The OVAL Repository 5.4 2015-09-03T06:27:59.699-04:00 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 acpid acpid could be made to stall under certain conditions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 puppet The Puppet master server could be impersonated in certain configurations. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 cifs-utils An attacker could trick cifs-utils into corrupting the system mtab file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 9.10 Ubuntu 10.04 Ubuntu 10.10 italc Stphane Graber discovered that the iTALC private keys shipped with the Edubuntu Live DVD were not correctly regenerated once Edubuntu was installed. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 8.04 pam PAM could be made to crash or run programs as an administrator. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 krb5 Several denial of service issues were fixed in the Kerberos Key Distribution Center (KDC). Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 xorg-server The X server could be made to crash or run programs as an administrator. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 9.10 Ubuntu 10.04 Ubuntu 10.10 firefox firefox-3.0 firefox-3.5 xulrunner-1.9.2 It was discovered that several invalid HTTPS certificates were issued and revoked. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 ffmpeg FFmpeg could be made to run programs as your login if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 thunderbird Multiple vulnerabilities were fixed in Thunderbird. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 linux Multiple kernel flaws have been fixed. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 8.04 php5 Several security issues were fixed in PHP. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 mutt An attacker could trick mutt into trusting a rogue server. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 gimp GIMP could be made to run programs as your login if it opened a specially crafted GIF file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 8.04 apt An attacker could trick APT into installing altered packages. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 puppet Puppet could be made to overwrite files and run programs with administrator privileges. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 quassel An unprivileged user could read files in the data and logging directories, including an automatically generated SSL certificate, used by the quasselcore daemon. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 linux-ti-omap4 Several security issues were fixed in the kernel. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 qt4-x11 A certificate authority mis-issued fraudulent certificates. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 xorg-server The X server could be made to crash, run programs as an administrator, or read arbitrary files. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 linux-ti-omap4 Multiple kernel flaws have been fixed. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 eucalyptus rampart An attacker could send crafted input to Eucalyptus to run commands as a valid user. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 firefox xulrunner-1.9.2 Multiple vulnerabilities have been fixed in Firefox and Xulrunner. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 8.04 postgresql-8.4 postgresql-8.3 PostgreSQL incorrectly handled blowfish passwords. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 puppet An attacker could send crafted input to puppet and cause it to overwrite files. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 empathy Empathy could be made to run programs or display webpages via specially crafted nicknames. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 linux Several security issues were fixed in the kernel. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 ca-certificates-java A certificate authority mis-issued fraudulent certificates. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 linux-mvl-dove The system could be made to crash under certain conditions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 kde4libs KDE-Libs could improperly display fraudulent security certificates. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 8.04 gnutls26 gnutls13 The GnuTLS library could be made to crash under certain conditions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 linux-mvl-dove Several security issues were fixed in the kernel. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 8.04 tiff The TIFF library could be made to crash or run programs as your login if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 8.04 backuppc BackupPC could be made to expose sensitive information over the network. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 8.04 libpng libpng could be made to crash or run programs as your login if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Linux linux-mvl-dove: Linux kernel for DOVE The system could be made to crash or run programs as an administrator. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Linux linux: Linux kernel Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 linux-ti-omap4 linux-ti-omap4: Linux kernel for OMAP4 Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 PHP php5: HTML-embedded scripting language interpreter Details: USN 1358-1 fixed multiple vulnerabilities in PHP. The fix for CVE-2012-0831 introduced a regression where the state of the magic_quotes_gpc setting was not correctly reflected when calling the ini_get function. We apologize for the inconvenience. Original advisory USN 1358-1 introduced a regression in PHP. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 OpenSSL openssl: Secure Socket Layer binary and related cryptographic tools Multiple vulnerabilities exist in OpenSSL that could expose sensitive information or cause applications to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Evince evince: Document viewer Evince could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 libpng libpng: PNG file library libpng could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Thunderbird thunderbird: Mozilla Open Source mail and newsgroup client Details: USN-1367-1 fixed vulnerabilities in libpng. This provides the corresponding update for Thunderbird. Original advisory Thunderbird could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 OpenJDK openjdk-6b18: Open Source Java implementation Details: USN 1373-1 fixed vulnerabilities in OpenJDK 6 in Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04 for all architectures except for ARM . This provides the corresponding OpenJDK 6 update for use with the ARM architecture in Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04. Original advisory Multiple vulnerabilities in OpenJDK 6 for the ARM architecture have been fixed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 libxml2 libxml2: GNOME XML library libxml2 could be made to cause a denial of service by consuming excessive CPU resources. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 Xulrunnner xulrunner-1.9.2: Mozilla Gecko runtime environment Several security issues were fixed in Xulrunner. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 PHP php5: HTML-embedded scripting language interpreter PHP could be made to crash or disclose sensitive information if it processed a specially crafted image file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 libxml2 libxml2: GNOME XML library Applications using libxml2 could be made to crash or run programs as your login if they opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Django python-django: High-level Python web development framework Applications using Django could be made to crash or expose sensitive information. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Linux linux: Linux kernel Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 FreeType freetype: FreeType 2 is a font engine library FreeType could be made to crash or run programs as your login if it opened a specially crafted font file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Linux linux: Linux kernel Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 t1lib t1lib: Type 1 font rasterizer library - runtime t1lib could be made to crash or run programs as your login if it opened a specially crafted font file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Tomcat tomcat6: Servlet and JSP engine Tomcat could be made to crash or expose sensitive information over the network. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 OpenLDAP openldap: OpenLDAP utilities An OpenLDAP server could potentially be made to crash if it received specially crafted network traffic from an authenticated user. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 libpng libpng: PNG file library libpng could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 ubufox ubufox: Ubuntu Firefox specific configuration defaults and apt support - webfav: Firefox extension for saving web favorites Details: USN-1355-1 fixed vulnerabilities in Firefox. This update provides updated ubufox and webfav packages for use with the latest Firefox. Original advisory This update provides compatible ubufox and webfav packages for the latest Firefox. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 cvs cvs: Concurrent Versions System cvs could be made to crash or run programs as your login if it connected to a malicious proxy server. SecPod Team DRAFT INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 ICU icu: International Components for Unicode library ICU could be made to crash or run programs as your login if it opened specially crafted data. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 libvorbis libvorbis: The Vorbis General Audio Compression Codec libvorbis could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Linux linux-ti-omap4: Linux kernel for OMAP4 Multiple kernel flaws have been fixed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Mozvoikko mozvoikko: Finnish spell-checker extension for Firefox Details: USN-1355-1 fixed vulnerabilities in Firefox. This update provides an updated Mozvoikko package for use with the latest Firefox. Original advisory This update provides compatible Mozvoikko packages for the latest Firefox. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 bzip2 bzip2: high-quality block-sorting file compressor - utilities Executables compressed by bzexe could be made to run programs as your login. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Thunderbird thunderbird: Mozilla Open Source mail and newsgroup client Multiple vulnerabilities have been fixed in Thunderbird. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 Firefox firefox: Mozilla Open Source web browser - xulrunner-1.9.2: Mozilla Gecko runtime environment Multiple vulnerabilities have been fixed in Firefox and Xulrunner. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 librsvg librsvg: Rendering library for SVG files SVG image rendering library has had flaws fixed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 Bind bind9: Internet Domain Name Server Bind could be made to crash if it received specially crafted network traffic. SecPod Team DRAFT INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Linux linux-ti-omap4: Linux kernel for OMAP4 Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 Apache apache2: Apache HTTP server A remote attacker could send crafted input to Apache and cause it to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Python python3.1: An interactive high-level object-oriented language - python3.2: An interactive high-level object-oriented language Applications using certain Python 3 modules could be made to crash or expose sensitive information over the network. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 OpenJDK openjdk-6: Open Source Java implementation - openjdk-6b18: Open Source Java implementation Details: USN-1263-1 fixed vulnerabilities in OpenJDK 6. The upstream patch for the chosen plaintext attack on the block-wise AES encryption algorithm introduced a regression that caused TLS/SSL connections to fail when using certain algorithms. This update fixes the problem. We apologize for the inconvenience. Original advisory USN-1263-1 caused a regression when using OpenJDK 6�s SSL/TLS implementation. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 OpenJDK openjdk-6: Open Source Java implementation Multiple OpenJDK 6 vulnerabilities have been fixed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Firefox firefox: Mozilla Open Source web browser Several security issues were fixed in Firefox. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 IcedTea-Web icedtea-web: A web browser plugin to execute Java applets - openjdk-6: Open Source Java implementation - openjdk-6b18: Open Source Java implementation Multiple OpenJDK 6 and IcedTea-Web vulnerabilities have been fixed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 Apache apache2: Apache HTTP server Several security issues were fixed in the Apache HTTP Server. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 gdm-guest-session gdm-guest-session: gdm extension for guest session gdm-guest-session could be made to delete files as the administrator. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.10 Software software-center: Utility for browsing, installing, and removing software An attacker could trick Software Center into installing altered packages and repositories or exposing sensitive information over the network. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Linux linux-mvl-dove: Linux kernel for DOVE Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Linux linux: Linux kernel Multiple kernel flaws have been fixed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 ubufox ubufox: Finnish spell-checker extension for Firefox Details: USN-1400-1 fixed vulnerabilities in Firefox. This update provides an updated ubufox package for use with the latest Firefox. Original advisory This update provides compatible ubufox packages for the latest Firefox. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 Update-Manager update-manager: GNOME application that manages apt updates Details: USN-1284-1 fixed vulnerabilities in Update Manager. One of the fixes introduced a regression for Kubuntu users attempting to upgrade to a newer Ubuntu release. This update fixes the problem. We apologize for the inconvenience. Original advisory USN-1284-1 introduced a regression in Update Manager. SecPod Team DRAFT INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Quassel quassel: KDE/Qt-based IRC client A remote attacker could send crafted input to Quassel and cause it to crash. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 JasPer jasper: Library for manipulating JPEG-2000 files JasPer could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.10 Puppet puppet: Centralized configuration management Puppet would allow unintended access to resources over the network. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 httplib2 python-httplib2: comprehensive HTTP client library written for Python httplib2 could be made to expose sensitive information over the network. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 Firefox firefox: Mozilla Open Source web browser - xulrunner-1.9.2: Mozilla Gecko runtime environment Multiple vulnerabilities have been fixed in Firefox and Xulrunner. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 GNU eglibc: Embedded GNU C Library: sources - glibc: GNU C Library: Documentation Multiple vulnerabilities were discovered and fixed in the GNU C Library. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 PHP php5: HTML-embedded scripting language interpreter Multiple vulnerabilities in PHP. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Thunderbird thunderbird: Mozilla Open Source mail and newsgroup client Several security issues were fixed in Thunderbird. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Quagga quagga: BGP/OSPF/RIP routing daemon Quagga could be made to crash or run programs if it received specially crafted network traffic. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Puppet puppet: Centralized configuration management Puppet could be made to overwrite files and run programs with administrator privileges. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 Apache apache2: Apache HTTP server - apache2-mpm-itk: multiuser MPM for Apache 2.2 Details: It was discovered that the mod_proxy module in Apache did not properly interact with the RewriteRule and ProxyPassMatch pattern matches in the configuration of a reverse proxy. This could allow remote attackers to contact internal webservers behind the proxy that were not intended for external exposure. Stefano Nichele discovered that the mod_proxy_ajp module in Apache when used with mod_proxy_balancer in certain configurations could allow remote attackers to cause a denial of service via a malformed HTTP request. Samuel Montosa discovered that the ITK Multi-Processing Module for Apache did not properly handle certain configuration sections that specify NiceValue but not AssignUserID, preventing Apache from dropping privileges correctly. This issue only affected Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04. USN 1199-1 fixed a vulnerability in the byterange filter of Apache. The upstream patch introduced a regression in Apache when handling specific byte range requests. This update fixes the issue. Original advisory Multiple vulnerabilities and a regression were fixed in the Apache HTTP server. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 acpid acpid: Advanced Configuration and Power Interface daemon Several security issues were fixed in acpid. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 vsftpd vsftpd: FTP server written for security Vsftpd or other applications could be made to crash if vsftpd received specially crafted network traffic. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Linux linux-mvl-dove: Linux kernel for DOVE Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 Xulrunner xulrunner-1.9.2: Mozilla Gecko runtime environment Details: USN-1367-1 fixed vulnerabilities in libpng. This provides the corresponding update for Xulrunner. Original advisory Xulrunner based applications could be made to crash or run programs as your login if they opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Linux linux-ti-omap4: Linux kernel for OMAP4 Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 CA ca-certificates: Common CA certificates Details: USN-1197-1 addressed an issue in Firefox and Xulrunner pertaining to the Dutch Certificate Authority DigiNotar mis-issuing fraudulent certificates. This update provides the corresponding update for ca-certificates. Original advisory A certificate authority mis-issued fraudulent certificates. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 PostgreSQL postgresql-9.1: Object-relational SQL database - postgresql-8.4: Object-relational SQL database - postgresql-8.3: Object-relational SQL database Several security issues were fixed in PostgreSQL. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Ruby ruby1.8: Interpreter of object-oriented scripting language Ruby 1.8 Several security issues were fixed in ruby1.8. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 8.04 Ubuntu 10.04 Ghostscript ghostscript: The GPL Ghostscript PostScript/PDF interpreter Ghostscript could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 devscripts devscripts: scripts to make the life of a Debian Package maintainer easier debdiff, a part of devscripts, could be made to run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 Update update-manager: GNOME application that manages apt updates - update-notifier: Daemon which notifies about package updates Update Manager could be made to overwrite files as the administrator. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 FreeType freetype: FreeType 2 is a font engine library FreeType could be made to crash or run programs as your login if it opened a specially crafted font file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Pidgin pidgin: multi-protocol instant messaging client Pidgin could be made to crash if it received specially crafted network traffic. SecPod Team DRAFT INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Linux linux: Linux kernel Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 t1lib t1lib: Type 1 font rasterizer library - runtime t1lib could be made to crash or run programs as your login if it opened a specially crafted font file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 eCryptfs ecryptfs-utils: ecryptfs cryptographic filesystem eCryptfs could be tricked into mounting and unmounting arbitrary locations, and possibly disclose confidential information. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Linux linux-ti-omap4: Linux kernel for OMAP4 Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 CUPS cups: Common UNIX Printing System - server - cupsys: Common UNIX Printing System - server An attacker could send crafted print jobs to CUPS and cause it to crash or run programs. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Tomcat tomcat6: Servlet and JSP engine Tomcat could be made to crash or expose sensitive information if it received specially crafted network traffic. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 KDE kdeutils: KDE general-purpose utilities Ark could be made to remove files. SecPod Team DRAFT INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 QEMU qemu-kvm: Machine emulator and virtualizer A remote attacker could cause QEMU to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Firefox firefox: Mozilla Open Source web browser - xulrunner-1.9.2: Mozilla Gecko runtime environment Details: USN-1197-1 partially addressed an issue with Dutch Certificate Authority DigiNotar mis-issuing fraudulent certificates. This update actively distrusts the DigiNotar root certificate as well as several intermediary certificates. Also included in this list of distrusted certificates are the Staat der Nederlanden root certificates. Original advisory A certificate authority issued fraudulent certificates. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.10 curl curl: HTTP, HTTPS, and FTP client and client libraries curl could be tricked into injecting arbitrary data if it handled a malicious URL. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Firefox firefox: Mozilla Open Source web browser Details: USN-1367-1 fixed vulnerabilities in libpng. This provides the corresponding update for Firefox. Original advisory Firefox could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Linux linux-mvl-dove: Linux kernel for DOVE Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Linux linux-mvl-dove: Linux kernel for DOVE Multiple kernel flaws have been fixed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Thunderbird thunderbird: Mozilla Open Source mail and newsgroup client Details: USN-1401-1 fixed vulnerabilities in Xulrunner. This update provides the corresponding fixes for Thunderbird. Original advisory Several security issues were fixed in Thunderbird. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Software software-properties: manage the repositories that you install software from Software Properties could be tricked into installing arbitrary PPA GPG keys. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 libmodplug libmodplug: Library for mod music based on ModPlug libmodplug could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 MySQL mysql-5.1: MySQL database - mysql-dfsg-5.1: MySQL database - mysql-dfsg-5.0: MySQL database Several security issues were fixed in MySQL. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Linux linux: Linux kernel Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Linux linux: Linux kernel Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 PyPAM python-pam: A Python interface to the PAM library PyPAM could be made to crash or possibly run programs if it processed a specially crafted password. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 libarchive libarchive: Library to read/write archive files libarchive could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Thunderbird thunderbird: Mozilla Open Source mail and newsgroup client Multiple vulnerabilities have been fixed in Thunderbird. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Thunderbird thunderbird: Mozilla Open Source mail and newsgroup client Details: USN-1197-1 fixed a vulnerability in Firefox with regard to the DigiNotar certificate authority. This update provides the corresponding updates for Thunderbird. We are aware that the DigiNotar Root CA Certificate is still shown as trusted in the Thunderbird certificate manager. This is due to Thunderbird using the system version of the Network Security Service libraries . Thunderbird will actively distrust any certificate signed by this DigiNotar Root CA certificate. This means that users will still get an untrusted certificate warning when accessing a service through Thunderbird that presents a certificate signed by this DigiNotar Root CA certificate. Original advisory A certificate authority issued fraudulent certificates. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 NSS nss: Network Security Service libraries Details: USN-1197-1 and USN-1197-3 addressed an issue in Firefox and Xulrunner pertaining to the Dutch Certificate Authority DigiNotar mis-issuing fraudulent certificates. This update provides the corresponding update for the Network Security Service libraries . Original advisory A certificate authority mis-issued fraudulent certificates. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Firefox firefox: Mozilla Open Source web browser A security vulnerability has been fixed in Firefox. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 DHCP isc-dhcp: DHCP server and client - dhcp3: DHCP server and client An attacker could send crafted input to DHCP and cause it to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 Xulrunner xulrunner-1.9.2: Mozilla Gecko runtime environment Several security issues were fixed in Firefox. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 radvd radvd: Router Advertisement Daemon radvd could be made to crash or overwrite certain files if it received specially crafted network traffic. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 FFmpeg ffmpeg: multimedia player, server and encoder FFmpeg could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 libXfont libxfont: X11 font rasterisation library libXfont could be made to run programs as an administrator if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 APT apt: Advanced front-end for dpkg Details: It was discovered that APT incorrectly handled the Verify-Host configuration option. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could potentially be used to steal repository credentials. This issue only affected Ubuntu 10.04 LTS and 10.10. USN-1215-1 fixed a vulnerability in APT by disabling the apt-key net-update option. This update re-enables the option with corrected verification. Original advisory APT could be made to expose sensitive information over the network. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Firefox firefox: Mozilla Open Source web browser Several security issues were fixed in Firefox. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 X.Org xorg: X.Org X Window System X could be made to start by a user who lacked appropriate permissions. SecPod Team DRAFT INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 ClamAV clamav: Anti-virus utility for Unix ClamAV could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.10 is installed SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Firefox firefox: Mozilla Open Source web browser - xulrunner-1.9.2: Mozilla Gecko runtime environment A certificate authority issued fraudulent certificates. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 bind9 bind9: Internet Domain Name Server An attacker could send crafted input to Bind and cause it to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 webkit webkit: Web content engine library for GTK+ Multiple security vulnerabilities were fixed in WebKit. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 qemu-kvm qemu-kvm: Machine emulator and virtualizer QEMU could be made to run with adminstrator group privileges under certain circumstances. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 ecryptfs-utils ecryptfs-utils: ecryptfs cryptographic filesystem An attacker could use eCryptfs to unmount arbitrary locations and cause a denial of service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 libsndfile libsndfile: Library for reading/writing audio files An application using libsndfile could be made to crash or possibly run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 firefox xulrunner-1.9.2 firefox: safe and easy web browser from Mozilla - xulrunner-1.9.2: XUL + XPCOM application runner Multiple Vulnerabilities were fixed in Firefox and Xulrunner SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 openjdk-6 openjdk-6b18 openjdk-6: Open Source Java implementation - openjdk-6b18: Open Source Java implementation Multiple OpenJDK 6 vulnerabilities have been fixed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 libpng libpng: PNG file library Libpng could be made to run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 gimp gimp: The GNU Image Manipulation Program GIMP could be made to run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 likewise-open likewise-open: Authentication services for Active Directory domains Local SQL injection vulnerability SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 icedtea-web openjdk-6 openjdk-6b18 icedtea-web: An implementation of the Java Network Launching Protocol - openjdk-6: Open Source Java implementation - openjdk-6b18: Open Source Java implementation An attacker could discover a user�s name or confuse a user into granting unintended access to files. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 rsync rsync: fast remote file copy program rsync could be made to crash or run programs as your login if it connected to a malicious server. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 exim4 exim4: Exim mail transfer agent Exim could be made to run arbitrary code under some conditions. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 foomatic-filters foomatic-filters: OpenPrinting printer support - filters An attacker could send crafted input to Foomatic and cause it to run programs as the "lp" user. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 dovecot dovecot: IMAP and POP3 email server an attacker could send a crafted email message that could disrupt email service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 qemu-kvm qemu-kvm: Machine emulator and virtualizer a privileged attacker within a QEMU guest could cause QEMU to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 firefox firefox-3.0 firefox-3.5 xulrunner-1.9.2 firefox: safe and easy web browser from Mozilla - xulrunner-1.9.2: XUL + XPCOM application runner - firefox-3.5: safe and easy web browser from Mozilla - firefox-3.0: safe and easy web browser from Mozilla Multiple vulnerabilities in Firefox and Xulrunner SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 thunderbird thunderbird: mail/news client with RSS and integrated spam filter support Thunderbird could be made to run programs as your login if it opened specially crafted mail. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 6.06 Ubuntu 9.10 Ubuntu 10.04 php5 php5: HTML-embedded scripting language interpreter Multiple vulnerabilities in PHP. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 6.06 Ubuntu 9.10 Ubuntu 10.04 openslp openslp-dfsg openslp-dfsg: OpenSLP is an implementation of the Service Location Protocol - openslp: OpenSLP is an implementation of the Service Location Protocol An attacker could send crafted input to OpenSLP and cause it to hang. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 firefox firefox: safe and easy web browser from Mozilla Details: USN-1149-1 fixed vulnerabilities in Firefox. Unfortunately, a regression was introduced that prevented cookies from being stored properly when the hostname was a single character. This update fixes the problem. We apologize for the inconvenience. Original advisory In rare instances, Firefox could have trouble accessing some websites. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 8.04 Ubuntu 10.04 pam pam: Pluggable Authentication Modules An attacker could cause PAM to read or delete arbitrary files or cause it to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 libvirt libvirt: Libvirt virtualization toolkit Libvirt could be made to crash or read arbitrary files on the host. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 qemu-kvm qemu-kvm: Machine emulator and virtualizer A privileged attacker within a QEMU guest could cause QEMU to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 6.06 Ubuntu 10.04 postfix postfix: High-performance mail transport agent An attacker could send crafted input to Postfix and cause it to crash or run programs. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 libvirt libvirt: Libvirt virtualization toolkit An authenticated attacker could send crafted input to libvirt and cause it to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 6.06 Ubuntu 9.10 Ubuntu 10.04 php php5: HTML-embedded scripting language interpreter Details: USN 1126-1 fixed several vulnerabilities in PHP. The fix for CVE-2010-4697 introduced an incorrect reference counting regression in the Zend engine that caused the PHP interpreter to segfault. This regression affects Ubuntu 6.06 LTS and Ubuntu 8.04 LTS. The fixes for CVE-2011-1072 and CVE-2011-1144 introduced a regression in the PEAR installer that prevented it from creating its cache directory and reporting errors correctly. We apologize for the inconvenience. Original advisory USN 1126-1 introduced two regressions in PHP. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 linux-ti-omap4 linux-ti-omap4: Linux kernel for OMAP4 devices Multiple security flaws have been fixed in the OMAP4 port of the Linux kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 dhcp3 dhcp3: DHCP Client Details: USN-1108-1 fixed vulnerabilities in DHCP. Due to an error, the patch to fix the vulnerability was not properly applied on Ubuntu 9.10 and higher. This update fixes the problem. Original advisory An attacker�s DHCP server could send crafted responses to your computer and cause it to run programs as root. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 6.06 Ubuntu 10.04 perl perl: Larry Wall�s Practical Extraction and Report Language An attacker could send crafted input to Perl and bypass intended restrictions. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 usb-creator usb-creator: create a startup disk using a CD or disc image An attacker could use usb-creator to unmount arbitrary disks or perform other unauthorized disk operations. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 linux linux: Linux kernel Multiple kernel flaws have been fixed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 linux-mvl-dove linux-mvl-dove: Linux kernel for DOVE Multiple kernel flaws have been fixed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 kdenetwork kdenetwork: networking applications for KDE 4 An attacker could overwrite files owned by the user if KGet opened a crafted metalink file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 freetype freetype: FreeType 2 is a font engine library FreeType could be made to run programs as your login if it opened a specially crafted font file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 apturl apturl: installs packages using the apt protocol apturl could be made to cause your desktop to crash if it opened a very long URL. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 kde4libs kde4libs: KDE 4 core applications An attacker could send crafted input to Konqueror to view sensitive information. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 8.04 Ubuntu 10.04 vino vino: VNC server for GNOME An attacker could send crafted input to Vino and cause it to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 8.04 Ubuntu 10.04 nbd nbd: Network Block Device protocol An attacker could send crafted input to NBD and cause it to crash or to run arbitrary programs. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 rdesktop rdesktop: RDP client for Windows NT/2000 Terminal Server An attacker could access your files if rdesktop connected to a malicious server. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 dhcp3 Sebastian Krahmer discovered that the dhclient utility incorrectly filtered crafted responses. An attacker could use this flaw with a malicious DHCP server to execute arbitrary code, resulting in root privilege escalation. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 qt4-x11 It was discovered that several invalid HTTPS certificates were issued and revoked. An attacker could exploit these to perform a man in the middle attack to view sensitive information or alter encrypted communications. These were placed on the certificate blacklist to prevent their misuse. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 tomcat6 It was discovered that the Tomcat SecurityManager did not properly restrict the working directory. An attacker could use this flaw to read or write files outside of the intended working directory. It was discovered that Tomcat did not properly escape certain parameters in the Manager application which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. It was discovered that Tomcat incorrectly enforced the maxHttpHeaderSize limit in certain configurations. A remote attacker could use this flaw to cause Tomcat to consume all available memory, resulting in a denial of service SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 libvirt Petr Matousek discovered that libvirt did not always honor read-only connections. An attacker who is authorized to connect to the libvirt daemon could exploit this to cause a denial of service via application crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 gdm Sebastian Krahmer discovered that GDM did not properly drop privileges when handling the cache directories used to store users" dmrc and face icon files. This could allow a local attacker to change the ownership of arbitrary files, thereby gaining root privileges. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 vsftpd It was discovered that vsftpd incorrectly handled certain glob expressions. A remote authenticated user could use a crafted glob expression to cause vftpd to consume all resources, leading to a denial of service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 subversion subversion: Advanced version control system an attacker could send crafted input to the Subversion mod_dav_svn module for Apache and cause it to crash or gain access to restricted files. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 gimp It was discovered that GIMP incorrectly handled malformed data in certain plugin configuration files. If a user were tricked into opening a specially crafted plugin configuration file, an attacker could cause GIMP to crash, or possibly execute arbitrary code with the user�s privileges. The default compiler options for affected releases should reduce the vulnerability to a denial of service. It was discovered that GIMP incorrectly handled malformed PSP image files. If a user were tricked into opening a specially crafted PSP image file, an attacker could cause GIMP to crash, or possibly execute arbitrary code with the user�s privileges SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 subversion Philip Martin discovered that the Subversion mod_dav_svn module for Apache did not properly handle certain requests containing a lock token. A remote attacker could use this flaw to cause the service to crash, leading to a denial of service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 tex-common Mathias Svensson discovered that the tex-common package contains an insecure shell_escape_commands configuration item. If a user or automated system were tricked into opening a specially crafted TeX file, a remote attacker could execute arbitrary code with user privileges. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 language-selector language-selector: Language selector for Ubuntu Linux Local users could gain root access via the language-selector. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 policykit-1 policykit-1: framework for managing administrative policies and privileges Local users could gain root access by using the pkexec tool in PolicyKit. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 libsoup2.4 libsoup2.4: HTTP client/server library for GNOME An attacker could send crafted URLs to a SoupServer application and obtain unintended access to files. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 tiff tiff: TIFF manipulation and conversion tools The TIFF library could be made to run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 libmodplug libmodplug: Library for mod music based on ModPlug libmodplug could be made to run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 linux Dan Rosenberg discovered that multiple terminal ioctls did not correctly initialize structure memory. A local attacker could exploit this to read portions of kernel stack memory, leading to a loss of privacy. Dan Rosenberg discovered that the socket filters did not correctly initialize structure memory. A local attacker could create malicious filters to read portions of kernel stack memory, leading to a loss of privacy. Dan Rosenberg discovered that the SCSI subsystem did not correctly validate iov segments. A local attacker with access to a SCSI device could send specially crafted requests to crash the system, leading to a denial of service. Dan Rosenberg discovered that the RDS protocol did not correctly check ioctl arguments. A local attacker could exploit this to crash the system, leading to a denial of service SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 openoffice.org Charlie Miller discovered several heap overflows in PPT processing. If a user or automated system were tricked into opening a specially crafted PPT document, a remote attacker could execute arbitrary code with user privileges. Ubuntu 10.10 was not affected. Marc Schoenefeld discovered that directory traversal was not correctly handled in XSLT, OXT, JAR, or ZIP files. If a user or automated system were tricked into opening a specially crafted document, a remote attacker overwrite arbitrary files, possibly leading to arbitrary code execution with user privileges. Dan Rosenberg discovered multiple heap overflows in RTF and DOC processing. If a user or automated system were tricked into opening a specially crafted RTF or DOC document, a remote attacker could execute arbitrary code with user privileges. Dmitri Gribenko discovered that OpenOffice.org did not correctly handle LD_LIBRARY_PATH in various tools. If a local attacker tricked a user or automated system into using OpenOffice.org from an attacker-controlled directory, they could execute arbitrary code with user privileges. Marc Schoenefeld discovered that OpenOffice.org did not correctly process PNG images. If a user or automated system were tricked into opening a specially crafted document, a remote attacker could execute arbitrary code with user privileges. It was discovered that OpenOffice.org did not correctly process TGA images. If a user or automated system were tricked into opening a specially crafted document, a remote attacker could execute arbitrary code with user privileges SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 exim4 It was discovered that Exim contained a design flaw in the way it processed alternate configuration files. An attacker that obtained privileges of the "Debian-exim" user could use an alternate configuration file to obtain root privileges. It was discovered that Exim incorrectly handled certain return values when handling logging. A local attacker could use this flaw to obtain root privileges. Dan Rosenberg discovered that Exim incorrectly handled writable sticky-bit mail directories. If Exim were configured in this manner, a local user could use this flaw to cause a denial of service or possibly gain privileges. This issue only applied to Ubuntu 6.06 LTS, 8.04 LTS, 9.10, and 10.04 LTS. Dan Rosenberg discovered that Exim incorrectly handled MBX locking. If Exim were configured in this manner, a local user could use this flaw to cause a denial of service or possibly gain privileges. This issue only applied to Ubuntu 6.06 LTS, 8.04 LTS, 9.10, and 10.04 LTS SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 dbus dbus: simple interprocess messaging system DBus could be made to crash if it processed a specially crafted message. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 8.04 Ubuntu 10.04 pam pam: Pluggable Authentication Modules Details: USN-1140-1 fixed vulnerabilities in PAM. A regression was found that caused cron to stop working with a "Module is unknown" error. As a result, systems configured with automatic updates will not receive updates until cron is restarted, these updates are installed or the system is rebooted. This update fixes the problem. We apologize for the inconvenience. Original advisory The USN-1140-1 PAM update caused cron to stop working. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 mailman It was discovered that Mailman did not properly sanitize certain fields, resulting in cross-site scripting vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 openldap openldap2.3 It was discovered that OpenLDAP did not properly check forwarded authentication failures when using a slave server and chain overlay. If OpenLDAP were configured in this manner, an attacker could bypass authentication checks by sending an invalid password to a slave server. It was discovered that OpenLDAP did not properly perform authentication checks to the rootdn when using the back-ndb backend. An attacker could exploit this to access the directory by sending an arbitrary password. Ubuntu does not ship OpenLDAP with back-ndb support by default. This issue did not affect Ubuntu 8.04 LTS. It was discovered that OpenLDAP did not properly validate modrdn requests. An unauthenticated remote user could use this to cause a denial of service via application crash SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 firefox firefox-3.0 firefox-3.5 xulrunner-1.9.2 Jesse Ruderman, Igor Bukanov, Olli Pettay, Gary Kwong, Jeff Walden, Henry Sivonen, Martijn Wargers, David Baron and Marcia Knous discovered several memory issues in the browser engine. An attacker could exploit these to crash the browser or possibly run arbitrary code as the user invoking the program. Zach Hoffman discovered that a recursive call to eval wrapped in a try/catch statement places the browser into a inconsistent state. An attacker could exploit this to force a user to accept any dialog. It was discovered that memory was used after being freed in a method used by JSON.stringify. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. Christian Holler discovered multiple buffer overflows in the JavaScript engine. An attacker could exploit these to crash the browser or possibly run arbitrary code as the user invoking the program. Daniel Kozlowski discovered that a JavaScript Worker kept a reference to memory after it was freed. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. Alex Miller discovered a buffer overflow in the browser rendering engine. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. Roberto Suggi Liverani discovered a possible issue with unsafe JavaScript execution in chrome documents. A malicious extension could exploit this to execute arbitrary code with chrome privlieges. Jordi Chancel discovered a buffer overlow in the JPEG decoding engine. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. Peleus Uhley discovered a CSRF vulnerability in the plugin code related to 307 redirects. This could allow custom headers to be forwarded across origins SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 postgresql-8.1 postgresql-8.3 postgresql-8.4 Geoff Keating reported that a buffer overflow exists in the intarray module�s input function for the query_int type. This could allow an attacker to cause a denial of service or possibly execute arbitrary code as the postgres user. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 krb5 Keiichi Mori discovered that the MIT krb5 KDC database propagation daemon is vulnerable to a denial of service attack due to improper logic when a worker child process exited because of invalid network input. This could only occur when kpropd is running in standalone mode; kpropd was not affected when running in incremental propagation mode or as an inetd server. This issue only affects Ubuntu 9.10, Ubuntu 10.04 LTS, and Ubuntu 10.10. Kevin Longfellow and others discovered that the MIT krb5 Key Distribution Center daemon is vulnerable to denial of service attacks when using an LDAP back end due to improper handling of network input SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 pango1.0 Marc Schoenefeld discovered that Pango incorrectly handled certain Glyph Definition tables. If a user were tricked into displaying text with a specially-crafted font, an attacker could cause Pango to crash, resulting in a denial of service. This issue only affected Ubuntu 8.04 LTS and 9.10. Dan Rosenberg discovered that Pango incorrectly handled certain FT_Bitmap objects. If a user were tricked into displaying text with a specially- crafted font, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. The default compiler options for affected releases should reduce the vulnerability to a denial of service. It was discovered that Pango incorrectly handled certain memory reallocation failures. If a user were tricked into displaying text in a way that would cause a reallocation failure, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. This issue only affected Ubuntu 9.10, 10.04 LTS and 10.10 SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 evince Jon Larimer discovered that Evince�s font parsers incorrectly handled certain buffer lengths when rendering a DVI file. By tricking a user into opening or previewing a DVI file that uses a specially crafted font file, an attacker could crash evince or execute arbitrary code with the user�s privileges. In the default installation of Ubuntu 9.10 and later, attackers would be isolated by the Evince AppArmor profile. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 firefox firefox-3.0 firefox-3.5 xulrunner-1.9.2 USN-1049-1 fixed vulnerabilities in Firefox and Xulrunner. That update introduced a regression where some Java applets would fail to load. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Jesse Ruderman, Igor Bukanov, Olli Pettay, Gary Kwong, Jeff Walden, Henry Sivonen, Martijn Wargers, David Baron and Marcia Knous discovered several memory issues in the browser engine. An attacker could exploit these to crash the browser or possibly run arbitrary code as the user invoking the program. Zach Hoffman discovered that a recursive call to eval wrapped in a try/catch statement places the browser into a inconsistent state. An attacker could exploit this to force a user to accept any dialog. It was discovered that memory was used after being freed in a method used by JSON.stringify. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. Christian Holler discovered multiple buffer overflows in the JavaScript engine. An attacker could exploit these to crash the browser or possibly run arbitrary code as the user invoking the program. Daniel Kozlowski discovered that a JavaScript Worker kept a reference to memory after it was freed. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. Alex Miller discovered a buffer overflow in the browser rendering engine. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. Roberto Suggi Liverani discovered a possible issue with unsafe JavaScript execution in chrome documents. A malicious extension could exploit this to execute arbitrary code with chrome privlieges. Jordi Chancel discovered a buffer overlow in the JPEG decoding engine. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. Peleus Uhley discovered a CSRF vulnerability in the plugin code related to 307 redirects. This could allow custom headers to be forwarded across origins SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 sudo Alexander Kurtz discovered that sudo would not prompt for a password when a group was specified in the Runas_Spec. A local attacker could exploit this to execute arbitrary code as the specified group if sudo was configured to allow the attacker to use a program as this group. The group Runas_Spec is not used in the default installation of Ubuntu. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 ffmpeg Cesar Bernardini and Felipe Andres Manzano discovered that FFmpeg incorrectly handled certain malformed flic files. If a user were tricked into opening a crafted flic file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS, 9.10 and 10.04 LTS. Dan Rosenberg discovered that FFmpeg incorrectly handled certain malformed wmv files. If a user were tricked into opening a crafted wmv file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS, 9.10 and 10.04 LTS. It was discovered that FFmpeg incorrectly handled certain malformed ogg files. If a user were tricked into opening a crafted ogg file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. It was discovered that FFmpeg incorrectly handled certain malformed WebM files. If a user were tricked into opening a crafted WebM file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. Dan Rosenberg discovered that FFmpeg incorrectly handled certain malformed RealMedia files. If a user were tricked into opening a crafted RealMedia file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS, 9.10 and 10.04 LTS. Dan Rosenberg discovered that FFmpeg incorrectly handled certain malformed VC1 files. If a user were tricked into opening a crafted VC1 file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 python-django It was discovered that Django did not properly validate HTTP requests that contain an X-Requested-With header. An attacker could exploit this vulnerability to perform cross-site request forgery attacks. It was discovered that Django did not properly sanitize its input when performing file uploads, resulting in cross-site scripting vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 openssl Neel Mehta discovered that incorrectly formatted ClientHello handshake messages could cause OpenSSL to parse past the end of the message. This could allow a remote attacker to cause a crash and denial of service by triggering invalid memory accesses. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 thunderbird thunderbird: Mozilla Open Source mail and newsgroup client Multiple vulnerabilities were fixed in Thunderbird. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 mysql-5.1 mysql-dfsg-5.0 mysql-dfsg-5.1 It was discovered that MySQL incorrectly handled certain requests with the UPGRADE DATA DIRECTORY NAME command. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 9.10 and 10.04 LTS. It was discovered that MySQL incorrectly handled joins involving a table with a unique SET column. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS. It was discovered that MySQL incorrectly handled NULL arguments to IN or CASE operations. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 9.10 and 10.04 LTS. It was discovered that MySQL incorrectly handled malformed arguments to the BINLOG statement. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 9.10 and 10.04 LTS. It was discovered that MySQL incorrectly handled the use of TEMPORARY InnoDB tables with nullable columns. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS. It was discovered that MySQL incorrectly handled alternate reads from two indexes on a table using the HANDLER interface. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS. It was discovered that MySQL incorrectly handled use of EXPLAIN with certain queries. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS. It was discovered that MySQL incorrectly handled error reporting when using LOAD DATA INFILE and would incorrectly raise an assert in certain circumstances. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 9.10 and 10.04 LTS. It was discovered that MySQL incorrectly handled propagation during evaluation of arguments to extreme-value functions. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 8.04 LTS, 9.10, 10.04 LTS and 10.10. It was discovered that MySQL incorrectly handled materializing a derived table that required a temporary table for grouping. An authenticated user could exploit this to make MySQL crash, causing a denial of service. It was discovered that MySQL incorrectly handled certain user-variable assignment expressions that are evaluated in a logical expression context. An authenticated user could exploit this to make MySQL crash, causing a denial of service. This issue only affected Ubuntu 8.04 LTS, 9.10, 10.04 LTS and 10.10. It was discovered that MySQL incorrectly handled pre-evaluation of LIKE predicates during view preparation. An authenticated user could exploit this to make MySQL crash, causing a denial of service. It was discovered that MySQL incorrectly handled using GROUP_CONCAT and WITH ROLLUP together. An authenticated user could exploit this to make MySQL crash, causing a denial of service. It was discovered that MySQL incorrectly handled certain queries using a mixed list of numeric and LONGBLOB arguments to the GREATEST or LEAST functions. An authenticated user could exploit this to make MySQL crash, causing a denial of service. It was discovered that MySQL incorrectly handled queries with nested joins when used from stored procedures and prepared statements. An authenticated user could exploit this to make MySQL hang, causing a denial of service. This issue only affected Ubuntu 9.10, 10.04 LTS and 10.10. It was discovered that MySQL incorrectly handled improper WKB data passed to the PolyFromWKB function. An authenticated user could exploit this to make MySQL crash, causing a denial of service SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 linux linux-ec2 Dan Rosenberg discovered that the btrfs filesystem did not correctly validate permissions when using the clone function. A local attacker could overwrite the contents of file handles that were opened for append-only, or potentially read arbitrary contents, leading to a loss of privacy. Only Ubuntu 9.10 was affected. Dave Chinner discovered that the XFS filesystem did not correctly order inode lookups when exported by NFS. A remote attacker could exploit this to read or write disk blocks that had changed file assignement or had become unlinked, leading to a loss of privacy. Kees Cook discovered that the Intel i915 graphics driver did not correctly validate memory regions. A local attacker with access to the video card could read and write arbitrary kernel memory to gain root privileges. Ubuntu 10.10 was not affected. Robert Swiecki discovered that ftrace did not correctly handle mutexes. A local attacker could exploit this to crash the kernel, leading to a denial of service. Dan Rosenberg discovered that several network ioctls did not clear kernel memory correctly. A local user could exploit this to read kernel stack memory, leading to a loss of privacy. Ben Hawkes discovered that the Linux kernel did not correctly filter registers on 64bit kernels when performing 32bit system calls. On a 64bit system, a local attacker could manipulate 32bit system calls to gain root privileges. The Ubuntu EC2 kernels needed additional fixing. Brad Spengler discovered that stack memory for new a process was not correctly calculated. A local attacker could exploit this to crash the system, leading to a denial of service. Kees Cook discovered that the ethtool interface did not correctly clear kernel memory. A local attacker could read kernel heap memory, leading to a loss of privacy. Kees Cook and Vasiliy Kulikov discovered that the shm interface did not clear kernel memory correctly. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 tgt tgt: Linux SCSI target user-space tools An attacker could send crafted input to tgt and cause it to crash or run arbitrary programs. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 php5 USN-1042-1 fixed vulnerabilities in PHP5. The fix for CVE-2010-3436 introduced a regression in the open_basedir restriction handling code. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that attackers might be able to bypass open_basedir restrictions by passing a specially crafted filename SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 x11-xserver-utils Sebastian Krahmer discovered that the xrdb utility incorrectly filtered crafted hostnames. An attacker could use this flaw with a malicious DHCP server or with a remote xdmcp login and execute arbitrary code, resulting in root privilege escalation. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 libxml2 libxml2: GNOME XML library libxml2 could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 dovecot It was discovered that the ACL plugin in Dovecot would incorrectly propagate ACLs to new mailboxes. A remote authenticated user could possibly read new mailboxes that were created with the wrong ACL. It was discovered that the ACL plugin in Dovecot would incorrectly merge ACLs in certain circumstances. A remote authenticated user could possibly bypass intended access restrictions and gain access to mailboxes. It was discovered that the ACL plugin in Dovecot would incorrectly grant the admin permission to owners of certain mailboxes. A remote authenticated user could possibly bypass intended access restrictions and gain access to mailboxes. It was discovered that Dovecot incorrecly handled the simultaneous disconnect of a large number of sessions. A remote authenticated user could use this flaw to cause Dovecot to crash, resulting in a denial of service SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 lcms It was discovered that a NULL pointer dereference in the code for handling transformations of monochrome profiles could allow an attacker to cause a denial of service through a specially crafted image SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 logrotate logrotate: Log rotation utility An attacker could cause logrotate to run programs, stop working, or read and write arbitrary files. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 xulrunner-1.9.1 xulrunner-1.9.2 USN-1011-1 fixed a vulnerability in Firefox. This update provides the corresponding update for Xulrunner. Original advisory details: Morten Krakvik discovered a heap-based buffer overflow in Firefox. If a user were tricked into navigating to a malicious site, an attacker could cause a denial of service or possibly execute arbitrary code as the user invoking the program. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 thunderbird Paul Nickerson, Jesse Ruderman, Olli Pettay, Igor Bukanov, Josh Soref, Gary Kwong, Martijn Wargers, Siddharth Agarwal and Michal Zalewski discovered various flaws in the browser engine. An attacker could exploit this to crash Thunderbird or possibly run arbitrary code as the user invoking the program. Alexander Miller, Sergey Glazunov, and others discovered several flaws in the JavaScript engine. If JavaScript were enabled, an attacker could exploit this to crash Thunderbird or possibly run arbitrary code as the user invoking the program. Eduardo Vela Nava discovered that Thunderbird could be made to violate the same-origin policy by using modal calls with JavaScript. If JavaScript were enabled, an attacker could exploit this to steal information from another site. Dmitri GribenkoDmitri Gribenko discovered that Thunderbird did not properly setup the LD_LIBRARY_PATH environment variable. A local attacker could exploit this to execute arbitrary code as the user invoking the program SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 exim4 exim4: metapackage to ease Exim MTA installation an attacker could send crafted input to Exim and cause it to run programs as the Exim user. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 tomcat6 It was discovered that Tomcat did not properly escape certain parameters in the Manager application which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.04 Ubuntu 9.10 glibc eglibc Tavis Ormandy discovered multiple flaws in the GNU C Library�s handling of the LD_AUDIT environment variable when running a privileged binary. A local attacker could exploit this to gain root privileges SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 qemu-kvm Neil Wilson discovered that if VNC passwords were blank in QEMU configurations, access to VNC sessions was allowed without a password instead of being disabled. A remote attacker could connect to running VNC sessions of QEMU and directly control the system. By default, QEMU does not start VNC sessions. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 util-linux USN-1045-1 fixed vulnerabilities in FUSE. This update to util-linux adds support for new options required by the FUSE update. Original advisory details: It was discovered that FUSE could be tricked into incorrectly updating the mtab file when mounting filesystems. A local attacker, with access to use FUSE, could unmount arbitrary locations, leading to a denial of service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 dpkg Jakub Wilk and Raphaël Hertzog discovered that dpkg-source did not correctly handle certain paths and symlinks when unpacking source-format version 3.0 packages. If a user or an automated system were tricked into unpacking a specially crafted source package, a remote attacker could modify files outside the target unpack directory, leading to a denial of service or potentially gaining access to the system. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 nagios3 nagios3: A host/service/network monitoring and management system an attacker could modify or steal data if you were tricked into clicking on a special link to Nagios. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 krb5 Mike Roszkowski discovered that the Kerberos KDC did not correctly validate the contents of certain messages. If an authenticated remote attacker sent specially crafted TGS requests, the KDC service would crash, leading to a denial of service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 tiff USN-1085-1 fixed vulnerabilities in the system TIFF library. The upstream fixes were incomplete and created problems for certain CCITTFAX4 files. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Sauli Pahlman discovered that the TIFF library incorrectly handled invalid td_stripbytecount fields. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service. This issue only affected Ubuntu 10.04 LTS and 10.10. Sauli Pahlman discovered that the TIFF library incorrectly handled TIFF files with an invalid combination of SamplesPerPixel and Photometric values. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service. This issue only affected Ubuntu 10.10. Nicolae Ghimbovschi discovered that the TIFF library incorrectly handled invalid ReferenceBlackWhite values. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service. Sauli Pahlman discovered that the TIFF library incorrectly handled certain default fields. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service. It was discovered that the TIFF library incorrectly validated certain data types. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service. It was discovered that the TIFF library incorrectly handled downsampled JPEG data. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could execute arbitrary code with user privileges, or crash the application, leading to a denial of service. This issue only affected Ubuntu 10.04 LTS and 10.10. It was discovered that the TIFF library incorrectly handled certain JPEG data. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could execute arbitrary code with user privileges, or crash the application, leading to a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS and 9.10. It was discovered that the TIFF library incorrectly handled certain TIFF FAX images. If a user or automated system were tricked into opening a specially crafted TIFF FAX image, a remote attacker could execute arbitrary code with user privileges, or crash the application, leading to a denial of service SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 openssl It was discovered that an old bug workaround in the SSL/TLS server code allowed an attacker to modify the stored session cache ciphersuite. This could possibly allow an attacker to downgrade the ciphersuite to a weaker one on subsequent connections. It was discovered that an old bug workaround in the SSL/TLS server code allowed allowed an attacker to modify the stored session cache ciphersuite. An attacker could possibly take advantage of this to force the use of a disabled cipher. This vulnerability only affects the versions of OpenSSL in Ubuntu 6.06 LTS, Ubuntu 8.04 LTS, and Ubuntu 9.10 SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 9.04 Ubuntu 9.10 Ubuntu 6.06 Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 poppler It was discovered that poppler contained multiple security issues when parsing malformed PDF documents. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 samba Volker Lendecke discovered that Samba incorrectly handled certain file descriptors. A remote attacker could send a specially crafted request to the server and cause Samba to crash or hang, resulting in a denial of service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 linux-mvl-dove Joel Becker discovered that OCFS2 did not correctly validate on-disk symlink structures. If an attacker were able to trick a user or automated system into mounting a specially crafted filesystem, it could crash the system or exposde kernel memory, leading to a loss of privacy. Ben Hutchings discovered that the ethtool interface did not correctly check certain sizes. A local attacker could perform malicious ioctl calls that could crash the system, leading to a denial of service. Eric Dumazet discovered that many network functions could leak kernel stack contents. A local attacker could exploit this to read portions of kernel memory, leading to a loss of privacy. Dave Chinner discovered that the XFS filesystem did not correctly order inode lookups when exported by NFS. A remote attacker could exploit this to read or write disk blocks that had changed file assignment or had become unlinked, leading to a loss of privacy. Tavis Ormandy discovered that the IRDA subsystem did not correctly shut down. A local attacker could exploit this to cause the system to crash or possibly gain root privileges. Brad Spengler discovered that the wireless extensions did not correctly validate certain request sizes. A local attacker could exploit this to read portions of kernel memory, leading to a loss of privacy. Tavis Ormandy discovered that the session keyring did not correctly check for its parent. On systems without a default session keyring, a local attacker could exploit this to crash the system, leading to a denial of service. Kees Cook discovered that the Intel i915 graphics driver did not correctly validate memory regions. A local attacker with access to the video card could read and write arbitrary kernel memory to gain root privileges. Kees Cook discovered that the V4L1 32bit compat interface did not correctly validate certain parameters. A local attacker on a 64bit system with access to a video device could exploit this to gain root privileges. Tavis Ormandy discovered that the AIO subsystem did not correctly validate certain parameters. A local attacker could exploit this to crash the system or possibly gain root privileges. Dan Rosenberg discovered that certain XFS ioctls leaked kernel stack contents. A local attacker could exploit this to read portions of kernel memory, leading to a loss of privacy. Robert Swiecki discovered that ftrace did not correctly handle mutexes. A local attacker could exploit this to crash the kernel, leading to a denial of service. Tavis Ormandy discovered that the OSS sequencer device did not correctly shut down. A local attacker could exploit this to crash the system or possibly gain root privileges. Dan Rosenberg discovered that several network ioctls did not clear kernel memory correctly. A local user could exploit this to read kernel stack memory, leading to a loss of privacy. Dan Rosenberg discovered that the ROSE driver did not correctly check parameters. A local attacker with access to a ROSE network device could exploit this to crash the system or possibly gain root privileges. Thomas Dreibholz discovered that SCTP did not correctly handle appending packet chunks. A remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. Dan Rosenberg discovered that the CD driver did not correctly check parameters. A local attacker could exploit this to read arbitrary kernel memory, leading to a loss of privacy. Dan Rosenberg discovered that the Sound subsystem did not correctly validate parameters. A local attacker could exploit this to crash the system, leading to a denial of service. Dan Rosenberg discovered that SCTP did not correctly handle HMAC calculations. A remote attacker could send specially crafted traffic that would crash the system, leading to a denial of service. Nelson Elhage discovered several problems with the Acorn Econet protocol driver. A local user could cause a denial of service via a NULL pointer dereference, escalate privileges by overflowing the kernel stack, and assign Econet addresses to arbitrary interfaces. Brad Spengler discovered that stack memory for new a process was not correctly calculated. A local attacker could exploit this to crash the system, leading to a denial of service. Dan Rosenberg discovered that the Linux kernel TIPC implementation contained multiple integer signedness errors. A local attacker could exploit this to gain root privileges. Kees Cook discovered that the ethtool interface did not correctly clear kernel memory. A local attacker could read kernel heap memory, leading to a loss of privacy. Thomas Pollet discovered that the RDS network protocol did not check certain iovec buffers. A local attacker could exploit this to crash the system or possibly execute arbitrary code as the root user. Dan Rosenberg discovered that the Linux kernel X.25 implementation incorrectly parsed facilities. A remote attacker could exploit this to crash the kernel, leading to a denial of service. Dan Rosenberg discovered that the CAN protocol on 64bit systems did not correctly calculate the size of certain buffers. A local attacker could exploit this to crash the system or possibly execute arbitrary code as the root user. Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. Vasiliy Kulikov discovered that the Linux kernel sockets implementation did not properly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. Vasiliy Kulikov discovered that the TIPC interface did not correctly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. Nelson Elhage discovered that the Linux kernel IPv4 implementation did not properly audit certain bytecodes in netlink messages. A local attacker could exploit this to cause the kernel to hang, leading to a denial of service. Dan Rosenberg discovered that the RDS network protocol did not correctly check certain parameters. A local attacker could exploit this gain root privileges. Kees Cook and Vasiliy Kulikov discovered that the shm interface did not clear kernel memory correctly. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. Dan Rosenberg discovered that multiple terminal ioctls did not correctly initialize structure memory. A local attacker could exploit this to read portions of kernel stack memory, leading to a loss of privacy. Dan Rosenberg discovered that the socket filters did not correctly initialize structure memory. A local attacker could create malicious filters to read portions of kernel stack memory, leading to a loss of privacy. Dan Rosenberg discovered that the SCSI subsystem did not correctly validate iov segments. A local attacker with access to a SCSI device could send specially crafted requests to crash the system, leading to a denial of service. Steve Chen discovered that setsockopt did not correctly check MSS values. A local attacker could make a specially crafted socket call to crash the system, leading to a denial of service. Dave Jones discovered that the mprotect system call did not correctly handle merged VMAs. A local attacker could exploit this to crash the system, leading to a denial of service. Dan Rosenberg discovered that the RDS protocol did not correctly check ioctl arguments. A local attacker could exploit this to crash the system, leading to a denial of service. Vegard Nossum discovered that memory garbage collection was not handled correctly for active sockets. A local attacker could exploit this to allocate all available kernel memory, leading to a denial of service. It was discovered that multithreaded exec did not handle CPU timers correctly. A local attacker could exploit this to crash the system, leading to a denial of service. Krishna Gudipati discovered that the bfa adapter driver did not correctly initialize certain structures. A local attacker could read files in /sys to crash the system, leading to a denial of service. Tavis Ormandy discovered that the install_special_mapping function could bypass the mmap_min_addr restriction. A local attacker could exploit this to mmap 4096 bytes below the mmap_min_addr area, possibly improving the chances of performing NULL pointer dereference attacks. It was discovered that the ICMP stack did not correctly handle certain unreachable messages. If a remote attacker were able to acquire a socket lock, they could send specially crafted traffic that would crash the system, leading to a denial of service. Dan Rosenberg discovered that the OSS subsystem did not handle name termination correctly. A local attacker could exploit this crash the system or gain root privileges. Dan Carpenter discovered that the Infiniband driver did not correctly handle certain requests. A local user could exploit this to crash the system or potentially gain root privileges SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 fuse It was discovered that FUSE would incorrectly follow symlinks when checking mountpoints under certain conditions. A local attacker, with access to use FUSE, could unmount arbitrary locations, leading to a denial of service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 telepathy-gabble It was discovered that Gabble did not verify the from field of google jingleinfo updates. This could allow a remote attacker to perform man in the middle attacks on streamed media. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 thunderbird thunderbird-locales Jesse Ruderman, Andreas Gal, Nils, Brian Hackett, and Igor Bukanov discovered several memory issues in the browser engine. An attacker could exploit these to crash THunderbird or possibly run arbitrary code as the user invoking the program. Marc Schoenefeld and Christoph Diehl discovered several problems when handling downloadable fonts. The new OTS font sanitizing library was added to mitigate these issues SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 thunderbird Jesse Ruderman, Igor Bukanov, Olli Pettay, Gary Kwong, Jeff Walden, Henry Sivonen, Martijn Wargers, David Baron and Marcia Knous discovered several memory issues in the browser engine. An attacker could exploit these to crash the browser or possibly run arbitrary code as the user invoking the program. Roberto Suggi Liverani discovered a possible issue with unsafe JavaScript execution in chrome documents. A malicious extension could exploit this to execute arbitrary code with chrome privlieges. Jordi Chancel discovered a buffer overlow in the JPEG decoding engine. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 linux linux-ec2 linux-source-2.6.15 Nelson Elhage discovered several problems with the Acorn Econet protocol driver. A local user could cause a denial of service via a NULL pointer dereference, escalate privileges by overflowing the kernel stack, and assign Econet addresses to arbitrary interfaces. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 openjdk-6 openjdk-6b18 It was discovered that the JNLP SecurityManager in IcedTea for Java OpenJDK in some instances failed to properly apply the intended scurity policy in its checkPermission method. This could allow an attacker execute code with privileges that should have been prevented SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 openjdk-6b18 USN-1079-2 fixed vulnerabilities in OpenJDK 6 for armel architectures in Ubuntu 9.10 and Ubuntu 10.04 LTS. This update fixes vulnerabilities in OpenJDK 6 for armel architectures for Ubuntu 10.10. Original advisory details: It was discovered that untrusted Java applets could create domain name resolution cache entries, allowing an attacker to manipulate name resolution within the JVM. It was discovered that the Java launcher did not did not properly setup the LD_LIBRARY_PATH environment variable. A local attacker could exploit this to execute arbitrary code as the user invoking the program. It was discovered that within the Swing library, forged timer events could allow bypass of SecurityManager checks. This could allow an attacker to access restricted resources. It was discovered that certain bytecode combinations confused memory management within the HotSpot JVM. This could allow an attacker to cause a denial of service through an application crash or possibly inject code. It was discovered that the way JAXP components were handled allowed them to be manipulated by untrusted applets. An attacker could use this to bypass XML processing restrictions and elevate privileges. It was discovered that the Java2D subcomponent, when processing broken CFF fonts could leak system properties. It was discovered that a flaw in the XML Digital Signature component could allow an attacker to cause untrusted code to replace the XML Digital Signature Transform or C14N algorithm implementations. Konstantin Preißer and others discovered that specific double literals were improperly handled, allowing a remote attacker to cause a denial of service. It was discovered that the JNLPClassLoader class when handling multiple signatures allowed remote attackers to gain privileges due to the assignment of an inappropriate security descriptor SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 webkit A large number of security issues were discovered in the WebKit browser and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution. Please consult the bug listed at the top of this advisory to get the exact list of CVE numbers fixed for each release. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.04 Ubuntu 9.10 firefox firefox-3.0 firefox-3.5 xulrunner-1.9.1 xulrunner-1.9.2 Paul Nickerson, Jesse Ruderman, Olli Pettay, Igor Bukanov, Josh Soref, Gary Kwong, Martijn Wargers, Siddharth Agarwal and Michal Zalewski discovered various flaws in the browser engine. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. Alexander Miller, Sergey Glazunov, and others discovered several flaws in the JavaScript engine. An attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. Robert Swiecki discovered that Firefox did not properly validate Gopher URLs. If a user were tricked into opening a crafted file via Gopher, an attacker could possibly run arbitrary JavaScript. Eduardo Vela Nava discovered that Firefox could be made to violate the same-origin policy by using modal calls with JavaScript. An attacker could exploit this to steal information from another site. Dmitri GribenkoDmitri Gribenko discovered that Firefox did not properly setup the LD_LIBRARY_PATH environment variable. A local attacker could exploit this to execute arbitrary code as the user invoking the program SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 imagemagick It was discovered that ImageMagick would search for configuration files in the current directory. If a user were tricked into opening or processing an image in an arbitrary directory, a local attacker could execute arbitrary code with the user�s privileges. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 samba samba: SMB/CIFS file, print, and login server for Unix An attacker could use a malicious URL to reconfigure Samba or steal information. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 openssl Rob Hulswit discovered a race condition in the OpenSSL TLS server extension parsing code when used within a threaded server. A remote attacker could trigger this flaw to cause a denial of service or possibly execute arbitrary code with application privileges SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 openjdk-6 openjdk-6b18 It was discovered that IcedTea for Java did not properly verify signatures when handling multiply signed or partially signed JAR files, allowing an attacker to cause code to execute that appeared to come from a verified source. USN 1052-1 fixed a vulnerability in OpenJDK for Ubuntu 9.10 and Ubuntu 10.04 LTS on all architectures, and Ubuntu 10.10 for all architectures except for the armel architecture. This update provides the corresponding update for Ubuntu 10.10 on the armel architecture. Original advisory details: It was discovered that the JNLP SecurityManager in IcedTea for Java OpenJDK in some instances failed to properly apply the intended scurity policy in its checkPermission method. This could allow an attacker to execute code with privileges that should have been prevented SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 9.04 Ubuntu 9.10 Ubuntu 6.06 Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 linux linux-ec2 linux-source-2.6.15 Joel Becker discovered that OCFS2 did not correctly validate on-disk symlink structures. If an attacker were able to trick a user or automated system into mounting a specially crafted filesystem, it could crash the system or exposde kernel memory, leading to a loss of privacy. Al Viro discovered a race condition in the TTY driver. A local attacker could exploit this to crash the system, leading to a denial of service. Dan Rosenberg discovered that the MOVE_EXT ext4 ioctl did not correctly check file permissions. A local attacker could overwrite append-only files, leading to potential data loss. Dan Rosenberg discovered that the swapexit xfs ioctl did not correctly check file permissions. A local attacker could exploit this to read from write-only files, leading to a loss of privacy. Suresh Jayaraman discovered that CIFS did not correctly validate certain response packats. A remote attacker could send specially crafted traffic that would crash the system, leading to a denial of service. Ben Hutchings discovered that the ethtool interface did not correctly check certain sizes. A local attacker could perform malicious ioctl calls that could crash the system, leading to a denial of service. James Chapman discovered that L2TP did not correctly evaluate checksum capabilities. If an attacker could make malicious routing changes, they could crash the system, leading to a denial of service. Neil Brown discovered that NFSv4 did not correctly check certain write requests. A remote attacker could send specially crafted traffic that could crash the system or possibly gain root privileges. David Howells discovered that DNS resolution in CIFS could be spoofed. A local attacker could exploit this to control DNS replies, leading to a loss of privacy and possible privilege escalation. Bob Peterson discovered that GFS2 rename operations did not correctly validate certain sizes. A local attacker could exploit this to crash the system, leading to a denial of service. Eric Dumazet discovered that many network functions could leak kernel stack contents. A local attacker could exploit this to read portions of kernel memory, leading to a loss of privacy. Sergey Vlasov discovered that JFS did not correctly handle certain extended attributes. A local attacker could bypass namespace access rules, leading to a loss of privacy. Tavis Ormandy discovered that the IRDA subsystem did not correctly shut down. A local attacker could exploit this to cause the system to crash or possibly gain root privileges. Brad Spengler discovered that the wireless extensions did not correctly validate certain request sizes. A local attacker could exploit this to read portions of kernel memory, leading to a loss of privacy. Tavis Ormandy discovered that the session keyring did not correctly check for its parent. On systems without a default session keyring, a local attacker could exploit this to crash the system, leading to a denial of service. Kees Cook discovered that the V4L1 32bit compat interface did not correctly validate certain parameters. A local attacker on a 64bit system with access to a video device could exploit this to gain root privileges. Toshiyuki Okajima discovered that ext4 did not correctly check certain parameters. A local attacker could exploit this to crash the system or overwrite the last block of large files. Tavis Ormandy discovered that the AIO subsystem did not correctly validate certain parameters. A local attacker could exploit this to crash the system or possibly gain root privileges. Dan Rosenberg discovered that certain XFS ioctls leaked kernel stack contents. A local attacker could exploit this to read portions of kernel memory, leading to a loss of privacy. Tavis Ormandy discovered that the OSS sequencer device did not correctly shut down. A local attacker could exploit this to crash the system or possibly gain root privileges. Dan Rosenberg discovered that the ROSE driver did not correctly check parameters. A local attacker with access to a ROSE network device could exploit this to crash the system or possibly gain root privileges. Thomas Dreibholz discovered that SCTP did not correctly handle appending packet chunks. A remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. Dan Rosenberg discovered that the CD driver did not correctly check parameters. A local attacker could exploit this to read arbitrary kernel memory, leading to a loss of privacy. Dan Rosenberg discovered that the Sound subsystem did not correctly validate parameters. A local attacker could exploit this to crash the system, leading to a denial of service. Dan Rosenberg discovered that SCTP did not correctly handle HMAC calculations. A remote attacker could send specially crafted traffic that would crash the system, leading to a denial of service. Dan Rosenberg discovered that the RDS network protocol did not correctly check certain parameters. A local attacker could exploit this gain root privileges SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 openjdk-6 openjdk-6b18 SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 tiff Sauli Pahlman discovered that the TIFF library incorrectly handled invalid td_stripbytecount fields. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service. This issue only affected Ubuntu 10.04 LTS and 10.10. Sauli Pahlman discovered that the TIFF library incorrectly handled TIFF files with an invalid combination of SamplesPerPixel and Photometric values. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service. This issue only affected Ubuntu 10.10. Nicolae Ghimbovschi discovered that the TIFF library incorrectly handled invalid ReferenceBlackWhite values. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service. Sauli Pahlman discovered that the TIFF library incorrectly handled certain default fields. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service. It was discovered that the TIFF library incorrectly validated certain data types. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service. It was discovered that the TIFF library incorrectly handled downsampled JPEG data. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could execute arbitrary code with user privileges, or crash the application, leading to a denial of service. This issue only affected Ubuntu 10.04 LTS and 10.10. It was discovered that the TIFF library incorrectly handled certain JPEG data. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could execute arbitrary code with user privileges, or crash the application, leading to a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS and 9.10. It was discovered that the TIFF library incorrectly handled certain TIFF FAX images. If a user or automated system were tricked into opening a specially crafted TIFF FAX image, a remote attacker could execute arbitrary code with user privileges, or crash the application, leading to a denial of service SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.04 Ubuntu 9.10 nss Richard Moore discovered that NSS would sometimes incorrectly match an SSL certificate which had a Common Name that used a wildcard followed by a partial IP address. While it is very unlikely that a Certificate Authority would issue such a certificate, if an attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to view sensitive information. Nelson Bolyard discovered a weakness in the Diffie-Hellman Ephemeral mode key exchange implementation which allowed servers to use a too small key length SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 6.06 Ubuntu 9.10 Ubuntu 10.04 postfix postfix: High-performance mail transport agent An attacker could send crafted input to Postfix and cause it to reveal confidential information. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 python-django It was discovered that Django did not properly sanitize the cookie value when applying CSRF protections resulting in a cross-site scripting vulnerability. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 aptdaemon Sergey Nizovtsev discovered that Aptdaemon incorrectly filtered certain arguments when using its D-Bus interface. A local attacker could use this flaw to bypass security restrictions and view sensitive information by reading arbitrary files. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 apparmor It was discovered that if AppArmor was misconfigured, under certain circumstances the parser could generate policy using an unconfined fallback execute transition when one was not specified. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 libxml2 Bui Quang Minh discovered that libxml2 did not properly process XPath namespaces and attributes. If an application using libxml2 opened a specially crafted XML file, an attacker could cause a denial of service or possibly execute code as the user invoking the program. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 eglibc glibc USN-1009-1 fixed vulnerabilities in the GNU C library. Colin Watson discovered that the fixes were incomplete and introduced flaws with setuid programs loading libraries that used dynamic string tokens in their RPATH. If the "man" program was installed setuid, a local attacker could exploit this to gain "man" user privileges, potentially leading to further privilege escalations. Default Ubuntu installations were not affected. Original advisory details: Tavis Ormandy discovered multiple flaws in the GNU C Library�s handling of the LD_AUDIT environment variable when running a privileged binary. A local attacker could exploit this to gain root privileges SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 openjdk-6 It was discovered that untrusted Java applets could create domain name resolution cache entries, allowing an attacker to manipulate name resolution within the JVM. It was discovered that the Java launcher did not did not properly setup the LD_LIBRARY_PATH environment variable. A local attacker could exploit this to execute arbitrary code as the user invoking the program. It was discovered that within the Swing library, forged timer events could allow bypass of SecurityManager checks. This could allow an attacker to access restricted resources. It was discovered that certain bytecode combinations confused memory management within the HotSpot JVM. This could allow an attacker to cause a denial of service through an application crash or possibly inject code. It was discovered that the way JAXP components were handled allowed them to be manipulated by untrusted applets. An attacker could use this to bypass XML processing restrictions and elevate privileges. It was discovered that the Java2D subcomponent, when processing broken CFF fonts could leak system properties. It was discovered that a flaw in the XML Digital Signature component could allow an attacker to cause untrusted code to replace the XML Digital Signature Transform or C14N algorithm implementations. Konstantin Preißer and others discovered that specific double literals were improperly handled, allowing a remote attacker to cause a denial of service. It was discovered that the JNLPClassLoader class when handling multiple signatures allowed remote attackers to gain privileges due to the assignment of an inappropriate security descriptor SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 linux linux: Linux kernel Multiple kernel vulnerabilities have been fixed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 hplip Sebastian Krahmer discovered that HPLIP incorrectly handled certain long SNMP responses. A remote attacker could send malicious SNMP replies to certain HPLIP tools and cause them to crash or possibly execute arbitrary code. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 eucalyptus It was discovered that Eucalyptus did not verify password resets from the Admin UI correctly. An unauthenticated remote attacker could issue password reset requests to gain admin privileges in the Eucalyptus environment. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 firefox firefox-3.0 firefox-3.5 Morten Krakvik discovered a heap-based buffer overflow in Firefox. If a user were tricked into navigating to a malicious site, an attacker could cause a denial of service or possibly execute arbitrary code as the user invoking the program. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 avahi It was discovered that Avahi incorrectly handled empty UDP packets. A remote attacker could send a specially-crafted packet and cause Avahi to hang, resulting in a denial of service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 bind9 It was discovered that Bind incorrectly handled IXFR transfers and dynamic updates while under heavy load when used as an authoritative server. A remote attacker could use this flaw to cause Bind to stop responding, resulting in a denial of service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 curl curl: HTTP, HTTPS, and FTP client and client libraries Details: Richard Silverman discovered that when doing GSSAPI authentication, libcurl unconditionally performs credential delegation, handing the server a copy of the client�s security credential. Wesley Miaw discovered that when zlib is enabled, libcurl does not properly restrict the amount of callback data sent to an application that requests automatic decompression. This might allow an attacker to cause a denial of service via an application crash or possibly execute arbitrary code with the privilege of the application. This issue only affected Ubuntu 8.04 LTS and Ubuntu 10.04 LTS. USN 818-1 fixed an issue with curl�s handling of SSL certificates with zero bytes in the Common Name. Due to a packaging error, the fix for this issue was not being applied during the build. This issue only affected Ubuntu 8.04 LTS. We apologize for the error. Original advisory Multiple vulnerabilities in curl. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.04 is installed SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 quagga It was discovered that Quagga incorrectly parsed certain malformed extended communities. A remote attacker could use this flaw to cause Quagga to crash, resulting in a denial of service. It was discovered that Quagga resets BGP sessions when encountering malformed AS_PATHLIMIT attributes. A remote attacker could use this flaw to disrupt BGP sessions, resulting in a denial of service. This update removes AS_PATHLIMIT support from Quagga. This issue only affected Ubuntu 8.04 LTS, 9.10, 10.04 LTS and 10.10 SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 shadow Kees Cook discovered that some shadow utilities did not correctly validate user input. A local attacker could exploit this flaw to inject newlines into the /etc/passwd file. If the system was configured to use NIS, this could lead to existing NIS groups or users gaining or losing access to the system, resulting in a denial of service or unauthorized access. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 apache2 It was discovered that Apache�s mod_cache and mod_dav modules incorrectly handled requests that lacked a path. A remote attacker could exploit this with a crafted request and cause a denial of service. This issue affected Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS. It was discovered that Apache did not properly handle memory when destroying APR buckets. A remote attacker could exploit this with crafted requests and cause a denial of service via memory exhaustion. This issue affected Ubuntu 6.06 LTS and 10.10 SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 bind9 It was discovered that Bind would incorrectly allow a ncache entry and a rrsig for the same type. A remote attacker could exploit this to cause Bind to crash, resulting in a denial of service. It was discovered that Bind would incorrectly mark zone data as insecure when the zone is undergoing a key algorithm rollover SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 8.04 Ubuntu 10.04 bind9 bind9: Internet Domain Name Server An attacker could send crafted input to Bind and cause it to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 ifupdown Under certain circumstances, the DHCP client could start before its AppArmor profile was loaded and therefore run unconfined. This update ensures the AppArmor profile is loaded before DHCP client starts. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 libvpx Chris Evans discovered that libvpx did not properly perform bounds checking. If an application using libvpx opened a specially crafted WebM file, an attacker could cause a denial of service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 openjdk-6 USN-1024-1 fixed vulnerabilities in OpenJDK. Some of the additional backported improvements could interfere with the compilation of certain Java software. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that certain system property information was being leaked, which could allow an attacker to obtain sensitive information. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 python-django Adam Baldwin discovered that Django did not properly validate query string lookups. This could be exploited to provide an information leak to an attacker with admin privilieges. Paul McMillan discovered that Django did not validate the length of the token used when generating a password reset. An attacker could exploit this to cause a denial of service via resource exhaustion SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 freetype Marc Schoenefeld discovered that FreeType did not correctly handle certain malformed font files. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash or possibly execute arbitrary code with user privileges. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS. Chris Evans discovered that FreeType did not correctly handle certain malformed TrueType font files. If a user were tricked into using a specially crafted TrueType file, a remote attacker could cause FreeType to crash or possibly execute arbitrary code with user privileges. This issue only affected Ubuntu 8.04 LTS, 9.10, 10.04 LTS and 10.10. It was discovered that FreeType did not correctly handle certain malformed TrueType font files. If a user were tricked into using a specially crafted TrueType file, a remote attacker could cause FreeType to crash or possibly execute arbitrary code with user privileges SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 cups Under certain circumstances, CUPS could start before its AppArmor profile was loaded and therefore run unconfined. This update ensures the AppArmor profile is loaded before CUPS starts. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 fuse It was discovered that FUSE could be tricked into incorrectly updating the mtab file when mounting filesystems. A local attacker, with access to use FUSE, could unmount arbitrary locations, leading to a denial of service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 firefox firefox-3.0 firefox-3.5 xulrunner-1.9.1 xulrunner-1.9.2 Jesse Ruderman, Andreas Gal, Nils, Brian Hackett, and Igor Bukanov discovered several memory issues in the browser engine. An attacker could exploit these to crash the browser or possibly run arbitrary code as the user invoking the program. It was discovered that Firefox did not properly verify the about:blank location elements when it was opened via window.open. An attacker could exploit this to run arbitrary code with chrome privileges. It was discovered that Firefox did not properly handle <div> elements when processing a XUL tree. If a user were tricked into opening a malicious web page, an attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. Marc Schoenefeld and Christoph Diehl discovered several problems when handling downloadable fonts. The new OTS font sanitizing library was added to mitigate these issues. Gregory Fleischer discovered that the Java LiveConnect script could be made to run in the wrong security context. An attacker could exploit this to read local files and run arbitrary code as the user invoking the program. Several problems were discovered in the JavaScript engine. If a user were tricked into opening a malicious web page, an attacker could exploit this to crash the browser or possibly run arbitrary code as the user invoking the program. Michal Zalewski discovered that Firefox did not always properly handle displaying pages from network or certificate errors. An attacker could exploit this to spoof the location bar, such as in a phishing attack. Yosuke Hasegawa and Masatoshi Kimura discovered that several character encodings would have some characters converted to angle brackets. An attacker could utilize this to perform cross-site scripting attacks SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 6.06 Ubuntu 10.04 apache2 apr apr: The Apache Portable Runtime Library - apache2: a scalable, extensible web server A denial of service issue exists that affects the Apache web server. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 thunderbird USN-1011-1 fixed a vulnerability in Firefox. This update provides the corresponding update for Thunderbird. Original advisory details: Morten Krakvik discovered a heap-based buffer overflow in Firefox. If a user were tricked into navigating to a malicious site, an attacker could cause a denial of service or possibly execute arbitrary code as the user invoking the program. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 krb5 It was discovered that Kerberos did not properly determine the acceptability of certain checksums. A remote attacker could use certain checksums to alter the prompt message, modify a response to a Key Distribution Center or forge a KRB-SAFE message. It was discovered that Kerberos did not properly determine the acceptability of certain checksums. A remote attacker could use certain checksums to forge GSS tokens or gain privileges. This issue only affected Ubuntu 9.10, 10.04 LTS and 10.10. It was discovered that Kerberos did not reject RC4 key-derivation checksums. An authenticated remote user could use this issue to forge AD-SIGNEDPATH or AD-KDC-ISSUED signatures and possibly gain privileges. This issue only affected Ubuntu 10.04 LTS and 10.10. It was discovered that Kerberos did not properly restrict the use of TGT credentials for armoring TGS requests. A remote authenticated user could use this flaw to impersonate a client. This issue only affected Ubuntu 9.10 SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 pcsc-lite pcsc-lite: Middleware to access a smart card using PC/SC PCSC-Lite could be made to crash or run programs if it accessed a special smart card. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 krb5 krb5: MIT Kerberos services An unauthenticated remote user could crash the Kerberos service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 apr-util It was discovered that APR-util did not properly handle memory when destroying APR buckets. An attacker could exploit this and cause a denial of service via memory exhaustion. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 cups cupsys Emmanuel Bouillon discovered that CUPS did not properly handle certain Internet Printing Protocol packets. A remote attacker could use this flaw to cause a denial of service or possibly execute arbitrary code. In the default installation in Ubuntu 8.04 LTS and later, attackers would be isolated by the CUPS AppArmor profile. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 php5 It was discovered that an integer overflow in the XML UTF-8 decoding code could allow an attacker to bypass cross-site scripting protections. This issue only affected Ubuntu 6.06 LTS, Ubuntu 8.04 LTS, and Ubuntu 9.10. It was discovered that the XML UTF-8 decoding code did not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which could allow an attacker to bypass cross-site scripting protections. It was discovered that attackers might be able to bypass open_basedir restrictions by passing a specially crafted filename. Maksymilian Arciemowicz discovered that a NULL pointer derefence in the ZIP archive handling code could allow an attacker to cause a denial of service through a specially crafted ZIP archive. This issue only affected Ubuntu 8.04 LTS, Ubuntu 9.10, Ubuntu 10.04 LTS, and Ubuntu 10.10. It was discovered that a stack consumption vulnerability in the filter_var PHP function when in FILTER_VALIDATE_EMAIL mode, could allow a remote attacker to cause a denial of service. This issue only affected Ubuntu 8.04 LTS, Ubuntu 9.10, Ubuntu 10.04 LTS, and Ubuntu 10.10. It was discovered that the mb_strcut function in the Libmbfl library within PHP could allow an attacker to read arbitrary memory within the application process. This issue only affected Ubuntu 10.10. Maksymilian Arciemowicz discovered that an integer overflow in the NumberFormatter::getSymbol function could allow an attacker to cause a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu 10.10. Rick Regan discovered that when handing PHP textual representations of the largest subnormal double-precision floating-point number, the zend_strtod function could go into an infinite loop on 32bit x86 processors, allowing an attacker to cause a denial of service SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 pidgin Pierre Noguès discovered that Pidgin incorrectly handled malformed SLP messages in the MSN protocol handler. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service. This issue only affected Ubuntu 8.04 LTS, 9.10 and 10.04 LTS. Daniel Atallah discovered that Pidgin incorrectly handled the return code of the Base64 decoding function. A remote attacker could send a specially crafted message and cause Pidgin to crash, leading to a denial of service SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 postgresql-8.4 USN-1002-1 fixed vulnerabilities in PostgreSQL. This update provides the corresponding update for Ubuntu 10.10. Original advisory details: It was discovered that PostgreSQL did not properly enforce permissions within sessions when PL/Perl and PL/Tcl functions or operators were redefined. A remote authenticated attacker could exploit this to execute arbitrary code with permissions of a different user, possibly leading to privilege escalation. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 clamav It was discovered that the Microsoft Office processing code in libclamav improperly handled certain Visual Basic for Applications data. This could allow a remote attacker to craft a document that could crash clamav or possibly execute arbitrary code. In the default installation, attackers would be isolated by the ClamAV AppArmor profile. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 linux It was discovered that KVM did not correctly initialize certain CPU registers. A local attacker could exploit this to crash the system, leading to a denial of service. Thomas Pollet discovered that the RDS network protocol did not check certain iovec buffers. A local attacker could exploit this to crash the system or possibly execute arbitrary code as the root user. Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. Vasiliy Kulikov discovered that the Linux kernel sockets implementation did not properly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. Vasiliy Kulikov discovered that the TIPC interface did not correctly initialize certain structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. Nelson Elhage discovered that the Linux kernel IPv4 implementation did not properly audit certain bytecodes in netlink messages. A local attacker could exploit this to cause the kernel to hang, leading to a denial of service. Dan Rosenberg discovered that the ivtv V4L driver did not correctly initialize certian structures. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. Dan Rosenberg discovered that the semctl syscall did not correctly clear kernel memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. It was discovered that multithreaded exec did not handle CPU timers correctly. A local attacker could exploit this to crash the system, leading to a denial of service. Nelson Elhage discovered that Econet did not correctly handle AUN packets over UDP. A local attacker could send specially crafted traffic to crash the system, leading to a denial of service. Tavis Ormandy discovered that the install_special_mapping function could bypass the mmap_min_addr restriction. A local attacker could exploit this to mmap 4096 bytes below the mmap_min_addr area, possibly improving the chances of performing NULL pointer dereference attacks. Dan Rosenberg discovered that the OSS subsystem did not handle name termination correctly. A local attacker could exploit this crash the system or gain root privileges. Dan Carpenter discovered that the Infiniband driver did not correctly handle certain requests. A local user could exploit this to crash the system or potentially gain root privileges SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 pam USN-959-1 fixed vulnerabilities in PAM. This update provides the corresponding updates for Ubuntu 10.10. Original advisory details: Denis Excoffier discovered that the PAM MOTD module in Ubuntu did not correctly handle path permissions when creating user file stamps. A local attacker could exploit this to gain root privilieges. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 awstats It was discovered that AWStats did not correctly filter the LoadPlugin configuration option. A local attacker on a shared system could use this to inject arbitrary code into AWStats. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 9.04 Ubuntu 9.10 Ubuntu 6.06 Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 openssl It was discovered that OpenSSL incorrectly handled return codes from the bn_wexpand function calls. A remote attacker could trigger this flaw in services that used SSL to cause a denial of service or possibly execute arbitrary code with application privileges. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.04 and 9.10. It was discovered that OpenSSL incorrectly handled certain private keys with an invalid prime. A remote attacker could trigger this flaw in services that used SSL to cause a denial of service or possibly execute arbitrary code with application privileges. The default compiler options for affected releases should reduce the vulnerability to a denial of service SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 9.04 Ubuntu 9.04 is installed SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 nss It was discovered that several invalid HTTPS certificates were issued and revoked. An attacker could exploit these to perform a man in the middle attack to view sensitive information or alter encrypted communications. These certificates were marked as explicitly not trusted to prevent their misuse. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 tiff Martin Barbella discovered that the thunder decoder in the TIFF library incorrectly handled an unexpected BitsPerSample value. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could execute arbitrary code with user privileges, or crash the application, leading to a denial of service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 krb5 Cameron Meadors discovered that the MIT Kerberos 5 Key Distribution Center daemon is vulnerable to a double-free condition if the Public Key Cryptography for Initial Authentication capability is enabled. This could allow a remote attacker to cause a denial of service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 subversion It was discovered that Subversion incorrectly handled certain "partial access" privileges in rare scenarios. Remote authenticated users could use this flaw to obtain sensitive information . This issue only applied to Ubuntu 6.06 LTS. It was discovered that the Subversion mod_dav_svn module for Apache did not properly handle a named repository as a rule scope. Remote authenticated users could use this flaw to bypass intended restrictions. This issue only applied to Ubuntu 9.10, 10.04 LTS, and 10.10. It was discovered that the Subversion mod_dav_svn module for Apache incorrectly handled the walk function. Remote authenticated users could use this flaw to cause the service to crash, leading to a denial of service. It was discovered that Subversion incorrectly handled certain memory operations. Remote authenticated users could use this flaw to consume large quantities of memory and cause the service to crash, leading to a denial of service. This issue only applied to Ubuntu 9.10, 10.04 LTS, and 10.10 SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.06 is installed SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 logwatch Dominik George discovered that logwatch did not properly sanitize log file names that were passed to the shell as part of a command. If a remote attacker were able to generate specially crafted filenames, they could execute arbitrary code with root privileges. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 libvpx Christoph Diehl discovered that libvpx did not properly perform bounds checking. If an application using libvpx opened a specially crafted WebM file, an attacker could cause a denial of service or possibly execute code as the user invoking the program. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 linux linux-ec2 Gleb Napatov discovered that KVM did not correctly check certain privileged operations. A local attacker with access to a guest kernel could exploit this to crash the host system, leading to a denial of service. Steve Chen discovered that setsockopt did not correctly check MSS values. A local attacker could make a specially crafted socket call to crash the system, leading to a denial of service. Dave Jones discovered that the mprotect system call did not correctly handle merged VMAs. A local attacker could exploit this to crash the system, leading to a denial of service. Vegard Nossum discovered that memory garbage collection was not handled correctly for active sockets. A local attacker could exploit this to allocate all available kernel memory, leading to a denial of service SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 dbus Remi Denis-Courmont discovered that D-Bus did not properly validate the number of nested variants when validating D-Bus messages. A local attacker could exploit this to cause a denial of service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.04 clamav Arkadiusz Miskiewicz and others discovered that the PDF processing code in libclamav improperly validated input. This could allow a remote attacker to craft a PDF document that could crash clamav or possibly execute arbitrary code. It was discovered that an off-by-one error in the icon_cb function in pe_icons.c in libclamav could allow an attacker to corrupt memory, causing clamav to crash or possibly execute arbitrary code. In the default installation, attackers would be isolated by the clamav AppArmor profile. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 10.10 Ubuntu 9.10 Ubuntu 10.04 openjdk-6 It was discovered that certain system property information was being leaked, which could allow an attacker to obtain sensitive information. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 8.04 is installed SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.10 is installed SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 10.04 Ubuntu 10.04 is installed SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 9.10 Ubuntu 9.10 is installed SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED