[USN-4-1] Standard C library script vulnerabilities

From: Martin Pitt (martin.pitt_at_canonical.com)
Date: 10/28/04

Next message: Valdis.Kletnieks_at_vt.edu: "Re: Update: Web browsers - a mini-farce (MSIE gives in)"

Previous message: Michael Wojcik: "RE: Update: Web browsers - a mini-farce (MSIE gives in)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Thu, 28 Oct 2004 08:06:43 +0200
To: ubuntu-security-announce@lists.ubuntu.com

===========================================================
Ubuntu Security Notice USN-4-1 October 27, 2004
Standard C library script vulnerabilities
CAN-2004-0968
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)

The following packages are affected:

libc6

The problem can be corrected by upgrading the affected package to
version 2.3.2.ds1-13ubuntu2.2. In general, a standard system upgrade
is sufficient to effect the necessary changes.

Details follow:

Recently, Trustix Secure Linux discovered some vulnerabilities in the
libc6 package. The utilities "catchsegv" and "glibcbug" created
temporary files in an insecure way, which allowed a symlink attack to
create or overwrite arbitrary files with the privileges of the user
invoking the program.

Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.3.2.ds1-13ubuntu2.2.diff.gz
      Size/MD5: 1718601 cf6afbc349154329c272077c73ba9179
    http://security.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.3.2.ds1-13ubuntu2.2.dsc
      Size/MD5: 1656 4c7cb8a913a57c4719b608c49c2d2b2e
    http://security.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.3.2.ds1.orig.tar.gz
      Size/MD5: 13246448 b982bf6ad7ebc8622d3b81d51c44b78a

Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/g/glibc/glibc-doc_2.3.2.ds1-13ubuntu2.2_all.deb
      Size/MD5: 3839054 c45aae7010692177a047dc68a0892f7c
    http://security.ubuntu.com/ubuntu/pool/main/g/glibc/locales_2.3.2.ds1-13ubuntu2.2_all.deb
      Size/MD5: 3979842 272da092e74a39c4f15d10ddd1c3c2a0

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

i386 architecture (x86 compatible Intel/AMD)

powerpc architecture (Apple Macintosh G3/G4/G5)

application/pgp-signature attachment: Digital signature

Next message: Valdis.Kletnieks_at_vt.edu: "Re: Update: Web browsers - a mini-farce (MSIE gives in)"

Previous message: Michael Wojcik: "RE: Update: Web browsers - a mini-farce (MSIE gives in)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

[Full-disclosure] [USN-219-1] Linux kernel vulnerabilities
... Ubuntu 4.10 ... The following Ubuntu 4.10 packages are affected: ... provides a new kernel. ... A local attacker could exploit this by sending an "USB ...
(Full-Disclosure)
[USN-219-1] Linux kernel vulnerabilities
... Ubuntu 4.10 ... The following Ubuntu 4.10 packages are affected: ... provides a new kernel. ... A local attacker could exploit this by sending an "USB ...
(Bugtraq)
[Full-disclosure] [USN-95-1] Linux kernel vulnerabilities
... Ubuntu 4.10 ... The following packages are affected: ... Georgi Guninski discovered a buffer overflow in the ATM driver. ... the previous Ubuntu security update (kernel version ...
(Full-Disclosure)
[Full-disclosure] [USN-263-1] Linux kernel vulnerabilities
... Ubuntu 4.10 ... The following packages are affected: ... a local attacker could exploit this to crash the kernel. ... affects the amd64 architecture on Intel processors. ...
(Full-Disclosure)
[USN-263-1] Linux kernel vulnerabilities
... Ubuntu 4.10 ... The following packages are affected: ... a local attacker could exploit this to crash the kernel. ... affects the amd64 architecture on Intel processors. ...
(Bugtraq)