The OVAL Repository 5.4 2015-09-03T06:29:07.415-04:00 Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 libarchive-tar-perl perl Jonathan Smith discovered that the Archive::Tar Perl module did not correctly handle symlinks when extracting archives. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 imlib2 It was discovered that Imlib2 did not correctly handle certain malformed XPM and PNG images. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 hplip It was discovered that the hpssd tool of hplip did not validate privileges in the alert-mailing function. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 linux linux-backports-modules-2.6.15 linux-backports-modules-2.6.22 linux-backports-modules-2.6.24 linux-backports-modules-2.6.27 linux-restricted-modules linux-restricted-modules-2.6.15 linux-restricted-modules-2.6.22 linux-restricted-modules-2.6.24 linux-source-2.6.15 linux-source-2.6.22 linux-ubuntu-modules-2.6.22 linux-ubuntu-modules-2.6.24 It was discovered that the Xen hypervisor block driver did not correctly validate requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 firefox Several flaws were discovered in the browser engine. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 ekg libgadu It was discovered that the Gadu library, used by some Instant Messaging clients, did not correctly verify certain packet sizes from the server. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 imagemagick It was discovered that ImageMagick did not correctly handle certain malformed XCF images. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 gnutls12 gnutls13 gnutls26 Martin von Gagern discovered that GnuTLS did not properly verify certificate chains when the last certificate in the chain was self-signed. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 awstats Morgan Todd discovered that AWStats did not correctly strip quotes from certain parameters, allowing for an XSS attack when running as a CGI. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 net-snmp Wes Hardaker discovered that the SNMP service did not correctly validate HMAC authentication requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 mozilla-thunderbird thunderbird Georgi Guninski, Michal Zalewsk and Chris Evans discovered that the same-origin check in Thunderbird could be bypassed. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 hplip USN-674-1 provided packages to fix vulnerabilities in HPLIP. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 libxml2 Drew Yao discovered that libxml2 did not correctly handle certain corrupt XML documents. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 pidgin It was discovered that Pidgin did not properly handle certain malformed messages in the MSN protocol handler. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 linux linux-source-2.6.15 linux-source-2.6.20 linux-source-2.6.22 It was discovered that there were multiple NULL-pointer function dereferences in the Linux kernel terminal handling code. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 cupsys It was discovered that the SGI image filter in CUPS did not perform proper bounds checking. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 freetype Multiple flaws were discovered in the PFB and TTF font handling code in freetype. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox Alexey Proskuryakov, Yosuke Hasegawa and Simon Montagu discovered flaws in Firefox's character encoding handling. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 ghostscript gs-esp gs-gpl Chris Evans discovered that Ghostscript contained a buffer overflow in its color space handling code. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 cupsys Thomas Pollet discovered that CUPS did not properly validate the size of PNG images. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mailman Multiple cross-site scripting flaws were discovered in mailman. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 tiff Drew Yao discovered that the TIFF library did not correctly validate LZW compressed TIFF images. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 gnutls12 gnutls13 gnutls26 USN-678-1 fixed a vulnerability in GnuTLS. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libcdio Devon Miller discovered that the iso-info and cd-info tools did not properly perform bounds checking. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 openssl-blacklist openvpn USN-612-3 addressed a weakness in OpenSSL certificate and keys generation in OpenVPN by adding checks for vulnerable certificates and keys to OpenVPN. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 cpio A buffer overflow was discovered in cpio. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 yelp Aaron Grattafiori discovered that the Gnome Help Viewer did not handle format strings correctly when displaying certain error messages. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mysql-dfsg-5.0 Masaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 7.04 Ubuntu 7.10 pulseaudio It was discovered that PulseAudio did not properly drop privileges when running as a daemon. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.04 Ubuntu 7.10 apt-listchanges Felipe Sateler discovered that apt-listchanges did not use safe paths when importing additional Python libraries. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mysql-dfsg-5.0 Masaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 ssl-cert USN-612-1 fixed vulnerabilities in openssl. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 cupsys Wei Wang discovered that the SNMP discovery backend did not correctly calculate the length of strings. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 linux-backports-modules-2.6.15 linux-backports-modules-2.6.20 linux-backports-modules-2.6.22 linux-restricted-modules-2.6.15 linux-restricted-modules-2.6.20 linux-restricted-modules-2.6.22 linux-source-2.6.15 linux-source-2.6.20 linux-source-2.6.22 linux-ubuntu-modules-2.6.22 It was discovered that the ALSA /proc interface did not write the correct number of bytes when reporting memory allocations. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 openssh A weakness has been discovered in the random number generator used by OpenSSL on Debian and Ubuntu systems. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libxfont xorg-server Multiple overflows were discovered in the XFree86-Misc, XInput-Misc, TOG-CUP, EVI, and MIT-SHM extensions which did not correctly validate function arguments. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 mozilla-thunderbird thunderbird Various flaws were discovered in the browser engine. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 tomboy Jan Oravec discovered that Tomboy did not properly setup the LD_LIBRARY_PATH environment variable. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 icu Will Drewry discovered that libicu did not properly handle '\0' when processing regular expressions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 boost Will Drewry and Tavis Ormandy discovered that the boost library20 did not properly perform input validation on regular expressions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 pwlib Jose Miguel Esparza discovered that pwlib did not correctly handle large string lengths. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 unzip Tavis Ormandy discovered that unzip did not correctly clean up pointers. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 libxml2 Andreas Solberg discovered that libxml2 did not handle recursive entities safely. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 bzip2 It was discovered that bzip2 did not correctly handle certain malformed archives. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 samba USN-544-1 fixed two vulnerabilities in Samba. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 openssh It was discovered that the ForceCommand directive could be bypassed. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 tomboy Jan Oravec discovered that Tomboy did not properly setup the LD_LIBRARY_PATH environment variable. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 squid It was discovered that Squid did not always clean up cache memory correctly. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 openldap2.2 openldap2.3 Jonathan Clarke discovered that the OpenLDAP slapd server did not properly handle modify requests when using the Berkeley DB backend and the NOOP control was used. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 samba Alin Rad Pop discovered that Samba did not correctly check the size of reply packets to mailslot requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 openldap2.2 openldap2.3 Jonathan Clarke discovered that the OpenLDAP slapd server did not properly handle modify requests when using the Berkeley DB backend and the NOOP control was used. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 ipsec-tools It was discovered that there were multiple ways to leak memory during the IKE negotiation when handling certain packets. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox Flaws were discovered in Firefox which could lead to crashes during JavaScript garbage collection. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 php5 It was discovered that PHP did not properly check the length of the string parameter to the fnmatch function. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 net-snmp Bill Trost discovered that snmpd did not properly limit GETBULK requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 linux-source-2.6.17 linux-source-2.6.20 linux-source-2.6.22 The minix filesystem did not properly validate certain filesystem values. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 bind9 Dan Kaminsky discovered weaknesses in the DNS protocol as implemented by Bind. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 openvpn USN-612-3 addressed a weakness in OpenSSL certificate and key generation in OpenVPN by adding checks for vulnerable certificates and keys to OpenVPN. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 gst-plugins-good0.10 USN-611-1 fixed a vulnerability in Speex. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 libxml2 It was discovered that libxml2 did not correctly handle long entity names. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 koffice USN-603-1 fixed vulnerabilities in poppler. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 unzip Tavis Ormandy discovered that unzip did not correctly clean up pointers. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 ltsp Christian Herzog discovered that it was possible to connect to any LTSP client's X session over the network. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 flac Sean de Regge discovered that flac did not properly perform bounds checking in many situations. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 libxslt It was discovered that long transformation matches in libxslt could overflow. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 amarok Dwayne Litzenberger discovered that Amarok created temporary files in an insecure way. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 squid It was discovered that Squid did not always clean up cache memory correctly. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 7.04 Ubuntu 7.10 rsync Sebastian Krahmer discovered that rsync could overflow when handling ACLs. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 linux-source-2.6.17 linux-source-2.6.20 linux-source-2.6.22 The minix filesystem did not properly validate certain filesystem values. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 7.10 gnome-screensaver It was discovered that the notify feature in gnome-screensaver could let a local attacker read the clipboard contents of a locked session by using Ctrl-V. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 avahi Emanuele Aina discovered that Avahi did not properly validate it's input when processing data over D-Bus. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.04 Ubuntu 7.10 dovecot It was discovered that in very rare configurations using LDAP, Dovecot may reuse cached connections for users with the same password. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 xorg-server USN-571-1 fixed vulnerabilities in X.org. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 icu Will Drewry discovered that libicu did not properly handle '\0' when processing regular expressions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox Alexey Proskuryakov, Yosuke Hasegawa and Simon Montagu discovered flaws in Firefox's character encoding handling. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox It was discovered that Firefox incorrectly associated redirected sites as the origin of "jar:" contents. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 ruby1.8 Chris Clark discovered that Ruby's HTTPS module did not check for commonName mismatches early enough during SSL negotiation. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 openssl A weakness has been discovered in the random number generator used by OpenSSL on Debian and Ubuntu systems. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 pwlib Jose Miguel Esparza discovered that pwlib did not correctly handle large string lengths. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 shadow Paul Szabo discovered a race condition in login. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 linux-source-2.6.17 linux-source-2.6.20 linux-source-2.6.22 Wojciech Purczynski discovered that the vmsplice system call did not properly perform verification of user-memory pointers. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 openssh Timo Juhani Lindfors discovered that the OpenSSH client, when port forwarding was requested, would listen on any available address family. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 firefox A flaw was discovered in the browser engine. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libgd2 Mattias Bengtsson and Philip Olausson discovered that the GD library did not properly perform bounds checking when creating images. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 apache2 It was discovered that Apache did not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 ghostscript gs-gpl USN-501-1 fixed vulnerabilities in Jasper. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mozilla-thunderbird thunderbird It was discovered that Thunderbird did not properly set the size of a buffer when parsing an external-body MIME-type. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 gnumeric Thilo Pfennig and Morten Welinder discovered that the XLS spreadsheet handling code in Gnumeric did not correctly calculate needed memory sizes. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 squid It was discovered that Squid did not perform proper bounds checking when processing cache update replies. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 moodle Lukasz Pilorz discovered that the HTML filtering used in Moodle was not strict enough. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 compiz USN-537-1 fixed vulnerabilities in gnome-screensaver. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 pcre3 It was discovered that PCRE did not correctly handle very long strings containing UTF8 sequences. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 pcre3 Tavis Ormandy and Will Drewry discovered multiple flaws in the regular expression handling of PCRE. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 evolution Alin Rad Pop of Secunia Research discovered that Evolution did not properly validate timezone data when processing iCalendar attachments. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 openldap2.2 openldap2.3 Thomas Sesselmann discovered that the OpenLDAP slapd server did not properly handle certain modify requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 apache2 It was discovered that Apache did not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 poppler Felipe Andres Manzano discovered that poppler did not correctly initialize certain page widgets. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 evolution Ulf Harnhammar discovered that Evolution did not correctly handle format strings when processing encrypted emails. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 dovecot It was discovered that the default configuration of dovecot could allow access to any email files with group "mail" without verifying that a user had valid rights. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 linux-ubuntu-modules-2.6.22 linux-ubuntu-modules-2.6.24 USN-662-1 fixed vulnerabilities in ndiswrapper in Ubuntu 8.10. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 squid It was discovered that Squid did not perform proper bounds checking when processing cache update replies. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 hsqldb openoffice.org openoffice.org-amd64 It was discovered that arbitrary Java methods were not filtered out when opening databases in OpenOffice.org. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 xorg-server USN-571-1 fixed vulnerabilities in X.org. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 firefox firefox-3.0 xulrunner-1.9 Justin Schuh, Tom Cross and Peter Williams discovered errors in the Firefox URL parsing routines. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 php5 It was discovered that the wordwrap function did not correctly check lengths. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 php5 USN-549-1 fixed vulnerabilities in PHP. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 python2.4 python2.5 Piotr Engelking discovered that strxfrm in Python was not correctly calculating the size of the destination buffer. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 openoffice.org openoffice.org-amd64 Multiple memory overflow flaws were discovered in OpenOffice.org's handling of WMF and EMF files. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 firefox firefox-3.0 xulrunner-1.9 Liu Die Yu discovered an information disclosure vulnerability in Firefox when using saved .url shortcut files. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 kdelibs It was discovered that start_kdeinit in KDE 3 did not properly sanitize its input. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 python2.4 python2.5 Piotr Engelking discovered that strxfrm in Python was not correctly calculating the size of the destination buffer. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 mozilla-thunderbird thunderbird It was discovered that the same-origin check in Thunderbird could be bypassed. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 bzip2 It was discovered that bzip2 did not correctly handle certain malformed archives. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 poppler It was discovered that the poppler PDF library did not correctly handle certain malformed embedded fonts. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 7.10 qt4-x11 It was discovered that QSslSocket did not properly verify SSL certificates. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 openvpn Once the update is applied, weak shared encryption keys and SSL/TLS certificates will be rejected where possible (though they cannot be detected in all cases). Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mozilla-thunderbird thunderbird It was discovered that Thunderbird did not properly set the size of a buffer when parsing an external-body MIME-type. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 xine-lib Alin Rad Pop discovered an array index vulnerability in the SDP parser. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 xorg-server Multiple flaws were found in the RENDER, RECORD, and Security extensions of X.org which did not correctly validate function arguments. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libcairo USN-550-1 fixed vulnerabilities in Cairo. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 7.10 qt4-x11 It was discovered that QSslSocket did not properly verify SSL certificates. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 sdl-image1.2 Michael Skladnikiewicz discovered that SDL_image did not correctly load GIF images. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 link-grammar Alin Rad Pop discovered that AbiWord's Link Grammar parser did not correctly handle overly-long words. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libcairo USN-550-1 fixed vulnerabilities in Cairo. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libpng It was discovered that libpng did not properly perform bounds checking and comparisons in certain operations. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mailman Multiple cross-site scripting flaws were discovered in mailman. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 speex It was discovered that Speex did not properly validate its input when processing Speex file headers. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 e2fsprogs Rafal Wojtczuk discovered multiple integer overflows in e2fsprogs. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 libexif Meder Kydyraliev discovered that libexif did not correctly handle certain EXIF headers. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 openldap2.2 openldap2.3 Thomas Sesselmann discovered that the OpenLDAP slapd server did not properly handle certain modify requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 dhcp Nahuel Riva and Gerardo Richarte discovered that the DHCP server did not correctly handle certain client options. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 gnome-screensaver Jens Askengren discovered that gnome-screensaver became confused when running under Compiz, and could lose keyboard lock focus. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 ruby1.8 Akira Tagoh discovered a vulnerability in Ruby which lead to an integer overflow. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 pcre3 Tavis Ormandy discovered that the PCRE library did not correctly handle certain in-pattern options. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 openssh Matt Zimmerman discovered that entries in ~/.ssh/authorized_keys with options (such as "no-port-forwarding" or forced commands) were ignored by the new ssh-vulnkey tool introduced in OpenSSH (see USN-612-2). Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox Various flaws were discovered in the browser and JavaScript engine. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 perl It was discovered that Perl's regular expression library did not correctly handle certain UTF sequences. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 dbus Havoc Pennington discovered that the D-Bus daemon did not correctly validate certain security policies. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 rdesktop It was discovered that rdesktop did not properly validate the length of packet headers when processing RDP requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 openssl-blacklist USN-612-3 addressed a weakness in OpenSSL certificate and key generation and introduced openssl-blacklist to aid in detecting vulnerable certificates and keys. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 pidgin It was discovered that Pidgin did not correctly handle certain logging events. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 gnutls12 gnutls13 Multiple flaws were discovered in the connection handling of GnuTLS. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 koffice USN-542-1 fixed a vulnerability in poppler. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox Various flaws were discovered in the browser and JavaScript engine. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox USN-546-1 fixed vulnerabilities in Firefox. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 firefox Various flaws were discovered in the browser engine. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 lcms It was discovered that certain gamma operations in lcms were not correctly bounds-checked. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 cupsys It was discovered that the CUPS administration interface contained a heap- based overflow flaw. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 openssh Jan Pechanec discovered that ssh would forward trusted X11 cookies when untrusted cookie generation failed. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 linux-source-2.6.17 linux-source-2.6.20 linux-source-2.6.22 Wojciech Purczynski discovered that the vmsplice system call did not properly perform verification of user-memory pointers. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 linux linux-source-2.6.15 linux-source-2.6.20 linux-source-2.6.22 Dirk Nehring discovered that the IPsec protocol stack did not correctly handle fragmented ESP packets. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 openssl Andy Polyakov discovered that the DTLS implementation in OpenSSL was vulnerable. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mozilla-thunderbird thunderbird Various flaws were discovered in the layout and JavaScript engines. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mysql-dfsg-5.0 Joe Gallo and Artem Russakovskii discovered that the InnoDB engine in MySQL did not properly perform input validation. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 boost Will Drewry and Tavis Ormandy discovered that the boost library20 did not properly perform input validation on regular expressions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 mozilla-thunderbird thunderbird Various flaws were discovered in the JavaScript engine. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 ruby1.8 Drew Yao discovered several vulnerabilities in Ruby which lead to integer overflows. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 emacs21 emacs22 It was discovered that Emacs did not account for precision when formatting integers. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 postfix Wietse Venema discovered that Postfix leaked internal file descriptors when executing non-Postfix commands. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 perl It was discovered that Perl's regular expression library did not correctly handle certain UTF sequences. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.04 Ubuntu 7.10 libcairo USN-550-1 fixed vulnerabilities in Cairo. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 imlib2 It was discovered that Imlib2 did not correctly handle certain malformed XPM images. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.04 Ubuntu 7.10 rsync Sebastian Krahmer discovered that rsync could overflow when handling ACLs. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 samba Samba developers discovered that nmbd could be made to overrun a buffer during the processing of GETDC logon server requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 linux-source-2.6.17 linux-source-2.6.20 linux-source-2.6.22 The minix filesystem did not properly validate certain filesystem values. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 vorbis-tools USN-611-1 fixed a vulnerability in Speex. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 cupsys Alin Rad Pop discovered that CUPS did not correctly validate buffer lengths when processing IPP tags. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 evolution Ulf Harnhammar discovered that Evolution did not correctly handle format strings when processing encrypted emails. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 tetex-bin texlive-bin Bastien Roucaries discovered that dvips as included in tetex-bin and texlive-bin did not properly perform bounds checking. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 samba Alin Rad Pop discovered that Samba did not correctly check the size of reply packets to mailslot requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libxml2 Brad Fitzpatrick discovered that libxml2 did not correctly handle certain UTF-8 sequences. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 openldap2.2 openldap2.3 Cameron Hotchkies discovered that OpenLDAP did not correctly handle certain ASN.1 BER data. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 postfix Sebastian Krahmer discovered that Postfix was not correctly handling mailbox ownership when dealing with Linux's implementation of hardlinking to symlinks. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mono It was discovered that Mono did not correctly bounds check certain BigInteger actions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 samba USN-617-1 fixed vulnerabilities in Samba. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 sdl-image1.2 Michael Skladnikiewicz discovered that SDL_image did not correctly load GIF images. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libxfont xorg-server Multiple overflows were discovered in the XFree86-Misc, XInput-Misc, TOG-CUP, EVI, and MIT-SHM extensions which did not correctly validate function arguments. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mono It was discovered that Mono did not correctly bounds check certain BigInteg er actions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 7.04 Ubuntu 7.10 libcairo USN-550-1 fixed vulnerabilities in Cairo. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 openssh Timo Juhani Lindfors discovered that the OpenSSH client, when port forwarding was requested, would listen on any available address family. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 samba Samba developers discovered that nmbd could be made to overrun a buffer during the processing of GETDC logon server requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 python2.4 python2.5 It was discovered that there were new integer overflows in the imageop module. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 tetex-bin texlive-bin Bastien Roucaries discovered that dvips as included in tetex-bin and texlive-bin did not properly perform bounds checking. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 e2fsprogs Rafal Wojtczuk discovered multiple integer overflows in e2fsprogs. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 poppler It was discovered that the poppler PDF library did not correctly handle certain malformed embedded fonts. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 gnumeric Thilo Pfennig and Morten Welinder discovered that the XLS spreadsheet handling code in Gnumeric did not correctly calculate needed memory sizes. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 cupsys It was discovered that the CUPS administration interface contained a heap- based overflow flaw. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 openssh Jan Pechanec discovered that ssh would forward trusted X11 cookies when untrusted cookie generation failed. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 linux linux-source-2.6.15 linux-source-2.6.22 It was discovered that the direct-IO subsystem did not correctly validate certain structures. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 cupsys Wei Wang discovered that the SNMP discovery backend did not correctly calculate the length of strings. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libgd2 Mattias Bengtsson and Philip Olausson discovered that the GD library did not properly perform bounds checking when creating images. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 compiz-fusion-plugins-main It was discovered that the Expo plugin for Compiz did not correctly restrict the screensaver window from being moved with the mouse. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 openssl-blacklist USN-612-3 addressed a weakness in OpenSSL certificate and key generation in OpenVPN by introducing openssl-blacklist to aid in detecting vulnerable private keys. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 libvirt It was discovered that libvirt did not mark certain operations as read-only. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 linux-source-2.6.17 linux-source-2.6.20 linux-source-2.6.22 The minix filesystem did not properly validate certain filesystem values. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 libvorbis It was discovered that libvorbis did not correctly handle certain malformed sound files. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox Flaws were discovered in Firefox which could lead to crashes during JavaScript garbage collection. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 dovecot It was discovered that the default configuration of dovecot could allow access to any email files with group "mail" without verifying that a user had valid rights. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libxml2 Brad Fitzpatrick discovered that libxml2 did not correctly handle certain UTF-8 sequences. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 mysql-dfsg-5.0 Joe Gallo and Artem Russakovskii discovered that the InnoDB engine in MySQL did not properly perform input validation. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 krb5 It was discovered that krb5 did not correctly handle certain krb4 requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 nfs-utils It was discovered that nfs-utils did not properly enforce netgroup restrictions when using TCP Wrappers. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox USN-546-1 fixed vulnerabilities in Firefox. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libcdio Devon Miller discovered that the iso-info and cd-info tools did not properly perform bounds checking. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 krb5 It was discovered that krb5 did not correctly handle certain krb4 requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 shadow vm-builder Mathias Gug discovered that vm-builder improperly set the root password when creating virtual machines. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 openssl-blacklist USN-612-3 addressed a weakness in OpenSSL certificate and key generation in OpenVPN by introducing openssl-blacklist to aid in detecting vulnerable private keys. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 exiv2 Meder Kydyraliev discovered that exiv2 did not correctly handle certain EXIF headers. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 tk8.0 tk8.3 tk8.4 It was discovered that Tk could be made to overrun a buffer when loading certain images. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 firefox Various flaws were discovered in the layout and JavaScript engines. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.04 Ubuntu 7.10 dovecot It was discovered that in very rare configurations using LDAP, Dovecot may reuse cached connections for users with the same password. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 dhcp USN-531-1 fixed vulnerabilities in dhcp. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 ffmpeg It was discovered that ffmpeg did not correctly handle STR file demuxing. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 emacs22 Drake Wilson discovered that Emacs did not correctly handle the safe mode of "enable-local-variables". Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 php5 USN-549-1 fixed vulnerabilities in PHP. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 mysql-dfsg-5.0 It was discovered that MySQL could be made to overwrite existing table files in the data directory. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 libcairo Peter Valchev discovered that Cairo did not correctly decode PNG image data. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 netpbm-free It was discovered that Netpbm could be made to overrun a buffer when loading certain images. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 ruby1.8 Chris Clark discovered that Ruby's HTTPS module did not check for commonName mismatches early enough during SSL negotiation. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 ghostscript gs-esp gs-gpl Chris Evans discovered that Ghostscript contained a buffer overflow in its color space handling code. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 7.10 Ubuntu 8.04 Ubuntu 8.10 enscript Ulf HE4rnhammar discovered multiple stack overflows in enscript's handling of special escape arguments. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 koffice USN-603-1 fixed vulnerabilities in poppler. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 7.04 Ubuntu 7.10 pulseaudio It was discovered that PulseAudio did not properly drop privileges when running as a daemon. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 postgresql-8.1 postgresql-8.2 Nico Leidecker discovered that PostgreSQL did not properly restrict dblink functions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 net-snmp Bill Trost discovered that snmpd did not properly limit GETBULK requests. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 pcre3 It was discovered that PCRE did not correctly handle very long strings containing UTF8 sequences. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.04 Ubuntu 7.10 apt-listchanges Felipe Sateler discovered that apt-listchanges did not use safe paths when importing additional Python libraries. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 postgresql-8.1 postgresql-8.2 Nico Leidecker discovered that PostgreSQL did not properly restrict dblink functions. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10 poppler Secunia Research discovered several vulnerabilities in poppler. Sergey Artykhov DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.04 Ubuntu 7.04 is installed Maria Kedovskaya DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 6.10 Ubuntu 6.10 is installed Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 ntp It was discovered that NTP did not properly perform signature verification. A remote attacker could exploit this to bypass certificate validation via a malformed SSL/TLS signature. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 6.06 tar Dmitry V. Levin discovered a buffer overflow in tar. If a user or automated system were tricked into opening a specially crafted tar file, an attacker could crash tar or possibly execute arbitrary code with the privileges of the user invoking the program. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 openssl It was discovered that OpenSSL did not properly perform signature verification on DSA and ECDSA keys. If user or automated system connected to a malicious server or a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to view sensitive information. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 git-core It was discovered that Git did not properly handle long file paths. If a user were tricked into performing commands on a specially crafted Git repository, an attacker could possibly execute arbitrary code with the privileges of the user invoking the program. It was discovered that the Git web interface did not correctly handle shell metacharacters when processing certain commands. A remote attacker could send specially crafted commands to the Git server and execute arbitrary code with the privileges of the Git web server. This issue only applied to Ubuntu 7.10 and 8.04 LTS. It was discovered that the Git web interface did not properly restrict the diff.external configuration parameter. A local attacker could exploit this issue and execute arbitrary code with the privileges of the Git web server. This issue only applied to Ubuntu 8.04 LTS and 8.10 SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 jasper It was discovered that JasPer did not correctly handle memory allocation when parsing certain malformed JPEG2000 images. If a user were tricked into opening a specially crafted image with an application that uses libjasper, an attacker could cause a denial of service and possibly execute arbitrary code with the user�s privileges. It was discovered that JasPer created temporary files in an insecure way. Local users could exploit a race condition and cause a denial of service in libjasper applications. It was discovered that JasPer did not correctly handle certain formatting operations. If a user were tricked into opening a specially crafted image with an application that uses libjasper, an attacker could cause a denial of service and possibly execute arbitrary code with the user�s privileges SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.10 Ubuntu 8.04 amarok It was discovered that Amarok did not correctly handle certain malformed tags in Audible Audio files. If a user were tricked into opening a crafted Audible Audio file, an attacker could execute arbitrary code with the privileges of the user invoking the program. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 cups cupsys It was discovered that CUPS did not properly check the height of TIFF images. If a user or automated system were tricked into opening a crafted TIFF image file, a remote attacker could cause a denial of service or possibly execute arbitrary code with user privileges. In Ubuntu 7.10, 8.04 LTS, and 8.10, attackers would be isolated by the AppArmor CUPS profile. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 firefox Jesse Ruderman and Gary Kwong discovered flaws in the browser engine. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. Georgi Guninski discovered a flaw when Firefox performed a cross-domain redirect. An attacker could bypass the same-origin policy in Firefox by utilizing nsIRDFService and steal private data from users authenticated to the redirected website SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.10 Ubuntu 8.04 glib2.0 Diego Petten discovered that the Base64 encoding functions in GLib did not properly handle large strings. If a user or automated system were tricked into processing a crafted Base64 string, an attacker could possibly execute arbitrary code with the privileges of the user invoking the program. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 krb5 Multiple flaws were discovered in the Kerberos GSS-API and ASN.1 routines that did not correctly handle certain requests. An unauthenticated remote attacker could send specially crafted traffic to crash services using the Kerberos library, leading to a denial of service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 firefox-3.0 A flaw was discovered in the browser engine when restoring closed tabs. If a user were tricked into restoring a tab to a malicious website with form input controls, an attacker could steal local files on the user�s system. Wladimir Palant discovered that Firefox did not restrict access to cookies in HTTP response headers. If a user were tricked into opening a malicious web page, a remote attacker could view sensitive information SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 cups cupsys It was discovered that CUPS didn�t properly handle adding a large number of RSS subscriptions. A local user could exploit this and cause CUPS to crash, leading to a denial of service. This issue only applied to Ubuntu 7.10, 8.04 LTS and 8.10. It was discovered that CUPS did not authenticate users when adding and cancelling RSS subscriptions. An unprivileged local user could bypass intended restrictions and add a large number of RSS subscriptions. This issue only applied to Ubuntu 7.10 and 8.04 LTS. It was discovered that the PNG filter in CUPS did not properly handle certain malformed images. If a user or automated system were tricked into opening a crafted PNG image file, a remote attacker could cause a denial of service or execute arbitrary code with user privileges. In Ubuntu 7.10, 8.04 LTS, and 8.10, attackers would be isolated by the AppArmor CUPS profile. It was discovered that the example pstopdf CUPS filter created log files in an insecure way. Local users could exploit a race condition to create or overwrite files with the privileges of the user invoking the program. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 ghostscript gs-gpl It was discovered that Ghostscript contained multiple integer overflows in its ICC color management library. If a user or automated system were tricked into opening a crafted Postscript file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. It was discovered that Ghostscript did not properly perform bounds checking in its ICC color management library. If a user or automated system were tricked into opening a crafted Postscript file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 udev Sebastian Krahmer discovered that udev did not correctly validate netlink message senders. A local attacker could send specially crafted messages to udev in order to gain root privileges. Sebastian Krahmer discovered a buffer overflow in the path encoding routines in udev. A local attacker could exploit this to crash udev, leading to a denial of service SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 xine-lib It was discovered that xine-lib did not correctly handle certain malformed Ogg and Windows Media files. If a user or automated system were tricked into opening a specially crafted Ogg or Windows Media file, an attacker could cause xine-lib to crash, creating a denial of service. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS. It was discovered that the MNG, MOD, and Real demuxers in xine-lib did not correctly handle memory allocation failures. If a user or automated system were tricked into opening a specially crafted MNG, MOD, or Real file, an attacker could crash xine-lib or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS. It was discovered that the QT demuxer in xine-lib did not correctly handle an invalid metadata atom size, resulting in a heap-based buffer overflow. If a user or automated system were tricked into opening a specially crafted MOV file, an attacker could execute arbitrary code as the user invoking the program. It was discovered that the Real, RealAudio, and Matroska demuxers in xine-lib did not correctly handle malformed files, resulting in heap-based buffer overflows. If a user or automated system were tricked into opening a specially crafted Real, RealAudio, or Matroska file, an attacker could execute arbitrary code as the user invoking the program. It was discovered that the MNG and QT demuxers in xine-lib did not correctly handle malformed files, resulting in integer overflows. If a user or automated system were tricked into opening a specially crafted MNG or MOV file, an attacker could execute arbitrary code as the user invoking the program. It was discovered that the Matroska, MOD, Real, and Real Audio demuxers in xine-lib did not correctly handle malformed files, resulting in integer overflows. If a user or automated system were tricked into opening a specially crafted Matroska, MOD, Real, or Real Audio file, an attacker could execute arbitrary code as the user invoking the program. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS. It was discovered that the input handlers in xine-lib did not correctly handle certain error codes, resulting in out-of-bounds reads and heap-based buffer overflows. If a user or automated system were tricked into opening a specially crafted file, stream, or URL, an attacker could execute arbitrary code as the user invoking the program. It was discovered that the Matroska and Real demuxers in xine-lib did not correctly handle memory allocation failures. If a user or automated system were tricked into opening a specially crafted Matroska or Real file, an attacker could crash xine-lib or possibly execute arbitrary code with the privileges of the user invoking the program. It was discovered that the QT demuxer in xine-lib did not correctly handle an invalid metadata atom size in a compressed MOV file, resulting in an integer underflow. If a user or automated system were tricked into opening a specially crafted MOV file, an attacker could an attacker could cause xine-lib to crash, creating a denial of service. It was discovered that the Real demuxer in xine-lib did not correctly handle certain malformed files. If a user or automated system were tricked into opening a specially crafted Real file, an attacker could could cause xine-lib to crash, creating a denial of service. It was discovered that xine-lib did not correctly handle certain malformed AAC files. If a user or automated system were tricked into opening a specially crafted AAC file, an attacker could could cause xine-lib to crash, creating a denial of service. This issue only applied to Ubuntu 7.10, and 8.04 LTS. It was discovered that the id3 tag handler in xine-lib did not correctly handle malformed tags, resulting in heap-based buffer overflows. If a user or automated system were tricked into opening a media file containing a specially crafted id3 tag, an attacker could execute arbitrary code as the user invoking the program. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS. It was discovered that xine-lib did not correctly handle MP3 files with metadata consisting only of separators. If a user or automated system were tricked into opening a specially crafted MP3 file, an attacker could could cause xine-lib to crash, creating a denial of service. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS. It was discovered that the Matroska demuxer in xine-lib did not correctly handle an invalid track type. If a user or automated system were tricked into opening a specially crafted Matroska file, an attacker could could cause xine-lib to crash, creating a denial of service. It was discovered that the ffmpeg video decoder in xine-lib did not correctly handle media with certain image heights, resulting in a heap-based buffer overflow. If a user or automated system were tricked into opening a specially crafted video file, an attacker could crash xine-lib or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only applied to Ubuntu 7.10, 8.04 LTS, and 8.10. It was discovered that the ffmpeg audio decoder in xine-lib did not correctly handle malformed media, resulting in a integer overflow. If a user or automated system were tricked into opening a specially crafted media file, an attacker could crash xine-lib or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only applied to Ubuntu 8.10. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.10 Ubuntu 8.04 network-manager-applet It was discovered that network-manager-applet did not properly enforce permissions when responding to dbus requests. A local user could perform dbus queries to view other users" network connection passwords and pre-shared keys. It was discovered that network-manager-applet did not properly enforce permissions when responding to dbus modify and delete requests. A local user could use dbus to modify or delete other users" network connections. This issue only applied to Ubuntu 8.10 SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 apache2 It was discovered that Apache did not sanitize the method specifier header from an HTTP request when it is returned in an error message, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. This issue only affected Ubuntu 6.06 LTS and 7.10. It was discovered that Apache was vulnerable to a cross-site request forgery in the mod_proxy_balancer balancer manager. If an Apache administrator were tricked into clicking a link on a specially crafted web page, an attacker could trigger commands that could modify the balancer manager configuration. This issue only affected Ubuntu 7.10 and 8.04 LTS. It was discovered that Apache had a memory leak when using mod_ssl with compression. A remote attacker could exploit this to exhaust server memory, leading to a denial of service. This issue only affected Ubuntu 7.10. It was discovered that in certain conditions, Apache did not specify a default character set when returning certain error messages containing UTF-7 encoded data, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. This issue only affected Ubuntu 6.06 LTS and 7.10. It was discovered that when configured as a proxy server, Apache did not limit the number of forwarded interim responses. A malicious remote server could send a large number of interim responses and cause a denial of service via memory exhaustion. It was discovered that mod_proxy_ftp did not sanitize wildcard pathnames when they are returned in directory listings, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 python-crypto Mike Wiacek discovered that the ARC2 implementation in Python Crypto did not correctly check the key length. If a user or automated system were tricked into processing a malicious ARC2 stream, a remote attacker could execute arbitrary code or crash the application using Python Crypto, leading to a denial of service. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 curl It was discovered that curl did not enforce any restrictions when following URL redirects. If a user or automated system were tricked into opening a URL to an untrusted server, an attacker could use redirects to gain access to abitrary files. This update changes curl behavior to prevent following "file" URLs after a redirect. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.10 Ubuntu 8.04 gst-plugins-good0.10 It was discovered that GStreamer Good Plugins did not correctly handle malformed Composition Time To Sample atom data in Quicktime movie files. If a user were tricked into opening a crafted mov file, an attacker could execute arbitrary code with the privileges of the user invoking the program. It was discovered that GStreamer Good Plugins did not correctly handle malformed Sync Sample atom data in Quicktime movie files. If a user were tricked into opening a crafted mov file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. It was discovered that GStreamer Good Plugins did not correctly handle malformed Time-to-sample atom data in Quicktime movie files. If a user were tricked into opening a crafted mov file, an attacker could execute arbitrary code with the privileges of the user invoking the program SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 firefox firefox-3.0 xulrunner-1.9 It was discovered that Firefox did not properly perform XUL garbage collection. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS and 8.10. A flaw was discovered in the way Firefox performed XSLT transformations. If a user were tricked into opening a crafted XSL stylesheet, an attacker could cause a denial of service or execute arbitrary code with the privileges of the user invoking the program SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 hplip It was discovered that an installation script in the HPLIP package would change permissions on the hplip config files located in user�s home directories. A local user could exploit this and change permissions on arbitrary files upon an HPLIP installation or upgrade, which could lead to root privileges. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 openssl It was discovered that OpenSSL did not properly validate the length of an encoded BMPString or UniversalString when printing ASN.1 strings. If a user or automated system were tricked into processing a crafted certificate, an attacker could cause a denial of service via application crash in applications linked against OpenSSL. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 icu It was discovered that libicu did not correctly handle certain invalid encoded data. If a user or automated system were tricked into processing specially crafted data with applications linked against libicu, certain content filters could be bypassed. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 xine-lib It was discovered that the 4xm demuxer in xine-lib did not correctly handle a large current_track value in a 4xm file, resulting in an integer overflow. If a user or automated system were tricked into opening a specially crafted 4xm movie file, an attacker could crash xine-lib or possibly execute arbitrary code with the privileges of the user invoking the program. USN-710-1 provided updated xine-lib packages to fix multiple security vulnerabilities. The security patch to fix CVE-2008-5239 introduced a regression causing some media files to be unplayable. This update corrects the problem. We apologize for the inconvenience. Original advisory details: It was discovered that the input handlers in xine-lib did not correctly handle certain error codes, resulting in out-of-bounds reads and heap- based buffer overflows. If a user or automated system were tricked into opening a specially crafted file, stream, or URL, an attacker could execute arbitrary code as the user invoking the program SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 php5 It was discovered that PHP did not properly enforce php_admin_value and php_admin_flag restrictions in the Apache configuration file. A local attacker could create a specially crafted PHP script that would bypass intended security restrictions. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS. It was discovered that PHP did not correctly handle certain malformed font files. If a PHP application were tricked into processing a specially crafted font file, an attacker may be able to cause a denial of service and possibly execute arbitrary code with application privileges. It was discovered that PHP did not properly check the delimiter argument to the explode function. If a script passed untrusted input to the explode function, an attacker could cause a denial of service and possibly execute arbitrary code with application privileges. It was discovered that PHP, when used as FastCGI module, did not properly sanitize requests. By performing a request with multiple dots preceding the extension, an attacker could cause a denial of service. It was discovered that PHP did not properly handle Unicode conversion in the mbstring extension. If a PHP application were tricked into processing a specially crafted string containing an HTML entity, an attacker could execute arbitrary code with application privileges. It was discovered that PHP did not properly initialize the page_uid and page_gid global variables for use by the SAPI php_getuid function. An attacker could exploit this issue to bypass safe_mode restrictions. It was dicovered that PHP did not properly enforce error_log safe_mode restrictions when set by php_admin_flag in the Apache configuration file. A local attacker could create a specially crafted PHP script that would overwrite arbitrary files. It was discovered that PHP contained a flaw in the ZipArchive::extractTo function. If a PHP application were tricked into processing a specially crafted zip file that had filenames containing "..", an attacker could write arbitrary files within the filesystem. This issue only applied to Ubuntu 7.10, 8.04 LTS, and 8.10. USN-557-1 fixed a vulnerability in the GD library. When using the GD library, PHP did not properly handle the return codes that were added in the security update. An attacker could exploit this issue with a specially crafted image file and cause PHP to crash, leading to a denial of service. This issue only applied to Ubuntu 6.06 LTS, and 7.10 SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.10 Ubuntu 8.04 ktorrent It was discovered that KTorrent did not properly restrict access when using the web interface plugin. A remote attacker could use a crafted http request and upload arbitrary torrent files to trigger the start of downloads and seeding. It was discovered that KTorrent did not properly handle certain parameters when using the web interface plugin. A remote attacker could use crafted http requests to execute arbitrary PHP code SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 mozilla-thunderbird thunderbird Several flaws were discovered in the browser engine. If Javascript were enabled, an attacker could exploit these flaws to crash Thunderbird and possibly execute arbitrary code with user privileges. Jesse Ruderman and Gary Kwong discovered flaws in the browser engine. If a user had Javascript enabled, these problems could allow a remote attacker to cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. Georgi Guninski discovered a flaw when Thunderbird performed a cross-domain redirect. If a user had Javascript enabled, an attacker could bypass the same-origin policy in Thunderbird by utilizing nsIRDFService and steal private data from users authenticated to the redirected website SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 bind9 It was discovered that Bind did not properly perform certificate verification. When DNSSEC with DSA certificates are in use, a remote attacker could exploit this to bypass certificate validation to spoof DNS entries and poison DNS caches. Among other things, this could lead to misdirected email and web traffic. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 moin Fernando Quintero discovered than MoinMoin did not properly sanitize its input when processing login requests, resulting in cross-site scripting vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. This issue affected Ubuntu 7.10 and 8.04 LTS. Fernando Quintero discovered that MoinMoin did not properly sanitize its input when attaching files, resulting in cross-site scripting vulnerabilities. This issue affected Ubuntu 6.06 LTS, 7.10 and 8.04 LTS. It was discovered that MoinMoin did not properly sanitize its input when processing user forms. A remote attacker could submit crafted cookie values and overwrite arbitrary files via directory traversal. This issue affected Ubuntu 6.06 LTS, 7.10 and 8.04 LTS. It was discovered that MoinMoin did not properly sanitize its input when editing pages, resulting in cross-site scripting vulnerabilities. This issue only affected Ubuntu 6.06 LTS and 7.10. It was discovered that MoinMoin did not properly enforce access controls, which could allow a remoter attacker to view private pages. This issue only affected Ubuntu 6.06 LTS and 7.10. It was discovered that MoinMoin did not properly sanitize its input when attaching files and using the rename parameter, resulting in cross-site scripting vulnerabilities. It was discovered that MoinMoin did not properly sanitize its input when displaying error messages after processing spam, resulting in cross-site scripting vulnerabilities SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 6.06 libsoup It was discovered that the Base64 encoding functions in libsoup did not properly handle large strings. If a user were tricked into connecting to a malicious server, an attacker could possibly execute arbitrary code with user privileges. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 xterm Paul Szabo discovered that the DECRQSS escape sequences were not handled correctly by xterm. Additionally, window title operations were also not safely handled. If a user were tricked into viewing a specially crafted series of characters while in xterm, a remote attacker could execute arbitrary commands with user privileges SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 kdepim It was discovered that Kmail did not adequately prevent execution of arbitrary code when a user clicked on a URL to an executable within an HTML mail. If a user clicked on a malicious URL and chose to execute the file, a remote attacker could execute arbitrary code with user privileges. This update changes KMail�s behavior to instead launch a helper program to view the file if the user chooses to execute such a link. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.10 Ubuntu 8.04 thunderbird Several flaws were discovered in the browser engine. If a user had Javascript enabled, these problems could allow an attacker to crash Thunderbird and possibly execute arbitrary code with user privileges. Boris Zbarsky discovered that the same-origin check in Thunderbird could be bypassed by utilizing XBL-bindings. If a user had Javascript enabled, an attacker could exploit this to read data from other domains. Marius Schilder discovered that Thunderbird did not properly handle redirects to an outside domain when an XMLHttpRequest was made to a same-origin resource. When Javascript is enabled, it�s possible that sensitive information could be revealed in the XMLHttpRequest response. Chris Evans discovered that Thunderbird did not properly protect a user�s data when accessing a same-domain Javascript URL that is redirected to an unparsable Javascript off-site resource. If a user were tricked into opening a malicious website and had Javascript enabled, an attacker may be able to steal a limited amount of private data. Chip Salzenberg, Justin Schuh, Tom Cross, and Peter William discovered Thunderbird did not properly parse URLs when processing certain control characters. Kojima Hajime discovered that Thunderbird did not properly handle an escaped null character. An attacker may be able to exploit this flaw to bypass script sanitization. Several flaws were discovered in the Javascript engine. If a user were tricked into opening a malicious website and had Javascript enabled, an attacker could exploit this to execute arbitrary Javascript code within the context of another website or with chrome privileges SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 nss firefox The MD5 algorithm is known not to be collision resistant SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 6.06 evolution-data-server It was discovered that the Base64 encoding functions in evolution-data-server did not properly handle large strings. If a user were tricked into opening a specially crafted image file, or tricked into connecting to a malicious server, an attacker could possibly execute arbitrary code with user privileges. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 lcms Chris Evans discovered that LittleCMS did not properly handle certain error conditions, resulting in a large memory leak. If a user or automated system were tricked into processing an image with malicious ICC tags, a remote attacker could cause a denial of service. Chris Evans discovered that LittleCMS contained multiple integer overflows. If a user or automated system were tricked into processing an image with malicious ICC tags, a remote attacker could crash applications linked against liblcms1, leading to a denial of service, or possibly execute arbitrary code with user privileges. Chris Evans discovered that LittleCMS did not properly perform bounds checking, leading to a buffer overflow. If a user or automated system were tricked into processing an image with malicious ICC tags, a remote attacker could execute arbitrary code with user privileges SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 libsndfile It was discovered that libsndfile did not correctly handle description chunks in CAF audio files. If a user or automated system were tricked into opening a specially crafted CAF audio file, an attacker could execute arbitrary code with the privileges of the user invoking the program. SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 libpng It was discovered that libpng did not properly perform bounds checking in certain operations. An attacker could send a specially crafted PNG image and cause a denial of service in applications linked against libpng. This issue only affected Ubuntu 8.04 LTS. Tavis Ormandy discovered that libpng did not properly initialize memory. If a user or automated system were tricked into opening a crafted PNG image, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue did not affect Ubuntu 8.10. Harald van Dijk discovered an off-by-one error in libpng. An attacker could could cause an application crash in programs using pngtest. It was discovered that libpng did not properly NULL terminate a keyword string. An attacker could exploit this to set arbitrary memory locations to zero. Glenn Randers-Pehrson discovered that libpng did not properly initialize pointers. If a user or automated system were tricked into opening a crafted PNG file, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 linux-source-2.6.15 linux-source-2.6.22 Hugo Dias discovered that the ATM subsystem did not correctly manage socket counts. A local attacker could exploit this to cause a system hang, leading to a denial of service. It was discovered that the libertas wireless driver did not correctly handle beacon and probe responses. A physically near-by attacker could generate specially crafted wireless network traffic and cause a denial of service. Ubuntu 6.06 was not affected. It was discovered that the inotify subsystem contained watch removal race conditions. A local attacker could exploit this to crash the system, leading to a denial of service. Dann Frazier discovered that in certain situations sendmsg did not correctly release allocated memory. A local attacker could exploit this to force the system to run out of free memory, leading to a denial of service. Ubuntu 6.06 was not affected. It was discovered that the ATA subsystem did not correctly set timeouts. A local attacker could exploit this to cause a system hang, leading to a denial of service. It was discovered that the ib700 watchdog timer did not correctly check buffer sizes. A local attacker could send a specially crafted ioctl to the device to cause a system crash, leading to a denial of service. It was discovered that in certain situations the network scheduler did not correctly handle very large levels of traffic. A local attacker could produce a high volume of UDP traffic resulting in a system hang, leading to a denial of service. Ubuntu 8.04 was not affected SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.10 Ubuntu 8.04 linux linux-source-2.6.22 NFS did not correctly handle races between fcntl and interrupts. A local attacker on an NFS mount could consume unlimited kernel memory, leading to a denial of service. Ubuntu 8.10 was not affected. Sparc syscalls did not correctly check mmap regions. A local attacker could cause a system panic, leading to a denial of service. Ubuntu 8.10 was not affected. In certain situations, cloned processes were able to send signals to parent processes, crossing privilege boundaries. A local attacker could send arbitrary signals to parent processes, leading to a denial of service. The kernel keyring did not free memory correctly. A local attacker could consume unlimited kernel memory, leading to a denial of service. The SCTP stack did not correctly validate FORWARD-TSN packets. A remote attacker could send specially crafted SCTP traffic causing a system crash, leading to a denial of service. The eCryptfs filesystem did not correctly handle certain VFS return codes. A local attacker with write-access to an eCryptfs filesystem could cause a system crash, leading to a denial of service. The Dell platform device did not correctly validate user parameters. A local attacker could perform specially crafted reads to crash the system, leading to a denial of service. The page fault handler could consume stack memory. A local attacker could exploit this to crash the system or gain root privileges with a Kprobe registered. Only Ubuntu 8.10 was affected. Network interfaces statistics for the SysKonnect FDDI driver did not check capabilities. A local user could reset statistics, potentially interfering with packet accounting systems. The getsockopt function did not correctly clear certain parameters. A local attacker could read leaked kernel memory, leading to a loss of privacy. The ext4 filesystem did not correctly clear group descriptors when resizing. A local attacker could exploit this to crash the system, leading to a denial of service. The ext4 filesystem did not correctly validate certain fields. A local attacker could mount a malicious ext4 filesystem, causing a system crash, leading to a denial of service. The syscall interface did not correctly validate parameters when crossing the 64-bit/32-bit boundary. A local attacker could bypass certain syscall restricts via crafted syscalls. The shared memory subsystem did not correctly handle certain shmctl calls when CONFIG_SHMEM was disabled. Ubuntu kernels were not vulnerable, since CONFIG_SHMEM is enabled by default. The virtual consoles did not correctly handle certain UTF-8 sequences. A local attacker on the physical console could exploit this to cause a system crash, leading to a denial of service SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 vim Jan Minar discovered that Vim did not properly sanitize inputs before invoking the execute or system functions inside Vim scripts. If a user were tricked into running Vim scripts with a specially crafted input, an attacker could execute arbitrary code with the privileges of the user invoking the program. Ben Schmidt discovered that Vim did not properly escape characters when performing keyword or tag lookups. If a user were tricked into running specially crafted commands, an attacker could execute arbitrary code with the privileges of the user invoking the program SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 6.06 Ubuntu 6.06 is installed SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 8.10 Ubuntu 8.04 ffmpeg ffmpeg-debian It was discovered that FFmpeg did not correctly handle certain malformed Ogg Media files. If a user were tricked into opening a crafted Ogg Media file, an attacker could cause the application using FFmpeg to crash, leading to a denial of service. It was discovered that FFmpeg did not correctly handle certain parameters when creating DTS streams. If a user were tricked into processing certain commands, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.10. It was discovered that FFmpeg did not correctly handle certain malformed DTS Coherent Acoustics files. If a user were tricked into opening a crafted DCA file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. It was discovered that FFmpeg did not correctly handle certain malformed 4X movie files. If a user were tricked into opening a crafted 4xm file, an attacker could execute arbitrary code with the privileges of the user invoking the program SecPod Team DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED Ubuntu 7.10 Ubuntu 7.10 is installed SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 8.10 Ubuntu 8.10 is installed SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Ubuntu 8.04 Ubuntu 8.04 is installed SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED