The OVAL Repository 5.4 2015-09-03T06:51:16.071-04:00 Ubuntu 11.04 libvoikko A regression caused Firefox to crash while spell checking in Finnish. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 acpid acpid could be made to stall under certain conditions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 puppet The Puppet master server could be impersonated in certain configurations. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 cifs-utils An attacker could trick cifs-utils into corrupting the system mtab file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 8.04 pam PAM could be made to crash or run programs as an administrator. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 linux Multiple kernel flaws have been fixed. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 krb5 Several denial of service issues were fixed in the Kerberos Key Distribution Center (KDC). Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 firefox Firefox could be made to crash or possibly run programs as your login if it opened a malicious website. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 mozvoikko ubufox webfav This update provides packages compatible with Firefox 7. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 thunderbird Multiple vulnerabilities were fixed in Thunderbird. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 rsyslog Rsyslog could be made to crash if it processed a specially crafted message. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 libav Libav could be made to run programs as your login if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 8.04 php5 Several security issues were fixed in PHP. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 mutt An attacker could trick mutt into trusting a rogue server. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 gimp GIMP could be made to run programs as your login if it opened a specially crafted GIF file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 8.04 apt An attacker could trick APT into installing altered packages. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 puppet Puppet could be made to overwrite files and run programs with administrator privileges. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 quassel An unprivileged user could read files in the data and logging directories, including an automatically generated SSL certificate, used by the quasselcore daemon. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 linux-ti-omap4 Multiple kernel flaws have been fixed. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 qt4-x11 A certificate authority mis-issued fraudulent certificates. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 xorg-server The X server could be made to crash, run programs as an administrator, or read arbitrary files. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 linux-ti-omap4 Several security issues were fixed in the kernel. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 eucalyptus rampart An attacker could send crafted input to Eucalyptus to run commands as a valid user. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 8.04 postgresql-8.4 postgresql-8.3 PostgreSQL incorrectly handled blowfish passwords. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 puppet An attacker could send crafted input to puppet and cause it to overwrite files. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 firefox Multiple security issues were fixed in Firefox. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 firefox Several security issues were fixed in Firefox. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 dbus DBus could be made to run programs as an administrator. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 qemu-kvm QEMU could be made to crash or run programs. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 libgssglue Privilege escalation via the GSSAPI_MECH_CONF environment variable with setuid programs. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 devscripts Several security issues were fixed in devscripts. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 eglibc glibc Multiple security issues were fixed in the GNU C Library. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 libxml2 Applications using libxml2 could be made to crash or run programs as your login if they opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.10 Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 openjdk-7 openjdk-6 Several security issues were fixed in OpenJDK. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 thunderbird Several security issues were fixed in Thunderbird. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 libxslt Applications using libxslt could be made to crash or run programs as your login if they processed a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 python-django Applications using Django could be made to crash or expose sensitive information. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.10 Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 firefox Several security issues were fixed in Firefox. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 isc-dhcp dhcp3 DHCP could be made to crash if it received specially crafted network traffic. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 gimp GIMP could be made to crash or run programs as your login if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 software-properties Software Properties could be tricked into installing arbitrary PPA GPG keys. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 isc-dhcp DHCP could be made to crash if it received specially crafted network traffic. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 qemu-kvm QEMU could be made to overwrite files as the administrator, or expose sensitive information. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 dbus DBus could be made to run programs as an administrator. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 python2.6 Several security issues were fixed in Python 2.6. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 bind9 Bind could be made to crash if it received specially crafted network traffic. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 libgc Applications using libgc could be made to crash or run arbitrary programs as your login. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 linux-ti-omap4 Several security issues were fixed in the kernel. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 thunderbird Several security issues were fixed in Thunderbird. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 quagga Quagga could be made to crash if it received specially crafted network traffic. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 koffice KOffice could be made to crash or run programs as your login if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 linux Several security issues were fixed in the kernel. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 clamav USN-1482-1 introduced a regression in ClamAV that could cause it to fail to scan certain documents. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 ruby1.8 Ruby could allow excessive access in untrusted programs. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 firefox USN-1548-1 introduced a regression in Firefox. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 php5 Several security issues were fixed in PHP. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 python2.7 Several security issues were fixed in Python 2.7. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 libreoffice LibreOffice could be made to crash or run programs as your login if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 gnupg gnupg2 GnuPG could be tricked into downloading a different key when downloading from a key server. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 aptdaemon An attacker could trick Aptdaemon into installing altered packages. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 quagga Quagga could be made to crash if it received specially crafted network traffic. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 ubuntu-sso-client Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 nvidia-graphics-drivers nvidia-graphics-drivers-173 nvidia-graphics-drivers-173-updates nvidia-graphics-drivers-updates NVIDIA graphics drivers could be made to run programs as an administrator. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM Maria Kedovskaya ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 ubuntuone-client Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 tiff tiff2pdf could be made to crash or run programs as your login if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 linux Several security issues were fixed in the kernel. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 empathy Empathy could be made to run programs or display webpages via specially crafted nicknames. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 gsettings-desktop-schemas Firefox's ability to use system proxy settings regressed. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 python3.1 Several security issues were fixed in Python 3.1. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 firefox Several security issues were fixed in Firefox. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 sudo Sudo could allow users to run arbitrary programs as the administrator. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 libconfig-inifiles-perl Config-IniFiles could be made to overwrite arbitrary files. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.10 Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 exim4 Exim could be made to run programs if it received specially crafted network traffic. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 openssl An application using OpenSSL could be made to crash or run programs if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 net-snmp Net-SNMP could be made to crash if it received specially crafted network traffic. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 update-manager Update Manager could expose sensitive information in certain circumstances. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 linux Several security issues were fixed in the kernel. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 libotr Applications using Off-the-Record messaging plugins could be made to crash or run programs if it received specially crafted network messages. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 linux Several security issues were fixed in the kernel. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 jetty Jetty could be made to hang or crash if it received specially crafted network traffic. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 qt4-x11 Qt Applications could be made to crash or run programs as your login if they opened specially crafted files. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 network-manager-applet network-manager-applet could create insecure AdHoc wireless networks. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 tiff The TIFF library could be made to crash or run programs as your login if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 libexif libexif could be made to crash, run programs as your login, or expose sensitive information if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 firefox USN-1463-1 introduced regressions in Firefox. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 mysql-5.5 mysql-5.1 mysql-dfsg-5.1 mysql-dfsg-5.0 Several security issues were fixed in MySQL. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 nvidia-graphics-drivers nvidia-graphics-drivers-173 nvidia-graphics-drivers-173-updates nvidia-graphics-drivers-updates NVIDIA graphics drivers could be made to run programs as an administrator. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 openjdk-6 icedtea-web Several security issues were fixed in OpenJDK 6. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 krb5 Several security issues were fixed in Kerberos. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 firefox Several security issues were fixed in Firefox. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 thunderbird Several security issues were fixed in Thunderbird. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 ca-certificates-java A certificate authority mis-issued fraudulent certificates. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 php5 Standalone PHP CGI scripts could be made to execute arbitrary code with the privilege of the web server. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 mono Mono could be made to expose sensitive information over the network. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 bind9 Bind could be made to crash or if it received specially crafted network traffic. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 puppet Several security issues were fixed in puppet. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 apt APT now more thoroughly verifies imported keyrings. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 thunderbird Several security issues were fixed in Thunderbird. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 linux Several security issues were fixed in the kernel. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 backuppc BackupPC could be made to expose sensitive information over the network. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.10 Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 python3.2 Several security issues were fixed in Python 3.2. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.10 Ubuntu 12.10 is installed SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 mysql-5.1 mysql-dfsg-5.1 mysql-dfsg-5.0 Several security issues were fixed in MySQL. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 ubufox This update provides compatible ubufox packages for the latest Firefox. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 libtasn1-3 Libtasn1 could be made to crash or run programs as your login if it received specially crafted input. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 freeradius FreeRADIUS could be made to crash or run programs if it received specially crafted network traffic. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 postgresql-9.1 postgresql-8.4 postgresql-8.3 PostgreSQL could allow unintended access to files over the network when using the XML2 extension. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 ubufox This update provides compatible ubufox packages for the latest Firefox. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 apparmor This update provides updates for the AppArmor profile abstractions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 python-crypto PyCrypto improperly created ElGamal encryption keys. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 kde4libs KDE-Libs could improperly display fraudulent security certificates. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 openjdk-6 Two security issues were fixed in OpenJDK 6. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 bind9 Bind could be made to crash if it received specially crafted network traffic. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 nut Nut could be made to crash if it received specially crafted network traffic. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 8.04 gnutls26 gnutls13 The GnuTLS library could be made to crash under certain conditions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 clamav ClamAV could improperly detect malware if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 pidgin Several security issues were fixed in Pidgin. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 apt An attacker could trick APT into installing altered packages. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 postgresql-9.1 postgresql-8.4 postgresql-8.3 PostgreSQL could be made to crash or incorrectly handle authentication. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 linux-ti-omap4 Several security issues were fixed in the kernel. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 icedtea-web The IcedTea-Web Java web browser plugin could be made to crash or possibly run programs as your login if it opened a specially crafted applet. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 imagemagick ImageMagick could be made to crash or run programs as your login if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 bind9 Bind could be made to crash if it received specially crafted network traffic. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 libav Libav could be made to crash or run programs as your login if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 moin Several security issues were fixed in MoinMoin. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 puppet Several security issues were fixed in Puppet. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 network-manager NetworkManager could create insecure AdHoc wireless networks. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 libgdata evolution-data-server Applications using GData services could be made to expose sensitive information over the network. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 xmlrpc-c XML-RPC for C and C++ could be made to cause a denial of service by consuming excessive CPU and memory resources. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 thunderbird USN-1551-1 introduced regressions in Thunderbird. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 samba Samba could allow a user to gain administrative privileges to the Samba server. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 usbmuxd usbmuxd could be made to crash or run programs if it received specially crafted input. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 openssl Applications using OpenSSL in certain situations could be made to crash or expose sensitive information. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 libxml2 Applications using libxml2 could be made to crash or run programs as your login if they opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 linux The system could be made to crash under certain conditions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 icedtea-web USN 1505-1 introduced a regression in the IcedTea-Web Java web browser plugin that prevented it from working with the Chromium web browser. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 unity-2d Popup menus were not working in Firefox under Unity 2D. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 linux Several security issues were fixed in the kernel. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 ubuntuone-storage-protocol Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 php5 Several security issues were fixed in PHP. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 update-manager Update Manager could expose sensitive information in certain circumstances. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 8.04 tiff The TIFF library could be made to crash or run programs as your login if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 nss NSS could be made to crash if it opened a specially crafted certificate. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 clamav ClamAV could improperly detect malware if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 samba Samba could be made to run programs as the administrator if it received specially crafted network traffic. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 linux Several security issues were fixed in the kernel. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 libreoffice libreoffice-l10n LibreOffice could be made to crash or potentially run programs as your login if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 unity-2d Popup menus were not working in Thunderbird under Unity 2D when started from the launcher. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 openssl An application using OpenSSL could be made to crash or run programs if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 firefox Several security issues were fixed in Firefox. Maria Kedovskaya DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 imagemagick ImageMagick could be made to crash or run programs as your login if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 firefox Multiple security issues were fixed in Firefox. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 8.04 backuppc BackupPC could be made to expose sensitive information over the network. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 puppet USN-1238-1 caused a regression on Ubuntu 11.04. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 8.04 libpng libpng could be made to crash or run programs as your login if it opened a specially crafted file. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 linux-ti-omap4 Several security issues were fixed in the kernel. Maria Kedovskaya DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 thunderbird Multiple security issues were fixed in Thunderbird. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04 Ubuntu 8.04 expat Expat could be made to cause a denial of service by consuming excessive CPU and memory resources. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 raptor Applications using Raptor could be made to expose sensitive information or run programs as your login if they opened a specially crafted file. Maria Kedovskaya DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 PHP php5: HTML-embedded scripting language interpreter Details: USN 1358-1 fixed multiple vulnerabilities in PHP. The fix for CVE-2012-0831 introduced a regression where the state of the magic_quotes_gpc setting was not correctly reflected when calling the ini_get function. We apologize for the inconvenience. Original advisory USN 1358-1 introduced a regression in PHP. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 OpenSSL openssl: Secure Socket Layer binary and related cryptographic tools Multiple vulnerabilities exist in OpenSSL that could expose sensitive information or cause applications to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Evince evince: Document viewer Evince could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Linux linux: Linux kernel Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 libpng libpng: PNG file library libpng could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Thunderbird thunderbird: Mozilla Open Source mail and newsgroup client Details: USN-1367-1 fixed vulnerabilities in libpng. This provides the corresponding update for Thunderbird. Original advisory Thunderbird could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 OpenJDK openjdk-6b18: Open Source Java implementation Details: USN 1373-1 fixed vulnerabilities in OpenJDK 6 in Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04 for all architectures except for ARM . This provides the corresponding OpenJDK 6 update for use with the ARM architecture in Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04. Original advisory Multiple vulnerabilities in OpenJDK 6 for the ARM architecture have been fixed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Rsyslog rsyslog: Enhanced syslogd Rsyslog could be made to crash if it processed a specially crafted log message. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 libxml2 libxml2: GNOME XML library libxml2 could be made to cause a denial of service by consuming excessive CPU resources. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 PHP php5: HTML-embedded scripting language interpreter PHP could be made to crash or disclose sensitive information if it processed a specially crafted image file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 libxml2 libxml2: GNOME XML library Applications using libxml2 could be made to crash or run programs as your login if they opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Django python-django: High-level Python web development framework Applications using Django could be made to crash or expose sensitive information. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 FreeType freetype: FreeType 2 is a font engine library FreeType could be made to crash or run programs as your login if it opened a specially crafted font file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 t1lib t1lib: Type 1 font rasterizer library - runtime t1lib could be made to crash or run programs as your login if it opened a specially crafted font file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Tomcat tomcat6: Servlet and JSP engine Tomcat could be made to crash or expose sensitive information over the network. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 OpenLDAP openldap: OpenLDAP utilities An OpenLDAP server could potentially be made to crash if it received specially crafted network traffic from an authenticated user. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 libpng libpng: PNG file library libpng could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 cvs cvs: Concurrent Versions System cvs could be made to crash or run programs as your login if it connected to a malicious proxy server. SecPod Team DRAFT INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 ICU icu: International Components for Unicode library ICU could be made to crash or run programs as your login if it opened specially crafted data. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Libav libav: Multimedia player, server, encoder and transcoder Libav could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 libvorbis libvorbis: The Vorbis General Audio Compression Codec libvorbis could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Mozvoikko mozvoikko: Finnish spell-checker extension for Firefox Details: USN-1355-1 fixed vulnerabilities in Firefox. This update provides an updated Mozvoikko package for use with the latest Firefox. Original advisory This update provides compatible Mozvoikko packages for the latest Firefox. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 bzip2 bzip2: high-quality block-sorting file compressor - utilities Executables compressed by bzexe could be made to run programs as your login. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Thunderbird thunderbird: Mozilla Open Source mail and newsgroup client Multiple vulnerabilities have been fixed in Thunderbird. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Firefox firefox: Mozilla Open Source web browser Multiple vulnerabilities have been fixed in Firefox. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 librsvg librsvg: Rendering library for SVG files SVG image rendering library has had flaws fixed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 Bind bind9: Internet Domain Name Server Bind could be made to crash if it received specially crafted network traffic. SecPod Team DRAFT INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Mozvoikko mozvoikko: Finnish spell-checker extension for Firefox Details: USN-1192-1 fixed vulnerabilities in Firefox. This update provides an updated Mozvoikko for use with Firefox 6. Original advisory This update provides a compatible Mozvoikko for Firefox 6. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 Apache apache2: Apache HTTP server A remote attacker could send crafted input to Apache and cause it to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Python python3.1: An interactive high-level object-oriented language - python3.2: An interactive high-level object-oriented language Applications using certain Python 3 modules could be made to crash or expose sensitive information over the network. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Linux linux: Linux kernel Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 OpenJDK openjdk-6: Open Source Java implementation - openjdk-6b18: Open Source Java implementation Details: USN-1263-1 fixed vulnerabilities in OpenJDK 6. The upstream patch for the chosen plaintext attack on the block-wise AES encryption algorithm introduced a regression that caused TLS/SSL connections to fail when using certain algorithms. This update fixes the problem. We apologize for the inconvenience. Original advisory USN-1263-1 caused a regression when using OpenJDK 6�s SSL/TLS implementation. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 OpenJDK openjdk-6: Open Source Java implementation Multiple OpenJDK 6 vulnerabilities have been fixed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Firefox firefox: Mozilla Open Source web browser Several security issues were fixed in Firefox. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 IcedTea-Web icedtea-web: A web browser plugin to execute Java applets - openjdk-6: Open Source Java implementation - openjdk-6b18: Open Source Java implementation Multiple OpenJDK 6 and IcedTea-Web vulnerabilities have been fixed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Mozvoikko mozvoikko: Finnish spell-checker extension for Firefox SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 Apache apache2: Apache HTTP server Several security issues were fixed in the Apache HTTP Server. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Linux linux-ti-omap4: Linux kernel for OMAP4 The system could be made to crash under certain conditions. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 gdm-guest-session gdm-guest-session: gdm extension for guest session gdm-guest-session could be made to delete files as the administrator. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.10 Software software-center: Utility for browsing, installing, and removing software An attacker could trick Software Center into installing altered packages and repositories or exposing sensitive information over the network. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Linux linux-ti-omap4: Linux kernel for OMAP4 Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 ubufox ubufox: Finnish spell-checker extension for Firefox Details: USN-1400-1 fixed vulnerabilities in Firefox. This update provides an updated ubufox package for use with the latest Firefox. Original advisory This update provides compatible ubufox packages for the latest Firefox. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 system-config-printer system-config-printer: Python modules for printer configuration with CUPS An attacker could trick system-config-printer into installing altered packages and repositories. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 Update-Manager update-manager: GNOME application that manages apt updates Details: USN-1284-1 fixed vulnerabilities in Update Manager. One of the fixes introduced a regression for Kubuntu users attempting to upgrade to a newer Ubuntu release. This update fixes the problem. We apologize for the inconvenience. Original advisory USN-1284-1 introduced a regression in Update Manager. SecPod Team DRAFT INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Quassel quassel: KDE/Qt-based IRC client A remote attacker could send crafted input to Quassel and cause it to crash. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 JasPer jasper: Library for manipulating JPEG-2000 files JasPer could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.10 Puppet puppet: Centralized configuration management Puppet would allow unintended access to resources over the network. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 httplib2 python-httplib2: comprehensive HTTP client library written for Python httplib2 could be made to expose sensitive information over the network. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 GNU eglibc: Embedded GNU C Library: sources - glibc: GNU C Library: Documentation Multiple vulnerabilities were discovered and fixed in the GNU C Library. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 PHP php5: HTML-embedded scripting language interpreter Multiple vulnerabilities in PHP. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Thunderbird thunderbird: Mozilla Open Source mail and newsgroup client Several security issues were fixed in Thunderbird. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Quagga quagga: BGP/OSPF/RIP routing daemon Quagga could be made to crash or run programs if it received specially crafted network traffic. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Linux linux: Linux kernel Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Puppet puppet: Centralized configuration management Puppet could be made to overwrite files and run programs with administrator privileges. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Linux linux-ti-omap4: Linux kernel for OMAP4 Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 Apache apache2: Apache HTTP server - apache2-mpm-itk: multiuser MPM for Apache 2.2 Details: It was discovered that the mod_proxy module in Apache did not properly interact with the RewriteRule and ProxyPassMatch pattern matches in the configuration of a reverse proxy. This could allow remote attackers to contact internal webservers behind the proxy that were not intended for external exposure. Stefano Nichele discovered that the mod_proxy_ajp module in Apache when used with mod_proxy_balancer in certain configurations could allow remote attackers to cause a denial of service via a malformed HTTP request. Samuel Montosa discovered that the ITK Multi-Processing Module for Apache did not properly handle certain configuration sections that specify NiceValue but not AssignUserID, preventing Apache from dropping privileges correctly. This issue only affected Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04. USN 1199-1 fixed a vulnerability in the byterange filter of Apache. The upstream patch introduced a regression in Apache when handling specific byte range requests. This update fixes the issue. Original advisory Multiple vulnerabilities and a regression were fixed in the Apache HTTP server. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 acpid acpid: Advanced Configuration and Power Interface daemon Several security issues were fixed in acpid. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 vsftpd vsftpd: FTP server written for security Vsftpd or other applications could be made to crash if vsftpd received specially crafted network traffic. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Apache commons-daemon: wrapper to launch Java applications as daemons Apache Commons Daemon would allow unintended access to files over the network. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Mozvoikko mozvoikko: Finnish spell-checker extension for Firefox - ubufox: Ubuntu Firefox specific configuration defaults and apt support Details: USN-1277-1 fixed vulnerabilities in Firefox. This update provides updated Mozvoikko and ubufox packages for use with Firefox 8. Original advisory This update provides packages compatible with Firefox 8. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 CA ca-certificates: Common CA certificates Details: USN-1197-1 addressed an issue in Firefox and Xulrunner pertaining to the Dutch Certificate Authority DigiNotar mis-issuing fraudulent certificates. This update provides the corresponding update for ca-certificates. Original advisory A certificate authority mis-issued fraudulent certificates. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 PostgreSQL postgresql-9.1: Object-relational SQL database - postgresql-8.4: Object-relational SQL database - postgresql-8.3: Object-relational SQL database Several security issues were fixed in PostgreSQL. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Ruby ruby1.8: Interpreter of object-oriented scripting language Ruby 1.8 Several security issues were fixed in ruby1.8. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Firefox firefox: Mozilla Open Source web browser Several security issues were fixed in Firefox. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 devscripts devscripts: scripts to make the life of a Debian Package maintainer easier debdiff, a part of devscripts, could be made to run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 Update update-manager: GNOME application that manages apt updates - update-notifier: Daemon which notifies about package updates Update Manager could be made to overwrite files as the administrator. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Firefox firefox: Mozilla Open Source web browser Multiple Firefox vulnerabilities have been fixed SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 FreeType freetype: FreeType 2 is a font engine library FreeType could be made to crash or run programs as your login if it opened a specially crafted font file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 LTSP ldm: LTSP display manager LTSP Display Manager could be made to run programs as an administrator. SecPod Team DRAFT INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Pidgin pidgin: multi-protocol instant messaging client Pidgin could be made to crash if it received specially crafted network traffic. SecPod Team DRAFT INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 t1lib t1lib: Type 1 font rasterizer library - runtime t1lib could be made to crash or run programs as your login if it opened a specially crafted font file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 eCryptfs ecryptfs-utils: ecryptfs cryptographic filesystem eCryptfs could be tricked into mounting and unmounting arbitrary locations, and possibly disclose confidential information. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Linux linux-ti-omap4: Linux kernel for OMAP4 Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Linux linux-ti-omap4: Linux kernel for OMAP4 Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 CUPS cups: Common UNIX Printing System - server - cupsys: Common UNIX Printing System - server An attacker could send crafted print jobs to CUPS and cause it to crash or run programs. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Tomcat tomcat6: Servlet and JSP engine Tomcat could be made to crash or expose sensitive information if it received specially crafted network traffic. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 KDE kdeutils: KDE general-purpose utilities Ark could be made to remove files. SecPod Team DRAFT INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 QEMU qemu-kvm: Machine emulator and virtualizer A remote attacker could cause QEMU to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Linux linux-ti-omap4: Linux kernel for OMAP4 Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Firefox firefox: Mozilla Open Source web browser - xulrunner-1.9.2: Mozilla Gecko runtime environment Details: USN-1197-1 partially addressed an issue with Dutch Certificate Authority DigiNotar mis-issuing fraudulent certificates. This update actively distrusts the DigiNotar root certificate as well as several intermediary certificates. Also included in this list of distrusted certificates are the Staat der Nederlanden root certificates. Original advisory A certificate authority issued fraudulent certificates. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.10 curl curl: HTTP, HTTPS, and FTP client and client libraries curl could be tricked into injecting arbitrary data if it handled a malicious URL. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 APT apt: Advanced front-end for dpkg an attacker could trick APT into installing altered packages. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Firefox firefox: Mozilla Open Source web browser Details: USN-1367-1 fixed vulnerabilities in libpng. This provides the corresponding update for Firefox. Original advisory Firefox could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Thunderbird thunderbird: Mozilla Open Source mail and newsgroup client Details: USN-1401-1 fixed vulnerabilities in Xulrunner. This update provides the corresponding fixes for Thunderbird. Original advisory Several security issues were fixed in Thunderbird. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Software software-properties: manage the repositories that you install software from Software Properties could be tricked into installing arbitrary PPA GPG keys. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 libmodplug libmodplug: Library for mod music based on ModPlug libmodplug could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 MySQL mysql-5.1: MySQL database - mysql-dfsg-5.1: MySQL database - mysql-dfsg-5.0: MySQL database Several security issues were fixed in MySQL. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Linux linux: Linux kernel Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 PyPAM python-pam: A Python interface to the PAM library PyPAM could be made to crash or possibly run programs if it processed a specially crafted password. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Linux linux: Linux kernel Multiple kernel flaws have been fixed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 10.04 Ubuntu 11.04 Ubuntu 11.10 Ubuntu 12.04 Modsecurity ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-5031 Gaurav Kumar DRAFT INTERIM ACCEPTED David Rothenberg INTERIM ACCEPTED ACCEPTED libapache-mod-security package is installed Gaurav Kumar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 Ubuntu 12.04 is installed Gaurav Kumar DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 12.04 modsecurity-apache package is installed Gaurav Kumar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 libarchive libarchive: Library to read/write archive files libarchive could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Linux linux: Linux kernel Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Thunderbird thunderbird: Mozilla Open Source mail and newsgroup client Multiple vulnerabilities have been fixed in Thunderbird. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Thunderbird thunderbird: Mozilla Open Source mail and newsgroup client Details: USN-1197-1 fixed a vulnerability in Firefox with regard to the DigiNotar certificate authority. This update provides the corresponding updates for Thunderbird. We are aware that the DigiNotar Root CA Certificate is still shown as trusted in the Thunderbird certificate manager. This is due to Thunderbird using the system version of the Network Security Service libraries . Thunderbird will actively distrust any certificate signed by this DigiNotar Root CA certificate. This means that users will still get an untrusted certificate warning when accessing a service through Thunderbird that presents a certificate signed by this DigiNotar Root CA certificate. Original advisory A certificate authority issued fraudulent certificates. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 NSS nss: Network Security Service libraries Details: USN-1197-1 and USN-1197-3 addressed an issue in Firefox and Xulrunner pertaining to the Dutch Certificate Authority DigiNotar mis-issuing fraudulent certificates. This update provides the corresponding update for the Network Security Service libraries . Original advisory A certificate authority mis-issued fraudulent certificates. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 DHCP isc-dhcp: DHCP server and client DHCP could be made to crash if it received specially crafted network traffic. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Firefox firefox: Mozilla Open Source web browser A security vulnerability has been fixed in Firefox. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Linux linux: Linux kernel Several security issues were fixed in the kernel. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 DHCP isc-dhcp: DHCP server and client - dhcp3: DHCP server and client An attacker could send crafted input to DHCP and cause it to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 radvd radvd: Router Advertisement Daemon radvd could be made to crash or overwrite certain files if it received specially crafted network traffic. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 libXfont libxfont: X11 font rasterisation library libXfont could be made to run programs as an administrator if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 APT apt: Advanced front-end for dpkg Details: It was discovered that APT incorrectly handled the Verify-Host configuration option. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could potentially be used to steal repository credentials. This issue only affected Ubuntu 10.04 LTS and 10.10. USN-1215-1 fixed a vulnerability in APT by disabling the apt-key net-update option. This update re-enables the option with corrected verification. Original advisory APT could be made to expose sensitive information over the network. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 Firefox firefox: Mozilla Open Source web browser Several security issues were fixed in Firefox. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 X.Org xorg: X.Org X Window System X could be made to start by a user who lacked appropriate permissions. SecPod Team DRAFT INTERIM ACCEPTED Chandan S INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.10 Ubuntu 10.04 Ubuntu 10.10 ClamAV clamav: Anti-virus utility for Unix ClamAV could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.10 Ubuntu 11.10 is installed SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 Firefox firefox: Mozilla Open Source web browser - xulrunner-1.9.2: Mozilla Gecko runtime environment A certificate authority issued fraudulent certificates. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 bind9 bind9: Internet Domain Name Server An attacker could send crafted input to Bind and cause it to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 qemu-kvm qemu-kvm: Machine emulator and virtualizer QEMU could be made to run with adminstrator group privileges under certain circumstances. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 ecryptfs-utils ecryptfs-utils: ecryptfs cryptographic filesystem An attacker could use eCryptfs to unmount arbitrary locations and cause a denial of service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 libsndfile libsndfile: Library for reading/writing audio files An application using libsndfile could be made to crash or possibly run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 linux linux: Linux kernel Multiple kernel flaws have been fixed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 clamav clamav: anti-virus utility for Unix - command-line interface An attacker could send crafted input to ClamAV and cause it to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 thunderbird thunderbird: mail/news client with RSS and integrated spam filter support Details: USN-1122-1 fixed vulnerabilities in Thunderbird for Lucid and Maverick. This update provides the corresponding fixes for Natty. Original advisory Thunderbird could be made to run programs as your login if it opened specially crafted mail. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 openjdk-6 openjdk-6b18 openjdk-6: Open Source Java implementation - openjdk-6b18: Open Source Java implementation Multiple OpenJDK 6 vulnerabilities have been fixed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 libpng libpng: PNG file library Libpng could be made to run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 thunderbird thunderbird: mail/news client with RSS and integrated spam filter support Details: USN-1122-2 fixed vulnerabilities in Thunderbird on Ubuntu 11.04. A regression was introduced which caused Thunderbird to display an empty menu bar. This update fixes the problem. We apologize for the inconvenience. Original advisory An empty menu bar sometimes appeared after upgrade in USN-1122-2 SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 gimp gimp: The GNU Image Manipulation Program GIMP could be made to run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 firefox firefox: Safe and easy web browser from Mozilla Multiple Firefox vulnerabilities have been fixed SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 likewise-open likewise-open: Authentication services for Active Directory domains Local SQL injection vulnerability SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 icedtea-web openjdk-6 openjdk-6b18 icedtea-web: An implementation of the Java Network Launching Protocol - openjdk-6: Open Source Java implementation - openjdk-6b18: Open Source Java implementation An attacker could discover a user�s name or confuse a user into granting unintended access to files. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 dgm gdm: GNOME Display Manager GDM could be made to launch a browser and leak information about the system. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 mozvoikko ubufox webfav mozvoikko: Finnish spell-checker extension for Firefox - ubufox: Ubuntu Firefox specific configuration defaults and apt support - webfav: Firefox extension for saving web favorites Details: USN-1157-1 fixed vulnerabilities in Firefox. This update provides updated packages for use with Firefox 5. Original advisory This update provides provides packages compatible with Firefox 5. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 foomatic-filters foomatic-filters: OpenPrinting printer support - filters An attacker could send crafted input to Foomatic and cause it to run programs as the "lp" user. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 firefox firefox: Safe and easy web browser from Mozilla Details: USN-1157-1 fixed vulnerabilities in Firefox. Unfortunately, this update produced the side effect of pulling in Firefox on some systems that did not have it installed during a dist-upgrade due to changes in the Ubuntu language packs. This update fixes the problem. We apologize for the inconvenience. Original advisory under certain circumstances, the updated translations could unintentionally install firefox. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 qemu-kvm qemu-kvm: Machine emulator and virtualizer a privileged attacker within a QEMU guest could cause QEMU to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 libvirt libvirt: Libvirt virtualization toolkit Libvirt could be made to crash or read arbitrary files on the host. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 qemu-kvm qemu-kvm: Machine emulator and virtualizer A privileged attacker within a QEMU guest could cause QEMU to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 apt apt: Advanced front-end for dpkg An attacker could trick APT into installing altered packages. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 libvirt libvirt: Libvirt virtualization toolkit An authenticated attacker could send crafted input to libvirt and cause it to crash. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 freetype freetype: FreeType 2 is a font engine library FreeType could be made to run programs as your login if it opened a specially crafted font file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 libsoup2.4 libsoup2.4: HTTP client/server library for GNOME An attacker could send crafted URLs to a SoupServer application and obtain unintended access to files. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 libmodplug libmodplug: Library for mod music based on ModPlug libmodplug could be made to run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 dbus dbus: simple interprocess messaging system DBus could be made to crash if it processed a specially crafted message. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 thunderbird thunderbird: Mozilla Open Source mail and newsgroup client Multiple vulnerabilities were fixed in Thunderbird. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.10 tgt tgt: Linux SCSI target user-space tools An attacker could send crafted input to tgt and cause it to crash or run arbitrary programs. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 libxml2 libxml2: GNOME XML library libxml2 could be made to crash or run programs as your login if it opened a specially crafted file. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 logrotate logrotate: Log rotation utility An attacker could cause logrotate to run programs, stop working, or read and write arbitrary files. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 nagios3 nagios3: A host/service/network monitoring and management system an attacker could modify or steal data if you were tricked into clicking on a special link to Nagios. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 firefox firefox: Safe and easy web browser from Mozilla Multiple firefox vulnerabilities SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 samba samba: SMB/CIFS file, print, and login server for Unix An attacker could use a malicious URL to reconfigure Samba or steal information. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 8.04 Ubuntu 10.04 Ubuntu 10.10 curl curl: HTTP, HTTPS, and FTP client and client libraries Details: Richard Silverman discovered that when doing GSSAPI authentication, libcurl unconditionally performs credential delegation, handing the server a copy of the client�s security credential. Wesley Miaw discovered that when zlib is enabled, libcurl does not properly restrict the amount of callback data sent to an application that requests automatic decompression. This might allow an attacker to cause a denial of service via an application crash or possibly execute arbitrary code with the privilege of the application. This issue only affected Ubuntu 8.04 LTS and Ubuntu 10.04 LTS. USN 818-1 fixed an issue with curl�s handling of SSL certificates with zero bytes in the Common Name. Due to a packaging error, the fix for this issue was not being applied during the build. This issue only affected Ubuntu 8.04 LTS. We apologize for the error. Original advisory Multiple vulnerabilities in curl. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 11.04 Ubuntu 11.04 is installed SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 8.04 is installed SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 10.10 Ubuntu 10.10 is installed SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 10.04 Ubuntu 10.04 is installed SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED