WINDOWS CENTER: ubuntu-security-announce Digest, Vol 62, Issue 4

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."

Today's Topics:

1. [USN-853-2] Firefox and Xulrunner regression (Jamie Strandboge)
2. [USN-858-1] OpenLDAP vulnerability (Marc Deslauriers)

----------------------------------------------------------------------

Message: 1
Date: Wed, 11 Nov 2009 11:00:13 -0600
From: Jamie Strandboge <jamie@canonical.com>
Subject: [USN-853-2] Firefox and Xulrunner regression
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Message-ID: <20091111170013.GA3718@severus.strandboge.com>
Content-Type: text/plain; charset="us-ascii"

===========================================================
Ubuntu Security Notice USN-853-2 November 11, 2009
firefox-3.5, xulrunner-1.9.1 regression
https://launchpad.net/bugs/480740
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 9.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
firefox-3.5 3.5.5+nobinonly-0ubuntu0.9.10.1
xulrunner-1.9.1 1.9.1.5+nobinonly-0ubuntu0.9.10.1

After a standard system upgrade you need to restart Firefox and any
applications that use xulrunner to effect the necessary changes.

Details follow:

USN-853-1 fixed vulnerabilities in Firefox and Xulrunner. The upstream
changes introduced regressions that could lead to crashes when processing
certain malformed GIF images, fonts and web pages. This update fixes the
problem.

We apologize for the inconvenience.

Original advisory details:

Alin Rad Pop discovered a heap-based buffer overflow in Firefox when it
converted strings to floating point numbers. If a user were tricked into
viewing a malicious website, a remote attacker could cause a denial of service
or possibly execute arbitrary code with the privileges of the user invoking the
program. (CVE-2009-1563)

Jeremy Brown discovered that the Firefox Download Manager was vulnerable to
symlink attacks. A local attacker could exploit this to create or overwrite
files with the privileges of the user invoking the program. (CVE-2009-3274)

Paul Stone discovered a flaw in the Firefox form history. If a user were
tricked into viewing a malicious website, a remote attacker could access this
data to steal confidential information. (CVE-2009-3370)

Orlando Berrera discovered that Firefox did not properly free memory when using
web-workers. If a user were tricked into viewing a malicious website, a remote
attacker could cause a denial of service or possibly execute arbitrary code
with the privileges of the user invoking the program. This issue only
affected Ubuntu 9.10. (CVE-2009-3371)

A flaw was discovered in the way Firefox processed Proxy Auto-configuration
(PAC) files. If a user configured the browser to use PAC files with certain
regular expressions, an attacker could cause a denial of service or possibly
execute arbitrary code with the privileges of the user invoking the program.
(CVE-2009-3372)

A heap-based buffer overflow was discovered in Mozilla's GIF image parser. If a
user were tricked into viewing a malicious website, a remote attacker could
cause a denial of service or possibly execute arbitrary code with the
privileges of the user invoking the program. (CVE-2009-3373)

A flaw was discovered in the JavaScript engine of Firefox. An attacker could
exploit this to execute scripts from page content with chrome privileges.
(CVE-2009-3374)

Gregory Fleischer discovered that the same-origin check in Firefox could be
bypassed by utilizing the document.getSelection function. An attacker could
exploit this to read data from other domains. (CVE-2009-3375)

Jesse Ruderman and Sid Stamm discovered that Firefox did not properly display
filenames containing right-to-left (RTL) override characters. If a user were
tricked into downloading a malicious file with a crafted filename, an attacker
could exploit this to trick the user into opening a different file than the
user expected. (CVE-2009-3376)

Several flaws were discovered in third party media libraries. If a user were
tricked into opening a crafted media file, a remote attacker could cause a
denial of service or possibly execute arbitrary code with the privileges of the
user invoking the program. This issue only affected Ubuntu 9.10.
(CVE-2009-3377)

Vladimir Vukicevic, Jesse Ruderman, Martijn Wargers, Daniel Banchero, David
Keeler, Boris Zbarsky, Thomas Frederiksen, Marcia Knous, Carsten Book, Kevin
Brosnan, David Anderson and Jeff Walden discovered various flaws in the browser
and JavaScript engines of Firefox. If a user were tricked into viewing a
malicious website, a remote attacker could cause a denial of service or
possibly execute arbitrary code with the privileges of the user invoking the
program. (CVE-2009-3380, CVE-2009-3381, CVE-2009-3382, CVE-2009-3383)

