ethereal-gnome-0.99.0-EL4.2.ia64.rpm
x86_64:
5ebe9b3c26db1f789d9ca53a11be3fdb ethereal-0.99.0-EL4.2.x86_64.rpm
37a665b1f8bf7b8787238aa55f33713a ethereal-debuginfo-0.99.0-EL4.2.x86_64.rpm
f881c98450c85c7d7cf29cf5f2c38bf9 ethereal-gnome-0.99.0-EL4.2.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1932
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1933
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1934
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1935
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1936
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1937
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1938
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1939
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1940
http://www.ethereal.com/appnotes/enpa-sa-00023.html
http://www.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2006 Red Hat, Inc.
Slackware Linux
[slackware-security] xorg server overflow (SSA:2006-123-01)
New xorg and xorg-devel packages are available for Slackware 10.1, 10.2,
and -current to fix a security issue. A typo in the X render extension
in X.Org 6.8.0 or later allows an X client to crash the server and
possibly to execute arbitrary code as the X server user (typically this
is "root".)
More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1526
The advisory from X.Org may be found here:
http://lists.freedesktop.org/archives/xorg/2006-May/015136.html
Here are the details from the Slackware 10.2 ChangeLog:
+--------------------------+
patches/packages/x11-6.8.2-i486-5.tgz:
Patched with x11r6.9.0-mitri.diff and recompiled.
A typo in the X render extension allows an X client to crash the server
and possibly to execute arbitrary code as the X server user (typically
this is "root".)
The CVE entry for this issue may be found here:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1526
The advisory from X.Org may be found here:
http://lists.freedesktop.org/archives/xorg/2006-May/015136.html
(* Security fix *)
patches/packages/x11-devel-6.8.2-i486-5.tgz:
Patched and recompiled libXrender.
(* Security fix *)
+--------------------------+
Updated packages for Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/x11-6.8.1-i486-5.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/x11-devel-6.8.1-i486-5.tgz
Updated packages for Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/x11-6.8.2-i486-5.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/x11-devel-6.8.2-i486-5.tgz
Updated packages for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/x11-6.9.0-i486-4.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/x11-devel-6.9.0-i486-4.tgz
Slackware 10.1 packages:
0adae00722f78242961ebdd8e874a97e x11-6.8.1-i486-5.tgz
7e1072009150f2d02bb958fdbf8920ed x11-devel-6.8.1-i486-5.tgz
Slackware 10.2 packages:
95a228488f09978c4a3468fb027a49c8 x11-6.8.2-i486-5.tgz
86f2fe06649b2d120f8f0fb1ad76f341 x11-devel-6.8.2-i486-5.tgz
Slackware -current packages:
2aa5db26d003137c01d2688e644d0b9d x11-6.9.0-i486-4.tgz
39b4feb60a97e79100962ebec50d9208 x11-devel-6.9.0-i486-4.tgz
Upgrade the packages as root:
# upgradepkg x11-6.8.2-i486-5.tgz x11-devel-6.8.2-i486-5.tgz
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
SUSE Linux
SUSE Security Announcement
Package: xorg-x11-server
Announcement ID: SUSE-SA:2006:023
Date: Wed, 03 May 2006 10:00:00 +0000
Affected Products: SUSE LINUX 10.0
SUSE LINUX 9.3
SUSE LINUX 9.2
Vulnerability Type: local privilege escalation
Severity (1-10): 7
SUSE Default Package: yes
Cross-References: CVE-2006-1526
Content of This Advisory:
- Security Vulnerability Resolved:
Buffer overflow in the X.Org X11 server
Problem Description
- Solution or Work-Around
- Special Instructions and Notes
- Package Location and Checksums
- Pending Vulnerabilities, Solutions, and Work-Arounds:
- See SUSE Security Summary Report
- Authenticity Verification and Additional Information
1) Problem Description and Brief Discussion
Miscalculation of a buffer size in the X Render extension of the
X.Org X11 server could potentially be exploited by users to cause a
buffer overflow and run code with elevated privileges.
2) Solution or Work-Around
There is no known workaround, please install the update packages.
3) Special Instructions and Notes
Please restart the X server by logging out or rebooting after the update.
4) Package Location and Checksums
The preferred method for installing security updates is to use the YaST
Online Update (YOU) tool. YOU detects which updates are required and
automatically performs the necessary steps to verify and install them.
Alternatively, download the update packages for your distribution manually
and verify their integrity by the methods listed in Section 6 of this
announcement. Then install the packages using the command
rpm -Fhv <file.rpm>
to apply the update, replacing <file.rpm> with the filename of the
downloaded RPM package.
x86 Platform:
SUSE LINUX 10.0:
ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/i586/xorg-x11-server-6.8.2-100.5.i586.rpm 44c3b8dcb2b6a402d76364fd1d93494c
SUSE LINUX 9.3:
ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/xorg-x11-server-6.8.2-30.5.i586.rpm f741187e9f45443f6da22f6c581eb2a9
SUSE LINUX 9.2:
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/xorg-x11-server-6.8.1-15.10.i586.rpm 4809ccda14af35911d03d58cca61d734
Power PC Platform:
SUSE LINUX 10.0:
ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/ppc/xorg-x11-server-6.8.2-100.5.ppc.rpm 0cb1e49e97ad623163649b8dd7052032
x86-64 Platform:
SUSE LINUX 10.0:
ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/x86_64/xorg-x11-server-6.8.2-100.5.x86_64.rpm fc09f74f782b734692934b74cf7f0da5
SUSE LINUX 9.3:
ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/xorg-x11-server-6.8.2-30.5.x86_64.rpm 1ee01c4d810ebf997caf767390ca1743
SUSE LINUX 9.2:
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/xorg-x11-server-6.8.1-15.10.x86_64.rpm db7c539b47dd0cbd0d190a5c587a2d09
5) Pending Vulnerabilities, Solutions, and Work-Arounds:
- See SUSE Security Summary Report
6) Authenticity Verification and Additional Information
- Announcement authenticity verification:
SUSE security announcements are published via mailing lists and on Web
sites. The authenticity and integrity of a SUSE security announcement is
guaranteed by a cryptographic signature in each announcement. All SUSE
security announcements are published with a valid signature.
To verify the signature of the announcement, save it as text into a file
and run the command
gpg --verify <file>
replacing <file> with the name of the file where you saved the
announcement. The output for a valid signature looks like:
gpg: Signature made <DATE> using RSA key ID 3D25D3D9
gpg: Good signature from "SuSE Security Team <security@suse.de>"
where <DATE> is replaced by the date the document was signed.
If the security team's key is not contained in your key ring, you can
import it from the first installation CD. To import the key, use the
command
gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc
- Package authenticity verification:
SUSE update packages are available on many mirror FTP servers all over the
world. While this service is considered valuable and important to the free
and open source software community, the authenticity and the integrity of
a package needs to be verified to ensure that it has not been tampered
with.
There are two verification methods that can be used independently from
each other to prove the authenticity of a downloaded file or RPM package:
- Using the internal gpg signatures of the rpm package
- MD5 checksums as provided in this announcement
- The internal rpm package signatures provide an easy way to verify the
authenticity of an RPM package. Use the command
rpm -v --checksig <file.rpm>
to verify the signature of the package, replacing <file.rpm> with the
filename of the RPM package downloaded. The package is unmodified if it
contains a valid signature from build@suse.de with the key ID 9C800ACA.
This key is automatically imported into the RPM database (on
RPMv4-based distributions) and the gpg key ring of 'root' during
installation. You can also find it on the first installation CD and at
the end of this announcement.
- If you need an alternative means of verification, use the md5sum
command to verify the authenticity of the packages. Execute the command
md5sum <filename.rpm>
after you downloaded the file from a SUSE FTP server or its mirrors.
Then compare the resulting md5sum with the one that is listed in the
SUSE security announcement. Because the announcement containing the
checksums is cryptographically signed (by security@suse.de), the
checksums show proof of the authenticity of the package if the
signature of the announcement is valid. Note that the md5 sums
published in the SUSE Security Announcements are valid for the
respective packages only. Newer versions of these packages cannot be
verified.
- SUSE runs two security mailing lists to which any interested party may
subscribe:
suse-security@suse.com
- General Linux and SUSE security discussion.
All SUSE security announcements are sent to this list.
To subscribe, send an e-mail to
<suse-security-subscribe@suse.com>.
suse-security-announce@suse.com
- SUSE's announce-only mailing list.
Only SUSE's security announcements are sent to this list.
To subscribe, send an e-mail to
<suse-security-announce-subscribe@suse.com>.
For general information or the frequently asked questions (FAQ),
send mail to <suse-security-info@suse.com> or
<suse-security-faq@suse.com>.
SUSE's security contact is <security@suse.com> or <security@suse.de>.
The <security@suse.de> public key is listed below.
The information in this advisory may be distributed or reproduced,
provided that the advisory is not modified in any way. In particular, the
clear text signature should show proof of the authenticity of the text.
SUSE Linux Products GmbH provides no warranties of any kind whatsoever
with respect to the information contained in this security advisory.
