===========================================================
Ubuntu Security Notice USN-1042-1 January 11, 2011
php5 vulnerabilities
CVE-2009-5016, CVE-2010-3436, CVE-2010-3709, CVE-2010-3710,
CVE-2010-3870, CVE-2010-4156, CVE-2010-4409, CVE-2010-4645
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 8.04 LTS
Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
libapache2-mod-php5 5.1.2-1ubuntu3.20
php5-cgi 5.1.2-1ubuntu3.20
php5-cli 5.1.2-1ubuntu3.20

Ubuntu 8.04 LTS:
libapache2-mod-php5 5.2.4-2ubuntu5.13
php5-cgi 5.2.4-2ubuntu5.13
php5-cli 5.2.4-2ubuntu5.13

Ubuntu 9.10:
libapache2-mod-php5 5.2.10.dfsg.1-2ubuntu6.6
php5-cgi 5.2.10.dfsg.1-2ubuntu6.6
php5-cli 5.2.10.dfsg.1-2ubuntu6.6

Ubuntu 10.04 LTS:
libapache2-mod-php5 5.3.2-1ubuntu4.6
php5-cgi 5.3.2-1ubuntu4.6
php5-cli 5.3.2-1ubuntu4.6

Ubuntu 10.10:
libapache2-mod-php5 5.3.3-1ubuntu9.2
php5-cgi 5.3.3-1ubuntu9.2
php5-cli 5.3.3-1ubuntu9.2

In general, a standard system update will make all the necessary changes.

Details follow:

It was discovered that an integer overflow in the XML UTF-8 decoding
code could allow an attacker to bypass cross-site scripting (XSS)
protections. This issue only affected Ubuntu 6.06 LTS, Ubuntu 8.04 LTS,
and Ubuntu 9.10. (CVE-2009-5016)

It was discovered that the XML UTF-8 decoding code did not properly
handle non-shortest form UTF-8 encoding and ill-formed subsequences
in UTF-8 data, which could allow an attacker to bypass cross-site
scripting (XSS) protections. (CVE-2010-3870)

It was discovered that attackers might be able to bypass open_basedir()
restrictions by passing a specially crafted filename. (CVE-2010-3436)

Maksymilian Arciemowicz discovered that a NULL pointer derefence in the
ZIP archive handling code could allow an attacker to cause a denial
of service through a specially crafted ZIP archive. This issue only
affected Ubuntu 8.04 LTS, Ubuntu 9.10, Ubuntu 10.04 LTS, and Ubuntu
10.10. (CVE-2010-3709)

It was discovered that a stack consumption vulnerability in the
filter_var() PHP function when in FILTER_VALIDATE_EMAIL mode, could
allow a remote attacker to cause a denial of service. This issue
only affected Ubuntu 8.04 LTS, Ubuntu 9.10, Ubuntu 10.04 LTS, and
Ubuntu 10.10. (CVE-2010-3710)

It was discovered that the mb_strcut function in the Libmbfl
library within PHP could allow an attacker to read arbitrary memory
within the application process. This issue only affected Ubuntu
10.10. (CVE-2010-4156)

Maksymilian Arciemowicz discovered that an integer overflow in the
NumberFormatter::getSymbol function could allow an attacker to cause
a denial of service. This issue only affected Ubuntu 10.04 LTS and
Ubuntu 10.10. (CVE-2010-4409)

Rick Regan discovered that when handing PHP textual representations
of the largest subnormal double-precision floating-point number,
the zend_strtod function could go into an infinite loop on 32bit
x86 processors, allowing an attacker to cause a denial of service.
(CVE-2010-4645)

