The OVAL Repository 5.9 2012-01-27T05:05:16.950-05:00 Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 bind9 bind9: Internet Domain Name Server An attacker could send crafted input to Bind and cause it to crash. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 qemu-kvm qemu-kvm: Machine emulator and virtualizer QEMU could be made to run with adminstrator group privileges under certain circumstances. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 ecryptfs-utils ecryptfs-utils: ecryptfs cryptographic filesystem An attacker could use eCryptfs to unmount arbitrary locations and cause a denial of service. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 libsndfile libsndfile: Library for reading/writing audio files An application using libsndfile could be made to crash or possibly run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 linux linux: Linux kernel Multiple kernel flaws have been fixed. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 clamav clamav: anti-virus utility for Unix - command-line interface An attacker could send crafted input to ClamAV and cause it to crash. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 thunderbird thunderbird: mail/news client with RSS and integrated spam filter support Details: USN-1122-1 fixed vulnerabilities in Thunderbird for Lucid and Maverick. This update provides the corresponding fixes for Natty. Original advisory Thunderbird could be made to run programs as your login if it opened specially crafted mail. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 openjdk-6 openjdk-6b18 openjdk-6: Open Source Java implementation - openjdk-6b18: Open Source Java implementation Multiple OpenJDK 6 vulnerabilities have been fixed. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 libpng libpng: PNG file library Libpng could be made to run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 thunderbird thunderbird: mail/news client with RSS and integrated spam filter support Details: USN-1122-2 fixed vulnerabilities in Thunderbird on Ubuntu 11.04. A regression was introduced which caused Thunderbird to display an empty menu bar. This update fixes the problem. We apologize for the inconvenience. Original advisory An empty menu bar sometimes appeared after upgrade in USN-1122-2 SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 gimp gimp: The GNU Image Manipulation Program GIMP could be made to run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 firefox firefox: Safe and easy web browser from Mozilla Multiple Firefox vulnerabilities have been fixed SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 likewise-open likewise-open: Authentication services for Active Directory domains Local SQL injection vulnerability SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 icedtea-web openjdk-6 openjdk-6b18 icedtea-web: An implementation of the Java Network Launching Protocol - openjdk-6: Open Source Java implementation - openjdk-6b18: Open Source Java implementation An attacker could discover a user"s name or confuse a user into granting unintended access to files. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 dgm gdm: GNOME Display Manager GDM could be made to launch a browser and leak information about the system. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 mozvoikko ubufox webfav mozvoikko: Finnish spell-checker extension for Firefox - ubufox: Ubuntu Firefox specific configuration defaults and apt support - webfav: Firefox extension for saving web favorites Details: USN-1157-1 fixed vulnerabilities in Firefox. This update provides updated packages for use with Firefox 5. Original advisory This update provides provides packages compatible with Firefox 5. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 foomatic-filters foomatic-filters: OpenPrinting printer support - filters An attacker could send crafted input to Foomatic and cause it to run programs as the "lp" user. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 firefox firefox: Safe and easy web browser from Mozilla Details: USN-1157-1 fixed vulnerabilities in Firefox. Unfortunately, this update produced the side effect of pulling in Firefox on some systems that did not have it installed during a dist-upgrade due to changes in the Ubuntu language packs. This update fixes the problem. We apologize for the inconvenience. Original advisory Under certain circumstances, the updated translations could unintentionally install firefox. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 qemu-kvm qemu-kvm: Machine emulator and virtualizer A privileged attacker within a QEMU guest could cause QEMU to crash. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 libvirt libvirt: Libvirt virtualization toolkit Libvirt could be made to crash or read arbitrary files on the host. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 qemu-kvm qemu-kvm: Machine emulator and virtualizer A privileged attacker within a QEMU guest could cause QEMU to crash. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 apt apt: Advanced front-end for dpkg An attacker could trick APT into installing altered packages. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 libvirt libvirt: Libvirt virtualization toolkit An authenticated attacker could send crafted input to libvirt and cause it to crash. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 freetype freetype: FreeType 2 is a font engine library FreeType could be made to run programs as your login if it opened a specially crafted font file. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 libsoup2.4 libsoup2.4: HTTP client/server library for GNOME An attacker could send crafted URLs to a SoupServer application and obtain unintended access to files. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 libmodplug libmodplug: Library for mod music based on ModPlug libmodplug could be made to run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 dbus dbus: simple interprocess messaging system DBus could be made to crash if it processed a specially crafted message. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 thunderbird thunderbird: Mozilla Open Source mail and newsgroup client Multiple vulnerabilities were fixed in Thunderbird. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 tgt tgt: Linux SCSI target user-space tools An attacker could send crafted input to tgt and cause it to crash or run arbitrary programs. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 libxml2 libxml2: GNOME XML library libxml2 could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 logrotate logrotate: Log rotation utility An attacker could cause logrotate to run programs, stop working, or read and write arbitrary files. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 nagios3 nagios3: A host/service/network monitoring and management system An attacker could modify or steal data if you were tricked into clicking on a special link to Nagios. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 firefox firefox: Safe and easy web browser from Mozilla Multiple firefox vulnerabilities SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 samba samba: SMB/CIFS file, print, and login server for Unix An attacker could use a malicious URL to reconfigure Samba or steal information. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 curl curl: HTTP, HTTPS, and FTP client and client libraries Details: Richard Silverman discovered that when doing GSSAPI authentication, libcurl unconditionally performs credential delegation, handing the server a copy of the client"s security credential. Wesley Miaw discovered that when zlib is enabled, libcurl does not properly restrict the amount of callback data sent to an application that requests automatic decompression. This might allow an attacker to cause a denial of service via an application crash or possibly execute arbitrary code with the privilege of the application. This issue only affected Ubuntu 8.04 LTS and Ubuntu 10.04 LTS. USN 818-1 fixed an issue with curl"s handling of SSL certificates with zero bytes in the Common Name. Due to a packaging error, the fix for this issue was not being applied during the build. This issue only affected Ubuntu 8.04 LTS. We apologize for the error. Original advisory Multiple vulnerabilities in curl. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.04 is installed SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 8.04 is installed SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.10 is installed SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 10.04 Ubuntu 10.04 is installed SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED