Ubuntu 5.04 : kdelibs vulnerability (USN-150-1)

Kate and Kwrite create a backup file before saving a modified file. These backup files were created with default permissions, even if the original file had more strict permissions set, so that other local users could possibly read the backup file even if they are not permitted to read the origina...

Ubuntu 4.10 : cyrus21-imapd vulnerability (USN-87-1)

Sean Larsson discovered a buffer overflow in the IMAP 'annotate' extension. This possibly allowed an authenticated IMAP client to execute arbitrary code with the privileges of the Cyrus IMAP server. Note that Tenable Network Security has extracted the preceding description block directly from the...

Ubuntu 4.10 : sharutils vulnerabilities (USN-102-1)

Shaun Colley discovered a buffer overflow in 'shar' that was triggered by output files specified with -o with names longer than 49 characters. This could be exploited to run arbitrary attacker specified code on systems that automatically process uploaded files with shar. Ulf Harnhammar discovered...

Ubuntu 4.10 : xpdf, cupsys vulnerabilities (USN-64-1)

A buffer overflow has been found in the xpdf viewer. An insufficient input validation of the encryption key length could be exploited by an attacker providing a specially crafted PDF file which, when processed by xpdf, could result in abnormal program termination or the execution of attacker...

Ubuntu 4.10 / 5.04 : php4, php4-universe fixed packages (USN-147-2)

USN-147-1 1 fixed a remote code execution vulnerability in the XMLRPC module of the PEAR library. Unfortunately the packages announced in USN-147-1 were faulty and shipped broken xmlrpc modules. The updated packages ship correct modules. We apologize for the inconvenience. 1...

Ubuntu 4.10 : python2.2, python2.3 vulnerability (USN-73-1)

The Python developers discovered a flaw in the SimpleXMLRPCServer module. Python XML-RPC servers that used the registerinstance method to register an object, but do not have a dispatch method, allowed remote users to access or change function internals using the im and func attributes. Note that...

Ubuntu 4.10 : mysql-dfsg vulnerability (USN-109-1)

USN-32-1 fixed a database privilege escalation vulnerability; original advisory text : 'If a user was granted privileges to a database with a name containing an underscore '', the user also gained the ability to grant privileges to other databases with similar names. CAN-2004-0957' Recently a...

Ubuntu 4.10 / 5.04 : cpio vulnerabilities (USN-189-1)

Imran Ghory found a race condition in the handling of output files. While a file was unpacked with cpio, a local attacker with write permissions to the target directory could exploit this to change the permissions of arbitrary files of the cpio user. CAN-2005-1111 Imran Ghory discovered a path...

Ubuntu 4.10 : imagemagick vulnerability (USN-62-1)

Andrei Nigmatulin discovered a potential buffer overflow in the PhotoShop Document image decoding function of ImageMagick. Decoding a malicious PSD image which specifies more than the allowed 24 channels might result in execution of arbitrary code with the user's privileges. Since ImageMagick can...

Ubuntu 5.04 : mozilla-firefox bug fix (USN-124-2)

USN-124-1 fixed several vulnerabilities of Firefox. After that update, several users experienced XML errors on various actions like adding bookmarks see https://bugzilla.ubuntu.com/showbug.cgi?id=10643. After installing these new packages and restarting the browser, these problems should be fixed...

Ubuntu 4.10 / 5.04 : bzip2 vulnerability (USN-161-1)

USN-158-1 fixed a command injection vulnerability in the 'zgrep' utility. It was determined that the 'bzgrep' counterpart in the bzip2 package is vulnerable to the same flaw. bzgrep did not handle shell metacharacters like '|' and '&' properly when they occurred in input file names. This could be...

Ubuntu 4.10 : libdbi-perl vulnerabilities (USN-70-1)

Javier Fernandez-Sanguino Pena from the Debian Security Audit Project discovered that the module DBI::ProxyServer in Perl's DBI library created a PID file in an insecure manner. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking...

Ubuntu 5.10 : inkscape vulnerability (USN-217-1)

A buffer overflow has been discovered in the SVG importer of Inkscape. By tricking an user into opening a specially crafted SVG image this could be exploited to execute arbitrary code with the privileges of the Inkscape user. Note that Tenable Network Security has extracted the preceding...

Ubuntu 4.10 : imlib2 vulnerabilities (USN-55-1)

Recently, Pavel Kankovsky discovered several buffer overflows in imlib which were fixed in USN-53-1. It was found that imlib2 was vulnerable to similar issues. If an attacker tricked a user into loading a malicious XPM or BMP image, he could exploit this to execute arbitrary code in the context o...

Ubuntu 4.10 / 5.04 : squid vulnerabilities (USN-183-1)

A Denial of Service vulnerability was discovered in the handling of aborted requests. A remote attacker could exploit this to crash Squid by sending specially crafted requests. CAN-2005-2794 Alex Masterov discovered a Denial of Service vulnerability in the sslConnectTimeout function. By sending...

Ubuntu 4.10 / 5.04 : gnupg vulnerability (USN-170-1)

Serge Mister and Robert Zuccherato discovered a weakness of the symmetrical encryption algorithm of gnupg. When decrypting a message, gnupg uses a feature called 'quick scan'; this can quickly check whether the key that is used for decryption is probably the right one, so that wrong keys can be...

Ubuntu 4.10 : imagemagick vulnerability (USN-90-1)

Tavis Ormandy discovered a format string vulnerability in ImageMagick's file name handling. Specially crafted file names could cause a program using ImageMagick to crash, or possibly even cause execution of arbitrary code. Since ImageMagick can be used in custom printing systems, this also might...

Ubuntu 4.10 / 5.04 : netpbm-free vulnerability (USN-164-1)

Max Vozeler discovered that the the 'pstopnm' conversion tool did not use the -dSAFER option when calling ghostscript. This option prohibits file operations and calling commands within PostScript code. This flaw could be exploited by an attacker to execute arbitrary code if he tricked an user or ...

Ubuntu 4.10 : apache vulnerabilities (USN-65-1)

Javier Fernandez-Sanguino Pena noticed that the 'checkforensic' script created temporary files in an insecure manner. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the program. Note that Tenable Network Security has extract...

Ubuntu 5.04 : graphviz vulnerability (USN-208-1)

Javier Fernandez-Sanguino Pena discovered that the 'dotty' tool created and used temporary files in an insecure way. A local attacker could exploit this with a symlink attack to create or overwrite arbitrary files with the privileges of the user running dotty. Note that Tenable Network Security h...