===========================================================
Ubuntu Security Notice USN-1041-1 January 10, 2011
linux, linux-ec2 vulnerabilities
CVE-2010-2537, CVE-2010-2538, CVE-2010-2943, CVE-2010-2962,
CVE-2010-3079, CVE-2010-3296, CVE-2010-3297, CVE-2010-3298,
CVE-2010-3301, CVE-2010-3858, CVE-2010-3861, CVE-2010-4072
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
linux-image-2.6.31-22-386 2.6.31-22.70
linux-image-2.6.31-22-generic 2.6.31-22.70
linux-image-2.6.31-22-generic-pae 2.6.31-22.70
linux-image-2.6.31-22-ia64 2.6.31-22.70
linux-image-2.6.31-22-lpia 2.6.31-22.70
linux-image-2.6.31-22-powerpc 2.6.31-22.70
linux-image-2.6.31-22-powerpc-smp 2.6.31-22.70
linux-image-2.6.31-22-powerpc64-smp 2.6.31-22.70
linux-image-2.6.31-22-server 2.6.31-22.70
linux-image-2.6.31-22-sparc64 2.6.31-22.70
linux-image-2.6.31-22-sparc64-smp 2.6.31-22.70
linux-image-2.6.31-22-virtual 2.6.31-22.70
linux-image-2.6.31-307-ec2 2.6.31-307.23

Ubuntu 10.04 LTS:
linux-image-2.6.32-27-386 2.6.32-27.49
linux-image-2.6.32-27-generic 2.6.32-27.49
linux-image-2.6.32-27-generic-pae 2.6.32-27.49
linux-image-2.6.32-27-ia64 2.6.32-27.49
linux-image-2.6.32-27-lpia 2.6.32-27.49
linux-image-2.6.32-27-powerpc 2.6.32-27.49
linux-image-2.6.32-27-powerpc-smp 2.6.32-27.49
linux-image-2.6.32-27-powerpc64-smp 2.6.32-27.49
linux-image-2.6.32-27-preempt 2.6.32-27.49
linux-image-2.6.32-27-server 2.6.32-27.49
linux-image-2.6.32-27-sparc64 2.6.32-27.49
linux-image-2.6.32-27-sparc64-smp 2.6.32-27.49
linux-image-2.6.32-27-versatile 2.6.32-27.49
linux-image-2.6.32-27-virtual 2.6.32-27.49
linux-image-2.6.32-311-ec2 2.6.32-311.23

Ubuntu 10.10:
linux-image-2.6.35-24-generic 2.6.35-24.42
linux-image-2.6.35-24-generic-pae 2.6.35-24.42
linux-image-2.6.35-24-omap 2.6.35-24.42
linux-image-2.6.35-24-powerpc 2.6.35-24.42
linux-image-2.6.35-24-powerpc-smp 2.6.35-24.42
linux-image-2.6.35-24-powerpc64-smp 2.6.35-24.42
linux-image-2.6.35-24-server 2.6.35-24.42
linux-image-2.6.35-24-versatile 2.6.35-24.42
linux-image-2.6.35-24-virtual 2.6.35-24.42

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the Ubuntu 10.04 LTS and
Ubuntu 10.10 kernel updates have been given a new version number,
which requires you to recompile and reinstall all third party kernel
modules you might have installed. If you use linux-restricted-modules,
you have to update that package as well to get modules which work with
the new kernel version. Unless you manually uninstalled the standard
kernel metapackages (e.g. linux-generic, linux-server, linux-powerpc),
a standard system upgrade will automatically perform this as well.

Details follow:

Dan Rosenberg discovered that the btrfs filesystem did not correctly
validate permissions when using the clone function. A local attacker could
overwrite the contents of file handles that were opened for append-only,
or potentially read arbitrary contents, leading to a loss of privacy. Only
Ubuntu 9.10 was affected. (CVE-2010-2537, CVE-2010-2538)

Dave Chinner discovered that the XFS filesystem did not correctly order
inode lookups when exported by NFS. A remote attacker could exploit this
to read or write disk blocks that had changed file assignement or had
become unlinked, leading to a loss of privacy. (CVE-2010-2943)

Kees Cook discovered that the Intel i915 graphics driver did not
correctly validate memory regions. A local attacker with access to the
video card could read and write arbitrary kernel memory to gain root
privileges. Ubuntu 10.10 was not affected. (CVE-2010-2962)

Robert Swiecki discovered that ftrace did not correctly handle mutexes. A
local attacker could exploit this to crash the kernel, leading to a
denial of service. (CVE-2010-3079)

Dan Rosenberg discovered that several network ioctls did not clear kernel
memory correctly. A local user could exploit this to read kernel stack
memory, leading to a loss of privacy. (CVE-2010-3296, CVE-2010-3297,
CVE-2010-3298)

Ben Hawkes discovered that the Linux kernel did not correctly filter
registers on 64bit kernels when performing 32bit system calls. On a
64bit system, a local attacker could manipulate 32bit system calls
to gain root privileges. The Ubuntu EC2 kernels needed additional
fixing. (CVE-2010-3301)

Brad Spengler discovered that stack memory for new a process was not
correctly calculated. A local attacker could exploit this to crash the
system, leading to a denial of service. (CVE-2010-3858)

Kees Cook discovered that the ethtool interface did not correctly clear
kernel memory. A local attacker could read kernel heap memory, leading
to a loss of privacy. (CVE-2010-3861)

Kees Cook and Vasiliy Kulikov discovered that the shm interface did not
clear kernel memory correctly. A local attacker could exploit this to
read kernel stack memory, leading to a loss of privacy. (CVE-2010-4072)

===========================================================
Ubuntu Security Notice USN-1040-1 January 07, 2011
python-django vulnerabilities
CVE-2010-4534, CVE-2010-4535
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
python-django 1.1.1-1ubuntu1.1

Ubuntu 10.04 LTS:
python-django 1.1.1-2ubuntu1.2

Ubuntu 10.10:
python-django 1.2.3-1ubuntu0.2.10.10.1

In general, a standard system update will make all the necessary changes.

Details follow:

Adam Baldwin discovered that Django did not properly validate query string
lookups. This could be exploited to provide an information leak to an
attacker with admin privilieges. (CVE-2010-4534)

Paul McMillan discovered that Django did not validate the length of the
token used when generating a password reset. An attacker could exploit
this to cause a denial of service via resource exhaustion. (CVE-2010-4535)

===========================================================
Ubuntu Security Notice USN-1039-1 January 07, 2011
apparmor update
https://launchpad.net/bugs/693082
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
apparmor 2.3.1+1403-0ubuntu27.4

Ubuntu 10.04 LTS:
apparmor 2.5.1-0ubuntu0.10.04.2

Ubuntu 10.10:
apparmor 2.5.1-0ubuntu0.10.10.3

In general, a standard system update will make all the necessary changes.

Details follow:

It was discovered that if AppArmor was misconfigured, under certain
circumstances the parser could generate policy using an unconfined fallback
execute transition when one was not specified.

===========================================================
Ubuntu Security Notice USN-1038-1 January 06, 2011
dpkg vulnerability
CVE-2010-1679
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
dpkg-dev 1.15.4ubuntu2.3

Ubuntu 10.04 LTS:
dpkg-dev 1.15.5.6ubuntu4.5

Ubuntu 10.10:
dpkg-dev 1.15.8.4ubuntu3.1

In general, a standard system update will make all the necessary changes.

Details follow:

Jakub Wilk and Raphaël Hertzog discovered that dpkg-source did not
correctly handle certain paths and symlinks when unpacking source-format
version 3.0 packages. If a user or an automated system were tricked into
unpacking a specially crafted source package, a remote attacker could
modify files outside the target unpack directory, leading to a denial
of service or potentially gaining access to the system.

===========================================================
Ubuntu Security Notice USN-1035-1 January 05, 2011
evince vulnerabilities
CVE-2010-2640, CVE-2010-2641, CVE-2010-2642, CVE-2010-2643
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 8.04 LTS
Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.04 LTS:
evince 2.22.2-0ubuntu2.1

Ubuntu 9.10:
evince 2.28.1-0ubuntu1.3

Ubuntu 10.04 LTS:
evince 2.30.3-0ubuntu1.2

Ubuntu 10.10:
evince 2.32.0-0ubuntu1.1

In general, a standard system update will make all the necessary changes.

Details follow:

Jon Larimer discovered that Evince's font parsers incorrectly handled
certain buffer lengths when rendering a DVI file. By tricking a user into
opening or previewing a DVI file that uses a specially crafted font file,
an attacker could crash evince or execute arbitrary code with the user's
privileges.

In the default installation of Ubuntu 9.10 and later, attackers would be
isolated by the Evince AppArmor profile.