User: Password:
|
|
Subscribe / Log in / New account

Ubuntu alert USN-25-1 (libgd2)

From:  Martin Pitt <martin.pitt@canonical.com>
To:  ubuntu-security-announce@lists.ubuntu.com
Subject:  [USN-25-1] libgd2 vulnerability
Date:  Mon, 15 Nov 2004 21:59:06 +0100
Cc:  bugtraq@securityfocus.com, full-disclosure@lists.netsys.com

=========================================================== Ubuntu Security Notice USN-25-1 November 15, 2004 libgd2 vulnerability CAN-2004-0941 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) The following packages are affected: libgd2-noxpm libgd2-xpm The problem can be corrected by upgrading the affected package to version 2.0.23-2ubuntu0.2. In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: CAN-2004-0990 described several more buffer overflows which had been discovered in libgd2's PNG handling functions. However, it was determined that the update from USN-11-1 was not sufficient to prevent every possible attack, so another update is required. If an attacker tricked a user into loading a malicious PNG image, they could leverage this into executing arbitrary code in the context of the user opening image. Most importantly, this library is commonly used in PHP. One possible target would be a PHP driven photo website that lets users upload images. Therefore this vulnerability might lead to privilege escalation to a web server's privileges. Source archives: http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/l... Size/MD5: 12226 07b3dbcc7859c96fd9361ba5acb55ca3 http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/l... Size/MD5: 783 7af6efbf687a91f9ae5a3706dff6b4e2 http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/l... Size/MD5: 544497 3bcd6daef3eb7b31ddc68a7d54b98c15 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/l... Size/MD5: 111930 e02388104c787c629cdaf7359f4e0dd6 http://security.ubuntu.com/ubuntu/pool/universe/libg/libg... Size/MD5: 111908 2babd3d434bae12783979f95a4adf00b amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/universe/libg/libg... Size/MD5: 128298 718b6351eab50fa26ec7352115df7dbc http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/l... Size/MD5: 305982 9d8c153eca642174db034475f635f876 http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/l... Size/MD5: 171350 316969fbd3f4074e4529c1a86d27dc5a http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/l... Size/MD5: 305978 0ce7ed0d0064efb50b80744e27603393 http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/l... Size/MD5: 171332 ec97c276edf3068a3ea339c6ba879e2a i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/universe/libg/libg... Size/MD5: 127402 1b5396bfedaa2834bb6eb6f634375068 http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/l... Size/MD5: 299968 cbbdbe2652350e2bc68b178a801b38f2 http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/l... Size/MD5: 167526 660bd677beaa8d38271659269917cb3a http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/l... Size/MD5: 299956 77de1a155bc35a7f1e19401f34111c01 http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/l... Size/MD5: 167506 03f731943138914465c94673e71b458b powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/universe/libg/libg... Size/MD5: 134178 d7cae80497fdb38ad24889a5fcbd15af http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/l... Size/MD5: 309086 42da3075045590245e629e590e484e15 http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/l... Size/MD5: 173336 d2600f9749dcf3fa290b83d2563bc8d1 http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/l... Size/MD5: 309068 33f9904e88d4661aece4c12d04a533cd http://security.ubuntu.com/ubuntu/pool/main/libg/libgd2/l... Size/MD5: 173314 62620d7ed4283f1c7cb675a729a7ca4d ----- End forwarded message ----- -- Martin Pitt http://www.piware.de Ubuntu Developer http://www.ubuntulinux.org Debian GNU/Linux Developer http://www.debian.org -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com http://lists.ubuntu.com/mailman/listinfo/ubuntu-security-...


(Log in to post comments)


Copyright © 2018, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds