ubuntu-security-announce Digest, Vol 95, Issue 14

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."


Today's Topics:

1. [USN-1546-1] libgc vulnerability (Steve Beattie)
2. [USN-1547-1] libGData, evolution-data-server vulnerability
(Steve Beattie)


----------------------------------------------------------------------

Message: 1
Date: Tue, 28 Aug 2012 14:58:37 -0700
From: Steve Beattie <sbeattie@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1546-1] libgc vulnerability
Message-ID: <20120828215837.GC11004@nxnw.org>
Content-Type: text/plain; charset="us-ascii"

==========================================================================
Ubuntu Security Notice USN-1546-1
August 28, 2012

libgc vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
- Ubuntu 8.04 LTS

Summary:

Applications using libgc could be made to crash or run arbitrary
programs as your login.

Software Description:
- libgc: Boehm-Demers-Weiser garbage collecting storage allocator library

Details:

It was discovered that multiple integer overflows existed in the
malloc and calloc implementations in the Boehm-Demers-Weiser garbage
collecting memory allocator (libgc). These could allow an attacker
to cause a denial of service or possibly execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
libgc1c2 1:7.1-8ubuntu0.12.04.1

Ubuntu 11.10:
libgc1c2 1:7.1-8ubuntu0.11.10.1

Ubuntu 11.04:
libgc1c2 1:6.8-1.2ubuntu3.2

Ubuntu 10.04 LTS:
libgc1c2 1:6.8-1.2ubuntu1.1

Ubuntu 8.04 LTS:
libgc1c2 1:6.8-1.1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1546-1
CVE-2012-2673

Package Information:
https://launchpad.net/ubuntu/+source/libgc/1:7.1-8ubuntu0.12.04.1
https://launchpad.net/ubuntu/+source/libgc/1:7.1-8ubuntu0.11.10.1
https://launchpad.net/ubuntu/+source/libgc/1:6.8-1.2ubuntu3.2
https://launchpad.net/ubuntu/+source/libgc/1:6.8-1.2ubuntu1.1
https://launchpad.net/ubuntu/+source/libgc/1:6.8-1.1ubuntu0.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20120828/37cd0956/attachment-0001.pgp>

------------------------------

Message: 2
Date: Tue, 28 Aug 2012 16:20:13 -0700
From: Steve Beattie <sbeattie@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1547-1] libGData, evolution-data-server vulnerability
Message-ID: <20120828232013.GD11004@nxnw.org>
Content-Type: text/plain; charset="us-ascii"

==========================================================================
Ubuntu Security Notice USN-1547-1
August 28, 2012

libgdata, evolution-data-server vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS

Summary:

Applications using GData services could be made to expose sensitive
information over the network.

Software Description:
- libgdata: Library to access GData services
- evolution-data-server: Evolution suite data server

Details:

Vreixo Formoso discovered that the libGData library, as used
by Evolution and other applications, did not properly verify SSL
certificates. A remote attacker could exploit this to perform a man
in the middle attack to view sensitive information or alter data
transmitted via the GData protocol.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
libgdata13 0.9.1-0ubuntu2.1

Ubuntu 11.04:
libgdata11 0.8.0-0ubuntu1.1

Ubuntu 10.04 LTS:
libgdata-google1.2-1 2.28.3.1-0ubuntu6.1
libgdata1.2-1 2.28.3.1-0ubuntu6.1
libgdata6 0.5.2-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1547-1
CVE-2012-1177

Package Information:
https://launchpad.net/ubuntu/+source/libgdata/0.9.1-0ubuntu2.1
https://launchpad.net/ubuntu/+source/libgdata/0.8.0-0ubuntu1.1
https://launchpad.net/ubuntu/+source/evolution-data-server/2.28.3.1-0ubuntu6.1
https://launchpad.net/ubuntu/+source/libgdata/0.5.2-0ubuntu1.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20120828/356a8432/attachment-0001.pgp>

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce


End of ubuntu-security-announce Digest, Vol 95, Issue 14
********************************************************