Ubuntu 4.10 : libxpm4 vulnerability (USN-27-1)

Chris Evans discovered several stack overflows in the versions of libXpm shipped by X.Org, XFree86, and LessTif. These overflows were fixed in the Warty development tree before its release. Mathieu Herrb of OpenBSD subsequently discovered that the original patch was insufficient to address these...

Ubuntu 4.10 : gettext vulnerabilities (USN-5-1)

Recently, Trustix Secure Linux discovered some vulnerabilities in the gettext package. The programs 'autopoint' and 'gettextize' created temporary files in an insecure way, which allowed a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program...

Ubuntu 4.10 / 5.04 / 5.10 : lynx vulnerability (USN-206-1)

Ulf Harnhammar discovered a remote vulnerability in Lynx when connecting to a news server NNTP. The function that added missing escape chararacters to article headers did not check the size of the target buffer. Specially crafted news entries could trigger a buffer overflow, which could be...

Ubuntu 4.10 / 5.04 : sudo vulnerability (USN-142-1)

Charles Morris discovered a race condition in sudo which could lead to privilege escalation. If /etc/sudoers allowed a user the execution of selected programs, and this was followed by another line containing the pseudo-command 'ALL', that user could execute arbitrary commands with sudo by creati...

Ubuntu 5.04 : courier vulnerability (USN-174-1)

A Denial of Service vulnerability has been discovered in the Courier mail server. Due to a flawed status code check, failed DNS domain name service queries for SPF sender policy framework were not handled properly and could lead to memory corruption. A malicious DNS server could exploit this to...

Ubuntu 4.10 / 5.04 : gnupg vulnerability (USN-170-1)

Serge Mister and Robert Zuccherato discovered a weakness of the symmetrical encryption algorithm of gnupg. When decrypting a message, gnupg uses a feature called 'quick scan'; this can quickly check whether the key that is used for decryption is probably the right one, so that wrong keys can be...

Ubuntu 4.10 : linux-source-2.6.8.1 vulnerability (USN-39-1)

USN-30-1 fixed several flaws in the Linux ELF binary loader's handling of setuid binaries. Unfortunately it was found that these patches were not sufficient to prevent all possible attacks on 64-bit platforms, so previous amd64 kernel images were still vulnerable to root privilege escalation if...

Ubuntu 4.10 / 5.04 : fetchmail vulnerability (USN-153-1)

Ross Boylan discovered a remote buffer overflow in fetchmail. By sending invalid responses with very long UIDs, a faulty or malicious POP server could crash fetchmail or execute arbitrary code with the privileges of the user invoking fetchmail. fetchmail is commonly run as root to fetch mail for...

Ubuntu 4.10 / 5.04 : ruby1.8 vulnerability (USN-195-1)

The object oriented scripting language Ruby supports safely executing untrusted code with two mechanisms: safe level and taint flag on objects. Dr. Yutaka Oiwa discovered a vulnerability that allows Ruby methods to bypass these mechanisms. In systems which use this feature, this could be exploite...

Ubuntu 4.10 / 5.04 : gedit vulnerability (USN-138-1)

A format string vulnerability has been discovered in gedit. Calling the program with specially crafted file names caused a buffer overflow, which could be exploited to execute arbitrary code with the privileges of the gedit user. This becomes security relevant if e. g. your web browser is configu...

Ubuntu 4.10 : postgresql contributed script vulnerability (USN-6-1)

Recently, Trustix Secure Linux discovered a vulnerability in the postgresql-contrib package. The script 'makeoidjoinscheck' created temporary files in an insecure way, which allowed a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the script. Note...

Ubuntu 5.04 : kdelibs vulnerability (USN-114-1)

Bruno Rohee discovered a buffer overflow in the PCX decoder of kimgio. If an attacker tricked a user into loading a malicious PCX image with a KDE application, he could exploit this to execute arbitrary code with the privileges of the user opening the image. Note that Tenable Network Security has...

Ubuntu 4.10 / 5.04 / 5.10 : ucd-snmp vulnerability (USN-190-2)

USN-190-1 fixed a vulnerability in the net-snmp library. It was discovered that the same problem also affects the ucs-snmp implementation which is used by the Cyrus email server. Original advisory : A remote Denial of Service has been discovered in the SMNP Simple Network Management Protocol...

Ubuntu 4.10 : debmake vulnerability (USN-49-1)

Javier Fernandez-Sanguino Pena noticed that the debstd script from debmake, a deprecated helper package for Debian packaging, created temporary directories in an insecure manner. This could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the...

Ubuntu 4.10 : nasm vulnerability (USN-45-1)

Jonathan Rockway discovered a locally exploitable buffer overflow in the error function of nasm. If an attacker tricked a user into assembling a malicious source file, they could exploit this to execute arbitrary code with the privileges of the user that runs nasm. Note that Tenable Network...

Ubuntu 4.10 / 5.04 : cfengine vulnerabilities (USN-198-1)

Javier Fernandez-Sanguino Pena discovered that several tools in the cfengine package vicf, cfmailfilter, and cfcron create and use temporary files in an insecure way. A local attacker could exploit this with a symlink attack to create or overwrite arbitrary files with the privileges of the user...

Ubuntu 4.10 : Standard C library script vulnerabilities (USN-4-1)

Recently, Trustix Secure Linux discovered some vulnerabilities in the libc6 package. The utilities 'catchsegv' and 'glibcbug' created temporary files in an insecure way, which allowed a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program. Not...

Ubuntu 4.10 / 5.04 : mozilla, mozilla-thunderbird, mozilla-firefox vulnerabilities (USN-181-1)

Tom Ferris discovered a buffer overflow in the Mozilla products Mozilla browser, Firefox, Thunderbird. By tricking an user to click on a Hyperlink with a specially crafted destination URL, a remote attacker could crash the application. It might even be possible to exploit this vulnerability to...

Ubuntu 4.10 / 5.04 : net-snmp vulnerability (USN-190-1)

A remote Denial of Service has been discovered in the SMNP Simple Network Management Protocol library. If a SNMP agent uses TCP sockets for communication, a malicious SNMP server could exploit this to crash the agent. Please note that by default SNMP uses UDP sockets. Note that Tenable Network...

Ubuntu 4.10 : reportbug information disclosure (USN-88-1)

Rolf Leggewie discovered two information disclosure bugs in reportbug. The per-user configuration file /.reportbugrc was created world-readable. If it contained email smarthost passwords, these were readable by any other user on the computer storing the home directory. reportbug usually includes...