WINDOWS CENTER

ubuntu-security-announce Digest, Vol 63, Issue 5

2009-12-10T19:09:00.000-08:00

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."

Today's Topics:

1. [USN-870-1] PyGreSQL vulnerability (Jamie Strandboge)
2. [USN-871-1] KDE vulnerability (Jamie Strandboge)
3. [USN-871-2] KDE 4 vulnerabilities (Jamie Strandboge)

----------------------------------------------------------------------

Message: 1
Date: Thu, 10 Dec 2009 18:33:50 -0600
From: Jamie Strandboge <jamie@canonical.com>
Subject: [USN-870-1] PyGreSQL vulnerability
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Message-ID: <20091211003350.GL26756@severus.strandboge.com>
Content-Type: text/plain; charset="us-ascii"

===========================================================
Ubuntu Security Notice USN-870-1 December 11, 2009
pygresql vulnerability
CVE-2009-2940
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 8.04 LTS
Ubuntu 8.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.04 LTS:
python-pygresql 1:3.8.1-2ubuntu0.1

Ubuntu 8.10:
python-pygresql 1:3.8.1-3ubuntu0.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

Steffen Joeris discovered that PyGreSQL 3.8 did not use PostgreSQL's safe
string and bytea functions in its own escaping functions. As a result,
applications written to use PyGreSQL's escaping functions are vulnerable to
SQL injections when processing certain multi-byte character sequences.
Because the safe functions require a database connection, to maintain
backwards compatibility, pg.escape_string() and pg.escape_bytea() are still
available, but applications will have to be adjusted to use the new
pyobj.escape_string() and pyobj.escape_bytea() functions. For example, code
containing:

import pg
connection = pg.connect(...)
escaped = pg.escape_string(untrusted_input)

should be adjusted to use:

import pg
connection = pg.connect(...)
escaped = connection.escape_string(untrusted_input)

Updated packages for Ubuntu 8.04 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/p/pygresql/pygresql_3.8.1-2ubuntu0.1.diff.gz
Size/MD5: 4556 282feadbd53e81d0912041f3e8707b65
http://security.ubuntu.com/ubuntu/pool/main/p/pygresql/pygresql_3.8.1-2ubuntu0.1.dsc
Size/MD5: 819 9613b347da5530beaaed5685ca7190e9
http://security.ubuntu.com/ubuntu/pool/main/p/pygresql/pygresql_3.8.1.orig.tar.gz
Size/MD5: 81186 5575979dac93c9c5795d7693a8f91c86

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/p/pygresql/python-pygresql-dbg_3.8.1-2ubuntu0.1_amd64.deb
Size/MD5: 158862 52a6055fbb6bd8343b5a714c12e30afa
http://security.ubuntu.com/ubuntu/pool/main/p/pygresql/python-pygresql_3.8.1-2ubuntu0.1_amd64.deb
Size/MD5: 113590 ab2f308e7c9d011e4290a159c0ac5c66

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/p/pygresql/python-pygresql-dbg_3.8.1-2ubuntu0.1_i386.deb
Size/MD5: 142506 fc8a7789c369ac24468b7dc9cfcf8de5
http://security.ubuntu.com/ubuntu/pool/main/p/pygresql/python-pygresql_3.8.1-2ubuntu0.1_i386.deb
Size/MD5: 108396 00a81a413758c9c9b91efdd2c694247e

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/p/pygresql/python-pygresql-dbg_3.8.1-2ubuntu0.1_lpia.deb
Size/MD5: 143308 9174b81254494f27457bce98d73f9a5b
http://ports.ubuntu.com/pool/main/p/pygresql/python-pygresql_3.8.1-2ubuntu0.1_lpia.deb
Size/MD5: 107932 c97afe12864aa0c91c82d1331edd739d

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/p/pygresql/python-pygresql-dbg_3.8.1-2ubuntu0.1_powerpc.deb
Size/MD5: 158918 9e2145814af329ba3b8deb6e269396e6
http://ports.ubuntu.com/pool/main/p/pygresql/python-pygresql_3.8.1-2ubuntu0.1_powerpc.deb
Size/MD5: 115096 39e2ed416b83c3c289eb4700d6b10fe4

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/p/pygresql/python-pygresql-dbg_3.8.1-2ubuntu0.1_sparc.deb
Size/MD5: 136806 6180a01bcca41ec614520a6a617247b1
http://ports.ubuntu.com/pool/main/p/pygresql/python-pygresql_3.8.1-2ubuntu0.1_sparc.deb
Size/MD5: 108752 5a37c25ed4116c66f26e28ba4d914a3d

Updated packages for Ubuntu 8.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/p/pygresql/pygresql_3.8.1-3ubuntu0.1.diff.gz
Size/MD5: 4554 0f4ebbe4a21abb32e1b8adcc841272fd
http://security.ubuntu.com/ubuntu/pool/main/p/pygresql/pygresql_3.8.1-3ubuntu0.1.dsc
Size/MD5: 1215 e957555bab090aeb2bf2b043710536c1
http://security.ubuntu.com/ubuntu/pool/main/p/pygresql/pygresql_3.8.1.orig.tar.gz
Size/MD5: 81186 5575979dac93c9c5795d7693a8f91c86

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/p/pygresql/python-pygresql-dbg_3.8.1-3ubuntu0.1_amd64.deb
Size/MD5: 161374 c2bd1d7edf9a4b7fe8775a4b81e41c89
http://security.ubuntu.com/ubuntu/pool/main/p/pygresql/python-pygresql_3.8.1-3ubuntu0.1_amd64.deb
Size/MD5: 113848 df4cf90f62f064cde2af19d4e53bb6a8

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/p/pygresql/python-pygresql-dbg_3.8.1-3ubuntu0.1_i386.deb
Size/MD5: 144342 9613af053ccac31ee68f0ea7237102ba
http://security.ubuntu.com/ubuntu/pool/main/p/pygresql/python-pygresql_3.8.1-3ubuntu0.1_i386.deb
Size/MD5: 108184 61858ff497b9a22271c987d2b3f8e136

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/p/pygresql/python-pygresql-dbg_3.8.1-3ubuntu0.1_lpia.deb
Size/MD5: 145702 efb2a010093fd49ad4b2d459ba700109
http://ports.ubuntu.com/pool/main/p/pygresql/python-pygresql_3.8.1-3ubuntu0.1_lpia.deb
Size/MD5: 107998 5aa9a9f24cde01ed80e5cc7119fc3976

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/p/pygresql/python-pygresql-dbg_3.8.1-3ubuntu0.1_powerpc.deb
Size/MD5: 160822 8414c4daf91fac983e85f48af335fadb
http://ports.ubuntu.com/pool/main/p/pygresql/python-pygresql_3.8.1-3ubuntu0.1_powerpc.deb
Size/MD5: 114884 359b31a67439795c2cb2d9740c9be2a2

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/p/pygresql/python-pygresql-dbg_3.8.1-3ubuntu0.1_sparc.deb
Size/MD5: 138978 01cd4bc1d15a97e96c62177855a610f2
http://ports.ubuntu.com/pool/main/p/pygresql/python-pygresql_3.8.1-3ubuntu0.1_sparc.deb
Size/MD5: 108932 e4847eeeeed2e144e4f7c4efe147312e

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
Url : https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20091210/6de2810e/attachment-0001.pgp

------------------------------

Message: 2
Date: Thu, 10 Dec 2009 20:29:40 -0600
From: Jamie Strandboge <jamie@canonical.com>
Subject: [USN-871-1] KDE vulnerability
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Message-ID: <20091211022940.GM26756@severus.strandboge.com>
Content-Type: text/plain; charset="us-ascii"

===========================================================
Ubuntu Security Notice USN-871-1 December 11, 2009
kdelibs vulnerability
CVE-2009-0689
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 8.04 LTS
Ubuntu 8.10
Ubuntu 9.04
Ubuntu 9.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.04 LTS:
kdelibs4c2a 4:3.5.10-0ubuntu1~hardy1.5

Ubuntu 8.10:
kdelibs4c2a 4:3.5.10-0ubuntu6.4

Ubuntu 9.04:
kdelibs4c2a 4:3.5.10.dfsg.1-1ubuntu8.4

Ubuntu 9.10:
kdelibs4c2a 4:3.5.10.dfsg.1-2ubuntu7.2

After a standard system upgrade you need to restart your session to effect
the necessary changes.

Details follow:

A buffer overflow was found in the KDE libraries when converting a string
to a floating point number. If a user or application linked against kdelibs
were tricked into processing crafted input, an attacker could cause a
denial of service (via application crash) or possibly execute arbitrary
code with the privileges of the user invoking the program. (CVE-2009-0689)

It was discovered that the KDE libraries could use KHTML to process an
unknown MIME type. If a user or application linked against kdelibs were
tricked into opening a crafted file, an attacker could potentially trigger
XMLHTTPRequests to remote sites.

Updated packages for Ubuntu 8.04 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10-0ubuntu1~hardy1.5.diff.gz
Size/MD5: 1793748 3693849d1a4409e8c03f0fde6da39fa5
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10-0ubuntu1~hardy1.5.dsc
Size/MD5: 1729 0e528a7564f8d3404a3bcaa28538cb2e
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10.orig.tar.gz
Size/MD5: 18631467 5eeb6f132e386668a0395d4d426d495e

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs-data_3.5.10-0ubuntu1~hardy1.5_all.deb
Size/MD5: 7326504 bbc8884536fab2b5af1c3cdb15abc148
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs4-doc_3.5.10-0ubuntu1~hardy1.5_all.deb
Size/MD5: 25454866 2d1266776d28be0be2a314539f3ee38e
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10-0ubuntu1~hardy1.5_all.deb
Size/MD5: 9328 bde1f5045141764729947822eb7749f7

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs-dbg_3.5.10-0ubuntu1~hardy1.5_amd64.deb
Size/MD5: 26758230 0ef2dcb722666b05bbe26b550160c22f
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs4-dev_3.5.10-0ubuntu1~hardy1.5_amd64.deb
Size/MD5: 1381590 774d2cd314be51e30660b84ac5565483
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs4c2a_3.5.10-0ubuntu1~hardy1.5_amd64.deb
Size/MD5: 10657036 02cf55ef3d63c2789dcfcf351f3fe787

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs-dbg_3.5.10-0ubuntu1~hardy1.5_i386.deb
Size/MD5: 25992402 cc525f04d9032e40c9d7f41503cad38f
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs4-dev_3.5.10-0ubuntu1~hardy1.5_i386.deb
Size/MD5: 1411164 e01ab41b8e22e5f012055b6dfc8f9b19
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs4c2a_3.5.10-0ubuntu1~hardy1.5_i386.deb
Size/MD5: 9615022 b31148854fde22f5f588920fb7266e55

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs-dbg_3.5.10-0ubuntu1~hardy1.5_lpia.deb
Size/MD5: 25971380 581ef5985071d294f3663ebc4943ca8a
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4-dev_3.5.10-0ubuntu1~hardy1.5_lpia.deb
Size/MD5: 1375934 5a64f795039d022fa270e2b9db4ddb16
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4c2a_3.5.10-0ubuntu1~hardy1.5_lpia.deb
Size/MD5: 9642908 1d5304980f9eb82c9972d96eb2bc27a1

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs-dbg_3.5.10-0ubuntu1~hardy1.5_powerpc.deb
Size/MD5: 27656998 81cc9e5a1758604597aac298701d86c0
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4-dev_3.5.10-0ubuntu1~hardy1.5_powerpc.deb
Size/MD5: 1393476 7bceb13671cc7b26d66ce06c281f2cbe
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4c2a_3.5.10-0ubuntu1~hardy1.5_powerpc.deb
Size/MD5: 10453790 2303cad503f7bd4f395be4cceee697f5

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs-dbg_3.5.10-0ubuntu1~hardy1.5_sparc.deb
Size/MD5: 25025950 28bb225b11e2e9b312d0f47beddcca90
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4-dev_3.5.10-0ubuntu1~hardy1.5_sparc.deb
Size/MD5: 1376534 c874a22da1260dcc046a68d7c8bbef82
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4c2a_3.5.10-0ubuntu1~hardy1.5_sparc.deb
Size/MD5: 9596634 a697b75916b628d1547ca9e562712b7e

Updated packages for Ubuntu 8.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10-0ubuntu6.4.diff.gz
Size/MD5: 726583 2bae45140ba24ccfe427d1000d2cb937
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10-0ubuntu6.4.dsc
Size/MD5: 2284 cd10eb858af120c2420b6045e0db2663
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10.orig.tar.gz
Size/MD5: 18631467 5eeb6f132e386668a0395d4d426d495e

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs-data_3.5.10-0ubuntu6.4_all.deb
Size/MD5: 7321288 0ef5e6ac303bd55dbc1a62ef5b12154f
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs4-doc_3.5.10-0ubuntu6.4_all.deb
Size/MD5: 25523888 0df6ca0a7ae1e6cc761f60f190716592
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10-0ubuntu6.4_all.deb
Size/MD5: 2272 0648e9f4672cff0f6b1a2bde0929b8a6

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs-dbg_3.5.10-0ubuntu6.4_amd64.deb
Size/MD5: 27375756 7464f9546f17461652d67b1b751ef962
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs4-dev_3.5.10-0ubuntu6.4_amd64.deb
Size/MD5: 1371454 ef8f62dcdf6d6dbb6eaae0447d8cec41
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs4c2a_3.5.10-0ubuntu6.4_amd64.deb
Size/MD5: 10930426 168e4c76f3804807b73a3f7c4eee432a

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs-dbg_3.5.10-0ubuntu6.4_i386.deb
Size/MD5: 26665714 0e89f87ee569198c85ea7343892e2cb1
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs4-dev_3.5.10-0ubuntu6.4_i386.deb
Size/MD5: 1405518 3422db629fbcc2f431610f9cdfc56598
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs4c2a_3.5.10-0ubuntu6.4_i386.deb
Size/MD5: 10143624 6d58c8fb72e17a0c5c2d12849e7d97d8

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs-dbg_3.5.10-0ubuntu6.4_lpia.deb
Size/MD5: 26675144 f5e947abceb595d9b8b6077468b4f11f
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4-dev_3.5.10-0ubuntu6.4_lpia.deb
Size/MD5: 1368234 719a1f05b6f3af1a5cedf2caaa4849f0
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4c2a_3.5.10-0ubuntu6.4_lpia.deb
Size/MD5: 10141624 c1410ee0b8dd09532a0d444a09d30bf0

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs-dbg_3.5.10-0ubuntu6.4_powerpc.deb
Size/MD5: 28218158 76503bc8d7c7c8e57b7288a6bd91f9c8
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4-dev_3.5.10-0ubuntu6.4_powerpc.deb
Size/MD5: 1380874 9a11e892f2c0027c245254844e0a915c
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4c2a_3.5.10-0ubuntu6.4_powerpc.deb
Size/MD5: 10749232 c366111b06394b4a869e56a5200a88be

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs-dbg_3.5.10-0ubuntu6.4_sparc.deb
Size/MD5: 25441392 307c87143d2a6a11ece50acc5b40291e
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4-dev_3.5.10-0ubuntu6.4_sparc.deb
Size/MD5: 1368498 6152dbe3fc1c231b7390d8e00e79fd4a
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4c2a_3.5.10-0ubuntu6.4_sparc.deb
Size/MD5: 9801840 d8e14b90ff8453d49504d9cfcef41280

Updated packages for Ubuntu 9.04:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10.dfsg.1-1ubuntu8.4.diff.gz
Size/MD5: 730213 b24ca20a24db817de9901c61f70e90b3
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10.dfsg.1-1ubuntu8.4.dsc
Size/MD5: 2342 ccc0ee94d16a854ef9d6930abb8379d5
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10.dfsg.1.orig.tar.gz
Size/MD5: 18639393 4bcfee29b0f939415791f5032a72e7b0

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs-data_3.5.10.dfsg.1-1ubuntu8.4_all.deb
Size/MD5: 6752210 11c8744d3bb2ca49bf0aad89092e926e
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10.dfsg.1-1ubuntu8.4_all.deb
Size/MD5: 2270 110eef16875f571661c553d295ffc7e5

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs-dbg_3.5.10.dfsg.1-1ubuntu8.4_amd64.deb
Size/MD5: 27110360 f91c2909a3c32e4c8b6ff7ec5f762788
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs4-dev_3.5.10.dfsg.1-1ubuntu8.4_amd64.deb
Size/MD5: 1360062 cb7e2ede68c5fa431ff6b3213f0d6c64
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs4c2a_3.5.10.dfsg.1-1ubuntu8.4_amd64.deb
Size/MD5: 10783134 25f15bf8d2957c6e4b59fa36aab7f9e2

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs-dbg_3.5.10.dfsg.1-1ubuntu8.4_i386.deb
Size/MD5: 26383054 9d18f9c1a6c38b95334483cb107c157f
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs4-dev_3.5.10.dfsg.1-1ubuntu8.4_i386.deb
Size/MD5: 1395328 cf787836d0618dc9ece201e145f6c629
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs4c2a_3.5.10.dfsg.1-1ubuntu8.4_i386.deb
Size/MD5: 10006430 74959eea23ce24afef3241d43b2d2118

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs-dbg_3.5.10.dfsg.1-1ubuntu8.4_lpia.deb
Size/MD5: 26385634 308c2ca36d90433724e1f4046089c00b
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4-dev_3.5.10.dfsg.1-1ubuntu8.4_lpia.deb
Size/MD5: 1356866 32ad3654f7ff480e661b1706252eeb4b
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4c2a_3.5.10.dfsg.1-1ubuntu8.4_lpia.deb
Size/MD5: 10020864 cfea875c3e64396258bb94a81f1bb9dd

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs-dbg_3.5.10.dfsg.1-1ubuntu8.4_powerpc.deb
Size/MD5: 27928798 264933dc950a1c7de4a8a27d14a7e655
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4-dev_3.5.10.dfsg.1-1ubuntu8.4_powerpc.deb
Size/MD5: 1369318 b034946f6860d913ef05429cecefa4e4
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4c2a_3.5.10.dfsg.1-1ubuntu8.4_powerpc.deb
Size/MD5: 10612072 3191cd83b4d762f1c1069f8e51bd082b

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs-dbg_3.5.10.dfsg.1-1ubuntu8.4_sparc.deb
Size/MD5: 25158852 e1db11cf38658b133ab5e16241ee5d56
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4-dev_3.5.10.dfsg.1-1ubuntu8.4_sparc.deb
Size/MD5: 1356962 a7d5a18a02eec881f81bf6feb2a30554
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4c2a_3.5.10.dfsg.1-1ubuntu8.4_sparc.deb
Size/MD5: 9663708 c2780bac10865f58b53d41b3eb2eccf1

Updated packages for Ubuntu 9.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10.dfsg.1-2ubuntu7.2.diff.gz
Size/MD5: 886928 afddbeaeb9d7dd1b8805202629df7a3e
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10.dfsg.1-2ubuntu7.2.dsc
Size/MD5: 2342 3b49bfd2ffc8ab9e1240e08eafa47f1a
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10.dfsg.1.orig.tar.gz
Size/MD5: 18639393 4bcfee29b0f939415791f5032a72e7b0

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs-data_3.5.10.dfsg.1-2ubuntu7.2_all.deb
Size/MD5: 6674924 c19977e54488daad70814a047fee31bc
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs_3.5.10.dfsg.1-2ubuntu7.2_all.deb
Size/MD5: 2276 1679879f18cb57114249a5c7a6a57785

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs-dbg_3.5.10.dfsg.1-2ubuntu7.2_amd64.deb
Size/MD5: 26714644 de3e7b175853c728cb3265bae249e068
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs4-dev_3.5.10.dfsg.1-2ubuntu7.2_amd64.deb
Size/MD5: 1361224 8674d009a291bc7dc091f895462abcb6
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs4c2a_3.5.10.dfsg.1-2ubuntu7.2_amd64.deb
Size/MD5: 10869100 b5c3d047f60f339718b0be98105aaedc

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs-dbg_3.5.10.dfsg.1-2ubuntu7.2_i386.deb
Size/MD5: 26410466 6d89bd2826e44581aaaa697c1f212ef5
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs4-dev_3.5.10.dfsg.1-2ubuntu7.2_i386.deb
Size/MD5: 1398050 99a1a41ba7c4fcc0283f4556bb182d67
http://security.ubuntu.com/ubuntu/pool/main/k/kdelibs/kdelibs4c2a_3.5.10.dfsg.1-2ubuntu7.2_i386.deb
Size/MD5: 9948900 3074338fe0cf50e7314020e693ffdd3b

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs-dbg_3.5.10.dfsg.1-2ubuntu7.2_lpia.deb
Size/MD5: 26418164 1d671311fe4a96c27148374781b80d15
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4-dev_3.5.10.dfsg.1-2ubuntu7.2_lpia.deb
Size/MD5: 1359634 8ff78351a0e470adc7ab2b61f307f999
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4c2a_3.5.10.dfsg.1-2ubuntu7.2_lpia.deb
Size/MD5: 10020080 3b84bcd0e1f7e8273244b218f911206a

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs-dbg_3.5.10.dfsg.1-2ubuntu7.2_powerpc.deb
Size/MD5: 28194764 807f3facbd2458c480544c3a54ca6def
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4-dev_3.5.10.dfsg.1-2ubuntu7.2_powerpc.deb
Size/MD5: 1360902 348faaa6840e245d05ba1c6c75b872e4
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4c2a_3.5.10.dfsg.1-2ubuntu7.2_powerpc.deb
Size/MD5: 10386026 039018f17303abd138e68ae6c343054a

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs-dbg_3.5.10.dfsg.1-2ubuntu7.2_sparc.deb
Size/MD5: 25012234 381d91aef4d5c73a2c3c3f221ed74d7c
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4-dev_3.5.10.dfsg.1-2ubuntu7.2_sparc.deb
Size/MD5: 1359422 755e788780d2216e16ee84a7c29ad170
http://ports.ubuntu.com/pool/main/k/kdelibs/kdelibs4c2a_3.5.10.dfsg.1-2ubuntu7.2_sparc.deb
Size/MD5: 9781308 ae75ebaca64dba4fd804509a75a86b7e

------------------------------

Message: 3
Date: Thu, 10 Dec 2009 20:54:50 -0600
From: Jamie Strandboge <jamie@canonical.com>
Subject: [USN-871-2] KDE 4 vulnerabilities
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Message-ID: <20091211025450.GN26756@severus.strandboge.com>
Content-Type: text/plain; charset="us-ascii"

===========================================================
Ubuntu Security Notice USN-871-2 December 11, 2009
kde4libs vulnerabilities
https://launchpad.net/bugs/495301
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 8.10
Ubuntu 9.04
Ubuntu 9.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.10:
kdelibs5 4:4.1.4-0ubuntu1~intrepid1.5

Ubuntu 9.04:
kdelibs5 4:4.2.2-0ubuntu5.4

Ubuntu 9.10:
kdelibs5 4:4.3.2-0ubuntu7.2

After a standard system upgrade you need to restart your session to effect
the necessary changes.

Details follow:

USN-871-1 fixed vulnerabilities in KDE. This update provides the
corresponding updates for KDE 4.

This update also fixes a directory traversal flaw in KDE when processing
help:// URLs. This issue only affected Ubuntu 8.10.

Original advisory details:

Updated packages for Ubuntu 8.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kde4libs_4.1.4-0ubuntu1~intrepid1.5.diff.gz
Size/MD5: 95977 d9bc80da0287e4a27cb968420d892d4b
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kde4libs_4.1.4-0ubuntu1~intrepid1.5.dsc
Size/MD5: 2308 89059af41fd455cd8591eab8df0b8ce6
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kde4libs_4.1.4.orig.tar.gz
Size/MD5: 11190299 18264580c1d6d978a3049a13fda36f29

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5-data_4.1.4-0ubuntu1~intrepid1.5_all.deb
Size/MD5: 3110960 e0b7e12e3bebb6619a000970ea535e97
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5-doc_4.1.4-0ubuntu1~intrepid1.5_all.deb
Size/MD5: 69202 2d65a7f3af2064f0071fe7f41235c6df

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs-bin_4.1.4-0ubuntu1~intrepid1.5_amd64.deb
Size/MD5: 395822 33edd1260233852ffc6c5d13de54d32c
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5-dbg_4.1.4-0ubuntu1~intrepid1.5_amd64.deb
Size/MD5: 66056004 8bc845533fc9a3ab78b3dd17ea5c7a37
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5-dev_4.1.4-0ubuntu1~intrepid1.5_amd64.deb
Size/MD5: 1441140 ef9268b6681c6787d2dbb17924b58a79
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5_4.1.4-0ubuntu1~intrepid1.5_amd64.deb
Size/MD5: 10103862 f388998bf382659d49a9677679d67dcc

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs-bin_4.1.4-0ubuntu1~intrepid1.5_i386.deb
Size/MD5: 371990 a1835282af9ddb9229117d34c1bef931
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5-dbg_4.1.4-0ubuntu1~intrepid1.5_i386.deb
Size/MD5: 65218556 73c538baa8a8101fca781ccc66d124bf
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5-dev_4.1.4-0ubuntu1~intrepid1.5_i386.deb
Size/MD5: 1438690 6c5878c932b90f837183c7f496412f24
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5_4.1.4-0ubuntu1~intrepid1.5_i386.deb
Size/MD5: 9523396 d3e663ccdcc52a1dd7dda5efbc64cda7

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs-bin_4.1.4-0ubuntu1~intrepid1.5_lpia.deb
Size/MD5: 376790 97518d066616d2fbf6b89cfe75e6d117
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5-dbg_4.1.4-0ubuntu1~intrepid1.5_lpia.deb
Size/MD5: 65334088 1e2c5b4df8f5c91bbc4f92ebe7801375
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5-dev_4.1.4-0ubuntu1~intrepid1.5_lpia.deb
Size/MD5: 1441160 bf293d1061e06e79403863f55a33b9d4
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5_4.1.4-0ubuntu1~intrepid1.5_lpia.deb
Size/MD5: 9535686 3a180768df11832e5cef0405c7ace583

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs-bin_4.1.4-0ubuntu1~intrepid1.5_powerpc.deb
Size/MD5: 423238 bd3e80909eda46558e4b276739973fc9
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5-dbg_4.1.4-0ubuntu1~intrepid1.5_powerpc.deb
Size/MD5: 69280176 c9775805d6a90568449e5df0055c8d68
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5-dev_4.1.4-0ubuntu1~intrepid1.5_powerpc.deb
Size/MD5: 1446080 7f9a904fd5e138a90ebb24ec9762c0cf
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5_4.1.4-0ubuntu1~intrepid1.5_powerpc.deb
Size/MD5: 10238640 2ca68c998ef5001b56599eeead4285bf

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs-bin_4.1.4-0ubuntu1~intrepid1.5_sparc.deb
Size/MD5: 381628 e4c66e47382390f9b18e7fc8a2d70fc2
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5-dbg_4.1.4-0ubuntu1~intrepid1.5_sparc.deb
Size/MD5: 64525262 3e892b50f4eee4cb61eefda24e7a9612
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5-dev_4.1.4-0ubuntu1~intrepid1.5_sparc.deb
Size/MD5: 1438444 3b02a43b55ee9c18921cf4dd704ba8cd
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5_4.1.4-0ubuntu1~intrepid1.5_sparc.deb
Size/MD5: 9653902 f9bd9be7d0c97c9fc492eb271d78a2b6

Updated packages for Ubuntu 9.04:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kde4libs_4.2.2-0ubuntu5.4.diff.gz
Size/MD5: 104020 32d0f05b8444a746a0edd41349c160c2
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kde4libs_4.2.2-0ubuntu5.4.dsc
Size/MD5: 2305 ec9eb15c47913f5ec148ffddca904315
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kde4libs_4.2.2.orig.tar.gz
Size/MD5: 12335659 83d6a0d59e79873bbe0a5a90ef23f27e

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5-data_4.2.2-0ubuntu5.4_all.deb
Size/MD5: 1989926 dd442e1cf759169409634e0a55f7bbe8

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs-bin_4.2.2-0ubuntu5.4_amd64.deb
Size/MD5: 281654 85c7bf34df6d9129f5c295e05adae9a4
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5-dbg_4.2.2-0ubuntu5.4_amd64.deb
Size/MD5: 44154854 ee9068a0c87001d9ec9d3d90ca2ca3da
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5-dev_4.2.2-0ubuntu5.4_amd64.deb
Size/MD5: 1091202 c1430eb8a84e68e5034c0d97f3ec51f4
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5_4.2.2-0ubuntu5.4_amd64.deb
Size/MD5: 7071844 e1ca3960e074100bf58fd89654103ee5
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/libplasma-dev_4.2.2-0ubuntu5.4_amd64.deb
Size/MD5: 102524 2bbebb2f95726d931579aca0739a62c6
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/libplasma3_4.2.2-0ubuntu5.4_amd64.deb
Size/MD5: 610934 8b5c132c776faf2a029f34c4b30cd656

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs-bin_4.2.2-0ubuntu5.4_i386.deb
Size/MD5: 269104 c4612880c098d4647d13926496adefb9
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5-dbg_4.2.2-0ubuntu5.4_i386.deb
Size/MD5: 43460726 c7f1491f2fcf451564a2312069dbde92
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5-dev_4.2.2-0ubuntu5.4_i386.deb
Size/MD5: 1090342 e56a2b8b8daeee653f55baa14be73284
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5_4.2.2-0ubuntu5.4_i386.deb
Size/MD5: 6778280 07b3fa6ce24c085424d102eda7261969
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/libplasma-dev_4.2.2-0ubuntu5.4_i386.deb
Size/MD5: 127322 4ebcee74931d57bcb56b05fc270fde3d
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/libplasma3_4.2.2-0ubuntu5.4_i386.deb
Size/MD5: 567162 9f72ead2cee64f5a3de3917792ab4c0f

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs-bin_4.2.2-0ubuntu5.4_lpia.deb
Size/MD5: 275580 1d5da4de19d017fcfa79a4056c17ae01
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5-dbg_4.2.2-0ubuntu5.4_lpia.deb
Size/MD5: 43587848 e94aed2b623e0463ef192e3ff19d6d44
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5-dev_4.2.2-0ubuntu5.4_lpia.deb
Size/MD5: 1092682 d040dc4b0718f148dfc93d81a6ef1454
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5_4.2.2-0ubuntu5.4_lpia.deb
Size/MD5: 6850706 8f0adbd06a0847da5a2d15cfad4c257c
http://ports.ubuntu.com/pool/main/k/kde4libs/libplasma-dev_4.2.2-0ubuntu5.4_lpia.deb
Size/MD5: 102486 239d38e7ee3443c3fdfaff5db8ae2eb9
http://ports.ubuntu.com/pool/main/k/kde4libs/libplasma3_4.2.2-0ubuntu5.4_lpia.deb
Size/MD5: 600146 89db6cb42b9c9a2a43a214205173467c

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs-bin_4.2.2-0ubuntu5.4_powerpc.deb
Size/MD5: 269884 2d1ab31ad761746d55b508fdf9020b03
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5-dbg_4.2.2-0ubuntu5.4_powerpc.deb
Size/MD5: 43126080 4e40874d089491ab0ad0a6f78dd6fd4d
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5-dev_4.2.2-0ubuntu5.4_powerpc.deb
Size/MD5: 1089852 50f1e895cf308de02e736bbf4ade19c1
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5_4.2.2-0ubuntu5.4_powerpc.deb
Size/MD5: 6203800 ccee8ec8a8c1da20a3fc50870d454b61
http://ports.ubuntu.com/pool/main/k/kde4libs/libplasma-dev_4.2.2-0ubuntu5.4_powerpc.deb
Size/MD5: 102474 69bde557a52136bbc666fc39550030b5
http://ports.ubuntu.com/pool/main/k/kde4libs/libplasma3_4.2.2-0ubuntu5.4_powerpc.deb
Size/MD5: 555434 4253e3224b0eddab9fd85357b8771756

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs-bin_4.2.2-0ubuntu5.4_sparc.deb
Size/MD5: 250250 7eb83ed7165eb32e59cdd191046c39df
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5-dbg_4.2.2-0ubuntu5.4_sparc.deb
Size/MD5: 40333438 5dc7af31143fceabcbf3d49929aed2e4
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5-dev_4.2.2-0ubuntu5.4_sparc.deb
Size/MD5: 1086248 3cd8c1c642149f35a6b04804664b5e1f
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5_4.2.2-0ubuntu5.4_sparc.deb
Size/MD5: 5932388 5a59b3b9df837d93f5ae3ddd59870631
http://ports.ubuntu.com/pool/main/k/kde4libs/libplasma-dev_4.2.2-0ubuntu5.4_sparc.deb
Size/MD5: 102446 2d843ca6ed093eb1641e7e2f5f421ffe
http://ports.ubuntu.com/pool/main/k/kde4libs/libplasma3_4.2.2-0ubuntu5.4_sparc.deb
Size/MD5: 530794 b0b5583c144ed90a855ac9a0b6643f74

Updated packages for Ubuntu 9.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kde4libs_4.3.2-0ubuntu7.2.diff.gz
Size/MD5: 160839 c594eccef7c8ceabff20a8b5bb8da6b0
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kde4libs_4.3.2-0ubuntu7.2.dsc
Size/MD5: 2301 7e7ce51359cf82ec23188479bd81f34f
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kde4libs_4.3.2.orig.tar.gz
Size/MD5: 12961029 076c304e8829229e1f1a5ef8eecda34d

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5-data_4.3.2-0ubuntu7.2_all.deb
Size/MD5: 2501328 635e74cea648a785eaca9d5ac7b7a8bf

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs-bin_4.3.2-0ubuntu7.2_amd64.deb
Size/MD5: 236080 ee88e1d5afe4da918c8e362b263ca355
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5-dbg_4.3.2-0ubuntu7.2_amd64.deb
Size/MD5: 47641692 4502ce2a9d687622a6fe0bfef406f1c6
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5-dev_4.3.2-0ubuntu7.2_amd64.deb
Size/MD5: 1162282 63050bae7403fb0ba6b7e34d686ecac7
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5_4.3.2-0ubuntu7.2_amd64.deb
Size/MD5: 7276964 d901a84198c938147eb97e364c8a4e7c
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/libplasma3_4.3.2-0ubuntu7.2_amd64.deb
Size/MD5: 657864 1a124d132ca09637458657de0f61a68f

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs-bin_4.3.2-0ubuntu7.2_i386.deb
Size/MD5: 227420 bb3a9991d63988035414bdb8d2d195db
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5-dbg_4.3.2-0ubuntu7.2_i386.deb
Size/MD5: 47142396 6950b2c99d61bfa71599020eb223aba7
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5-dev_4.3.2-0ubuntu7.2_i386.deb
Size/MD5: 1161550 829a35f9f7637176d9a4a74923d27cdb
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/kdelibs5_4.3.2-0ubuntu7.2_i386.deb
Size/MD5: 7019572 3c4af34e1fc523ace73a2aa7a53048ef
http://security.ubuntu.com/ubuntu/pool/main/k/kde4libs/libplasma3_4.3.2-0ubuntu7.2_i386.deb
Size/MD5: 608938 2b44f507a4ba29aa8d8de059d2674921

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs-bin_4.3.2-0ubuntu7.2_lpia.deb
Size/MD5: 234518 6edda7121cb4e64320eccfbf0ee37d79
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5-dbg_4.3.2-0ubuntu7.2_lpia.deb
Size/MD5: 47232510 0fedbdd6ec510ac83e9fb6cc59f5293a
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5-dev_4.3.2-0ubuntu7.2_lpia.deb
Size/MD5: 1163720 66d8939b2a848dd113390438996d31c5
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5_4.3.2-0ubuntu7.2_lpia.deb
Size/MD5: 7163048 0f84dc555132acf0d40f8310a7260c8c
http://ports.ubuntu.com/pool/main/k/kde4libs/libplasma3_4.3.2-0ubuntu7.2_lpia.deb
Size/MD5: 653692 bed649a879d2a387406f91284c27dc94

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs-bin_4.3.2-0ubuntu7.2_powerpc.deb
Size/MD5: 217718 2951df67e37de8dff2380eab9e946b0d
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5-dbg_4.3.2-0ubuntu7.2_powerpc.deb
Size/MD5: 47000996 1eabf7a08da76c26a4981fdb2b039007
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5-dev_4.3.2-0ubuntu7.2_powerpc.deb
Size/MD5: 1158764 96a4bdf2699880369d39b8f12fefeb5c
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5_4.3.2-0ubuntu7.2_powerpc.deb
Size/MD5: 6387572 fea74e2bbe2137a7bed4938649612bca
http://ports.ubuntu.com/pool/main/k/kde4libs/libplasma3_4.3.2-0ubuntu7.2_powerpc.deb
Size/MD5: 599074 193adda0adb27083c3643568bb560ea4

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs-bin_4.3.2-0ubuntu7.2_sparc.deb
Size/MD5: 217164 8a2cc000d2afa3daf4745cc9710c1391
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5-dbg_4.3.2-0ubuntu7.2_sparc.deb
Size/MD5: 43663358 d58f044f914a89c78f5388e70fdc856c
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5-dev_4.3.2-0ubuntu7.2_sparc.deb
Size/MD5: 1157850 acaef9c86335bedc7133860129de2579
http://ports.ubuntu.com/pool/main/k/kde4libs/kdelibs5_4.3.2-0ubuntu7.2_sparc.deb
Size/MD5: 6202126 4b1d5c0a92b9a2ab8368d4f649d80bb0
http://ports.ubuntu.com/pool/main/k/kde4libs/libplasma3_4.3.2-0ubuntu7.2_sparc.deb
Size/MD5: 572642 48ab7fa1e805f94334adcf212f86c6f6

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

End of ubuntu-security-announce Digest, Vol 63, Issue 5
*******************************************************

ubuntu-security-announce Digest, Vol 63, Issue 4

2009-12-09T18:47:00.000-08:00

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."

Today's Topics:

1. [USN-869-1] Linux kernel vulnerabilities (Kees Cook)

----------------------------------------------------------------------

Message: 1
Date: Wed, 9 Dec 2009 17:09:03 -0800
From: Kees Cook <kees@ubuntu.com>
Subject: [USN-869-1] Linux kernel vulnerabilities
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Message-ID: <20091210010903.GQ6207@outflux.net>
Content-Type: text/plain; charset="us-ascii"

===========================================================
Ubuntu Security Notice USN-869-1 December 10, 2009
linux vulnerability
CVE-2009-1298, CVE-2009-4131
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 9.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
linux-image-2.6.31-16-386 2.6.31-16.53
linux-image-2.6.31-16-generic 2.6.31-16.53
linux-image-2.6.31-16-generic-pae 2.6.31-16.53
linux-image-2.6.31-16-ia64 2.6.31-16.53
linux-image-2.6.31-16-lpia 2.6.31-16.53
linux-image-2.6.31-16-powerpc 2.6.31-16.53
linux-image-2.6.31-16-powerpc-smp 2.6.31-16.53
linux-image-2.6.31-16-powerpc64-smp 2.6.31-16.53
linux-image-2.6.31-16-server 2.6.31-16.53
linux-image-2.6.31-16-sparc64 2.6.31-16.53
linux-image-2.6.31-16-sparc64-smp 2.6.31-16.53
linux-image-2.6.31-16-virtual 2.6.31-16.53

After a standard system upgrade you need to reboot your computer to
effect the necessary changes.

Details follow:

David Ford discovered that the IPv4 defragmentation routine did not
correctly handle oversized packets. A remote attacker could send
specially crafted traffic that would cause a system to crash, leading
to a denial of service. (The fix was included in the earlier kernels
from USN-864-1.) (CVE-2009-1298)

Akira Fujita discovered that the Ext4 "move extents" ioctl did not
correctly check permissions. A local attacker could exploit this to
overwrite arbitrary files on the system, leading to root privilege
escalation. (CVE-2009-4131)

Updated packages for Ubuntu 9.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/l/linux/linux_2.6.31-16.53.diff.gz
Size/MD5: 2759717 46bb1e1c70f8cd4b8a426f36145b96b3
http://security.ubuntu.com/ubuntu/pool/main/l/linux/linux_2.6.31-16.53.dsc
Size/MD5: 3781 ba87d38489ec61b8f83824717d524fec
http://security.ubuntu.com/ubuntu/pool/main/l/linux/linux_2.6.31.orig.tar.gz
Size/MD5: 78278595 16c0355d3612806ef87addf7c9f8c9f9

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/l/linux/linux-doc_2.6.31-16.53_all.deb
Size/MD5: 3788070 2066149ef4cf1eb56029b0b474f8dc1f
http://security.ubuntu.com/ubuntu/pool/main/l/linux/linux-headers-2.6.31-16_2.6.31-16.53_all.deb
Size/MD5: 9527628 a98981b3a5da26fe246fdf35a2119b7e
http://security.ubuntu.com/ubuntu/pool/main/l/linux/linux-source-2.6.31_2.6.31-16.53_all.deb
Size/MD5: 62153736 e31831df66d0fcd0b78a3ce4d3fe2400

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

i386 architecture (x86 compatible Intel/AMD):

lpia architecture (Low Power Intel Architecture):

powerpc architecture (Apple Macintosh G3/G4/G5):

sparc architecture (Sun SPARC/UltraSPARC):

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 235 bytes
Desc: Digital signature
Url : https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20091209/4ecfe8b7/attachment.pgp

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

End of ubuntu-security-announce Digest, Vol 63, Issue 4
*******************************************************

ubuntu-security-announce Digest, Vol 63, Issue 3

2009-12-08T16:47:00.000-08:00

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."

Today's Topics:

1. [USN-866-1] gnome-screensaver vulnerability (Marc Deslauriers)
2. [USN-867-1] Ntp vulnerability (Jamie Strandboge)
3. [USN-868-1] GRUB 2 vulnerability (Jamie Strandboge)

----------------------------------------------------------------------

Message: 1
Date: Mon, 07 Dec 2009 16:23:17 -0500
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Subject: [USN-866-1] gnome-screensaver vulnerability
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Message-ID: <1260220997.3803.37.camel@mdlinux.technorage.com>
Content-Type: text/plain; charset="utf-8"

===========================================================
Ubuntu Security Notice USN-866-1 December 07, 2009
gnome-screensaver vulnerability
https://launchpad.net/bugs/411350
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 9.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
gnome-screensaver 2.28.0-0ubuntu3.1

After a standard system upgrade you need to restart your session to effect
the necessary changes.

Details follow:

It was discovered that gnome-screensaver did not always re-enable itself
after applications requested it to ignore idle timers. This may result in the
screen not being automatically locked after the inactivity timeout is
reached, permitting an attacker with physical access to gain access to an
unlocked session.

Updated packages for Ubuntu 9.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/g/gnome-screensaver/gnome-screensaver_2.28.0-0ubuntu3.1.diff.gz
Size/MD5: 13327 f2c77fbb875fa28d1c44d39936232927
http://security.ubuntu.com/ubuntu/pool/main/g/gnome-screensaver/gnome-screensaver_2.28.0-0ubuntu3.1.dsc
Size/MD5: 1756 cdcdd23a16e1d25d6940e5340f6eb760
http://security.ubuntu.com/ubuntu/pool/main/g/gnome-screensaver/gnome-screensaver_2.28.0.orig.tar.gz
Size/MD5: 5069053 cdf328a0443a3cc30b4b2b36d9a99236

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/g/gnome-screensaver/gnome-screensaver_2.28.0-0ubuntu3.1_amd64.deb
Size/MD5: 4185376 942a077f04675c8d27c5d55e826b039b

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/g/gnome-screensaver/gnome-screensaver_2.28.0-0ubuntu3.1_i386.deb
Size/MD5: 4168922 a3ca1ae6e3274795a0d2aff0a4b94a6f

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/g/gnome-screensaver/gnome-screensaver_2.28.0-0ubuntu3.1_lpia.deb
Size/MD5: 4169780 e9e90dfe93ebd18c13808e5f0bf83f4c

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/g/gnome-screensaver/gnome-screensaver_2.28.0-0ubuntu3.1_powerpc.deb
Size/MD5: 4179392 d0ae3da6337a4fb8b71dd0ef36f4692d

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/g/gnome-screensaver/gnome-screensaver_2.28.0-0ubuntu3.1_sparc.deb
Size/MD5: 4177782 ee55f5f5f3ac0e4867cd9e8c1bc450f6

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
Url : https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20091207/8c7c7516/attachment-0001.pgp

------------------------------

Message: 2
Date: Tue, 8 Dec 2009 16:29:02 -0600
From: Jamie Strandboge <jamie@canonical.com>
Subject: [USN-867-1] Ntp vulnerability
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Message-ID: <20091208222902.GE26756@severus.strandboge.com>
Content-Type: text/plain; charset="us-ascii"

===========================================================
Ubuntu Security Notice USN-867-1 December 08, 2009
ntp vulnerability
CVE-2009-3563
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 8.04 LTS
Ubuntu 8.10
Ubuntu 9.04
Ubuntu 9.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
ntp 1:4.2.0a+stable-8.1ubuntu6.3
ntp-server 1:4.2.0a+stable-8.1ubuntu6.3

Ubuntu 8.04 LTS:
ntp 1:4.2.4p4+dfsg-3ubuntu2.3

Ubuntu 8.10:
ntp 1:4.2.4p4+dfsg-6ubuntu2.4

Ubuntu 9.04:
ntp 1:4.2.4p4+dfsg-7ubuntu5.2

Ubuntu 9.10:
ntp 1:4.2.4p6+dfsg-1ubuntu5.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

Robin Park and Dmitri Vinokurov discovered a logic error in ntpd. A remote
attacker could send a crafted NTP mode 7 packet with a spoofed IP address
of an affected server and cause a denial of service via CPU and disk
resource consumption.

Updated packages for Ubuntu 6.06 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.0a+stable-8.1ubuntu6.3.diff.gz
Size/MD5: 262833 1fdb567debfe1ce10ffc44ec492d4aa5
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.0a+stable-8.1ubuntu6.3.dsc
Size/MD5: 872 a6f59fefbf4050684aa38de8b24c54b3
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.0a+stable.orig.tar.gz
Size/MD5: 2272395 30f8b3d5b970c14dce5c6d8c922afa3e

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp-doc_4.2.0a+stable-8.1ubuntu6.3_all.deb
Size/MD5: 891204 35969710cca05eabef8399e53de0bdb5

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp-server_4.2.0a+stable-8.1ubuntu6.3_amd64.deb
Size/MD5: 35022 cf299ac36cb52399b7b80a7aa6b00c77
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp-simple_4.2.0a+stable-8.1ubuntu6.3_amd64.deb
Size/MD5: 136402 14d2d9f6ec9a8f4edb2d674538b642a8
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.0a+stable-8.1ubuntu6.3_amd64.deb
Size/MD5: 270524 05dfaa4fdf895ebfdf61ee43d97ef9c6
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntpdate_4.2.0a+stable-8.1ubuntu6.3_amd64.deb
Size/MD5: 47932 ee2a72cdc8d20e545443bbcf086c6f82
http://security.ubuntu.com/ubuntu/pool/universe/n/ntp/ntp-refclock_4.2.0a+stable-8.1ubuntu6.3_amd64.deb
Size/MD5: 224268 d9daac981b2dd6d16d69d4bfc0f1d4bf

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp-server_4.2.0a+stable-8.1ubuntu6.3_i386.deb
Size/MD5: 33926 4a79ecdb4d1fa3d407fca23c00292a9d
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp-simple_4.2.0a+stable-8.1ubuntu6.3_i386.deb
Size/MD5: 121710 77db2cb6c9daa84d6174fbe277a96c44
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.0a+stable-8.1ubuntu6.3_i386.deb
Size/MD5: 256764 7aeb8e664a3ff16608fc880a108a8645
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntpdate_4.2.0a+stable-8.1ubuntu6.3_i386.deb
Size/MD5: 44598 1e3067b9f7fee43a3f0b18ec9d4b356b
http://security.ubuntu.com/ubuntu/pool/universe/n/ntp/ntp-refclock_4.2.0a+stable-8.1ubuntu6.3_i386.deb
Size/MD5: 198516 a0066ee286571189f7f6099bd8a2c220

powerpc architecture (Apple Macintosh G3/G4/G5):

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp-server_4.2.0a+stable-8.1ubuntu6.3_powerpc.deb
Size/MD5: 37162 3b19f883b00809d36ae9bd79114955c1
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp-simple_4.2.0a+stable-8.1ubuntu6.3_powerpc.deb
Size/MD5: 135184 d1419b2d9aff1392c78bab2911114c2a
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.0a+stable-8.1ubuntu6.3_powerpc.deb
Size/MD5: 271468 856ffca2e1d79bfd730aec3bcc1ce497
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntpdate_4.2.0a+stable-8.1ubuntu6.3_powerpc.deb
Size/MD5: 49266 2cee0d14d9d1deafb78b26041d1ed05a
http://security.ubuntu.com/ubuntu/pool/universe/n/ntp/ntp-refclock_4.2.0a+stable-8.1ubuntu6.3_powerpc.deb
Size/MD5: 222168 42ef5dfaddb9e1fe9b9933119cdbe9ab

sparc architecture (Sun SPARC/UltraSPARC):

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp-server_4.2.0a+stable-8.1ubuntu6.3_sparc.deb
Size/MD5: 34428 09539a35a435d11f12ed9f5bd9534771
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp-simple_4.2.0a+stable-8.1ubuntu6.3_sparc.deb
Size/MD5: 126814 8e2066b695d32e08355bfdc0f571c705
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.0a+stable-8.1ubuntu6.3_sparc.deb
Size/MD5: 261652 1e4142216eb7ff527ce1f59b2ad2d0af
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntpdate_4.2.0a+stable-8.1ubuntu6.3_sparc.deb
Size/MD5: 46790 7d456f67bea9e6c3f2452a5d6a847f67
http://security.ubuntu.com/ubuntu/pool/universe/n/ntp/ntp-refclock_4.2.0a+stable-8.1ubuntu6.3_sparc.deb
Size/MD5: 207566 433dca719ea61cca73b993a530299fae

Updated packages for Ubuntu 8.04 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p4+dfsg-3ubuntu2.3.diff.gz
Size/MD5: 287172 dfb60aa2cd60f61907856f5b50c8fc46
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p4+dfsg-3ubuntu2.3.dsc
Size/MD5: 1046 251a7ead6fcf835535176b89ed7cc3d4
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p4+dfsg.orig.tar.gz
Size/MD5: 2835029 dc2b3ac9cc04b0f29df35467514c9884

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp-doc_4.2.4p4+dfsg-3ubuntu2.3_all.deb
Size/MD5: 928116 28eb96c89717c9fdfe39b3f140428484

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p4+dfsg-3ubuntu2.3_amd64.deb
Size/MD5: 477388 bc91b335e5963954d4284d0b57b37c40
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntpdate_4.2.4p4+dfsg-3ubuntu2.3_amd64.deb
Size/MD5: 65194 185195f8e2df78f7dfbba5b88be482ce

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p4+dfsg-3ubuntu2.3_i386.deb
Size/MD5: 432592 0ec673d7b4507cb992091a7b63007826
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntpdate_4.2.4p4+dfsg-3ubuntu2.3_i386.deb
Size/MD5: 61224 fbf4533c390ea05b7149e370815983e1

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/n/ntp/ntp_4.2.4p4+dfsg-3ubuntu2.3_lpia.deb
Size/MD5: 435450 1be0d440cf6bcf5048139c856b85106b
http://ports.ubuntu.com/pool/main/n/ntp/ntpdate_4.2.4p4+dfsg-3ubuntu2.3_lpia.deb
Size/MD5: 61184 a1b2a4c34beee7210e322b2f05d94095

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/n/ntp/ntp_4.2.4p4+dfsg-3ubuntu2.3_powerpc.deb
Size/MD5: 490538 e6adb5a7bde67fc04b543664e6ef748f
http://ports.ubuntu.com/pool/main/n/ntp/ntpdate_4.2.4p4+dfsg-3ubuntu2.3_powerpc.deb
Size/MD5: 66780 35b709a20016e07b383362610ae2b45a

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/n/ntp/ntp_4.2.4p4+dfsg-3ubuntu2.3_sparc.deb
Size/MD5: 442346 212fc209067ce419756fa2d6f486fd33
http://ports.ubuntu.com/pool/main/n/ntp/ntpdate_4.2.4p4+dfsg-3ubuntu2.3_sparc.deb
Size/MD5: 61964 7937872f5231323d82c98f0ace751a79

Updated packages for Ubuntu 8.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p4+dfsg-6ubuntu2.4.diff.gz
Size/MD5: 305723 ea6556c8f4053f2abd79e4cf96633a65
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p4+dfsg-6ubuntu2.4.dsc
Size/MD5: 1555 fa669b54aac2751215e1fbac226bf51e
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p4+dfsg.orig.tar.gz
Size/MD5: 2835029 dc2b3ac9cc04b0f29df35467514c9884

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp-doc_4.2.4p4+dfsg-6ubuntu2.4_all.deb
Size/MD5: 928754 eaa802a30b795ce27417c0f8fd612564

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p4+dfsg-6ubuntu2.4_amd64.deb
Size/MD5: 487270 83aef0ae73d841ca98c1aff95b68b974
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntpdate_4.2.4p4+dfsg-6ubuntu2.4_amd64.deb
Size/MD5: 66118 b1d338d727c1fbb479a0298e67cf920c

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p4+dfsg-6ubuntu2.4_i386.deb
Size/MD5: 442316 9441f50fefcd831651417c8e66353769
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntpdate_4.2.4p4+dfsg-6ubuntu2.4_i386.deb
Size/MD5: 62320 67f26e8efd2233911b3ee5d5c779da52

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/n/ntp/ntp_4.2.4p4+dfsg-6ubuntu2.4_lpia.deb
Size/MD5: 441714 cc6ffa5cf9f82b707ebf77291c0c7c2b
http://ports.ubuntu.com/pool/main/n/ntp/ntpdate_4.2.4p4+dfsg-6ubuntu2.4_lpia.deb
Size/MD5: 62086 d4c4d6efa2ae6c85b400d73bd39cac8d

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/n/ntp/ntp_4.2.4p4+dfsg-6ubuntu2.4_powerpc.deb
Size/MD5: 491332 f4016ec402c0665df5241555af9a04ed
http://ports.ubuntu.com/pool/main/n/ntp/ntpdate_4.2.4p4+dfsg-6ubuntu2.4_powerpc.deb
Size/MD5: 67198 47c3dd10eae821a9d1abcf77a85d6651

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/n/ntp/ntp_4.2.4p4+dfsg-6ubuntu2.4_sparc.deb
Size/MD5: 449572 4a168bf44988c1da63a39bd14b17b682
http://ports.ubuntu.com/pool/main/n/ntp/ntpdate_4.2.4p4+dfsg-6ubuntu2.4_sparc.deb
Size/MD5: 62834 0ae1f43f7f327de4ab787c911f0fd1ca

Updated packages for Ubuntu 9.04:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p4+dfsg-7ubuntu5.2.diff.gz
Size/MD5: 306032 90b99d80d9e52e4db7e30b96002834b4
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p4+dfsg-7ubuntu5.2.dsc
Size/MD5: 1556 b6f57df7732c6fd3a29de6d4c65c421d
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p4+dfsg.orig.tar.gz
Size/MD5: 2835029 dc2b3ac9cc04b0f29df35467514c9884

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp-doc_4.2.4p4+dfsg-7ubuntu5.2_all.deb
Size/MD5: 929066 4230567b7ef012596cd5e291df13df76

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p4+dfsg-7ubuntu5.2_amd64.deb
Size/MD5: 487628 3789b894fe98014ed8b62fc910088d2a
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntpdate_4.2.4p4+dfsg-7ubuntu5.2_amd64.deb
Size/MD5: 66442 b43e6e46f0c035961fa2e382bd883fe2

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p4+dfsg-7ubuntu5.2_i386.deb
Size/MD5: 442634 efaf8cc0f84114fe6d426827f22e3db4
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntpdate_4.2.4p4+dfsg-7ubuntu5.2_i386.deb
Size/MD5: 62642 7c9ce030867f9809b49634bdcc2a57a3

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/n/ntp/ntp_4.2.4p4+dfsg-7ubuntu5.2_lpia.deb
Size/MD5: 442086 4dd3ea7d09c746a592b0b622f4fcb753
http://ports.ubuntu.com/pool/main/n/ntp/ntpdate_4.2.4p4+dfsg-7ubuntu5.2_lpia.deb
Size/MD5: 62410 77fa9c143489ea55da37adcd9f268e6b

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/n/ntp/ntp_4.2.4p4+dfsg-7ubuntu5.2_powerpc.deb
Size/MD5: 491526 d04d12ed5ebc7968a90894d92ca094c6
http://ports.ubuntu.com/pool/main/n/ntp/ntpdate_4.2.4p4+dfsg-7ubuntu5.2_powerpc.deb
Size/MD5: 67530 55cffc037f6a88b24abd399925e700c3

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/n/ntp/ntp_4.2.4p4+dfsg-7ubuntu5.2_sparc.deb
Size/MD5: 449666 7dbdc0aa05e90a9363dfcae003c3e531
http://ports.ubuntu.com/pool/main/n/ntp/ntpdate_4.2.4p4+dfsg-7ubuntu5.2_sparc.deb
Size/MD5: 63156 4647b041df35cabb86fb0789e3a083ce

Updated packages for Ubuntu 9.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p6+dfsg-1ubuntu5.1.diff.gz
Size/MD5: 344395 26dd6961151053346b36474a18d6412f
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p6+dfsg-1ubuntu5.1.dsc
Size/MD5: 1575 c86cc4fe026ee6830d6564cabeaedc61
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p6+dfsg.orig.tar.gz
Size/MD5: 2836728 bddc66cdc7c35c0cb22cc84cad770c65

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp-doc_4.2.4p6+dfsg-1ubuntu5.1_all.deb
Size/MD5: 931324 bcc11545b9399ca7e09268a85fd6eabf

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p6+dfsg-1ubuntu5.1_amd64.deb
Size/MD5: 529994 c766915925a1cccbd27332232a45e016
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntpdate_4.2.4p6+dfsg-1ubuntu5.1_amd64.deb
Size/MD5: 70098 968cdde0e47a775cf13b922c7f2308f5

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntp_4.2.4p6+dfsg-1ubuntu5.1_i386.deb
Size/MD5: 490892 83e3785020b3cb659b6559cb51632333
http://security.ubuntu.com/ubuntu/pool/main/n/ntp/ntpdate_4.2.4p6+dfsg-1ubuntu5.1_i386.deb
Size/MD5: 66770 34bd54ff829c032049dc8d7340984b4c

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/n/ntp/ntp_4.2.4p6+dfsg-1ubuntu5.1_lpia.deb
Size/MD5: 487552 f7ad919e64533aed59112c2fe5c49fd9
http://ports.ubuntu.com/pool/main/n/ntp/ntpdate_4.2.4p6+dfsg-1ubuntu5.1_lpia.deb
Size/MD5: 66316 4a2cd9cdf5cfa46ad3784c37f7c29502

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/n/ntp/ntp_4.2.4p6+dfsg-1ubuntu5.1_powerpc.deb
Size/MD5: 528880 401e4a455acdf2a14c5f556e8cae1911
http://ports.ubuntu.com/pool/main/n/ntp/ntpdate_4.2.4p6+dfsg-1ubuntu5.1_powerpc.deb
Size/MD5: 69390 9e0e3535fbe3ffe61be245ddd22e5d6c

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/n/ntp/ntp_4.2.4p6+dfsg-1ubuntu5.1_sparc.deb
Size/MD5: 499646 6059b8a5f9f216b8de00eed901af902e
http://ports.ubuntu.com/pool/main/n/ntp/ntpdate_4.2.4p6+dfsg-1ubuntu5.1_sparc.deb
Size/MD5: 67272 8d04c1e93ca4acd7a4eaac04008326b3

------------------------------

Message: 3
Date: Tue, 8 Dec 2009 18:47:32 -0600
From: Jamie Strandboge <jamie@canonical.com>
Subject: [USN-868-1] GRUB 2 vulnerability
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Message-ID: <20091209004732.GG26756@severus.strandboge.com>
Content-Type: text/plain; charset="us-ascii"

===========================================================
Ubuntu Security Notice USN-868-1 December 09, 2009
grub2 vulnerability
CVE-2009-4128
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 9.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
grub2 1.97~beta4-1ubuntu4.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Users who have upgraded from GRUB Legacy to GRUB 2 and are still using Grub
Legacy to chainload into GRUB 2, you will have to run the following command
(possibly adjusting 'hd0') to update GRUB 2's on disk core image:

$ sudo grub-install --no-floppy --grub-setup=/bin/true "(hd0)"

If you previously ran 'upgrade-from-grub-legacy', a standard system upgrade
is sufficient to effect the necessary changes.

Details follow:

It was discovered that GRUB 2 did not properly validate passwords. An
attacker with physical access could conduct a brute force attack and bypass
authentication by submitting a 1 character password.

Updated packages for Ubuntu 9.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/g/grub2/grub2_1.97~beta4-1ubuntu4.1.diff.gz
Size/MD5: 250341 94284059eefdd8b1a204142abedb645c
http://security.ubuntu.com/ubuntu/pool/main/g/grub2/grub2_1.97~beta4-1ubuntu4.1.dsc
Size/MD5: 1945 66af22931f8a965f49a26bc84c5fb9e2
http://security.ubuntu.com/ubuntu/pool/main/g/grub2/grub2_1.97~beta4.orig.tar.gz
Size/MD5: 1244094 78edf78a2cf4ee39d539ba0b82a6afed

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

i386 architecture (x86 compatible Intel/AMD):

lpia architecture (Low Power Intel Architecture):

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/g/grub2/grub-common_1.97~beta4-1ubuntu4.1_sparc.deb
Size/MD5: 1002148 66abb79f534f3d55e45c51859c618a06
http://ports.ubuntu.com/pool/universe/g/grub2/grub-emu_1.97~beta4-1ubuntu4.1_sparc.deb
Size/MD5: 332094 bacedc782f461faed75006715ee955e6
http://ports.ubuntu.com/pool/universe/g/grub2/grub-ieee1275_1.97~beta4-1ubuntu4.1_sparc.deb
Size/MD5: 334620 e37a7b515ea456152f714caf796de3c0
http://ports.ubuntu.com/pool/universe/g/grub2/grub2_1.97~beta4-1ubuntu4.1_sparc.deb
Size/MD5: 2620 331f84d64fbef94c1b6a97425009db0c

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

End of ubuntu-security-announce Digest, Vol 63, Issue 3
*******************************************************

ubuntu-security-announce Digest, Vol 63, Issue 2

2009-12-07T06:40:00.000-08:00

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."

Today's Topics:

1. [USN-865-1] Bind vulnerability (Marc Deslauriers)

----------------------------------------------------------------------

Message: 1
Date: Mon, 07 Dec 2009 09:39:49 -0500
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Subject: [USN-865-1] Bind vulnerability
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, "bugtraq@securityfocus.com"
<bugtraq@securityfocus.com>
Message-ID: <1260196789.3803.19.camel@mdlinux.technorage.com>
Content-Type: text/plain; charset="utf-8"

===========================================================
Ubuntu Security Notice USN-865-1 December 07, 2009
bind9 vulnerability
CVE-2009-4022
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 8.04 LTS
Ubuntu 8.10
Ubuntu 9.04
Ubuntu 9.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
libdns23 1:9.3.2-2ubuntu1.9

Ubuntu 8.04 LTS:
libdns36 1:9.4.2.dfsg.P2-2ubuntu0.4

Ubuntu 8.10:
libdns44 1:9.5.0.dfsg.P2-1ubuntu3.4

Ubuntu 9.04:
libdns46 1:9.5.1.dfsg.P2-1ubuntu0.3

Ubuntu 9.10:
libdns53 1:9.6.1.dfsg.P1-3ubuntu0.2

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

Michael Sinatra discovered that Bind did not correctly validate certain
records added to its cache. When DNSSEC validation is in use, a remote
attacker could exploit this to spoof DNS entries and poison DNS caches.
Among other things, this could lead to misdirected email and web traffic.

Updated packages for Ubuntu 6.06 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/b/bind9/bind9_9.3.2-2ubuntu1.9.diff.gz
Size/MD5: 107716 730ae2b522410ce9f626eba005274c43
http://security.ubuntu.com/ubuntu/pool/main/b/bind9/bind9_9.3.2-2ubuntu1.9.dsc
Size/MD5: 783 8d03dccc13984711f013d99347fbfd81
http://security.ubuntu.com/ubuntu/pool/main/b/bind9/bind9_9.3.2.orig.tar.gz
Size/MD5: 5302112 55e709501a7780233c36e25ccd15ece2

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/b/bind9/bind9-doc_9.3.2-2ubuntu1.9_all.deb
Size/MD5: 181134 620434575b50b094e25aedfe625f2b7e

amd64 architecture (Athlon64, Opteron, EM64T Xeon):