Ubuntu 5.04 / 5.10 / 6.06 LTS : dovecot, exim4, postfix vulnerabilities (USN-288-3)

USN-288-1 described a PostgreSQL client vulnerability in the way the '''''''. If a client application uses one of the affected encodings and does not interpret multibyte characters, and an attacker supplies a specially cr...

Ubuntu 5.04 / 5.10 / 6.06 LTS : apache2 vulnerability (USN-328-1)

Mark Dowd discovered an off-by-one buffer overflow in the modrewrite module's ldap scheme handling. On systems which activate 'RewriteEngine on', a remote attacker could exploit certain rewrite rules to crash Apache, or potentially even execute arbitrary code this has not been verified...

Ubuntu 6.06 LTS / 6.10 / 7.04 : firefox vulnerabilities (USN-468-1)

Various flaws were discovered in the layout and JavaScript engines. By tricking a user into opening a malicious web page, an attacker could execute arbitrary code with the user's privileges. CVE-2007-2867, CVE-2007-2868 A flaw was discovered in the form autocomplete feature. By tricking a user in...

Ubuntu 6.06 LTS : mozilla-thunderbird vulnerabilities (USN-297-1)

Jonas Sicking discovered that under some circumstances persisted XUL attributes are associated with the wrong URL. A malicious website could exploit this to execute arbitrary code with the privileges of the user. MFSA 2006-35, CVE-2006-2775 Paul Nickerson discovered that content-defined setters o...

Ubuntu 5.04 / 5.10 / 6.06 LTS : libgd2 vulnerability (USN-298-1)

Xavier Roche discovered that libgd's function for reading GIF image data did not sufficiently verify its validity. Specially crafted GIF images could cause an infinite loop which used up all available CPU resources. Since libgd is often used in PHP and Perl web applications, this could lead to a...

Ubuntu 6.10 / 7.04 : hplip vulnerability (USN-530-1)

It was discovered that the hpssd tool of hplip did not correctly handle shell meta-characters. A local attacker could exploit this to execute arbitrary commands as the hplip user. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security...

Ubuntu 5.10 / 6.06 LTS : imagemagick vulnerability (USN-386-1)

Daniel Kobras discovered multiple buffer overflows in ImageMagick's SGI file format decoder. By tricking a user or an automated system into processing a specially crafted SGI image, this could be exploited to execute arbitrary code with the user's privileges. Note that Tenable Network Security ha...

Ubuntu 5.04 / 5.10 / 6.06 LTS : python2.3, python2.4 vulnerability (USN-359-1)

Benjamin C. Wiley Sittler discovered that Python's repr function did not properly handle UTF-32/UCS-4 strings. If an application uses repr on arbitrary untrusted data, this could be exploited to execute arbitrary code with the privileges of the python application. Note that Tenable Network Securi...

Ubuntu 5.10 / 6.06 LTS / 6.10 : tar vulnerability (USN-385-1)

Teemu Salmela discovered that tar still handled the deprecated GNUTYPENAMES record type. This record type could be used to create symlinks that would be followed while unpacking a tar archive. If a user or an automated system were tricked into unpacking a specially crafted tar file, arbitrary fil...

Ubuntu 6.06 LTS / 6.10 / 7.04 : openssl vulnerabilities (USN-522-1)

It was discovered that OpenSSL did not correctly perform Montgomery multiplications. Local attackers might be able to reconstruct RSA private keys by examining another user's OpenSSL processes. CVE-2007-3108 Moritz Jodeit discovered that OpenSSL's SSLgetsharedciphers function did not correctly...

Ubuntu 6.06 LTS / 6.10 / 7.04 : firefox vulnerabilities (USN-493-1)

A flaw was discovered in handling of 'about:blank' windows used by addons. A malicious website could exploit this to modify the contents, or steal confidential data such as passwords, of other web pages. CVE-2007-3844 Jesper Johansson discovered that spaces and double-quotes were not correctly...

Ubuntu 6.06 LTS / 6.10 : libnet-dns-perl vulnerabilities (USN-483-1)

Peter Johannes Holzer discovered that the Net::DNS Perl module had predictable sequence numbers. This could allow remote attackers to carry out DNS spoofing, leading to possible man-in-the-middle attacks. CVE-2007-3377 Steffen Ullrich discovered that the Net::DNS Perl module did not correctly...

Ubuntu 5.04 / 5.10 / 6.06 LTS : linux-source-2.6.10/-2.6.12/-2.6.15 vulnerabilities (USN-311-1)

A race condition was discovered in the doaddcounters functions. Processes which do not run with full root privileges, but have the CAPNETADMIN capability can exploit this to crash the machine or read a random piece of kernel memory. In Ubuntu there are no packages that are affected by this, so th...

Ubuntu 5.04 / 5.10 / 6.06 LTS : imagemagick vulnerability (USN-337-1)

Damian Put discovered a buffer overflow in imagemagick's SGI file format decoder. By tricking an user or automated system into processing a specially crafted SGI image, this could be exploited to execute arbitrary code with the user's privileges. Note that Tenable Network Security has extracted t...

Ubuntu 5.04 / 5.10 / 6.06 LTS : qt-x11-free vulnerability (USN-368-1)

An integer overflow was discovered in Qt's image loader. By processing a specially crafted image with an application that uses this library like Konqueror, a remote attacker could exploit this to execute arbitrary code with the application's privileges. Note that Tenable Network Security has...

Ubuntu 5.04 / 5.10 / 6.06 LTS : heartbeat vulnerability (USN-335-1)

Yan Rong Ge discovered that heartbeat did not sufficiently verify some packet input data, which could lead to an out-of-boundary memory access. A remote attacker could exploit this to crash the daemon Denial of Service. Note that Tenable Network Security has extracted the preceding description...

Ubuntu 6.06 LTS / 6.10 / 7.04 : t1lib vulnerability (USN-515-1)

It was discovered that t1lib does not properly perform bounds checking which can result in a buffer overflow vulnerability. An attacker could send specially crafted input to applications linked against t1lib which could result in a DoS or arbitrary code execution. Note that Tenable Network Securi...

Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : dhcp vulnerability (USN-531-1)

Nahuel Riva and Gerardo Richarte discovered that the DHCP server did not correctly handle certain client options. A remote attacker could send malicious DHCP replies to the server and execute arbitrary code. Note that Tenable Network Security has extracted the preceding description block directly...

Ubuntu 5.10 / 6.06 LTS / 6.10 : geoip vulnerability (USN-412-1)

Dean Gaudet discovered that the GeoIP update tool did not validate the filename responses from the update server. A malicious server, or man-in-the-middle system posing as a server, could write to arbitrary files with user privileges. Note that Tenable Network Security has extracted the preceding...

Ubuntu 6.06 LTS / 6.10 / 7.04 : firefox vulnerabilities (USN-490-1)

Various flaws were discovered in the layout and JavaScript engines. By tricking a user into opening a malicious web page, an attacker could execute arbitrary code with the user's privileges. CVE-2007-3734, CVE-2007-3735 Flaws were discovered in the JavaScript methods addEventListener and setTimeo...