Ubuntu Linux: Firefox vulnerabilitie

Status
Not open for further replies.
T

Troy

Contributor
Since many TE members use ubuntu , I would like to bring this security hole to their notice.



===========================================================

Ubuntu Security Notice USN-327-1 July 27, 2006

firefox vulnerabilities

CVE-2006-3113, CVE-2006-3677, CVE-2006-3801, CVE-2006-3802,

CVE-2006-3803, CVE-2006-3805, CVE-2006-3806, CVE-2006-3807,

CVE-2006-3808, CVE-2006-3809, CVE-2006-3810, CVE-2006-3811,

CVE-2006-3812

===========================================================



A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS

This advisory also applies to the corresponding versions of

Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the

following package versions:

Ubuntu 6.06 LTS:

firefox 1.5.dfsg+1.5.0.5-0ubuntu6.06

After a standard system upgrade you need to restart Firefox to effect

the necessary changes.

Please note that Firefox 1.0.8 in Ubuntu 5.10 and Ubuntu 5.04 are also

affected by these problems. Updates for these Ubuntu releases will be

delayed due to upstream dropping support for this Firefox version. We

strongly advise that you disable JavaScript to disable the attack

vectors for most vulnerabilities if you use one of these Ubuntu

versions.

Details follow:

Various flaws have been reported that allow an attacker to execute

arbitrary code with user privileges by tricking the user into opening

a malicious URL. (CVE-2006-3113, CVE-2006-3677, CVE-2006-3801,

CVE-2006-3803, CVE-2006-3805, CVE-2006-3806, CVE-2006-3807,

CVE-2006-3809, CVE-2006-3811, CVE-2006-3812)

cross-site scripting vulnerabilities were found in the

XPCNativeWrapper() function and native DOM method handlers. A

malicious web site could exploit these to modify the contents or steal

confidential data (such as passwords) from other opened web pages.

(CVE-2006-3802, CVE-2006-3810)

A bug was found in the script handler for automatic proxy

configuration. A malicious proxy could send scripts which could

execute arbitrary code with the user's privileges. (CVE-2006-3808)

Please see

Mozilla Foundation Security Advisories

for technical details of these vulnerabilities.

Updated packages for Ubuntu 6.06 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06.diff.gz

Size/MD5: 174602 7be6f5862219ac4cf44f05733f372f2b

http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06.dsc

Size/MD5: 1109 252d6acf45b009008a6bc88166e2632f

http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5.orig.tar.gz

Size/MD5: 44067762 749933c002e158576ec15782fc451e43

Architecture independent packages:

http://security.ubuntu.com/ubuntu/p...efox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_all.deb

Size/MD5: 49190 850dd650e7f876dd539e605d9b3026c8

http://security.ubuntu.com/ubuntu/p...-firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_all.deb

Size/MD5: 50078 c1fa4a40187d9c5b58bd049edb00ce54

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

http://security.ubuntu.com/ubuntu/p...ox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb

Size/MD5: 47269292 167aadc3f03b4e1b7cb9ed826e672983

http://security.ubuntu.com/ubuntu/p...ox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb

Size/MD5: 2796768 b54592d0bd736f6ee12a90987771bc59

http://security.ubuntu.com/ubuntu/p...pector_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb

Size/MD5: 216136 79fa6c69ffb0dd6037e56d1ba538ff64

http://security.ubuntu.com/ubuntu/p...upport_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb

Size/MD5: 82358 e2e026d582a7b5352cee4453cef0fe45

http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb

Size/MD5: 9400544 a9d0b804a4374dc636bb79968a2bce5c

http://security.ubuntu.com/ubuntu/p...firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb

Size/MD5: 218822 a09476caea7d8d73d6a2f534bd494493

http://security.ubuntu.com/ubuntu/p...firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb

Size/MD5: 161876 0e0e65348dba8167b4891b173baa8f0d

http://security.ubuntu.com/ubuntu/p...firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb

Size/MD5: 235746 064fc1434a315f857ee92f60fd49d772

http://security.ubuntu.com/ubuntu/p...firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_amd64.deb

Size/MD5: 757458 bd6a5e28e05a04a5deca731ab29f70e4

i386 architecture (x86 compatible Intel/AMD)

http://security.ubuntu.com/ubuntu/p...fox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb

Size/MD5: 43837610 a7e4a535262f8a5d5cb0ace7ed785237

http://security.ubuntu.com/ubuntu/p...fox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb

Size/MD5: 2796700 4509dbf62e3fd2cda7168c20aa65ba4f

http://security.ubuntu.com/ubuntu/p...spector_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb

Size/MD5: 209546 50e174c1c7290fca51f9e1ee71ebb56c

http://security.ubuntu.com/ubuntu/p...support_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb

Size/MD5: 74732 25ba86caeeb1a88da4493875178a3636

http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb

Size/MD5: 7916536 40ebfe4330af25c2359f8b25b039ed5e

http://security.ubuntu.com/ubuntu/p....firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb

Size/MD5: 218822 6066f59acbce1b4de2dc284b5801efc5

http://security.ubuntu.com/ubuntu/p....firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb

Size/MD5: 146570 c1a5c5cc4371b228093d03d9ed7ad607

http://security.ubuntu.com/ubuntu/p....firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb

Size/MD5: 235754 0e9a1a89f63a9869b875ee6a50547c2b

http://security.ubuntu.com/ubuntu/p....firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_i386.deb

Size/MD5: 669556 d537a4771b80e5c06f18b2c5d7e5d384

powerpc architecture (Apple Macintosh G3/G4/G5)

http://security.ubuntu.com/ubuntu/p...-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb

Size/MD5: 48648192 479d29e08ff2b9cef89a6da3285c0aad

http://security.ubuntu.com/ubuntu/p...-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb

Size/MD5: 2796790 60b97738bfc3b8b32914487bb4aba239

http://security.ubuntu.com/ubuntu/p...ctor_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb

Size/MD5: 212982 a396e119a32303afc024d513b997c84e

http://security.ubuntu.com/ubuntu/p...port_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb

Size/MD5: 77894 ef7841bb2ab8de0e0c44e59c893b1622

http://security.ubuntu.com/ubuntu/p...efox_1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb

Size/MD5: 9019132 ed3927484eea5fccf84a2840640febf3

http://security.ubuntu.com/ubuntu/p...refox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb

Size/MD5: 218826 a2338c3c8064a304deb752bf32a291f8

http://security.ubuntu.com/ubuntu/p...refox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb

Size/MD5: 159112 7d5d6100727ceb894695b219cec11e43

http://security.ubuntu.com/ubuntu/p...refox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb

Size/MD5: 235754 69085beb145222fea07d2d6c19158a2d

http://security.ubuntu.com/ubuntu/p...refox1.5.dfsg+1.5.0.5-0ubuntu6.06_powerpc.deb

Size/MD5: 768332 8dc6cc8c54185d57af14bab3bee39f9d

sparc architecture (Sun SPARC/UltraSPARC)

http://security.ubuntu.com/ubuntu/p...ox-dbg_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb

Size/MD5: 45235424 f5a07188af5802fffbd3cfdd64b109cf

http://security.ubuntu.com/ubuntu/p...ox-dev_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb

Size/MD5: 2796756 cb13c7ea0e3b7af2f1e12db1f8dc38a2

http://security.ubuntu.com/ubuntu/p...pector_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb

Size/MD5: 210488 17f7723b697110c8f132422bc059d447

http://security.ubuntu.com/ubuntu/p...upport_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb

Size/MD5: 76340 c38ccb8b71b9c3783a1c9816ecd9cf5d

http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb

Size/MD5: 8411310 4b3865b2df3924d094e0b18f207bf33d

http://security.ubuntu.com/ubuntu/p...firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb

Size/MD5: 218814 a0e67d0d425cea2cd5835e2c2faa930f

http://security.ubuntu.com/ubuntu/p...firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb

Size/MD5: 149018 73108368f0ef745188ebd1c48ea10c88

http://security.ubuntu.com/ubuntu/p...firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb

Size/MD5: 235746 695a6122710fb30201daaa239ba6d48d

http://security.ubuntu.com/ubuntu/p...firefox1.5.dfsg+1.5.0.5-0ubuntu6.06_sparc.deb

Size/MD5: 681612 896721beb3cdcea12bab98223c0796c2
Click to expand...