Type Bits/KeyID Date User ID
pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security@suse.de>
pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build@suse.de>
Ubuntu Linux
Ubuntu Security Notice USN-276-1 May 03, 2006
mozilla-thunderbird vulnerabilities
CVE-2006-0292, CVE-2006-0296, CVE-2006-0748, CVE-2006-0749,
CVE-2006-0884, CVE-2006-1045, CVE-2006-1727, CVE-2006-1728,
CVE-2006-1730, CVE-2006-1731, CVE-2006-1732, CVE-2006-1733,
CVE-2006-1734, CVE-2006-1735, CVE-2006-1737, CVE-2006-1738,
CVE-2006-1739, CVE-2006-1741, CVE-2006-1742, CVE-2006-1790
A security issue affects the following Ubuntu releases:
Ubuntu 5.04 (Hoary Hedgehog)
Ubuntu 5.10 (Breezy Badger)
The following packages are affected:
mozilla-thunderbird
The problem can be corrected by upgrading the affected package to
version 1.0.8-0ubuntu05.04 (for Ubuntu 5.04) or 1.0.8-0ubuntu05.10.1
(for Ubuntu 5.10). After a standard system upgrade you need to restart
Thunderbird to effect the necessary changes.
Details follow:
Igor Bukanov discovered that the JavaScript engine did not properly
declare some temporary variables. Under some rare circumstances, a
malicious mail with embedded JavaScript could exploit this to execute
arbitrary code with the privileges of the user. (CVE-2006-0292,
CVE-2006-1742)
The function XULDocument.persist() did not sufficiently validate the
names of attributes. An attacker could exploit this to inject
arbitrary XML code into the file 'localstore.rdf', which is read and
evaluated at startup. This could include JavaScript commands that
would be run with the user's privileges. (CVE-2006-0296)
Due to a flaw in the HTML tag parser a specific sequence of HTML tags
caused memory corruption. A malicious HTML email could exploit this to
crash the browser or even execute arbitrary code with the user's
privileges. (CVE-2006-0748)
An invalid ordering of table-related tags caused Thunderbird to use a
negative array index. A malicious HTML email could exploit this to
execute arbitrary code with the privileges of the user.
(CVE-2006-0749)
Georgi Guninski discovered that forwarding mail in-line while using
the default HTML "rich mail" editor executed JavaScript embedded in
the email message. Forwarding mail in-line is not the default setting
but it is easily accessed through the "Forward As" menu item.
(CVE-2006-0884)
As a privacy measure to prevent senders (primarily spammers) from
tracking when email is read Thunderbird does not load remote content
referenced from an HTML mail message until a user tells it to do so.
This normally includes the content of frames and CSS files. It was
discovered that it was possible to bypass this restriction by
indirectly including remote content through an intermediate inline CSS
script or frame. (CVE-2006-1045)
Georgi Guninski discovered that embedded XBL scripts could escalate
their (normally reduced) privileges to get full privileges of the user
if the email is viewed with "Print Preview". (CVE-2006-1727)
The crypto.generateCRMFRequest() function had a flaw which could be
exploited to run arbitrary code with the user's privileges.
(CVE-2006-1728)
An integer overflow was detected in the handling of the CSS property
"letter-spacing". A malicious HTML email could exploit this to run
arbitrary code with the user's privileges. (CVE-2006-1730)
The methods valueOf.call() and .valueOf.apply() returned an object
whose privileges were not properly confined to those of the caller,
which made them vulnerable to cross-site scripting attacks. A
malicious email with embedded JavaScript code could exploit this to
modify the contents or steal confidential data (such as passwords)
from other opened web pages. (CVE-2006-1731) The window.controllers
array variable (CVE-2006-1732) and event handlers (CVE-2006-1741) were
vulnerable to a similar attack.
The privileged built-in XBL bindings were not fully protected from web
content and could be accessed by calling valueOf.call() and
valueOf.apply() on a method of that binding. A malicious email could
exploit this to run arbitrary JavaScript code with the user's
privileges. (CVE-2006-1733)
It was possible to use the Object.watch() method to access an internal
function object (the "clone parent"). A malicious email containing
JavaScript code could exploit this to execute arbitrary code with the
user's privileges. (CVE-2006-1734)
By calling the XBL.method.eval/() method in a special way it was
possible to create JavaScript functions that would get compiled with
the wrong privileges. A malicious email could exploit this to execute
arbitrary JavaScript code with the user's privileges. (CVE-2006-1735)
Several crashes have been fixed which could be triggered by specially
crafted HTML content and involve memory corruption. These could
potentially be exploited to execute arbitrary code with the user's
privileges. (CVE-2006-1737, CVE-2006-1738, CVE-2006-1739,
CVE-2006-1790)
The "enigmail" plugin has been updated to work with the new
Thunderbird and Mozilla versions.
