bugtraq - [USN-675-2] Gaim vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1227548244.7339.9.camel@mdlinux.technorage.com>
Date: Mon, 24 Nov 2008 12:37:24 -0500
From: Marc Deslauriers <marc.deslauriers@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>,
	full-disclosure@...ts.grok.org.uk
Subject: [USN-675-2] Gaim vulnerability

===========================================================
Ubuntu Security Notice USN-675-2          November 24, 2008
gaim vulnerability
CVE-2008-2927
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  gaim                            1:1.5.0+1.5.1cvs20051015-1ubuntu10.1

After a standard system upgrade you need to restart Gaim to effect
the necessary changes.

Details follow:

It was discovered that Gaim did not properly handle certain malformed
messages in the MSN protocol handler. A remote attacker could send a specially
crafted message and possibly execute arbitrary code with user privileges.
(CVE-2008-2927)


Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim_1.5.0+1.5.1cvs20051015-1ubuntu10.1.diff.gz
      Size/MD5:    34051 dde2b4483bc14d671228c8a512c9fd0c
    http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim_1.5.0+1.5.1cvs20051015-1ubuntu10.1.dsc
      Size/MD5:     1061 0293c5a43587d3db41a2437da5254206
    http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim_1.5.0+1.5.1cvs20051015.orig.tar.gz
      Size/MD5:  4299145 949ae755e9be1af68eef6c09c36a7530

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim-data_1.5.0+1.5.1cvs20051015-1ubuntu10.1_all.deb
      Size/MD5:   613282 4b5fd4fd6053473bf10db0634e993af0

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim-dev_1.5.0+1.5.1cvs20051015-1ubuntu10.1_amd64.deb
      Size/MD5:   103266 05b0562cf37fb5c72063566134aa7369
    http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim_1.5.0+1.5.1cvs20051015-1ubuntu10.1_amd64.deb
      Size/MD5:   954258 7da66022c5ea3372d097f3f7404610f2

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim-dev_1.5.0+1.5.1cvs20051015-1ubuntu10.1_i386.deb
      Size/MD5:   103248 81eebc45938e22bae57d3278682eee4b
    http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim_1.5.0+1.5.1cvs20051015-1ubuntu10.1_i386.deb
      Size/MD5:   836378 82ecc0d267bb90f7669786ea2092cb93

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim-dev_1.5.0+1.5.1cvs20051015-1ubuntu10.1_powerpc.deb
      Size/MD5:   103256 0fba1bcef36f3b6369effaf634c1a1df
    http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim_1.5.0+1.5.1cvs20051015-1ubuntu10.1_powerpc.deb
      Size/MD5:   924628 5f2721e0fcbaf536e4bcbd7a74a6b06e

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim-dev_1.5.0+1.5.1cvs20051015-1ubuntu10.1_sparc.deb
      Size/MD5:   103250 e43bfb56d37e3617b7bee0644c3948a8
    http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim_1.5.0+1.5.1cvs20051015-1ubuntu10.1_sparc.deb
      Size/MD5:   856760 66a004eff69e42183c6c58d732761b86



Download attachment "signature.asc" of type "application/pgp-signature" (198 bytes)