--------------------------------------------------------------------x--------------------------------------------------------------------

PHP4 Regression



===========================================================

Ubuntu Security Notice USN-320-2 July 26, 2006

php4 regression

https://launchpad.net/bugs/53581

===========================================================



A security issue affects the following Ubuntu releases:

Ubuntu 5.04

This advisory also applies to the corresponding versions of

Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the

following package versions:

Ubuntu 5.04:

libapache2-mod-php4 4:4.3.10-10ubuntu4.6

php4-cgi 4:4.3.10-10ubuntu4.6

php4-cli 4:4.3.10-10ubuntu4.6

In general, a standard system upgrade is sufficient to effect the

necessary changes.

Details follow:

USN-320-2 fixed several vulnerabilities in PHP. James Manning

discovered that the Ubuntu 5.04 update introduced a regression, the

function tempnam() caused a crash of the PHP interpreter in some

circumstances. The updated packages fix this.

We apologize for the inconvenience.

Updated packages for Ubuntu 5.04:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4_4.3.10-10ubuntu4.6.diff.gz

Size/MD5: 281956 1c914659e6f61602a9f71b8d37b3392b

http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4_4.3.10-10ubuntu4.6.dsc

Size/MD5: 1469 17a8050464f1dbbb1fabb99343a5c6cf

http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4_4.3.10.orig.tar.gz

Size/MD5: 4892209 73f5d1f42e34efa534a09c6091b5a21e

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4_4.3.10-10ubuntu4.6_all.deb

Size/MD5: 1126 a05b26a1ea93b28d73b94422da467918

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

http://security.ubuntu.com/ubuntu/pool/main/p/php4/libapache2-mod-php4_4.3.10-10ubuntu4.6_amd64.deb

Size/MD5: 1657558 9d8d66e9cb31cb87294b6233fa927e33

http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4-cgi_4.3.10-10ubuntu4.6_amd64.deb

Size/MD5: 3275316 4423f48ce31f2f3334506b23f02fedb8

http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4-cli_4.3.10-10ubuntu4.6_amd64.deb

Size/MD5: 1647604 e79fed2516655fc81564e8fe0f488bea

http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4-common_4.3.10-10ubuntu4.6_amd64.deb

Size/MD5: 168258 5252917d283455beea87dcfcd80d3bbf

http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4-dev_4.3.10-10ubuntu4.6_amd64.deb

Size/MD5: 348252 d38144e70507eeeaccd0f0eb88201332

i386 architecture (x86 compatible Intel/AMD)

http://security.ubuntu.com/ubuntu/pool/main/p/php4/libapache2-mod-php4_4.3.10-10ubuntu4.6_i386.deb

Size/MD5: 1592844 ab4f524bf3b203661ca083fc6cbefb00

http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4-cgi_4.3.10-10ubuntu4.6_i386.deb

Size/MD5: 3169886 0b56067b59dd1612562dc82fc6eede43

http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4-cli_4.3.10-10ubuntu4.6_i386.deb

Size/MD5: 1592924 86addeffabaa817733857dfed3e37b29

http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4-common_4.3.10-10ubuntu4.6_i386.deb

Size/MD5: 168254 f0ed0ff02813d768a8e600f3646382ba

http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4-dev_4.3.10-10ubuntu4.6_i386.deb

Size/MD5: 348266 70238b0ae0790cd79c645720e66eae19

powerpc architecture (Apple Macintosh G3/G4/G5)

http://security.ubuntu.com/ubuntu/p...ache2-mod-php4_4.3.10-10ubuntu4.6_powerpc.deb

Size/MD5: 1658990 5769a9d9690042900e70f98432ed7d7a

http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4-cgi_4.3.10-10ubuntu4.6_powerpc.deb

Size/MD5: 3278826 9a2287a0bf8e587ee651230d8e40b797

http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4-cli_4.3.10-10ubuntu4.6_powerpc.deb

Size/MD5: 1646196 a001bf1a15d25ae4354190d8c722e846

http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4-common_4.3.10-10ubuntu4.6_powerpc.deb

Size/MD5: 168268 37293b3c08d1593bb55b73bce39cf6c3

http://security.ubuntu.com/ubuntu/pool/main/p/php4/php4-dev_4.3.10-10ubuntu4.6_powerpc.deb

Size/MD5: 348282 257afdf00afb930d1fb294d12454ae3a
Click to expand...

Source:hxxp://www.xatrix.org/

P.s:. This thread should hv been in security solutions can MODS pls move it there.
 
Status
Not open for further replies.
Top Bottom