[USN-570-1] boost vulnerabilities

=========================================================== Ubuntu Security Notice USN-570-1 January 16, 2008 boost vulnerabilities CVE-2008-0171, CVE-2008-0172 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubun...

USN-567-1: Dovecot vulnerability

It was discovered that in very rare configurations using LDAP, Dovecot may reuse cached connections for users with the same password. As a result, a user may be able to login as another if the connection is reused. The default Ubuntu configuration of Dovecot was not vulnerable...

Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : pwlib vulnerability (USN-561-1)

Jose Miguel Esparza discovered that pwlib did not correctly handle large string lengths. A remote attacker could send specially crafted packets to applications linked against pwlib e.g. Ekiga causing them to crash, leading to a denial of service. Note that Tenable Network Security has extracted t...

USN-566-1: OpenSSH vulnerability

Jan Pechanec discovered that ssh would forward trusted X11 cookies when untrusted cookie generation failed. This could lead to unintended privileges being forwarded to a remote host...

Linux Kernel IPv6 Hop-By-Hop头字段远程拒绝服务漏洞

Linux是一款开放源代码的操作系统。 Linux内核处理特定构建的IPv6 'Hop-By-Hop'头字段数据存在问题，远程攻击者可以利用漏洞对系统进行拒绝服务攻击。 由于skb-dst在ip6routeinput中分配，不正确在hop-by-hop选项处理器中使用，可导致造成内核出现问题，造成拒绝服务攻击。 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu...

Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : libcairo vulnerability (USN-550-1)

Peter Valchev discovered that Cairo did not correctly decode PNG image data. By tricking a user or automated system into processing a specially crafted PNG with Cairo, a remote attacker could execute arbitrary code with user privileges. Note that Tenable Network Security has extracted the precedi...

PHP 5.2.4及之前版本存在多个漏洞

PHP是一款流行的网络编程语言。 PHP存在多个安全问题，远程攻击者可以利用漏洞进行缓冲区溢出，拒绝服务，和安全绕过攻击。 -dl处理文件名存在问题，可导致跨站脚本攻击。 -dl处理MAXPATHLEN参数大小存在问题，可导致拒绝服务攻击。 -tmlentities/htmlspecialchars处理部分多字节序列存在问题。 -fnmatch, setlocale和glob函数的glibc实现存在缓冲区溢出。 Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 12.0 Slackware Linux 11.0...

Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : flac vulnerability (USN-540-1)

Sean de Regge discovered that flac did not properly perform bounds checking in many situations. An attacker could send a specially crafted FLAC audio file and execute arbitrary code as the user or cause a denial of service in flac or applications that link against flac. Note that Tenable Network...

Ubuntu 6.06 LTS / 6.10 / 7.04 : tar vulnerability (USN-506-1)

Dmitry V. Levin discovered that tar did not correctly detect the '..' file path element when unpacking archives. If a user or an automated system were tricked into unpacking a specially crafted tar file, arbitrary files could be overwritten with user privileges. Note that Tenable Network Security...

Ubuntu 7.04 : linux-source-2.6.20 vulnerabilities (USN-510-1)

A flaw was discovered in the PPP over Ethernet implementation. Local attackers could manipulate ioctls and cause kernel memory consumption leading to a denial of service. CVE-2007-2525 An integer underflow was discovered in the cpuset filesystem. If mounted, local attackers could obtain kernel...

Ubuntu 6.06 LTS / 6.10 / 7.04 : pptpd vulnerability (USN-459-1)

A flaw was discovered in the PPTP tunnel server. Remote attackers could send a specially crafted packet and disrupt established PPTP tunnels, leading to a denial of service. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory...

Ubuntu 6.06 LTS / 6.10 / 7.04 : elinks vulnerability (USN-457-1)

Arnaud Giersch discovered that elinks incorrectly attempted to load gettext catalogs from a relative path. If a user were tricked into running elinks from a specific directory, a local attacker could execute code with user privileges. Note that Tenable Network Security has extracted the preceding...

Ubuntu 6.06 LTS / 6.10 / 7.04 : php5 vulnerabilities (USN-455-1)

Stefan Esser discovered multiple vulnerabilities in the 'Month of PHP bugs'. The substrcompare function did not sufficiently verify its length argument. This might be exploited to read otherwise unaccessible memory, which might lead to information disclosure. CVE-2007-1375 The shared memory shmop...

Ubuntu 6.06 LTS / 6.10 / 7.04 : qt-x11-free vulnerability (USN-495-1)

Several format string vulnerabilities have been discovered in Qt warning messages. By causing an application to process specially crafted input data which triggered Qt warnings, this could be exploited to execute arbitrary code with the privilege of the user running the application. Note that...

Ubuntu 6.06 LTS / 6.10 / 7.04 : jasper vulnerability (USN-501-1)

It was discovered that Jasper did not correctly handle corrupted JPEG2000 images. By tricking a user into opening a specially crafted JPG, a remote attacker could cause the application using libjasper to crash, resulting in a denial of service. Note that Tenable Network Security has extracted the...

Ubuntu 6.06 LTS / 6.10 / 7.04 : krb5, librpcsecgss vulnerability (USN-511-1)

It was discovered that the libraries handling RPCSECGSS did not correctly validate the size of certain packet structures. An unauthenticated remote user could send a specially crafted request and execute arbitrary code with root privileges. Note that Tenable Network Security has extracted the...

Ubuntu 7.04 : tcp-wrappers vulnerability (USN-507-1)

It was discovered that the TCP wrapper library was incorrectly allowing connections to services that did not specify server-side connection details. Remote attackers could connect to services that had been configured to block such connections. This only affected Ubuntu Feisty. Note that Tenable...

Ubuntu 6.06 LTS / 6.10 / 7.04 : evolution-data-server vulnerability (USN-475-1)

Philip Van Hoof discovered that the IMAP client in Evolution did not correctly verify the SEQUENCE value. A malicious or spoofed server could exploit this to execute arbitrary code with user privileges. Note that Tenable Network Security has extracted the preceding description block directly from...

Ubuntu 6.06 LTS / 6.10 / 7.04 : xfsdump vulnerability (USN-516-1)

Paul Martin discovered that xfsfsr creates a temporary directory with insecure permissions. This allows a local attacker to exploit a race condition in xfsfsr to read or overwrite arbitrary files on xfs filesystems. Note that Tenable Network Security has extracted the preceding description block...

Ubuntu 6.10 / 7.04 : hplip vulnerability (USN-530-1)

It was discovered that the hpssd tool of hplip did not correctly handle shell meta-characters. A local attacker could exploit this to execute arbitrary commands as the hplip user. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security...