Updated packages for Ubuntu 5.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.8-0ubuntu05.04.diff.gz
Size/MD5: 76623 e2c82d7f468caa965e5621ad18b77a69
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.8-0ubuntu05.04.dsc
Size/MD5: 942 4931c6ed9945f46bad16162d90837282
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.8.orig.tar.gz
Size/MD5: 32849510 ae345f1b722d8f3a977af4fd358d27b0
http://security.ubuntu.com/ubuntu/pool/main/e/enigmail/enigmail_0.92.1-0ubuntu05.04.1.diff.gz
Size/MD5: 16967 0d21f085cb14cc87f8dd2d3e1f066c00
http://security.ubuntu.com/ubuntu/pool/main/e/enigmail/enigmail_0.92.1-0ubuntu05.04.1.dsc
Size/MD5: 900 e90119b58ffbc055a79dbf8c27974890
http://security.ubuntu.com/ubuntu/pool/main/e/enigmail/enigmail_0.92.1.orig.tar.gz
Size/MD5: 2041938 5225bb1b406e9242c38cf9ac6c3d6dd0
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.8-0ubuntu05.04_amd64.deb
Size/MD5: 3346316 4838ce489a4512185c2e8619c36803af
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.8-0ubuntu05.04_amd64.deb
Size/MD5: 144566 5e8664ddac5eb2d360dfe7cf5693b5ca
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.8-0ubuntu05.04_amd64.deb
Size/MD5: 27052 8ee5b7fa38567d6b56b94263c6b214ae
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.8-0ubuntu05.04_amd64.deb
Size/MD5: 82044 33b3f22708c85cfe4afc45d6309b7a39
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.8-0ubuntu05.04_amd64.deb
Size/MD5: 11955310 6816901f94b36fe12c17a5e77a91cdd1
http://security.ubuntu.com/ubuntu/pool/universe/e/enigmail/mozilla-enigmail_0.92.1-0ubuntu05.04.1_amd64.deb
Size/MD5: 327162 ae60497d3d11bc53d6844a7e6b54b2fc
http://security.ubuntu.com/ubuntu/pool/main/e/enigmail/mozilla-thunderbird-enigmail_0.92.1-0ubuntu05.04.1_amd64.deb
Size/MD5: 333180 7d3b0e50d3d274f341502cb447983794
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.8-0ubuntu05.04_i386.deb
Size/MD5: 3339820 40cfb23ff33a24a1e002e5ae6e319a55
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.8-0ubuntu05.04_i386.deb
Size/MD5: 139624 5a3929b65c1e9384ca953f6f28f86991
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.8-0ubuntu05.04_i386.deb
Size/MD5: 27040 ee1123d1e2bb0b46a7212679de65ccd6
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.8-0ubuntu05.04_i386.deb
Size/MD5: 79778 84622dd3db2690375b0e073448841e91
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.8-0ubuntu05.04_i386.deb
Size/MD5: 10906934 55712d19a5b6cb3806b13fc465ad60b4
http://security.ubuntu.com/ubuntu/pool/universe/e/enigmail/mozilla-enigmail_0.92.1-0ubuntu05.04.1_i386.deb
Size/MD5: 310964 0f4d71ae7dc7b613cde1e1759fa29dbb
http://security.ubuntu.com/ubuntu/pool/main/e/enigmail/mozilla-thunderbird-enigmail_0.92.1-0ubuntu05.04.1_i386.deb
Size/MD5: 318594 78b3bcfa57d384908226868b1ad426ce
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.8-0ubuntu05.04_powerpc.deb
Size/MD5: 3335256 c56ffb4e645d66c08e7102b12fe18c83
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.8-0ubuntu05.04_powerpc.deb
Size/MD5: 138410 107186f5ec6c4048a4bc8ebd510abfa5
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.8-0ubuntu05.04_powerpc.deb
Size/MD5: 27044 7587ace6fd17ffb10799c5b7546e8262
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.8-0ubuntu05.04_powerpc.deb
Size/MD5: 73992 5c50490392e962e7d5e21fa1d1ef6c4d
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.8-0ubuntu05.04_powerpc.deb
Size/MD5: 10449994 1787f118606df90c056107248d39e98f
http://security.ubuntu.com/ubuntu/pool/universe/e/enigmail/mozilla-enigmail_0.92.1-0ubuntu05.04.1_powerpc.deb
Size/MD5: 313234 83451690ecff28aa21b302659ab67e3a
http://security.ubuntu.com/ubuntu/pool/main/e/enigmail/mozilla-thunderbird-enigmail_0.92.1-0ubuntu05.04.1_powerpc.deb
Size/MD5: 320344 bd8cacb157b0391f95e47b7f55049ad9
Updated packages for Ubuntu 5.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.8-0ubuntu05.10.1.diff.gz
Size/MD5: 78589 a81e704914bb097722eef1eb1951bbd0
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.8-0ubuntu05.10.1.dsc
Size/MD5: 918 c30bd87fbee4cd0f0c3ab1e1a549f210
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.8.orig.tar.gz
Size/MD5: 32849510 ae345f1b722d8f3a977af4fd358d27b0
http://security.ubuntu.com/ubuntu/pool/main/e/enigmail/enigmail_0.92.1-0ubuntu05.10.1.diff.gz
Size/MD5: 16998 45dd732ea8a6e94cc72329cb5fd8abfd
http://security.ubuntu.com/ubuntu/pool/main/e/enigmail/enigmail_0.92.1-0ubuntu05.10.1.dsc
Size/MD5: 866 88c6273adbf2f0bf648aae9d919529dd
http://security.ubuntu.com/ubuntu/pool/main/e/enigmail/enigmail_0.92.1.orig.tar.gz
Size/MD5: 2041938 5225bb1b406e9242c38cf9ac6c3d6dd0
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.8-0ubuntu05.10.1_amd64.deb
Size/MD5: 3293534 a5466ae79562b66ab65516bd786cc4c1
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.8-0ubuntu05.10.1_amd64.deb
Size/MD5: 146062 85510c5277f233cf543bb24629cf2791
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.8-0ubuntu05.10.1_amd64.deb
Size/MD5: 27556 1ed57f5b19fffaa589f2c63cc38b8d34
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.8-0ubuntu05.10.1_amd64.deb
Size/MD5: 85568 4ef141fb9d6cfe98cc3596c4fd0be89b
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.8-0ubuntu05.10.1_amd64.deb
Size/MD5: 11976142 a69cb1d98a768049462499b178f5a99f
http://security.ubuntu.com/ubuntu/pool/universe/e/enigmail/mozilla-enigmail_0.92.1-0ubuntu05.10.1_amd64.deb
Size/MD5: 328698 a8b8a3c072d452f9574c956de3a8805e
http://security.ubuntu.com/ubuntu/pool/main/e/enigmail/mozilla-thunderbird-enigmail_0.92.1-0ubuntu05.10.1_amd64.deb
Size/MD5: 334412 5338fb2503077e60e317a7555640aef7
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.8-0ubuntu05.10.1_i386.deb
Size/MD5: 3287228 96f7b87993b15341908028905fc93679
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.8-0ubuntu05.10.1_i386.deb
Size/MD5: 139624 b268fad24d8c35ed9a05c9c97e01bb5e
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.8-0ubuntu05.10.1_i386.deb
Size/MD5: 27552 a38be0266866af883b525a50d8672ac3
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.8-0ubuntu05.10.1_i386.deb
Size/MD5: 76942 1e2b0b0163b12d52af2881720978ca7d
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.8-0ubuntu05.10.1_i386.deb
Size/MD5: 10374514 32e541a406bed650de919d15f089a3aa
http://security.ubuntu.com/ubuntu/pool/universe/e/enigmail/mozilla-enigmail_0.92.1-0ubuntu05.10.1_i386.deb
Size/MD5: 311056 4d8ecdff00ada64fde35baa64c6362a5
http://security.ubuntu.com/ubuntu/pool/main/e/enigmail/mozilla-thunderbird-enigmail_0.92.1-0ubuntu05.10.1_i386.deb
Size/MD5: 318578 4fb5630d72f0442a33554ca364b6cede
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.8-0ubuntu05.10.1_powerpc.deb
Size/MD5: 3285046 59891dba5f7f0a8045a777ebee2bbe13
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.8-0ubuntu05.10.1_powerpc.deb
Size/MD5: 139692 6d78f1414d2e2375682b3763cc0da542
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.8-0ubuntu05.10.1_powerpc.deb
Size/MD5: 27552 28194ffd23b895a46ebca73dcb1b85d3
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.8-0ubuntu05.10.1_powerpc.deb
Size/MD5: 76654 e352b77b08e50b4a72228e6390de00b5
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.8-0ubuntu05.10.1_powerpc.deb
Size/MD5: 10487686 644313dc6de638d7b6620f090a5cabed
http://security.ubuntu.com/ubuntu/pool/universe/e/enigmail/mozilla-enigmail_0.92.1-0ubuntu05.10.1_powerpc.deb
Size/MD5: 314132 a1ae03a1b92a71dfd85f31fa2f548335
http://security.ubuntu.com/ubuntu/pool/main/e/enigmail/mozilla-thunderbird-enigmail_0.92.1-0ubuntu05.10.1_powerpc.deb
Size/MD5: 321364 bf03d8fd532a39f09ff0e4205518cd2c
Ubuntu Security Notice USN-277-1 May 03, 2006
tiff vulnerabilities
CVE-2006-2024, CVE-2006-2025, CVE-2006-2026, CVE-2006-2120
A security issue affects the following Ubuntu releases:
Ubuntu 5.04 (Hoary Hedgehog)
Ubuntu 5.10 (Breezy Badger)
The following packages are affected:
libtiff4
The problem can be corrected by upgrading the affected package to
version 3.6.1-5ubuntu0.3 (for Ubuntu 5.04), or 3.7.3-1ubuntu1.1 (for
Ubuntu 5.10). After a standard system upgrade you need to reboot your
computer to effect the necessary changes, since this library is used
by many client and server applications.
Details follow:
Tavis Ormandy and Andrey Kiselev discovered that libtiff did not
sufficiently verify the validity of TIFF files. By tricking an user
into opening a specially crafted TIFF file with any application that
uses libtiff, an attacker could exploit this to crash the application
or even execute arbitrary code with the application's privileges.
Updated packages for Ubuntu 5.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/tiff_3.6.1-5ubuntu0.3.diff.gz
Size/MD5: 25844 bf3bb894195ad17e5c860daf0b52e1ce
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/tiff_3.6.1-5ubuntu0.3.dsc
Size/MD5: 681 7ca48c0c729b1ed1eaf448c8f25f3fd9
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/tiff_3.6.1.orig.tar.gz
Size/MD5: 848760 bd252167a20ac7910ab3bd2b3ee9e955
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiff-tools_3.6.1-5ubuntu0.3_amd64.deb
Size/MD5: 172968 2ffca24fa53dc7bfb5c5901e193a104c
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiff4-dev_3.6.1-5ubuntu0.3_amd64.deb
Size/MD5: 459186 3bb686188917d73793abc5f812d388b9
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiff4_3.6.1-5ubuntu0.3_amd64.deb
Size/MD5: 112794 309519051cbeac5ee4970c17c95f873f
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiff-tools_3.6.1-5ubuntu0.3_i386.deb
Size/MD5: 155950 dd997be32c7b3379260bf9f9ff9576c8
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiff4-dev_3.6.1-5ubuntu0.3_i386.deb
Size/MD5: 440500 16622a398c014cf6035494e0ff29d660
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiff4_3.6.1-5ubuntu0.3_i386.deb
Size/MD5: 103712 fe939d6535627e0fc713fb43fefa399e
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiff-tools_3.6.1-5ubuntu0.3_powerpc.deb
Size/MD5: 188176 88838f14d7d5da36f1f403f4c0a39b66
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiff4-dev_3.6.1-5ubuntu0.3_powerpc.deb
Size/MD5: 463658 3aa8bf134de05702211eafa321b06503
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiff4_3.6.1-5ubuntu0.3_powerpc.deb
Size/MD5: 114124 de1c205214d625b875ae75c18c18078a
Updated packages for Ubuntu 5.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/tiff_3.7.3-1ubuntu1.1.diff.gz
Size/MD5: 10710 2bd5f0ece5925350446d84ee8189e071
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/tiff_3.7.3-1ubuntu1.1.dsc
Size/MD5: 756 6189550944c0b45fc86c910ed0dbcf26
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/tiff_3.7.3.orig.tar.gz
Size/MD5: 1268182 48fbef3d76a6253699f28f49c8f25a8b
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/universe/t/tiff/libtiff-opengl_3.7.3-1ubuntu1.1_amd64.deb
Size/MD5: 47954 af59fddd16097f942f3e0e30191d28d0
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiff-tools_3.7.3-1ubuntu1.1_amd64.deb
Size/MD5: 219564 3ed70fe840906f3f2a1c3911a7361e29
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiff4-dev_3.7.3-1ubuntu1.1_amd64.deb
Size/MD5: 281560 1e221cf189548ff8d6e5d1493800c05d
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiff4_3.7.3-1ubuntu1.1_amd64.deb
Size/MD5: 471914 5736f410bb8db26c4249a4921491be9a
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiffxx0c2_3.7.3-1ubuntu1.1_amd64.deb
Size/MD5: 42792 139dc849797a3d1075afb782d6bd6c70
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/universe/t/tiff/libtiff-opengl_3.7.3-1ubuntu1.1_i386.deb
Size/MD5: 47346 5eddb50954c66c612b7f3512782dda0f
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiff-tools_3.7.3-1ubuntu1.1_i386.deb
Size/MD5: 204506 18fdd790464fad763946019e3eacf08d
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiff4-dev_3.7.3-1ubuntu1.1_i386.deb
Size/MD5: 258138 7034f05b5208a7e12d08f0f0f617c267
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiff4_3.7.3-1ubuntu1.1_i386.deb
Size/MD5: 457970 6ff93fae3665cc4d755e00193bc3878d
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiffxx0c2_3.7.3-1ubuntu1.1_i386.deb
Size/MD5: 42792 b8171ab19a074a0bb824bbf9b7e6878c
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/universe/t/tiff/libtiff-opengl_3.7.3-1ubuntu1.1_powerpc.deb
Size/MD5: 49658 ce5d543ec0f79778d91c35621a21cfb2
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiff-tools_3.7.3-1ubuntu1.1_powerpc.deb
Size/MD5: 238916 80c0907f7bcc9ce449ab7c290f4de184
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiff4-dev_3.7.3-1ubuntu1.1_powerpc.deb
Size/MD5: 286772 43624f7226b1b4f7805b6824afabce4d
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiff4_3.7.3-1ubuntu1.1_powerpc.deb
Size/MD5: 472118 0bbe31b13584e60800c85e9a1e2fd462
http://security.ubuntu.com/ubuntu/pool/main/t/tiff/libtiffxx0c2_3.7.3-1ubuntu1.1_powerpc.deb
Size/MD5: 44986 11c16855448a486adbdd3520006845dd
Ubuntu Security Notice USN-278-1 May 03, 2006
gdm vulnerabilitiy
CVE-2006-1057
A security issue affects the following Ubuntu releases:
Ubuntu 5.04 (Hoary Hedgehog)
Ubuntu 5.10 (Breezy Badger)
The following packages are affected:
gdm
The problem can be corrected by upgrading the affected package to
2.6.0.7-0ubuntu7.1 (for Ubuntu 5.04) or 2.8.0.5-0ubuntu1.1
(for Ubuntu 5.10). In general, a standard system upgrade is
sufficient to effect the necessary changes.
Details follow:
Marcus Meissner discovered a race condition in gdm's handling of the
~/.ICEauthority file permissions. A local attacker could exploit this
to become the owner of an arbitrary file in the system. When getting
control over automatically executed scripts (like cron jobs), the
attacker could eventually leverage this flaw to execute arbitrary
commands with root privileges.
Updated packages for Ubuntu 5.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.6.0.7-0ubuntu7.1.diff.gz
Size/MD5: 68630 07276634f63f6cf6e3d3946661cf2939
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.6.0.7-0ubuntu7.1.dsc
Size/MD5: 787 6e666f8da0735aee929c25a9818dd53a
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.6.0.7.orig.tar.gz
Size/MD5: 5594495 50254890d9fbbec6b2d3455d4343f6e0
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.6.0.7-0ubuntu7.1_amd64.deb
Size/MD5: 1382686 716ba56c1177162685a7198b46a28667
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.6.0.7-0ubuntu7.1_i386.deb
Size/MD5: 1343230 9bb1a76e6d0a8658f49ce787f6a66606
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.6.0.7-0ubuntu7.1_powerpc.deb
Size/MD5: 1379750 bcaec993d57ce53221c920245495d3b8
Updated packages for Ubuntu 5.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.8.0.5-0ubuntu1.1.diff.gz
Size/MD5: 65777 3181d42210c694ab595840f1359d5735
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.8.0.5-0ubuntu1.1.dsc
Size/MD5: 820 0165df3317618487e8d39e60b5174c83
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.8.0.5.orig.tar.gz
Size/MD5: 4226618 349b76492113ab814f2732d4ce3a49c2
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.8.0.5-0ubuntu1.1_amd64.deb
Size/MD5: 1618080 7aa6c967d046d2876e577975e5c6759f
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.8.0.5-0ubuntu1.1_i386.deb
Size/MD5: 1559770 3dc875b89062d5572b2b2e84a8354434
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.8.0.5-0ubuntu1.1_powerpc.deb
Size/MD5: 1571404 1ca7c072d5460d694af449719f2abc57
Ubuntu Security Notice USN-279-1 May 03, 2006
libnasl vulnerability
CVE-2006-2093
A security issue affects the following Ubuntu releases:
Ubuntu 5.04 (Hoary Hedgehog)
Ubuntu 5.10 (Breezy Badger)
The following packages are affected:
libnasl2
The problem can be corrected by upgrading the affected package to
version 2.2.3-1ubuntu0.1 (libnasl-dev and libnasl2) and
2.2.4-1ubuntu0.1 (libnasl-dev and libnasl2). After a standard system
upgrade you need to restart nessusd to effect the necessary changes.
