapd vulnerability (USN-87-1)

Sean Larsson discovered a buffer overflow in the IMAP 'annotate' extension. This possibly allowed an authenticated IMAP client to execute arbitrary code with the privileges of the Cyrus IMAP server. Note that Tenable Network Security has extracted the preceding description block directly from the...

Ubuntu 4.10 / 5.04 : courier vulnerabilities (USN-201-1)

Several Cross Site Scripting vulnerabilities were discovered in SqWebmail. A remote attacker could exploit this to execute arbitrary JavaScript or other active HTML embeddable content in the web browser of an SqWebmail user by sending specially crafted emails to him. Please note that the...