These are the Ubuntu security notices that affect the current supported releases of Ubuntu. These notices are also posted to the ubuntu-security-announce mailing list (list archive). To report a security vulnerability in an Ubuntu package, please contact the Ubuntu Security Team. You may also be interested in learning about Ubuntu security policies. For more details on a specific CVE or source package, please see the Ubuntu CVE Tracker.

You can also view the latest notices by subscribing to the RSS or the Atom feeds.

Latest notices

USN-185-1: CUPS vulnerability

A flaw was detected in the printer access control list checking in the CUPS server. Printer names were compared in a case sensitive manner; by modifying the capitalization of printer names, a remote attacker could circumvent ACLs and print to printers he should not have access to. The Ubuntu 5.04 version of cupsys is not vulnerable against this.

20 September 2005 | ubuntu-4.10

USN-184-1: umount vulnerability

David Watson discovered that “umount -r” removed some restrictive mount options like the “nosuid” flag. If /etc/fstab contains user-mountable removable devices which specify the “nosuid” flag (which is common practice for such devices), a local attacker could exploit this to execute arbitrary programs with root privileges by calling “umount -r” on…

19 September 2005 | ubuntu-5.04, ubuntu-4.10

USN-183-1: Squid vulnerabilities

A Denial of Service vulnerability was discovered in the handling of aborted requests. A remote attacker could exploit this to crash Squid by sending specially crafted requests. (CAN-2005-2794) Alex Masterov discovered a Denial of Service vulnerability in the sslConnectTimeout() function. By sending specially crafted SSL requests, a remote…

13 September 2005 | ubuntu-5.04, ubuntu-4.10

USN-83-2: LessTif 1 vulnerabilities

USN-83-1 fixed some vulnerabilities in the “lesstif2” library. The older “lesstif1” library was also affected, however, a fix was not yet available at that time. This USN fixes the flaws for lesstif1. Please note that there are no supported applications that use this library, so this only affects you if you use third-party applications which use…

13 September 2005 | ubuntu-4.10

USN-181-1: Mozilla products vulnerability

Tom Ferris discovered a buffer overflow in the Mozilla products (Mozilla browser, Firefox, Thunderbird). By tricking an user to click on a Hyperlink with a specially crafted destination URL, a remote attacker could crash the application. It might even be possible to exploit this vulnerability to execute arbitrary code, but this has not yet been…

12 September 2005 | ubuntu-5.04, ubuntu-4.10

USN-182-1: X server vulnerability

A local privilege escalation vulnerability has been discovered in the pixmap allocation handling of the X server. By allocating a huge pixmap, a local user could trigger an integer overflow that resulted in a memory allocation that was too small for the requested pixmap. This resulted in a buffer overflow which could eventually be exploited to…

12 September 2005 | ubuntu-5.04, ubuntu-4.10

USN-180-1: MySQL vulnerability

AppSecInc Team SHATTER discovered a buffer overflow in the “CREATE FUNCTION” statement. By specifying a specially crafted long function name, a local or remote attacker with function creation privileges could crash the server or execute arbitrary code with server privileges. However, the right to create function is usually not granted…

12 September 2005 | ubuntu-5.04, ubuntu-4.10

USN-179-1: openssl weak default configuration

The current default algorithm for creating “message digests” (electronic signatures) for certificates created by openssl is MD5. However, this algorithm is not deemed secure any more, and some practical attacks have been demonstrated which could allow an attacker to forge certificates with a valid certification authority signature even if he does…

10 September 2005 | ubuntu-5.04, ubuntu-4.10

USN-178-1: Linux kernel vulnerabilities

Oleg Nesterov discovered a local Denial of Service vulnerability in the timer handling. When a non group-leader thread called exec() to execute a different program while an itimer was pending, the timer expiry would signal the old group leader task, which did not exist any more. This caused a kernel panic. This vulnerability only affects Ubuntu…

9 September 2005 | ubuntu-5.04, ubuntu-4.10

USN-177-1: Apache 2 vulnerabilities

Apache did not honour the “SSLVerifyClient require” directive within a <Location> block if the surrounding <VirtualHost> block contained a directive “SSLVerifyClient optional”. This allowed clients to bypass client certificate validation on servers with the above configuration. (CAN-2005-2700) Filip Sneppe discovered a Denial of Service…

7 September 2005 | ubuntu-5.04, ubuntu-4.10