| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20041123190133.GA19142@box79162.elkhouse.de>
Date: Tue, 23 Nov 2004 20:01:33 +0100
From: Martin Pitt <martin.pitt@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: bugtraq@...urityfocus.com, full-disclosure@...ts.netsys.com
Subject: [USN-31-1] cyrus21-imapd vulnerabilities
===========================================================
Ubuntu Security Notice USN-31-1 November 23, 2004
cyrus21-imapd vulnerabilities
CAN-2004-1012, CAN-2004-1013,
http://security.e-matters.de/advisories/152004.html
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 4.10 (Warty Warthog)
The following packages are affected:
cyrus21-imapd
The problem can be corrected by upgrading the affected package to
version 2.1.16-6ubuntu0.1. In general, a standard system upgrade is
sufficient to effect the necessary changes.
Details follow:
Stefan Esser discovered several buffer overflows in the Cyrus IMAP
server. Due to insufficient checking within the argument parser of
the "partial" and "fetch" commands, an argument like "body[p" was
detected as "body.peek". This could cause a buffer overflow which
could be exploited to execute arbitrary attacker-supplied code.
This update also fixes an exploitable buffer overflow that could be
triggered in situations when memory allocation fails (i. e. when no
free memory is available any more).
Both vulnerabilities can lead to privilege escalation to root.
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-imapd_2.1.16-6ubuntu0.1.diff.gz
Size/MD5: 234979 f254486e886fa85a76b2535f0d502016
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-imapd_2.1.16-6ubuntu0.1.dsc
Size/MD5: 1040 85b0b97ad9ab8b67426114158126f1de
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-imapd_2.1.16.orig.tar.gz
Size/MD5: 1687454 8f4ff803a910d0f4e4cfab3b13a6080d
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-admin_2.1.16-6ubuntu0.1_all.deb
Size/MD5: 87850 80e34d6e5fea0c7b8ed2553ce961afdc
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-doc_2.1.16-6ubuntu0.1_all.deb
Size/MD5: 206492 85d547e5d130e27783428b44ff1be1c5
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-clients_2.1.16-6ubuntu0.1_amd64.deb
Size/MD5: 106934 0fa30f41ad7648613e9ae3b0a7c66b94
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-common_2.1.16-6ubuntu0.1_amd64.deb
Size/MD5: 2071388 1e8de398184325db3d3d83c6c7d858c4
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-dev_2.1.16-6ubuntu0.1_amd64.deb
Size/MD5: 267958 ec6a173cc4cacdc7ca1b065b4e9403c6
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-imapd_2.1.16-6ubuntu0.1_amd64.deb
Size/MD5: 591194 f972a251e2490cbb61b4b44190cf39b4
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-murder_2.1.16-6ubuntu0.1_amd64.deb
Size/MD5: 526738 6901a198e350b6d3ba4a8c646177a0ee
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-pop3d_2.1.16-6ubuntu0.1_amd64.deb
Size/MD5: 93078 ee6c85476f63f7a208518806c3a3f5f2
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/libcyrus-imap-perl21_2.1.16-6ubuntu0.1_amd64.deb
Size/MD5: 137652 c8100718ef12d7cc82b6e5ab36cb0883
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-clients_2.1.16-6ubuntu0.1_i386.deb
Size/MD5: 104102 f372a3f41f5f7d436f6b6fca85c8add6
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-common_2.1.16-6ubuntu0.1_i386.deb
Size/MD5: 1949328 1cad157239aa79e4b6adbdce5d980e64
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-dev_2.1.16-6ubuntu0.1_i386.deb
Size/MD5: 261398 568e017d51c76e48316faf0e28de8318
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-imapd_2.1.16-6ubuntu0.1_i386.deb
Size/MD5: 561756 6e9f695212413fa58cd928102e8221ab
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-murder_2.1.16-6ubuntu0.1_i386.deb
Size/MD5: 493322 feb26f26e6092349a525ab8a2ab1854c
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-pop3d_2.1.16-6ubuntu0.1_i386.deb
Size/MD5: 85210 db0eee22d2ec621dcd5783872baf9985
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/libcyrus-imap-perl21_2.1.16-6ubuntu0.1_i386.deb
Size/MD5: 133702 9075c381787315d36dd759f91de6a72d
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-clients_2.1.16-6ubuntu0.1_powerpc.deb
Size/MD5: 106734 c82df404b7a3ae83c39e2557c19b78ca
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-common_2.1.16-6ubuntu0.1_powerpc.deb
Size/MD5: 2083454 eae46dabf659bd8656d0fbaf6e8ceaa8
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-dev_2.1.16-6ubuntu0.1_powerpc.deb
Size/MD5: 265412 db269fd664c7f9097caf62bd6147bece
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-imapd_2.1.16-6ubuntu0.1_powerpc.deb
Size/MD5: 593496 6f797c3db11dede0486cef5bc210e9d9
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-murder_2.1.16-6ubuntu0.1_powerpc.deb
Size/MD5: 527656 b8b38d4c59f7fa38b6175e16118d17eb
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/cyrus21-pop3d_2.1.16-6ubuntu0.1_powerpc.deb
Size/MD5: 93268 c5094222880135acc57e10d74ad93c35
http://security.ubuntu.com/ubuntu/pool/main/c/cyrus21-imapd/libcyrus-imap-perl21_2.1.16-6ubuntu0.1_powerpc.deb
Size/MD5: 135690 e740ecc270bb11cdae18104c2f82738c
Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)
Powered by blists - more mailing lists