The OVAL Repository 5.4 2015-09-03T06:29:03.432-04:00 Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox Alexey Proskuryakov, Yosuke Hasegawa and Simon Montagu discovered flaws in Firefox's character encoding handling. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 ghostscript gs-esp gs-gpl Chris Evans discovered that Ghostscript contained a buffer overflow in its color space handling code. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mailman Multiple cross-site scripting flaws were discovered in mailman. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libcdio Devon Miller discovered that the iso-info and cd-info tools did not properly perform bounds checking. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mysql-dfsg-5.0 Masaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mysql-dfsg-5.0 Masaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 cupsys Wei Wang discovered that the SNMP discovery backend did not correctly calculate the length of strings. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libxfont xorg-server Multiple overflows were discovered in the XFree86-Misc, XInput-Misc, TOG-CUP, EVI, and MIT-SHM extensions which did not correctly validate function arguments. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 tomboy Jan Oravec discovered that Tomboy did not properly setup the LD_LIBRARY_PATH environment variable. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 icu Will Drewry discovered that libicu did not properly handle '\0' when processing regular expressions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 boost Will Drewry and Tavis Ormandy discovered that the boost library20 did not properly perform input validation on regular expressions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 libnet-dns-perl It was discovered that Net::DNS did not correctly validate the size of DNS replies. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 mozilla-thunderbird USN-582-1 fixed several vulnerabilities in Thunderbird. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM Maria Kedovskaya DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 pwlib Jose Miguel Esparza discovered that pwlib did not correctly handle large string lengths. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 unzip Tavis Ormandy discovered that unzip did not correctly clean up pointers. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 bzip2 It was discovered that bzip2 did not correctly handle certain malformed archives. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 samba USN-544-1 fixed two vulnerabilities in Samba. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 tomboy Jan Oravec discovered that Tomboy did not properly setup the LD_LIBRARY_PATH environment variable. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 squid It was discovered that Squid did not always clean up cache memory correctly. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 openldap2.2 openldap2.3 Jonathan Clarke discovered that the OpenLDAP slapd server did not properly handle modify requests when using the Berkeley DB backend and the NOOP control was used. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 samba Alin Rad Pop discovered that Samba did not correctly check the size of reply packets to mailslot requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 openldap2.2 openldap2.3 Jonathan Clarke discovered that the OpenLDAP slapd server did not properly handle modify requests when using the Berkeley DB backend and the NOOP control was used. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox Flaws were discovered in Firefox which could lead to crashes during JavaScript garbage collection. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 opal Jose Miguel Esparza discovered that certain SIP headers were not correctly validated. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 net-snmp Bill Trost discovered that snmpd did not properly limit GETBULK requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 linux-source-2.6.17 linux-source-2.6.20 linux-source-2.6.22 The minix filesystem did not properly validate certain filesystem values. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.10 Ubuntu 7.04 hplip It was discovered that the hpssd tool of hplip did not correctly handle shell meta-characters. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 libmodplug Luigi Auriemma discovered that libmodplug did not properly sanitize its input. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 elinks Kalle Olavi Niemitalo discovered that if elinks makes a POST request to an HTTPS URL through a proxy, information may be sent in clear-text between elinks and the proxy. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 tk8.3 tk8.4 It was discovered that Tk could be made to overrun a buffer when loading certain images. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 koffice USN-603-1 fixed vulnerabilities in poppler. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 enigmail USN-469-1 fixed vulnerabilities in the Mozilla Thunderbird email client. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 unzip Tavis Ormandy discovered that unzip did not correctly clean up pointers. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 flac Sean de Regge discovered that flac did not properly perform bounds checking in many situations. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 squid It was discovered that Squid did not always clean up cache memory correctly. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 linux-source-2.6.17 linux-source-2.6.20 linux-source-2.6.22 The minix filesystem did not properly validate certain filesystem values. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 xorg-server USN-571-1 fixed vulnerabilities in X.org. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 icu Will Drewry discovered that libicu did not properly handle '\0' when processing regular expressions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 xfsdump Paul Martin discovered that xfs_fsr creates a temporary directory with insecure permissions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox Alexey Proskuryakov, Yosuke Hasegawa and Simon Montagu discovered flaws in Firefox's character encoding handling. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox It was discovered that Firefox incorrectly associated redirected sites as the origin of "jar:" contents. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 imagemagick Multiple vulnerabilities were found in the image decoders of ImageMagick. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 ruby1.8 Chris Clark discovered that Ruby's HTTPS module did not check for commonName mismatches early enough during SSL negotiation. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 pwlib Jose Miguel Esparza discovered that pwlib did not correctly handle large string lengths. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 linux-source-2.6.17 linux-source-2.6.20 linux-source-2.6.22 Wojciech Purczynski discovered that the vmsplice system call did not properly perform verification of user-memory pointers. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 openssh Timo Juhani Lindfors discovered that the OpenSSH client, when port forwarding was requested, would listen on any available address family. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libgd2 Mattias Bengtsson and Philip Olausson discovered that the GD library did not properly perform bounds checking when creating images. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 apache2 It was discovered that Apache did not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 ghostscript gs-gpl USN-501-1 fixed vulnerabilities in Jasper. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mozilla-thunderbird thunderbird It was discovered that Thunderbird did not properly set the size of a buffer when parsing an external-body MIME-type. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 gnumeric Thilo Pfennig and Morten Welinder discovered that the XLS spreadsheet handling code in Gnumeric did not correctly calculate needed memory sizes. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 squid It was discovered that Squid did not perform proper bounds checking when processing cache update replies. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 kdebase kdelibs It was discovered that Konqueror could be tricked into displaying incorrect URLs. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 krb5 librpcsecgss It was discovered that the libraries handling RPCSEC_GSS did not correctly validate the size of certain packet structures. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 pcre3 It was discovered that PCRE did not correctly handle very long strings containing UTF8 sequences. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 pcre3 Tavis Ormandy and Will Drewry discovered multiple flaws in the regular expression handling of PCRE. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 openldap2.2 openldap2.3 Thomas Sesselmann discovered that the OpenLDAP slapd server did not properly handle certain modify requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 apache2 It was discovered that Apache did not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 util-linux Ludwig Nussel discovered that mount and umount did not properly drop privileges when using helper programs. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 evolution Ulf Harnhammar discovered that Evolution did not correctly handle format strings when processing encrypted emails. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 mozilla-thunderbird Various flaws were discovered in the layout and JavaScript engines. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 dovecot It was discovered that the default configuration of dovecot could allow access to any email files with group "mail" without verifying that a user had valid rights. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 squid It was discovered that Squid did not perform proper bounds checking when processing cache update replies. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 xorg-server USN-571-1 fixed vulnerabilities in X.org. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 php5 It was discovered that the wordwrap function did not correctly check lengths. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 python2.4 python2.5 Piotr Engelking discovered that strxfrm in Python was not correctly calculating the size of the destination buffer. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 python2.4 python2.5 Piotr Engelking discovered that strxfrm in Python was not correctly calculating the size of the destination buffer. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 bzip2 It was discovered that bzip2 did not correctly handle certain malformed archives. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 poppler It was discovered that the poppler PDF library did not correctly handle certain malformed embedded fonts. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mozilla-thunderbird thunderbird It was discovered that Thunderbird did not properly set the size of a buffer when parsing an external-body MIME-type. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 openoffice.org openoffice.org-amd64 An integer overflow was discovered in the TIFF handling code in OpenOffice. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libcairo USN-550-1 fixed vulnerabilities in Cairo. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 sdl-image1.2 Michael Skladnikiewicz discovered that SDL_image did not correctly load GIF images. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libcairo USN-550-1 fixed vulnerabilities in Cairo. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libpng It was discovered that libpng did not properly perform bounds checking and comparisons in certain operations. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mailman Multiple cross-site scripting flaws were discovered in mailman. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 quagga It was discovered that Quagga did not correctly verify OPEN messages or COMMUNITY attributes sent from configured peers. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 e2fsprogs Rafal Wojtczuk discovered multiple integer overflows in e2fsprogs. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 openldap2.2 openldap2.3 Thomas Sesselmann discovered that the OpenLDAP slapd server did not properly handle certain modify requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 dhcp Nahuel Riva and Gerardo Richarte discovered that the DHCP server did not correctly handle certain client options. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 krb5 librpcsecgss USN-511-1 fixed vulnerabilities in krb5 and librpcsecgss. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox Various flaws were discovered in the browser and JavaScript engine. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 perl It was discovered that Perl's regular expression library did not correctly handle certain UTF sequences. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 koffice USN-542-1 fixed a vulnerability in poppler. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox Various flaws were discovered in the browser and JavaScript engine. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox USN-546-1 fixed vulnerabilities in Firefox. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 tar Dmitry V. Levin discovered that tar did not correctly detect the ".." file path element when unpacking archives. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 vim Ulf Harnhammar discovered that vim does not properly sanitise the "helptags_one()" function when running the "helptags" command. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 cupsys It was discovered that the CUPS administration interface contained a heap- based overflow flaw. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 openssh Jan Pechanec discovered that ssh would forward trusted X11 cookies when untrusted cookie generation failed. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 linux-source-2.6.17 linux-source-2.6.20 linux-source-2.6.22 Wojciech Purczynski discovered that the vmsplice system call did not properly perform verification of user-memory pointers. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 openssl Andy Polyakov discovered that the DTLS implementation in OpenSSL was vulnerable. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mozilla-thunderbird thunderbird Various flaws were discovered in the layout and JavaScript engines. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mysql-dfsg-5.0 Joe Gallo and Artem Russakovskii discovered that the InnoDB engine in MySQL did not properly perform input validation. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 boost Will Drewry and Tavis Ormandy discovered that the boost library20 did not properly perform input validation on regular expressions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 perl It was discovered that Perl's regular expression library did not correctly handle certain UTF sequences. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 kdebase It was discovered that KDM would allow logins without password checks under certain circumstances. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 mysql-dfsg-5.0 Neil Kettle discovered that MySQL could be made to dereference a NULL pointer and divide by zero. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 samba Samba developers discovered that nmbd could be made to overrun a buffer during the processing of GETDC logon server requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 linux-source-2.6.17 linux-source-2.6.20 linux-source-2.6.22 The minix filesystem did not properly validate certain filesystem values. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 cupsys Alin Rad Pop discovered that CUPS did not correctly validate buffer lengths when processing IPP tags. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 evolution Ulf Harnhammar discovered that Evolution did not correctly handle format strings when processing encrypted emails. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 tetex-bin texlive-bin Bastien Roucaries discovered that dvips as included in tetex-bin and texlive-bin did not properly perform bounds checking. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 samba Alin Rad Pop discovered that Samba did not correctly check the size of reply packets to mailslot requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libxml2 Brad Fitzpatrick discovered that libxml2 did not correctly handle certain UTF-8 sequences. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 t1lib It was discovered that t1lib does not properly perform bounds checking which can result in a buffer overflow vulnerability. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mono It was discovered that Mono did not correctly bounds check certain BigInteger actions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 debian-goodies Thomas de Grenier de Latour discovered that the checkrestart program included in debian-goodies did not correctly handle shell meta-characters. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 sdl-image1.2 Michael Skladnikiewicz discovered that SDL_image did not correctly load GIF images. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 openssl It was discovered that OpenSSL did not correctly perform Montgomery multiplications. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libxfont xorg-server Multiple overflows were discovered in the XFree86-Misc, XInput-Misc, TOG-CUP, EVI, and MIT-SHM extensions which did not correctly validate function arguments. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mono It was discovered that Mono did not correctly bounds check certain BigInteg er actions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 openssh Timo Juhani Lindfors discovered that the OpenSSH client, when port forwarding was requested, would listen on any available address family. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 tetex-bin texlive-bin Bastien Roucaries discovered that dvips as included in tetex-bin and texlive-bin did not properly perform bounds checking. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 e2fsprogs Rafal Wojtczuk discovered multiple integer overflows in e2fsprogs. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 poppler It was discovered that the poppler PDF library did not correctly handle certain malformed embedded fonts. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 gnumeric Thilo Pfennig and Morten Welinder discovered that the XLS spreadsheet handling code in Gnumeric did not correctly calculate needed memory sizes. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 linux-source-2.6.15 linux-source-2.6.17 linux-source-2.6.20 Evan Teran discovered that the Linux kernel ptrace routines did not correctly handle certain requests robustly. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 cupsys It was discovered that the CUPS administration interface contained a heap- based overflow flaw. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 openssh Jan Pechanec discovered that ssh would forward trusted X11 cookies when untrusted cookie generation failed. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 libsndfile Robert Buchholz discovered that libsndfile did not correctly validate the size of its memory buffers. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 cupsys Wei Wang discovered that the SNMP discovery backend did not correctly calculate the length of strings. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libgd2 Mattias Bengtsson and Philip Olausson discovered that the GD library did not properly perform bounds checking when creating images. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 opal Jose Miguel Esparza discovered that certain SIP headers were not correctly validated. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 qt-x11-free Dirk Mueller discovered that UTF8 strings could be made to cause a small buffer overflow. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 mozilla-thunderbird USN-582-1 fixed several vulnerabilities in Thunderbird. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED Maria Mikhno ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 linux-source-2.6.17 linux-source-2.6.20 linux-source-2.6.22 The minix filesystem did not properly validate certain filesystem values. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox Flaws were discovered in Firefox which could lead to crashes during JavaScript garbage collection. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 dovecot It was discovered that the default configuration of dovecot could allow access to any email files with group "mail" without verifying that a user had valid rights. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libxml2 Brad Fitzpatrick discovered that libxml2 did not correctly handle certain UTF-8 sequences. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mysql-dfsg-5.0 Joe Gallo and Artem Russakovskii discovered that the InnoDB engine in MySQL did not properly perform input validation. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 krb5 It was discovered that krb5 did not correctly handle certain krb4 requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox USN-546-1 fixed vulnerabilities in Firefox. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libcdio Devon Miller discovered that the iso-info and cd-info tools did not properly perform bounds checking. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 krb5 It was discovered that krb5 did not correctly handle certain krb4 requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.10 linux-source-2.6.17 A flaw in the sysfs_readdir function allowed a local user to cause a denial of service by dereferencing a NULL pointer. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 fetchmail Gaetan Leurent discovered a vulnerability in the APOP protocol based on MD5 collisions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox Various flaws were discovered in the layout and JavaScript engines. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 dhcp USN-531-1 fixed vulnerabilities in dhcp. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 libnet-dns-perl It was discovered that Net::DNS did not correctly validate the size of DNS replies. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libcairo Peter Valchev discovered that Cairo did not correctly decode PNG image data. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 emacs21 Hendrik Tews discovered that emacs21 did not correctly handle certain GIF images. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 ruby1.8 Chris Clark discovered that Ruby's HTTPS module did not check for commonName mismatches early enough during SSL negotiation. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 ghostscript gs-esp gs-gpl Chris Evans discovered that Ghostscript contained a buffer overflow in its color space handling code. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 koffice USN-603-1 fixed vulnerabilities in poppler. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 postgresql-8.1 postgresql-8.2 Nico Leidecker discovered that PostgreSQL did not properly restrict dblink functions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 net-snmp Bill Trost discovered that snmpd did not properly limit GETBULK requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 pcre3 It was discovered that PCRE did not correctly handle very long strings containing UTF8 sequences. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 postgresql-8.1 postgresql-8.2 Nico Leidecker discovered that PostgreSQL did not properly restrict dblink functions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 linux-restricted-modules-2.6.17 linux-restricted-modules-2.6.20 vmware-player-kernel-2.6.15 Neel Mehta and Ryan Smith discovered that the VMWare Player DHCP server did not correctly handle certain packet structures. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM Maria Kedovskaya ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 poppler Secunia Research discovered several vulnerabilities in poppler. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.04 Ubuntu 7.04 is installed Maria Kedovskaya DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 6.10 Ubuntu 6.10 is installed Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 7.10 is installed SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.06 is installed SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED