=========================================================== Ubuntu Security Notice USN-851-1 October 21, 2009 elinks vulnerabilities CVE-2006-5925, CVE-2008-7224 ===========================================================
A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: elinks 0.10.6-1ubuntu3.4 elinks-lite 0.10.6-1ubuntu3.4 After a standard system upgrade you need to restart Elinks to effect the necessary changes. Details follow: Teemu Salmela discovered that Elinks did not properly validate input when processing smb:// URLs. If a user were tricked into viewing a malicious website and had smbclient installed, a remote attacker could execute arbitrary code with the privileges of the user invoking the program. (CVE-2006-5925) Jakub Wilk discovered a logic error in Elinks, leading to a buffer overflow. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-7224) Updated packages for Ubuntu 6.06 LTS: Source archives: http://security.ubuntu.com/ubuntu/pool/main/e/elinks/elinks_0.10.6-1ubuntu3.4.diff.gz Size/MD5: 32513 2337a42ab88b259360509ca287a7fdb4 http://security.ubuntu.com/ubuntu/pool/main/e/elinks/elinks_0.10.6-1ubuntu3.4.dsc Size/MD5: 746 35c7278a815709ad6049c98eff1e21f9 http://security.ubuntu.com/ubuntu/pool/main/e/elinks/elinks_0.10.6.orig.tar.gz Size/MD5: 3651428 0243203b9e54cf0cf002fca31244ce79 amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/e/elinks/elinks_0.10.6-1ubuntu3.4_amd64.deb Size/MD5: 907150 31ade5835f45e514e0c0b1a7dd86cc17 http://security.ubuntu.com/ubuntu/pool/universe/e/elinks/elinks-lite_0.10.6-1ubuntu3.4_amd64.deb Size/MD5: 732642 b8581260f7a96f74a4658367c4589948 i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/e/elinks/elinks_0.10.6-1ubuntu3.4_i386.deb Size/MD5: 845652 030f2fa6d5e6345322ff9e721a8e6150 http://security.ubuntu.com/ubuntu/pool/universe/e/elinks/elinks-lite_0.10.6-1ubuntu3.4_i386.deb Size/MD5: 683282 433e35cea4c997bab0363c0bdb1b327b powerpc architecture (Apple Macintosh G3/G4/G5): http://security.ubuntu.com/ubuntu/pool/main/e/elinks/elinks_0.10.6-1ubuntu3.4_powerpc.deb Size/MD5: 890200 16446dc0b839fc78d335df36fe7515bb http://security.ubuntu.com/ubuntu/pool/universe/e/elinks/elinks-lite_0.10.6-1ubuntu3.4_powerpc.deb Size/MD5: 721242 4e90bc3c72980c0337f5c05a8eb62d69 sparc architecture (Sun SPARC/UltraSPARC): http://security.ubuntu.com/ubuntu/pool/main/e/elinks/elinks_0.10.6-1ubuntu3.4_sparc.deb Size/MD5: 862772 740ae50cb4c3d0f3ca5ee4c8cf94861d http://security.ubuntu.com/ubuntu/pool/universe/e/elinks/elinks-lite_0.10.6-1ubuntu3.4_sparc.deb Size/MD5: 697860 eb467ca12766aed2c5e7c1da96a3ccff
signature.asc
Description: Digital signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/