星球
USN-1022-1: APR-util vulnerability
2010/11/25 22:35:03 | Ubuntu security notices
Referenced CVEs:
CVE-2010-1623
Description:
===========================================================
Ubuntu Security Notice USN-1022-1 November 25, 2010
apr-util vulnerability
CVE-2010-1623
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 8.04 LTS
Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 8.04 LTS:
libaprutil1 1.2.12+dfsg-3ubuntu0.3
Ubuntu 9.10:
libaprutil1 1.3.9+dfsg-1ubuntu1.1
Ubuntu 10.04 LTS:
libaprutil1 1.3.9+dfsg-3ubuntu0.10.04.1
Ubuntu 10.10:
libaprutil1 1.3.9+dfsg-3ubuntu0.10.10.1
After a standard system update you need to restart any applications using
APR-util, such as Subversion and Apache, to make all the necessary changes.
Details follow:
It was discovered that APR-util did not properly handle memory when
destroying APR buckets. An attacker could exploit this and cause a denial
of service via memory exhaustion.
USN-1021-1: Apache vulnerabilities
2010/11/25 22:27:10 | Ubuntu security notices
Referenced CVEs:
CVE-2010-1452, CVE-2010-1623
Description:
===========================================================
Ubuntu Security Notice USN-1021-1 November 25, 2010
apache2 vulnerabilities
CVE-2010-1452, CVE-2010-1623
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS
Ubuntu 8.04 LTS
Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 6.06 LTS:
apache2-common 2.0.55-4ubuntu2.12
Ubuntu 8.04 LTS:
apache2.2-common 2.2.8-1ubuntu0.19
Ubuntu 9.10:
apache2.2-common 2.2.12-1ubuntu2.4
Ubuntu 10.04 LTS:
apache2.2-common 2.2.14-5ubuntu8.4
Ubuntu 10.10:
apache2.2-common 2.2.16-1ubuntu3.1
In general, a standard system update will make all the necessary changes.
Details follow:
It was discovered that Apache's mod_cache and mod_dav modules incorrectly
handled requests that lacked a path. A remote attacker could exploit this
with a crafted request and cause a denial of service. This issue affected
Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS. (CVE-2010-1452)
It was discovered that Apache did not properly handle memory when
destroying APR buckets. A remote attacker could exploit this with crafted
requests and cause a denial of service via memory exhaustion. This issue
affected Ubuntu 6.06 LTS and 10.10. (CVE-2010-1623)
【Blogger】企鵝網製寵物
2010/11/23 18:39:00 | 凍仁的 Ubuntu 筆記
不知從何時開始，凍仁就開始喜歡上企鵝，連凍仁家的桌機旁邊都擺著 4 隻布偶，也在「企鵝+便利貼-韓國-衣服」的關鍵字以下找到了這個療傷系的網誌寵物。
至於為什麼要多個「-韓國」？那是因為近來的 韓國跆拳亞運風波。z
至於為什麼要多個「-韓國」？那是因為近來的 韓國跆拳亞運風波。z
資料來源：
★網誌寵物：企鵝家族 - luckydenny新酷音進度報告 8
2010/11/22 23:34:00 | Jserv's blog
「我寧可做人類中有夢想和有完成夢想的願望的最渺小的人，而不願做一個最偉大的無夢想無願望的人。」 晚間忙完雜務後，鍵盤聲響尚未停歇之際，想起紀伯倫的這席名言。記得筆者十年前拿著 iPaq 作實驗，運行著 PocketLinux，讚嘆於 StrongARM 核心時脈高達 200 MHz 的效能，心想自己真是幸運兒；現在到處都能見到採用 45 奈米製程、時脈高達 1 GHz 的 iPad，只覺得自己心態還沒調適好，儘管自知這是 Moore's law 的必然結果。然而，軟體的進展卻沒有如此明顯，在中文輸入法的部份，普遍可說大多在「變老把戲」的狀態，對於一位 2001 年間斷修改酷音輸入法程式、到 2010 年還在零星維護程式碼的人來說，不得不有些感嘆。 難道輸入法開發就是老樣子、永遠在重新造輪子嗎？倒也未必。如前文 [手寫版酷音輸入法雛型] 所及，當使用者族群逐漸採用移動裝置時，需要一個易於書寫且容易讓輸入法引擎 (也就是 "Language Engine" 或 "IM Engine") 涉入處理的設計，現有的智慧型手機，比方說 Android 與 iPhone，都提供了全螢幕書寫的機制，要實現「何不直接辨識注音符號，然後導入新酷音輸入法引擎去作猜字處理？」這類簡單易用的方案，相當可行，也注入新的開發動能。兩年前的 [新酷音進度報告 7] 談到目前...
USN-1018-1: OpenSSL vulnerability
2010/11/18 13:48:38 | Ubuntu security notices
Referenced CVEs:
CVE-2010-3864
Description:
===========================================================
Ubuntu Security Notice USN-1018-1 November 18, 2010
openssl vulnerability
CVE-2010-3864
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 8.04 LTS
Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 8.04 LTS:
libssl0.9.8 0.9.8g-4ubuntu3.12
Ubuntu 9.10:
libssl0.9.8 0.9.8g-16ubuntu3.4
Ubuntu 10.04 LTS:
libssl0.9.8 0.9.8k-7ubuntu8.4
Ubuntu 10.10:
libssl0.9.8 0.9.8o-1ubuntu4.2
After a standard system update you need to reboot your computer to make
all the necessary changes.
Details follow:
Rob Hulswit discovered a race condition in the OpenSSL TLS server
extension parsing code when used within a threaded server. A remote
attacker could trigger this flaw to cause a denial of service
or possibly execute arbitrary code with application privileges.
(CVE-2010-3864)