Ubuntu 4.10 : mozilla-firefox vulnerabilities (USN-186-2)

USN-186-1 fixed several vulnerabilities in the Firefox browser for Ubuntu 5.04. This update provides fixed packages for Ubuntu 4.10, which was vulnerable to the same issues. The original advisory is available at http://www.ubuntu.com/usn/usn-186-1 Note that Tenable Network Security has extracted...

Ubuntu 4.10 / 5.04 : vim vulnerability (USN-154-1)

Georgi Guninski discovered that it was possible to construct Vim modelines that execute arbitrary shell commands by wrapping them in glob or expand function calls. If an attacker tricked an user to open a file with a specially crafted modeline, he could exploit this to execute arbitrary commands...

Ubuntu 4.10 / 5.04 : php4 vulnerability (USN-207-1)

A bug has been found in the handling of the openbasedir directive handling. Contrary to the specification, the value of openbasedir was handled as a prefix instead of a proper directory name even if it was terminated by a slash '/'. For example, this allowed PHP scripts to access the directory...

Ubuntu 4.10 : php4 vulnerabilities (USN-99-2)

USN-99-1 fixed a safe mode bypass which allowed malicious PHP scripts to circumvent path restrictions by creating a specially crafted directory whose length exceeded the capacity of the realpath function CAN-2004-1064. However, this caused severe regressions, some applications like SquirrelMail a...

Ubuntu 4.10 / 5.04 : apache2, libapache-mod-ssl vulnerabilities (USN-177-1)

Apache did not honour the 'SSLVerifyClient require' directive within a block if the surrounding block contained a directive 'SSLVerifyClient optional'. This allowed clients to bypass client certificate validation on servers with the above configuration. CAN-2005-2700 Filip Sneppe discovered a...

Ubuntu 4.10 / 5.04 : dpkg, ia32-libs, amd64-libs vulnerabilities (USN-151-2)

USN-148-1 and USN-151-1 fixed two security flaws in zlib, which could be exploited to cause Denial of Service attacks or even arbitrary code execution with malicious data streams. Most applications use the shared library provided by the 'zlib1g' package; however, some packages contain copies of t...

Ubuntu 4.10 : imlib+png2 vulnerabilities (USN-53-1)

Pavel Kankovsky discovered several buffer overflows in imlib. If an attacker tricked a user into loading a malicious image, he could exploit this to execute arbitrary code in the context of the user opening the image. Note that Tenable Network Security has extracted the preceding description bloc...

Ubuntu 4.10 : tiff vulnerability (USN-54-1)

Dmitry V. Levin discovered a buffer overflow in the 'tiffdump' utility. If an attacker tricked a user into processing a malicious TIFF image with tiffdump, they could cause a buffer overflow which at least causes the program to crash. However, it is not entirely clear whether this can be exploite...

Ubuntu 4.10 / 5.04 : php4, php4-universe fixed packages (USN-147-2)

USN-147-1 1 fixed a remote code execution vulnerability in the XMLRPC module of the PEAR library. Unfortunately the packages announced in USN-147-1 were faulty and shipped broken xmlrpc modules. The updated packages ship correct modules. We apologize for the inconvenience. 1...

Ubuntu 4.10 : xpdf, cupsys vulnerabilities (USN-64-1)

A buffer overflow has been found in the xpdf viewer. An insufficient input validation of the encryption key length could be exploited by an attacker providing a specially crafted PDF file which, when processed by xpdf, could result in abnormal program termination or the execution of attacker...

Ubuntu 4.10 : sharutils vulnerabilities (USN-102-1)

Shaun Colley discovered a buffer overflow in 'shar' that was triggered by output files specified with -o with names longer than 49 characters. This could be exploited to run arbitrary attacker specified code on systems that automatically process uploaded files with shar. Ulf Harnhammar discovered...

Ubuntu 5.10 : inkscape vulnerability (USN-217-1)

A buffer overflow has been discovered in the SVG importer of Inkscape. By tricking an user into opening a specially crafted SVG image this could be exploited to execute arbitrary code with the privileges of the Inkscape user. Note that Tenable Network Security has extracted the preceding...

Ubuntu 5.04 : mozilla-firefox bug fix (USN-124-2)

USN-124-1 fixed several vulnerabilities of Firefox. After that update, several users experienced XML errors on various actions like adding bookmarks see https://bugzilla.ubuntu.com/showbug.cgi?id=10643. After installing these new packages and restarting the browser, these problems should be fixed...

Ubuntu 4.10 : imagemagick vulnerability (USN-62-1)

Andrei Nigmatulin discovered a potential buffer overflow in the PhotoShop Document image decoding function of ImageMagick. Decoding a malicious PSD image which specifies more than the allowed 24 channels might result in execution of arbitrary code with the user's privileges. Since ImageMagick can...

Ubuntu 4.10 : squid vulnerability (USN-111-1)

A remote Denial of Service vulnerability has been discovered in Squid. If the remote end aborted the connection during a PUT or POST request, Squid tried to free an already freed part of memory, which eventually caused the server to crash. Note that Tenable Network Security has extracted the...

Ubuntu 4.10 : imlib2 vulnerabilities (USN-55-1)

Recently, Pavel Kankovsky discovered several buffer overflows in imlib which were fixed in USN-53-1. It was found that imlib2 was vulnerable to similar issues. If an attacker tricked a user into loading a malicious XPM or BMP image, he could exploit this to execute arbitrary code in the context o...

Ubuntu 4.10 : libdbi-perl vulnerabilities (USN-70-1)

Javier Fernandez-Sanguino Pena from the Debian Security Audit Project discovered that the module DBI::ProxyServer in Perl's DBI library created a PID file in an insecure manner. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking...

Ubuntu 4.10 : mysql-dfsg vulnerability (USN-109-1)

USN-32-1 fixed a database privilege escalation vulnerability; original advisory text : 'If a user was granted privileges to a database with a name containing an underscore '', the user also gained the ability to grant privileges to other databases with similar names. CAN-2004-0957' Recently a...

Ubuntu 4.10 : python2.2, python2.3 vulnerability (USN-73-1)

The Python developers discovered a flaw in the SimpleXMLRPCServer module. Python XML-RPC servers that used the registerinstance method to register an object, but do not have a dispatch method, allowed remote users to access or change function internals using the im and func attributes. Note that...

Ubuntu 4.10 / 5.04 : apache vulnerability (USN-160-2)

USN-160-1 fixed two vulnerabilities in the Apache 2 server. The old Apache 1 server was also vulnerable to one of the vulnerabilities CAN-2005-2088. Please note that Apache 1 is not officially supported in Ubuntu it is in the 'universe' component of the archive. For reference, this is the relevan...