Details follow:
Jayesh KS discovered that the nasl_split() function in the NASL
(Nessus Attack Scripting Language) library did not check for a
zero-length separator argument, which lead to an invalid memory
allocation. This library is primarily used in the Nessus security
scanner; a remote attacker could exploit this vulnerability to cause
the Nessus daemon to crash.
Updated packages for Ubuntu 5.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/libn/libnasl/libnasl_2.2.3-1ubuntu0.1.diff.gz
Size/MD5: 325024 934e559032064bdbfaf178e0e64b347d
http://security.ubuntu.com/ubuntu/pool/main/libn/libnasl/libnasl_2.2.3-1ubuntu0.1.dsc
Size/MD5: 758 3326827ac8f9245a9188222ac517224d
http://security.ubuntu.com/ubuntu/pool/main/libn/libnasl/libnasl_2.2.3.orig.tar.gz
Size/MD5: 360918 ee66b86f0a808c9eb1e1756490e5c067
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/libn/libnasl/libnasl-dev_2.2.3-1ubuntu0.1_amd64.deb
Size/MD5: 334004 81c12b0e563175c9add90f462d55c46d
http://security.ubuntu.com/ubuntu/pool/main/libn/libnasl/libnasl2_2.2.3-1ubuntu0.1_amd64.deb
Size/MD5: 101580 63413de59bcc9efe8cacbcc34380df67
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/libn/libnasl/libnasl-dev_2.2.3-1ubuntu0.1_i386.deb
Size/MD5: 312834 8c0bfa1daf1854ef200cc9bb4e50a54c
http://security.ubuntu.com/ubuntu/pool/main/libn/libnasl/libnasl2_2.2.3-1ubuntu0.1_i386.deb
Size/MD5: 95840 4d8e2c1a91d8fc991f2fd1716b8583cb
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/libn/libnasl/libnasl-dev_2.2.3-1ubuntu0.1_powerpc.deb
Size/MD5: 338600 33be5486ddf9ca014d27bf77281200f0
http://security.ubuntu.com/ubuntu/pool/main/libn/libnasl/libnasl2_2.2.3-1ubuntu0.1_powerpc.deb
Size/MD5: 99624 98dcfe611e5029dc619caf72dfd4da86
Updated packages for Ubuntu 5.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/libn/libnasl/libnasl_2.2.4-1ubuntu0.1.diff.gz
Size/MD5: 325052 1a6cb2d4eba535bf7d04c86e28753fce
http://security.ubuntu.com/ubuntu/pool/main/libn/libnasl/libnasl_2.2.4-1ubuntu0.1.dsc
Size/MD5: 758 77166e15fa4998fccb44c731649318b9
http://security.ubuntu.com/ubuntu/pool/main/libn/libnasl/libnasl_2.2.4.orig.tar.gz
Size/MD5: 361551 47de3e86725b5f54f5752233a4bc1ea8
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/libn/libnasl/libnasl-dev_2.2.4-1ubuntu0.1_amd64.deb
Size/MD5: 342848 312e410daa37b832a4462c0fd43a256e
http://security.ubuntu.com/ubuntu/pool/main/libn/libnasl/libnasl2_2.2.4-1ubuntu0.1_amd64.deb
Size/MD5: 105872 17131088c3fcf03c61ff48c1068de163
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/libn/libnasl/libnasl-dev_2.2.4-1ubuntu0.1_i386.deb
Size/MD5: 314346 3e306ca23afe7008bc7fb1e0864763fa
http://security.ubuntu.com/ubuntu/pool/main/libn/libnasl/libnasl2_2.2.4-1ubuntu0.1_i386.deb
Size/MD5: 96150 dc30810ccc3d00679da3f081517ada1d
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/libn/libnasl/libnasl-dev_2.2.4-1ubuntu0.1_powerpc.deb
Size/MD5: 344788 fa5ead6eae23d5811973691236068b5a
http://security.ubuntu.com/ubuntu/pool/main/libn/libnasl/libnasl2_2.2.4-1ubuntu0.1_powerpc.deb
Size/MD5: 102438 25bf747848d3cec7561298f198ffa1f5
