Flaws were discovered in Firefox which could lead to crashes during
JavaScript garbage collection. If a user were tricked into opening a
malicious web page, an attacker may be able to crash the browser or
possibly execute arbitrary code with the user's privileges.
(CVE-2008-1380)
Thilo Pfennig and Morten Welinder discovered that the XLS spreadsheet
handling code in Gnumeric did not correctly calculate needed memory sizes.
If a user or automated system were tricked into loading a specially crafted
XLS document, a remote attacker could execute arbitrary code with user
privileges.
It was discovered that the poppler PDF library did not correctly handle
certain malformed embedded fonts. If a user or an automated system were
tricked into opening a malicious PDF, a remote attacker could execute
arbitrary code with user privileges.
USN-603-1 fixed vulnerabilities in poppler. This update provides the
corresponding updates for KWord, part of KOffice.
Original advisory details:
It was discovered that the poppler PDF library did not correctly handle
certain malformed embedded fonts. If a user or an automated system were
tricked into opening a malicious PDF, a remote attacker could execute
arbitrary code with user privileges.
Sebastian Krahmer discovered that rsync could overflow when handling ACLs.
An attacker could construct a malicious set of files that when processed
by rsync could lead to arbitrary code execution or a crash.
Chris Evans discovered that Ghostscript contained a buffer overflow in
its color space handling code. If a user or automated system were
tricked into opening a crafted Postscript file, an attacker could cause
a denial of service or execute arbitrary code with privileges of the
user invoking the program. (CVE-2008-0411)
It was discovered that the CUPS administration interface contained a heap-based overflow flaw. A local attacker, and a remote attacker if printer
sharing is enabled, could send a malicious request and possibly execute
arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04.
In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile.
(CVE-2008-0047)
USN-588-1 fixed vulnerabilities in MySQL. In fixing CVE-2007-2692 for
Ubuntu 6.06, additional improvements were made to make privilege checks
more restictive. As a result, an upstream bug was exposed which could
cause operations on tables or views in a different database to fail. This
update fixes the problem.
Timo Juhani Lindfors discovered that the OpenSSH client, when port
forwarding was requested, would listen on any available address family.
A local attacker could exploit this flaw on systems with IPv6 enabled
to hijack connections, including X11 forwards.
Chris Clark discovered that Ruby's HTTPS module did not check for
commonName mismatches early enough during SSL negotiation. If a remote
attacker were able to perform man-in-the-middle attacks, this flaw could
be exploited to view sensitive information in HTTPS requests coming from
Ruby applications. (CVE-2007-5162)
It was discovered that the default configuration of dovecot could allow
access to any email files with group "mail" without verifying that a user
had valid rights. An attacker able to create symlinks in their mail
directory could exploit this to read or delete another user's email.
(CVE-2008-1199)
It was discovered that Net::DNS did not correctly validate the size
of DNS replies. A remote attacker could send a specially crafted DNS
response and cause applications using Net::DNS to abort, leading to a
denial of service.
Michael Skladnikiewicz discovered that SDL_image did not correctly load
GIF images. If a user or automated system were tricked into processing
a specially crafted GIF, a remote attacker could execute arbitrary code
or cause a crash, leading to a denial of service. (CVE-2007-6697)
David Raulo discovered that SDL_image did not correctly load ILBM images.
If a user or automated system were tricked into processing a specially
crafted ILBM, a remote attacker could execute arbitrary code or cause
a crash, leading to a denial of service. (CVE-2008-0544)
Alexey Proskuryakov, Yosuke Hasegawa and Simon Montagu discovered flaws
in Firefox's character encoding handling. If a user were tricked into
opening a malicious web page, an attacker could perform cross-site
scripting attacks. (CVE-2008-0416)
It was discovered that bzip2 did not correctly handle certain malformed
archives. If a user or automated system were tricked into processing
a specially crafted bzip2 archive, applications linked against libbz2
could be made to crash, possibly leading to a denial of service.
Will Drewry discovered that libicu did not properly handle '\0' when
processing regular expressions. If an application linked against libicu
processed a crafted regular expression, an attacker could execute
arbitrary code with privileges of the user invoking the program.
Tavis Ormandy discovered that unzip did not correctly clean up pointers.
If a user or automated service was tricked into processing a specially
crafted ZIP archive, a remote attacker could execute arbitrary code with
user privileges.
Masaaki Hirose discovered that MySQL could be made to dereference
a NULL pointer. An authenticated user could cause a denial of service
(application crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA
table. This issue only affects Ubuntu 6.06 and 6.10. (CVE-2006-7232)
Alexander Nozdrin discovered that MySQL did not restore database access
privileges when returning from SQL SECURITY INVOKER stored routines. An
authenticated user could exploit this to gain privileges. This issue
does not affect Ubuntu 7.10. (CVE-2007-2692)
It was discovered that krb5 did not correctly handle certain krb4
requests. An unauthenticated remote attacker could exploit this flaw
by sending a specially crafted traffic, which could expose sensitive
information, cause a crash, or execute arbitrary code. (CVE-2008-0062,
CVE-2008-0063)
Multiple cross-site scripting flaws were discovered in mailman.
A malicious list administrator could exploit this to execute arbitrary
JavaScript, potentially stealing user credentials.
