lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list] 
Message-ID: <20070103033442.GT4462@outflux.net>
Date: Tue, 2 Jan 2007 19:34:42 -0800
From: Kees Cook <kees@...ntu.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-399-1] w3m vulnerabilities

=========================================================== 
Ubuntu Security Notice USN-399-1           January 03, 2007
w3m vulnerabilities
http://sf.net/tracker/?func=detail&aid=1612792&group_id=39518&atid=425439
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 5.10
Ubuntu 6.06 LTS
Ubuntu 6.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 5.10:
  w3m                                      0.5.1-3ubuntu1.1

Ubuntu 6.06 LTS:
  w3m                                      0.5.1-4ubuntu2.6.06

Ubuntu 6.10:
  w3m                                      0.5.1-4ubuntu2.6.10

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

A format string vulnerability was discovered in w3m.  If a user were 
tricked into visiting an HTTPS URL protected by a specially crafted SSL 
certificate, an attacker could execute arbitrary code with user 
privileges.


Updated packages for Ubuntu 5.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-3ubuntu1.1.diff.gz
      Size/MD5:    26918 6c80b8da1759df35d0fbbbfd762be482
    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-3ubuntu1.1.dsc
      Size/MD5:      714 d5fab4328a132271d45443b0c62c9c5f
    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1.orig.tar.gz
      Size/MD5:  1892121 0678b72e07e69c41709d71ef0fe5da13

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.1-3ubuntu1.1_amd64.deb
      Size/MD5:    90086 e9be4901190f36350b7c3906e8d5c7c0
    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-3ubuntu1.1_amd64.deb
      Size/MD5:  1119434 544af8fe74b78b80b85b0618934e993f

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.1-3ubuntu1.1_i386.deb
      Size/MD5:    88984 b39f657ec9c7fc9f0b66eccf6548ecfd
    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-3ubuntu1.1_i386.deb
      Size/MD5:  1062408 4681dd0f0799ac9418ae11f17c39efb6

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.1-3ubuntu1.1_powerpc.deb
      Size/MD5:    91540 47fbc7739850d784fea04b739763a79b
    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-3ubuntu1.1_powerpc.deb
      Size/MD5:  1120800 43549c92dd35b1b1945fefed4c10caad

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.1-3ubuntu1.1_sparc.deb
      Size/MD5:    89256 e9975d718fb34e212ab9471a19b293b8
    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-3ubuntu1.1_sparc.deb
      Size/MD5:  1087110 ac0ece82654dc503f9aff5c961d766ae

Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-4ubuntu2.6.06.diff.gz
      Size/MD5:    35266 4eb07f00d81679ccf53f5c50c3cf5403
    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-4ubuntu2.6.06.dsc
      Size/MD5:      702 ced346058b3f71ecec26652b9aa919d7
    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1.orig.tar.gz
      Size/MD5:  1892121 0678b72e07e69c41709d71ef0fe5da13

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.1-4ubuntu2.6.06_amd64.deb
      Size/MD5:    88458 ac45f4fade3fa7f60643b18553ccfb32
    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-4ubuntu2.6.06_amd64.deb
      Size/MD5:  1119712 d48a1acda4b04bd2b8870d7328d471af

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.1-4ubuntu2.6.06_i386.deb
      Size/MD5:    87464 790cddd717ef3d53576cd44325bbe74c
    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-4ubuntu2.6.06_i386.deb
      Size/MD5:  1061434 1309934c6ce36eddc7d1fe10c8a397d7

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.1-4ubuntu2.6.06_powerpc.deb
      Size/MD5:    89786 7a5076bb3784d7c3ee23a83a799c006e
    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-4ubuntu2.6.06_powerpc.deb
      Size/MD5:  1120114 a3464f27e707e26c6282a0913e485330

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.1-4ubuntu2.6.06_sparc.deb
      Size/MD5:    87854 18bcf4fe486d5d5223c6cff38fc2badd
    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-4ubuntu2.6.06_sparc.deb
      Size/MD5:  1084034 f76db440d2206b0f6cccda184bbc1380

Updated packages for Ubuntu 6.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-4ubuntu2.6.10.diff.gz
      Size/MD5:    35266 30be4e65c986ec185ff1bc0855b1debb
    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-4ubuntu2.6.10.dsc
      Size/MD5:      702 0ba7b9609b67a3312af4eda07da0b342
    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1.orig.tar.gz
      Size/MD5:  1892121 0678b72e07e69c41709d71ef0fe5da13

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.1-4ubuntu2.6.10_amd64.deb
      Size/MD5:    88446 f05692dbf3a8ece4a7c4897fca454fe1
    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-4ubuntu2.6.10_amd64.deb
      Size/MD5:  1131030 1500cfb7d6066f6df6ac510dbd133a57

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.1-4ubuntu2.6.10_i386.deb
      Size/MD5:    87712 f17dcbf4a518d4704f203f6694166ab1
    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-4ubuntu2.6.10_i386.deb
      Size/MD5:  1085166 861a156c3ac25b0908756cb83c593ff3

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.1-4ubuntu2.6.10_powerpc.deb
      Size/MD5:    89888 b98545747a5f409b99fa7667ce034595
    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-4ubuntu2.6.10_powerpc.deb
      Size/MD5:  1136062 b20c1b12d34f3cf52ed85d6a8441eb0e

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.1-4ubuntu2.6.10_sparc.deb
      Size/MD5:    87830 547b4ccbf9cde9c40ad8a18e0a67436e
    http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-4ubuntu2.6.10_sparc.deb
      Size/MD5:  1099004 7175fd58a8037a2d6a652a661c09c3ac


Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