Ubuntu 5.04 / 5.10 / 6.06 LTS : gnutls11, gnutls12 vulnerability (USN-348-1)

The GnuTLS library did not sufficiently check the padding of PKCS 1 v1.5 signatures if the exponent of the public key is 3 which is widely used for CAs. This could be exploited to forge signatures without the need of the secret key. Note that Tenable Network Security has extracted the preceding...

Ubuntu 6.06 LTS / 6.10 / 7.04 : openoffice.org(2)/-amd64 vulnerability (USN-482-1)

John Heasman discovered that OpenOffice did not correctly validate the sizes of tags in RTF documents. If a user were tricked into opening a specially crafted document, a remote attacker could execute arbitrary code with user privileges. Note that Tenable Network Security has extracted the...

Ubuntu 5.04 / 5.10 / 6.06 LTS : gzip vulnerabilities (USN-349-1)

Tavis Ormandy discovered that gzip did not sufficiently verify the validity of gzip or compress archives while unpacking. By tricking an user or automated system into unpacking a specially crafted compressed file, this could be exploited to execute arbitrary code with the user's privileges. Note...

Ubuntu 5.10 / 6.06 LTS / 6.10 : libgtop2 vulnerability (USN-407-1)

Liu Qishuai discovered a buffer overflow in the /proc parsing routines in libgtop. By creating and running a process in a specially crafted long path and tricking an user into running gnome-system-monitor, an attacker could exploit this to execute arbitrary code with the user's privileges. Note...

Ubuntu 5.10 / 6.06 LTS / 6.10 : xine-lib vulnerability (USN-435-1)

Moritz Jodeit discovered that the DirectShow loader of Xine did not correctly validate the size of an allocated buffer. By tricking a user into opening a specially crafted media file, an attacker could execute arbitrary code with the user's privileges. Note that Tenable Network Security has...

Ubuntu 5.04 / 6.06 LTS : openoffice.org-amd64, openoffice.org vulnerabilities (USN-313-1)

It was possible to embed Basic macros in documents in a way that OpenOffice.org would not ask for confirmation about executing them. By tricking a user into opening a malicious document, this could be exploited to run arbitrary Basic code including local file access and modification with the user...

Ubuntu 5.10 : mysql-dfsg-4.1 vulnerability (USN-306-1)

MySQL did not correctly handle NULL as the second argument to the strtodate function. An authenticated user could exploit this to crash the server. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to...

Ubuntu 5.04 / 5.10 : linux-source-2.6.10, linux-source-2.6.12 vulnerability (USN-319-2)

USN-319-1 fixed a Linux kernel vulnerability in Ubuntu 6.06 LTS. This followup advisory provides the corresponding updates for Ubuntu 5.04 and 5.10. For reference, these are the details of the original USN : A race condition has been discovered in the file permission handling of the /proc file...

Ubuntu 5.04 / 5.10 / 6.06 LTS : imagemagick vulnerability (USN-337-1)

Damian Put discovered a buffer overflow in imagemagick's SGI file format decoder. By tricking an user or automated system into processing a specially crafted SGI image, this could be exploited to execute arbitrary code with the user's privileges. Note that Tenable Network Security has extracted t...

Ubuntu 5.10 / 6.06 LTS : imagemagick vulnerability (USN-386-1)

Daniel Kobras discovered multiple buffer overflows in ImageMagick's SGI file format decoder. By tricking a user or an automated system into processing a specially crafted SGI image, this could be exploited to execute arbitrary code with the user's privileges. Note that Tenable Network Security ha...

Ubuntu 6.06 LTS / 6.10 / 7.04 : libvorbis vulnerabilities (USN-498-1)

David Thiel discovered that libvorbis did not correctly verify the size of certain headers, and did not correctly clean up a broken stream. If a user were tricked into processing a specially crafted Vorbis stream, a remote attacker could execute arbitrary code with the user's privileges. Note tha...

Ubuntu 6.06 LTS / 6.10 / 7.04 : php5 vulnerabilities (USN-485-1)

It was discovered that the PHP xmlrpc extension did not correctly check heap memory allocation sizes. A remote attacker could send a specially crafted request to a PHP application using xmlrpc and execute arbitrary code as the Apache user. CVE-2007-1864 Stefan Esser discovered a flaw in the rando...

Ubuntu 6.06 LTS / 6.10 / 7.04 : vim vulnerability (USN-505-1)

Ulf Harnhammar discovered that vim does not properly sanitise the 'helptagsone' function when running the 'helptags' command. By tricking a user into running a crafted help file, a remote attacker could execute arbitrary code with the user's privileges. Note that Tenable Network Security has...

Ubuntu 5.04 / 5.10 / 6.06 LTS : heartbeat vulnerability (USN-326-1)

Yan Rong Ge discovered that heartbeat did not set proper permissions for an allocated shared memory segment. A local attacker could exploit this to render the heartbeat service unavailable Denial of Service. Note that Tenable Network Security has extracted the preceding description block directly...

Ubuntu 6.06 LTS / 6.10 / 7.04 : linux-source-2.6.15, linux-source-2.6.17, linux-source-2.6.20 vulnerabilities (USN-518-1)

Evan Teran discovered that the Linux kernel ptrace routines did not correctly handle certain requests robustly. Local attackers could exploit this to crash the system, causing a denial of service. CVE-2007-3731 It was discovered that hugetlb kernels on PowerPC systems did not prevent the stack fr...

Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : dhcp vulnerability (USN-531-1)

Nahuel Riva and Gerardo Richarte discovered that the DHCP server did not correctly handle certain client options. A remote attacker could send malicious DHCP replies to the server and execute arbitrary code. Note that Tenable Network Security has extracted the preceding description block directly...

Ubuntu 6.06 LTS / 6.10 / 7.04 : tcpdump vulnerability (USN-492-1)

A flaw was discovered in the BGP dissector of tcpdump. Remote attackers could send specially crafted packets and execute arbitrary code with user privileges. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has...

Ubuntu 6.06 LTS : mysql-dfsg-5.0 vulnerabilities (USN-338-1)

Dmitri Lenev discovered that arguments of setuid SQL functions were evaluated in the security context of the functions' definer instead of its caller. An authenticated user with the privilege to call such a function could exploit this to execute arbitrary statements with the privileges of the...

Ubuntu 5.10 / 6.06 LTS / 6.10 : firefox vulnerability (USN-443-1)

A flaw was discovered in how Firefox handled PASV FTP responses. If a user were tricked into visiting a malicious FTP server, a remote attacker could perform a port-scan of machines within the user's network, leading to private information disclosure. Note that Tenable Network Security has...

Ubuntu 6.06 LTS / 6.10 : squid vulnerabilities (USN-414-1)

David Duncan Ross Palmer and Henrik Nordstrom discovered that squid incorrectly handled special characters in FTP URLs. Remote users with access to squid could crash the server leading to a denial of service. CVE-2007-0247 Erick Dantas Rotole and Henrik Nordstrom discovered that squid could end u...