Updated packages for Ubuntu 9.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5_3.5.5+nobinonly-0ubuntu0.9.10.1.diff.gz
Size/MD5: 128517 cfbe278dd79f8b469525bd6ce72947a5
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5_3.5.5+nobinonly-0ubuntu0.9.10.1.dsc
Size/MD5: 2940 de2b4954011bc7f3e75f67cef2da3251
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.5/firefox-3.5_3.5.5+nobinonly.orig.tar.gz
Size/MD5: 44924176 c2cb33f3f6330cb7ec844d2c9f55640d
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner-1.9.1_1.9.1.5+nobinonly-0ubuntu0.9.10.1.diff.gz
Size/MD5: 64123 899bc767278d6baa6342832beebe5514
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner-1.9.1_1.9.1.5+nobinonly-0ubuntu0.9.10.1.dsc
Size/MD5: 2910 92e04905a7f495dfdcb5960fdd2f5d04
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.1/xulrunner-1.9.1_1.9.1.5+nobinonly.orig.tar.gz
Size/MD5: 44061677 e86f3dcf09bb514e6cb33d69057d0e01

Architecture independent packages:

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

i386 architecture (x86 compatible Intel/AMD):

lpia architecture (Low Power Intel Architecture):

powerpc architecture (Apple Macintosh G3/G4/G5):

sparc architecture (Sun SPARC/UltraSPARC):

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
Url : https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20091111/581b3466/attachment-0001.pgp

------------------------------

Message: 2
Date: Thu, 12 Nov 2009 09:29:21 -0500
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Subject: [USN-858-1] OpenLDAP vulnerability
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Message-ID: <1258036161.3657.1.camel@mdlinux.technorage.com>
Content-Type: text/plain; charset="utf-8"

===========================================================
Ubuntu Security Notice USN-858-1 November 12, 2009
openldap2.2 vulnerability
CVE-2009-3767
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
libldap-2.2-7 2.2.26-5ubuntu2.9

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

It was discovered that OpenLDAP did not correctly handle SSL certificates
with zero bytes in the Common Name. A remote attacker could exploit this to
perform a man in the middle attack to view sensitive information or alter
encrypted communications.

Updated packages for Ubuntu 6.06 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/openldap2.2_2.2.26-5ubuntu2.9.diff.gz
Size/MD5: 516098 098a03b4f7d511ce730e9647deca2072
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/openldap2.2_2.2.26-5ubuntu2.9.dsc
Size/MD5: 1028 5a95dae94a1016fbcf41c1c1992ea8e6
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/openldap2.2_2.2.26.orig.tar.gz
Size/MD5: 2626629 afc8700b5738da863b30208e1d3e9de8

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/ldap-utils_2.2.26-5ubuntu2.9_amd64.deb
Size/MD5: 130854 1f1b40b12adcb557a810194d0c4f7993
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/libldap-2.2-7_2.2.26-5ubuntu2.9_amd64.deb
Size/MD5: 166444 500528d10502361c075a08578c1586f5
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/slapd_2.2.26-5ubuntu2.9_amd64.deb
Size/MD5: 961974 f56eef919306d6ca7f4a7a090d2ae6ba

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/ldap-utils_2.2.26-5ubuntu2.9_i386.deb
Size/MD5: 118638 0558a833fb6eadf4d87bd9fd6e687838
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/libldap-2.2-7_2.2.26-5ubuntu2.9_i386.deb
Size/MD5: 146444 fc85d5259c97622324047bbda153937d
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/slapd_2.2.26-5ubuntu2.9_i386.deb
Size/MD5: 873424 358c78f76ee16010c1fb81e89adfe849

powerpc architecture (Apple Macintosh G3/G4/G5):

http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/ldap-utils_2.2.26-5ubuntu2.9_powerpc.deb
Size/MD5: 133012 92d9de435a795261e6bf4143f2bf59c7
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/libldap-2.2-7_2.2.26-5ubuntu2.9_powerpc.deb
Size/MD5: 157480 099b1ee5e158f77be109a7972587f596
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/slapd_2.2.26-5ubuntu2.9_powerpc.deb
Size/MD5: 960052 850fb56995224edd6ae329af1b8236ef

sparc architecture (Sun SPARC/UltraSPARC):

http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/ldap-utils_2.2.26-5ubuntu2.9_sparc.deb
Size/MD5: 120932 4fa0f7accd968ba71dff1f7c5b2ef811
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/libldap-2.2-7_2.2.26-5ubuntu2.9_sparc.deb
Size/MD5: 148546 2d1af209a8b53a8315fbd4bd86573d70
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/slapd_2.2.26-5ubuntu2.9_sparc.deb
Size/MD5: 903928 4aa6b0478821e803c80a020b031aafed

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
Url : https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20091112/9caed4d4/attachment.pgp

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

End of ubuntu-security-announce Digest, Vol 62, Issue 4
*******************************************************

News

Thursday, November 12, 2009

ubuntu-security-announce Digest, Vol 62, Issue 4

No comments:

WINDOWS CENTER

Blog Archive