Ubuntu 5.10 : mysql-dfsg-4.1 vulnerability (USN-321-1)

Jean-David Maillefer discovered a format string bug in the dateformat function's error reporting. By calling the function with invalid arguments, an authenticated user could exploit this to crash the server. Note that Tenable Network Security has extracted the preceding description block directly...

Ubuntu 7.04 : pulseaudio vulnerability (USN-465-1)

Luigi Auriemma discovered multiple flaws in pulseaudio's network processing code. If an unauthenticated attacker sent specially crafted requests to the pulseaudio daemon, it would crash, resulting in a denial of service. Note that Tenable Network Security has extracted the preceding description...

Ubuntu 6.06 LTS / 6.10 / 7.04 : dovecot vulnerability (USN-487-1)

It was discovered that Dovecot, when configured to use non-system-user spools and compressed folders, would allow directory traversals in mailbox names. Remote authenticated users could potentially read email owned by other users. Note that Tenable Network Security has extracted the preceding...

Ubuntu 5.04 / 5.10 / 6.06 LTS : imagemagick vulnerabilities (USN-340-1)

Tavis Ormandy discovered several buffer overflows in imagemagick's Sun Raster and XCF Gimp image decoders. By tricking a user or automated system into processing a specially crafted image, this could be exploited to execute arbitrary code with the users' privileges. Note that Tenable Network...

Ubuntu 6.06 LTS / 6.10 / 7.04 : libapache2-mod-perl2 vulnerability (USN-488-1)

Alex Solovey discovered that modperl did not correctly validate certain regular expression matches. A remote attacker could send a specially crafted request to a web application using modperl, causing the web server to monopolize CPU resources. This could lead to a remote denial of service. Note...

Ubuntu 5.10 : openoffice.org2-amd64, openoffice.org2 vulnerabilities (USN-313-2)

USN-313-1 fixed several vulnerabilities in OpenOffice for Ubuntu 5.04 and Ubuntu 6.06 LTS. This followup advisory provides the corresponding update for Ubuntu 5.10. For reference, these are the details of the original USN : It was possible to embed Basic macros in documents in a way that...

Ubuntu 6.06 LTS : linux-source-2.6.15 vulnerability (USN-319-1)

A race condition has been discovered in the file permission handling of the /proc file system. A local attacker could exploit this to execute arbitrary code with full root privileges. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu securit...

Ubuntu 5.04 : php4 regression (USN-320-2)

USN-320-2 fixed several vulnerabilities in PHP. James Manning discovered that the Ubuntu 5.04 update introduced a regression, the function tempnam caused a crash of the PHP interpreter in some circumstances. The updated packages fix this. We apologize for the inconvenience. Note that Tenable...

Ubuntu 6.06 LTS / 6.10 / 7.04 : evolution-data-server vulnerability (USN-475-1)

Philip Van Hoof discovered that the IMAP client in Evolution did not correctly verify the SEQUENCE value. A malicious or spoofed server could exploit this to execute arbitrary code with user privileges. Note that Tenable Network Security has extracted the preceding description block directly from...

Ubuntu 6.06 LTS : xorg-server vulnerability (USN-514-1)

Aaron Plattner discovered that the Composite extension did not correctly calculate the size of buffers when copying between different bit depths. An authenticated user could exploit this to execute arbitrary code with root privileges. Note that Tenable Network Security has extracted the preceding...

Ubuntu 7.04 : tcp-wrappers vulnerability (USN-507-1)

It was discovered that the TCP wrapper library was incorrectly allowing connections to services that did not specify server-side connection details. Remote attackers could connect to services that had been configured to block such connections. This only affected Ubuntu Feisty. Note that Tenable...

Ubuntu 5.10 / 6.06 LTS / 6.10 : tar vulnerability (USN-385-1)

Teemu Salmela discovered that tar still handled the deprecated GNUTYPENAMES record type. This record type could be used to create symlinks that would be followed while unpacking a tar archive. If a user or an automated system were tricked into unpacking a specially crafted tar file, arbitrary fil...

Ubuntu 5.10 / 6.06 LTS : openoffice.org/-amd64, openoffice.org2/-amd64 vulnerability (USN-406-1)

An integer overflow was discovered in OpenOffice.org's handling of WMF files. If a user were tricked into opening a specially crafted WMF file, an attacker could execute arbitrary code with user privileges. Note that Tenable Network Security has extracted the preceding description block directly...

Ubuntu 5.10 / 6.06 LTS / 6.10 : libwpd vulnerability (USN-437-1)

Sean Larsson of iDefense Labs discovered that libwpd was vulnerable to integer overflows. If a user were tricked into opening a specially crafted WordPerfect document with an application that used libwpd, an attacker could execute arbitrary code with user privileges. Note that Tenable Network...

Ubuntu 5.10 / 6.06 LTS / 6.10 : ipsec-tools vulnerability (USN-450-1)

A flaw was discovered in the IPSec key exchange server 'racoon'. Remote attackers could send a specially crafted packet and disrupt established IPSec tunnels, leading to a denial of service. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu...

Ubuntu 6.06 LTS / 6.10 / 7.04 : samba vulnerabilities (USN-460-1)

Paul Griffith and Andrew Hogue discovered that Samba did not fully drop root privileges while translating SIDs. A remote authenticated user could issue SMB operations during a small window of opportunity and gain root privileges. CVE-2007-2444 Brian Schafer discovered that Samba did not handle ND...

Ubuntu 5.04 / 5.10 / 6.06 LTS : dovecot, exim4, postfix vulnerabilities (USN-288-3)

USN-288-1 described a PostgreSQL client vulnerability in the way the '''''''. If a client application uses one of the affected encodings and does not interpret multibyte characters, and an attacker supplies a specially cr...

Ubuntu 5.04 / 5.10 / 6.06 LTS : php4, php5 vulnerabilities (USN-342-1)

The sscanf function did not properly check array boundaries. In applications which use sscanf with argument swapping, a remote attacker could potentially exploit this to crash the affected web application or even execute arbitrary code with the application's privileges. CVE-2006-4020 The fileexis...

Ubuntu 5.10 / 6.06 LTS / 6.10 : gnupg vulnerability (USN-393-1)

Tavis Ormandy discovered that gnupg was incorrectly using the stack. If a user were tricked into processing a specially crafted message, an attacker could execute arbitrary code with the user's privileges. Note that Tenable Network Security has extracted the preceding description block directly...

Ubuntu 5.10 / 6.06 LTS / 6.10 : ekiga, gnomemeeting vulnerabilities (USN-426-1)

Mu Security discovered a format string vulnerability in Ekiga. If a user was running Ekiga and listening for incoming calls, a remote attacker could send a crafted call request, and execute arbitrary code with the user's privileges. Note that Tenable Network Security has extracted the preceding...