[Full-disclosure] [USN-212-1] libgda2 vulnerability

From: Martin Pitt (martin.pitt_at_canonical.com)
Date: 10/28/05

Next message: Martin Pitt: "[Full-disclosure] [USN-213-1] sudo vulnerability"

Previous message: Valdis Shkesters: "Re: [Full-disclosure] Re: Microsoft AntiSpyware falling furtherbehind"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Fri, 28 Oct 2005 15:38:04 -0400
To: ubuntu-security-announce@lists.ubuntu.com

===========================================================
Ubuntu Security Notice USN-212-1 October 28, 2005
libgda2 vulnerability
CAN-2005-2958
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)
Ubuntu 5.10 (Breezy Badger)

The following packages are affected:

libgda2-1
libgda2-3

The problem can be corrected by upgrading the affected package to
version 1.0.4-1ubuntu0.1 (for Ubuntu 4.10), 1.1.99-1ubuntu0.1 (for
Ubuntu 5.04), or 1.2.1-2ubuntu3.1 (for Ubuntu 5.10). In general, a
standard system upgrade is sufficient to effect the necessary changes.

Details follow:

Steve Kemp discovered two format string vulnerabilities in the logging
handler of the Gnome database access library. Depending on the
application that uses the library, this could have been exploited to
execute arbitrary code with the permission of the user running the
application.

Updated packages for Ubuntu 4.10:

Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/libg/libgda2/libgda2_1.0.4-1ubuntu0.1.diff.gz
      Size/MD5: 14829 ba4ce8b304539a61ab575d932711070f
    http://security.ubuntu.com/ubuntu/pool/main/libg/libgda2/libgda2_1.0.4-1ubuntu0.1.dsc
      Size/MD5: 1961 c6eaf76b68cd4ea8f436a62f2dab101b
    http://security.ubuntu.com/ubuntu/pool/main/libg/libgda2/libgda2_1.0.4.orig.tar.gz
      Size/MD5: 1778950 345980ba52dcc1a4d24092e57869f92c

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/libg/libgda2/libgda2-doc_1.0.4-1ubuntu0.1_all.deb
Size/MD5: 212224 354ca028706f54fa53ad89b93fbad5ed

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

i386 architecture (x86 compatible Intel/AMD)

powerpc architecture (Apple Macintosh G3/G4/G5)

Updated packages for Ubuntu 5.04:

Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/libg/libgda2/libgda2_1.1.99-1ubuntu0.1.diff.gz
      Size/MD5: 8586 1c333a3c2c26190125b252ca4f8c9d0a
    http://security.ubuntu.com/ubuntu/pool/main/libg/libgda2/libgda2_1.1.99-1ubuntu0.1.dsc
      Size/MD5: 2015 bdd8f14c7de66ca7f7e9b62f02403710
    http://security.ubuntu.com/ubuntu/pool/main/libg/libgda2/libgda2_1.1.99.orig.tar.gz
      Size/MD5: 2024240 50d115c5c363b3a5ffadcd8451952d40

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/libg/libgda2/libgda2-doc_1.1.99-1ubuntu0.1_all.deb
Size/MD5: 251970 3cac3fd6ad68e3083d64da50d1178c47

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

i386 architecture (x86 compatible Intel/AMD)

powerpc architecture (Apple Macintosh G3/G4/G5)

Updated packages for Ubuntu 5.10:

Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/libg/libgda2/libgda2_1.2.1-2ubuntu3.1.diff.gz
      Size/MD5: 10175 a0581f32596cc721eeaa933f508d6e6f
    http://security.ubuntu.com/ubuntu/pool/main/libg/libgda2/libgda2_1.2.1-2ubuntu3.1.dsc
      Size/MD5: 1992 9158d234ff184030863d6a50afe6697b
    http://security.ubuntu.com/ubuntu/pool/main/libg/libgda2/libgda2_1.2.1.orig.tar.gz
      Size/MD5: 2038045 ca6103ad97d565c08a613b13b6b32f8d

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/libg/libgda2/libgda2-doc_1.2.1-2ubuntu3.1_all.deb
Size/MD5: 246388 7142c393d12e3146fae1a15de535b10f

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

i386 architecture (x86 compatible Intel/AMD)

powerpc architecture (Apple Macintosh G3/G4/G5)

-- 
Martin Pitt        http://www.piware.de
Ubuntu Developer   http://www.ubuntu.com
Debian Developer   http://www.debian.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

application/pgp-signature attachment: Digital signature

Next message: Martin Pitt: "[Full-disclosure] [USN-213-1] sudo vulnerability"

Previous message: Valdis Shkesters: "Re: [Full-disclosure] Re: Microsoft AntiSpyware falling furtherbehind"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

[Full-disclosure] [USN-263-1] Linux kernel vulnerabilities
... Ubuntu 4.10 ... The following packages are affected: ... a local attacker could exploit this to crash the kernel. ... affects the amd64 architecture on Intel processors. ...
(Full-Disclosure)
[USN-263-1] Linux kernel vulnerabilities
... Ubuntu 4.10 ... The following packages are affected: ... a local attacker could exploit this to crash the kernel. ... affects the amd64 architecture on Intel processors. ...
(Bugtraq)
[Full-disclosure] [USN-261-1] PHP vulnerabilities
... php4, php5 vulnerabilities ... Ubuntu 4.10 ... The following packages are affected: ... amd64 architecture ...
(Full-Disclosure)
[USN-261-1] PHP vulnerabilities
... php4, php5 vulnerabilities ... Ubuntu 4.10 ... The following packages are affected: ... amd64 architecture ...
(Bugtraq)
[USN-231-1] Linux kernel vulnerabilities
... Ubuntu 4.10 ... The following packages are affected: ... A memory leak was discovered in the VFS lease handling. ... i386 architecture ...
(Bugtraq)