lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list] 
Message-Id: <1229956517.23276.7.camel@mdlinux.technorage.com>
Date: Mon, 22 Dec 2008 09:35:17 -0500
From: Marc Deslauriers <marc.deslauriers@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-697-1] Imlib2 vulnerability

===========================================================
Ubuntu Security Notice USN-697-1          December 22, 2008
imlib2 vulnerability
CVE-2008-2426
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 7.10
Ubuntu 8.04 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  libimlib2                       1.2.1-2ubuntu0.4

Ubuntu 7.10:
  libimlib2                       1.3.0.0debian1-4ubuntu0.2

Ubuntu 8.04 LTS:
  libimlib2                       1.4.0-1ubuntu1.2

After a standard system upgrade you need to restart any applications that
use Imlib2 to effect the necessary changes.

Details follow:

It was discovered that Imlib2 did not correctly handle certain malformed XPM
and PNG images. If a user were tricked into opening a specially crafted image
with an application that uses Imlib2, an attacker could cause a denial of
service and possibly execute arbitrary code with the user's privileges.


Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/imlib2_1.2.1-2ubuntu0.4.diff.gz
      Size/MD5:   112004 40358c580aa8df51d351dd6e7f5a16c8
    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/imlib2_1.2.1-2ubuntu0.4.dsc
      Size/MD5:      753 5420a8a79b55140d8e24db8f2de00dd6
    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/imlib2_1.2.1.orig.tar.gz
      Size/MD5:   911360 deb3c9713339fe9ca964e100cce42cd1

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2.1-2ubuntu0.4_amd64.deb
      Size/MD5:   352146 b50aee75d96a48b69302db0b41ae17ad
    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.1-2ubuntu0.4_amd64.deb
      Size/MD5:   214740 b699d7ceafc603c4da9c42325732e076

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2.1-2ubuntu0.4_i386.deb
      Size/MD5:   302668 ebf21b1c1a22e4802a18c82f59de28e8
    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.1-2ubuntu0.4_i386.deb
      Size/MD5:   193408 34bfcc6c8dc0986f44e06ec5d7410665

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2.1-2ubuntu0.4_powerpc.deb
      Size/MD5:   342046 295d87aa13c311a74cd344c0f073af6d
    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.1-2ubuntu0.4_powerpc.deb
      Size/MD5:   212958 93c174a40fc7d88d48a70f5fdb09a3f5

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.2.1-2ubuntu0.4_sparc.deb
      Size/MD5:   318588 e21dc5553e88054dfd9010cc898181f9
    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.2.1-2ubuntu0.4_sparc.deb
      Size/MD5:   194098 fbe1c22aad50c8258c140c67dd85894d

Updated packages for Ubuntu 7.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/imlib2_1.3.0.0debian1-4ubuntu0.2.diff.gz
      Size/MD5:    13769 09820004bae28d3057000445482ef609
    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/imlib2_1.3.0.0debian1-4ubuntu0.2.dsc
      Size/MD5:      873 cf5b5d9869202da1a5aa29dbd57b31ab
    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/imlib2_1.3.0.0debian1.orig.tar.gz
      Size/MD5:   617750 7f389463afdb09310fa61e5036714bb3

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.3.0.0debian1-4ubuntu0.2_amd64.deb
      Size/MD5:   365988 53ecdab9240acf9b71e9beb9903ec7fc
    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.3.0.0debian1-4ubuntu0.2_amd64.deb
      Size/MD5:   214090 b379ee9c5d678cde9e6766df89695dba

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.3.0.0debian1-4ubuntu0.2_i386.deb
      Size/MD5:   334468 907b6b0b7f11895b1b32b0886d7a9343
    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.3.0.0debian1-4ubuntu0.2_i386.deb
      Size/MD5:   205802 dc82a1e573a045e487e77dd8dae5fd65

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.3.0.0debian1-4ubuntu0.2_lpia.deb
      Size/MD5:   341414 516b71217f39e0bc653d2862d1e1db19
    http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2_1.3.0.0debian1-4ubuntu0.2_lpia.deb
      Size/MD5:   209358 3cf0224915a3dd16199aafbb49e96c34

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.3.0.0debian1-4ubuntu0.2_powerpc.deb
      Size/MD5:   362620 634e0878891c1e6308950333718c1bd4
    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.3.0.0debian1-4ubuntu0.2_powerpc.deb
      Size/MD5:   229886 b37e628289bf933f6cd8ecb4e8d6b3ac

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.3.0.0debian1-4ubuntu0.2_sparc.deb
      Size/MD5:   338862 57c8a21576417e08d2b9b7c4e5ee8db1
    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.3.0.0debian1-4ubuntu0.2_sparc.deb
      Size/MD5:   200926 1f96efa5649dd902157fd7e1ea358a7b

Updated packages for Ubuntu 8.04 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/imlib2_1.4.0-1ubuntu1.2.diff.gz
      Size/MD5:    56663 fb26ad4224322e4ede71f5d70a62638f
    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/imlib2_1.4.0-1ubuntu1.2.dsc
      Size/MD5:      843 e80fb6a9f642fd8a5c0d4b82b4a20429
    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/imlib2_1.4.0.orig.tar.gz
      Size/MD5:   845017 1f7f497798e06085767d645b0673562a

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.4.0-1ubuntu1.2_amd64.deb
      Size/MD5:   344524 d023421c4725c4fadb076510ba28f0cb
    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.4.0-1ubuntu1.2_amd64.deb
      Size/MD5:   199838 4a7b97363d6af1862911a576703b760a

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2-dev_1.4.0-1ubuntu1.2_i386.deb
      Size/MD5:   309450 b9a5eeb6b5ba08edc7252b25b2df1811
    http://security.ubuntu.com/ubuntu/pool/main/i/imlib2/libimlib2_1.4.0-1ubuntu1.2_i386.deb
      Size/MD5:   190318 290fda5b18c7dae98526f38a9b324595

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.4.0-1ubuntu1.2_lpia.deb
      Size/MD5:   318168 6cfb7d6f677930908a2dfc4567b2ff7f
    http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2_1.4.0-1ubuntu1.2_lpia.deb
      Size/MD5:   194220 05f1faaa12d4094a2622cfa70dff086e

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.4.0-1ubuntu1.2_powerpc.deb
      Size/MD5:   336314 665ed6ae263c147a59d4f94a199b0395
    http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2_1.4.0-1ubuntu1.2_powerpc.deb
      Size/MD5:   211732 d97ee45ecc1b5300b5a8e7e1e9608496

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2-dev_1.4.0-1ubuntu1.2_sparc.deb
      Size/MD5:   314152 f14550d0965519dcc4d5b1c5bc435e64
    http://ports.ubuntu.com/pool/main/i/imlib2/libimlib2_1.4.0-1ubuntu1.2_sparc.deb
      Size/MD5:   181174 c48d4ebd678032ebfc55d19c72d613b5



Download attachment "signature.asc" of type "application/pgp-signature" (198 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