Ubuntu 4.10 : php4 vulnerabilities (USN-99-1)

Stefano Di Paola discovered integer overflows in PHP's pack and unpack functions. A malicious PHP script could exploit these to break out of safe mode and execute arbitrary code with the privileges of the PHP interpreter. CAN-2004-1018 Note: The second part of CAN-2004-1018 buffer overflow in the...

Ubuntu 4.10 / 5.04 : openldap2, libpam-ldap, libnss-ldap vulnerabilities (USN-152-1)

Andrea Barisani discovered a flaw in the SSL handling of pam-ldap and libnss-ldap. When a client connected to a slave LDAP server using SSL, the slave server did not use SSL as well when contacting the LDAP master server. This caused passwords and other confident information to be transmitted...

Ubuntu 4.10 : openssh information leakage (USN-34-1)

@Mediaservice.net discovered two information leaks in the OpenSSH server. When using password authentication, an attacker could test whether a login name exists by measuring the time between failed login attempts, i. e. the time after which the 'password:' prompt appears again. A similar issue...

Ubuntu 4.10 / 5.04 : apache2, libapache-mod-ssl vulnerabilities (USN-177-1)

Apache did not honour the 'SSLVerifyClient require' directive within a block if the surrounding block contained a directive 'SSLVerifyClient optional'. This allowed clients to bypass client certificate validation on servers with the above configuration. CAN-2005-2700 Filip Sneppe discovered a...

Ubuntu 4.10 : tiff vulnerability (USN-54-1)

Dmitry V. Levin discovered a buffer overflow in the 'tiffdump' utility. If an attacker tricked a user into processing a malicious TIFF image with tiffdump, they could cause a buffer overflow which at least causes the program to crash. However, it is not entirely clear whether this can be exploite...

Ubuntu 4.10 / 5.04 : dpkg, ia32-libs, amd64-libs vulnerabilities (USN-151-2)

USN-148-1 and USN-151-1 fixed two security flaws in zlib, which could be exploited to cause Denial of Service attacks or even arbitrary code execution with malicious data streams. Most applications use the shared library provided by the 'zlib1g' package; however, some packages contain copies of t...

Ubuntu 5.04 : kdelibs fixed packages (USN-114-2)

USN-114-1 fixed a vulnerability in the PCX decoder of kimgio. Unfortunately it was discovered that the original patches were faulty and caused regressions. This update now has the correct patches. This update also fixes the disappearing KDE settings which were caused by the accidental removal of...

Ubuntu 4.10 / 5.04 : mysql-dfsg vulnerability (USN-180-1)

AppSecInc Team SHATTER discovered a buffer overflow in the 'CREATE FUNCTION' statement. By specifying a specially crafted long function name, a local or remote attacker with function creation privileges could crash the server or execute arbitrary code with server privileges. However, the right to...

Ubuntu 4.10 : passwd vulnerabilities (USN-17-1)

Martin Schulze and Steve Grubb discovered a flaw in the authentication input validation of the 'chfn' and 'chsh' programs. This allowed logged in users with an expired password to change their real name and their login shell without having to change their password. This flaw cannot lead to...

Ubuntu 4.10 : groff utility vulnerability (USN-13-1)

Recently, Trustix Secure Linux discovered a vulnerability in the groff package. The utility 'groffer' created a temporary directory in an insecure way, which allowed exploitation of a race condition to create or overwrite files with the privileges of the user invoking the program. Note that Tenab...

Ubuntu 5.04 : dia vulnerability (USN-193-1)

Joxean Koret discovered that the SVG import plugin did not properly sanitise data read from an SVG file. By tricking an user into opening a specially crafted SVG file, an attacker could exploit this to execute arbitrary code with the privileges of the user. Note that Tenable Network Security has...

Ubuntu 4.10 : python2.2, python2.3 vulnerability (USN-73-1)

The Python developers discovered a flaw in the SimpleXMLRPCServer module. Python XML-RPC servers that used the registerinstance method to register an object, but do not have a dispatch method, allowed remote users to access or change function internals using the im and func attributes. Note that...

Ubuntu 4.10 : emacs21 vulnerability (USN-76-1)

Max Vozeler discovered a format string vulnerability in the 'movemail' utility of Emacs. By sending specially crafted packets, a malicious POP3 server could cause a buffer overflow, which could have been exploited to execute arbitrary code with the privileges of the user and the 'mail' group sinc...

Ubuntu 4.10 / 5.04 : xine-lib vulnerability (USN-196-1)

Ulf Harnhammar discovered a format string vulnerability in the CDDB module's cache file handling in the Xine library, which is used by packages such as xine-ui, totem-xine, and gxine. By tricking an user into playing a particular audio CD which has a specially crafted CDDB entry, a remote attacke...

Ubuntu 4.10 : sharutils vulnerabilities (USN-102-1)

Shaun Colley discovered a buffer overflow in 'shar' that was triggered by output files specified with -o with names longer than 49 characters. This could be exploited to run arbitrary attacker specified code on systems that automatically process uploaded files with shar. Ulf Harnhammar discovered...

Ubuntu 4.10 : curl vulnerability (USN-86-1)

infamous41md discovered a buffer overflow in cURL's NT LAN Manager NTLM authentication handling. By sending a specially crafted long NTLM reply packet, a remote attacker could overflow the reply buffer. This could lead to execution of arbitrary attacker specified code with the privileges of the...

Ubuntu 4.10 / 5.04 / 5.10 : gtk+2.0, gdk-pixbuf vulnerabilities (USN-216-1)

Two integer overflows have been discovered in the XPM image loader of the GDK pixbuf library. By tricking an user into opening a specially crafted XPM image with any Gnome desktop application that uses this library, this could be exploited to execute arbitrary code with the privileges of the user...

Ubuntu 4.10 / 5.04 / 5.10 : libungif4 vulnerabilities (USN-214-1)

Chris Evans discovered several buffer overflows in the libungif library. By tricking an user or automated system into processing a specially crafted GIF image, this could be exploited to execute arbitrary code with the privileges of the application using libungif. Note that Tenable Network Securi...

Ubuntu 5.04 : kdewebdev vulnerability (USN-115-1)

Eckhart Worner discovered that Kommander opens files from remote and possibly untrusted locations without user confirmation. Since Kommander files can contain scripts, this would allow an attacker to execute arbitrary code with the privileges of the user opening the file. The updated Kommander wi...

Ubuntu 4.10 : GhostScript utility script vulnerabilities (USN-3-1)

Recently, Trustix Secure Linux discovered some vulnerabilities in the gs-common package. The utilities 'pv.sh' and 'ps2epsi' created temporary files in an insecure way, which allowed a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program. Note...