These are the Ubuntu security notices that affect the current supported releases of Ubuntu. These notices are also posted to the ubuntu-security-announce mailing list (list archive). To report a security vulnerability in an Ubuntu package, please contact the Ubuntu Security Team. You may also be interested in learning about Ubuntu security policies. For more details on a specific CVE or source package, please see the Ubuntu CVE Tracker.

You can also view the latest notices by subscribing to the RSS or the Atom feeds.

Latest notices

USN-204-1: SSL library vulnerability

Yutaka Oiwa discovered a possible cryptographic weakness in OpenSSL applications. Applications using the OpenSSL library can use the SSL_OP_MSIE_SSLV2_RSA_PADDING option (or SSL_OP_ALL, which implies the former) to maintain compatibility with third party products, which is achieved by working around known bugs in them. The…

14 October 2005 | ubuntu-5.10, ubuntu-5.04, ubuntu-4.10

USN-203-1: Abiword vulnerabilities

Chris Evans discovered several buffer overflows in the RTF import module of AbiWord. By tricking a user into opening an RTF file with specially crafted long identifiers, an attacker could exploit this to execute arbitrary code with the privileges of the AbiWord user.

13 October 2005 | ubuntu-5.04, ubuntu-4.10

USN-202-1: KOffice vulnerability

Chris Evans discovered a buffer overflow in the RTF import module of KOffice. By tricking a user into opening a specially-crafted RTF file, an attacker could exploit this to execute arbitrary code with the privileges of the AbiWord user.

12 October 2005 | ubuntu-5.04

USN-201-1: SqWebmail vulnerabilities

Several Cross Site Scripting vulnerabilities were discovered in SqWebmail. A remote attacker could exploit this to execute arbitrary JavaScript or other active HTML embeddable content in the web browser of an SqWebmail user by sending specially crafted emails to him. Please note that the “sqwebmail” package is not officially supported by Ubuntu…

12 October 2005 | ubuntu-5.04, ubuntu-4.10

USN-200-1: Thunderbird vulnerabilities

A buffer overflow was discovered in the XBM image handler. By tricking an user into opening a specially crafted XBM image, an attacker could exploit this to execute arbitrary code with the user’s privileges. (CAN-2005-2701) Mats Palmgren discovered a buffer overflow in the Unicode string parser. Unicode strings that contained “zero-width…

11 October 2005 | ubuntu-5.04, ubuntu-4.10

USN-199-1: Linux kernel vulnerabilities

A Denial of Service vulnerability was discovered in the sys_set_mempolicy() function. By calling the function with a negative first argument, a local attacker could cause a kernel crash. (CAN-2005-3053) A race condition was discovered in the handling of shared memory mappings with CLONE_VM. A local attacker could exploit this to cause a deadlock…

11 October 2005 | ubuntu-5.04, ubuntu-4.10

USN-198-1: cfengine vulnerabilities

Javier Fern�ndez-Sanguino Pe�a discovered that several tools in the cfengine package (vicf, cfmailfilter, and cfcron) create and use temporary files in an insecure way. A local attacker could exploit this with a symlink attack to create or overwrite arbitrary files with the privileges of the user running the cfengine program.

10 October 2005 | ubuntu-5.04, ubuntu-4.10

USN-197-1: Shorewall vulnerability

A firewall bypass vulnerability has been found in shorewall. If MACLIST_TTL was set to a value greater than 0 or MACLIST_DISPOSITION was set to “ACCEPT” in /etc/shorewall/shorewall.conf, and a client was positively identified through its MAC address, that client bypassed all other policies/rules in place. This could allow external computers to get…

10 October 2005 | ubuntu-5.04, ubuntu-4.10

USN-196-1: Xine library vulnerability

Ulf Harnhammar discovered a format string vulnerability in the CDDB module’s cache file handling in the Xine library, which is used by packages such as xine-ui, totem-xine, and gxine. By tricking an user into playing a particular audio CD which has a specially-crafted CDDB entry, a remote attacker could exploit this vulnerability to execute…

10 October 2005 | ubuntu-5.04, ubuntu-4.10

USN-195-1: Ruby vulnerability

The object oriented scripting language Ruby supports safely executing untrusted code with two mechanisms: safe level and taint flag on objects. Dr. Yutaka Oiwa discovered a vulnerability that allows Ruby methods to bypass these mechanisms. In systems which use this feature, this could be exploited to execute Ruby code beyond the restrictions…

10 October 2005 | ubuntu-5.04, ubuntu-4.10