These are the Ubuntu security notices that affect the current supported releases of Ubuntu. These notices are also posted to the ubuntu-security-announce mailing list (list archive). To report a security vulnerability in an Ubuntu package, please contact the Ubuntu Security Team. You may also be interested in learning about Ubuntu security policies. For more details on a specific CVE or source package, please see the Ubuntu CVE Tracker.

You can also view the latest notices by subscribing to the RSS or the Atom feeds.

Latest notices

USN-243-1: tuxpaint vulnerability

Javier Fern�ndez-Sanguino Pe�a discovered that the tuxpaint-import.sh script created a temporary file in an insecure way. This could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user running tuxpaint.

16 January 2006 | ubuntu-5.10

USN-242-1: mailman vulnerabilities

Aliet Santiesteban Sifontes discovered a remote Denial of Service vulnerability in the attachment handler. An email with an attachment whose filename contained invalid UTF-8 characters caused mailman to crash. (CVE-2005-3573) Mailman did not sufficiently verify the validity of email dates. Very large numbers in dates caused mailman to crash….

16 January 2006 | ubuntu-5.10, ubuntu-5.04, ubuntu-4.10

USN-241-1: Apache vulnerabilities

The “mod_imap” module (which provides support for image maps) did not properly escape the “referer” URL which rendered it vulnerable against a cross-site scripting attack. A malicious web page (or HTML email) could trick a user into visiting a site running the vulnerable mod_imap, and employ cross-site-scripting techniques to gather sensitive…

13 January 2006 | ubuntu-5.10, ubuntu-5.04, ubuntu-4.10

USN-240-1: bogofilter vulnerability

A buffer overflow was found in bogofilter’s character set conversion handling. Certain invalid UTF-8 character sequences caused an invalid memory access. By sending a specially crafted email, a remote attacker could exploit this to crash bogofilter or possibly even execute arbitrary code with bogofilter’s privileges.

12 January 2006 | ubuntu-5.10

USN-194-2: texinfo regression fix

USN-194-1 fixed a vulnerability in the ‘texindex’ program. Unfortunately this update introduced a regression that caused the program to abort when cleaning up temporary files (which are used with extraordinarily large input files). The updated packages fix this.

9 January 2006 | ubuntu-5.10, ubuntu-5.04

USN-235-2: sudo vulnerability

USN-235-1 fixed a vulnerability in sudo’s handling of environment variables. Tavis Ormandy noticed that sudo did not filter out the PYTHONINSPECT environment variable, so that users with the limited privilege of calling a python script with sudo could still escalate their privileges. For reference, this is the original advisory: Charles Morris…

9 January 2006 | ubuntu-5.10, ubuntu-5.04, ubuntu-4.10

USN-236-2: xpdf vulnerabilities in kword, kpdf

USN-236-1 fixed several vulnerabilities in xpdf. kpdf and kword contain copies of xpdf code and are thus vulnerable to the same issues. For reference, this is the original advisory: Chris Evans discovered several integer overflows in the XPDF code, which is present in xpdf, the Poppler library, and tetex-bin. By tricking an user into…

9 January 2006 | ubuntu-5.10, ubuntu-5.04

USN-239-1: libapache2-mod-auth-pgsql vulnerability

Several format string vulnerabilities were discovered in the error logging handling. By sending specially crafted user names, an unauthenticated remote attacker could exploit this to crash the Apache server or possibly even execute arbitrary code with the privileges of Apache (user ‘www-data’).

9 January 2006 | ubuntu-5.10, ubuntu-5.04, ubuntu-4.10

USN-238-2: Blender vulnerability

Damian Put discovered that Blender did not properly validate a ‘length’ value in .blend files. Negative values led to an insufficiently sized memory allocation. By tricking a user into opening a specially crafted .blend file, this could be exploited to execute arbitrary code with the privileges of the Blender user.

6 January 2006 | ubuntu-5.10

USN-238-1: Blender vulnerability

Kurt Fitzner discovered that the NBD (network block device) server did not correctly verify the maximum size of request packets. By sending specially crafted large request packets, a remote attacker who is allowed to access the server could exploit this to execute arbitrary code with root privileges.

6 January 2006 | ubuntu-5.10