{"cves":[{"id":"CVE-2008-4359","published":"2008-10-03T17:41:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nlighttpd before 1.4.20 compares URIs to patterns in the (1) url.redirect\nand (2) url.rewrite configuration settings before performing URL decoding,\nwhich might allow remote attackers to bypass intended access restrictions,\nand obtain sensitive information or possibly modify data.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"according to http://redmine.lighttpd.net/issues/show/1720, the\nupstream patch has been reverted due to too many regressions. As such,\nfuture versions will need to be checked to ensure it is fixed"}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-4359"],"bugs":["https://bugs.launchpad.net/ubuntu/jaunty/+source/lighttpd/+bug/279490"],"patches":{"lighttpd":["debdiff: https://bugs.launchpad.net/ubuntu/jaunty/+source/lighttpd/+bug/279490"]},"tags":{},"packages":[{"name":"lighttpd","source":"https://ubuntu.com/security/cve?package=lighttpd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=lighttpd","debian":"https://tracker.debian.org/pkg/lighttpd","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"1.4.19-5ubuntu6","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"1.4.19-5ubuntu6","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"1.4.19-5ubuntu6","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"1.4.19-5ubuntu6","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"1.4.19-5ubuntu6","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"1.4.19-5ubuntu6","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.4.19-5","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-3833","published":"2008-10-03T17:41:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe generic_file_splice_write function in fs/splice.c in the Linux kernel\nbefore 2.6.19 does not properly strip setuid and setgid bits when there is\na write to a file, which allows local users to gain the privileges of a\ndifferent group, and obtain sensitive information or possibly have\nunspecified other impact, by splicing into an inode in order to create an\nexecutable file in a setgid directory, a different vulnerability than\nCVE-2008-4210.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-3833"],"bugs":[""],"patches":{"linux-source-2.6.15":[],"linux-source-2.6.20":[],"linux-source-2.6.22":[],"linux":[]},"tags":{},"packages":[{"name":"linux","source":"https://ubuntu.com/security/cve?package=linux","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux","debian":"https://tracker.debian.org/pkg/linux","statuses":[{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.15","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.15","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.15","debian":"https://tracker.debian.org/pkg/linux-source-2.6.15","statuses":[{"release_codename":"dapper","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.20","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.20","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.20","debian":"https://tracker.debian.org/pkg/linux-source-2.6.20","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.22","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.22","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.22","debian":"https://tracker.debian.org/pkg/linux-source-2.6.22","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-3832","published":"2008-10-03T17:41:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nA certain Fedora patch for the utrace subsystem in the Linux kernel before\n2.6.26.5-28 on Fedora 8, and before 2.6.26.5-45 on Fedora 9, allows local\nusers to cause a denial of service (NULL pointer dereference and system\ncrash or hang) via a call to the utrace_control function.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-3832"],"bugs":[""],"patches":{"linux-source-2.6.15":[],"linux-source-2.6.20":[],"linux-source-2.6.22":[],"linux":[]},"tags":{},"packages":[{"name":"linux","source":"https://ubuntu.com/security/cve?package=linux","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux","debian":"https://tracker.debian.org/pkg/linux","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.15","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.15","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.15","debian":"https://tracker.debian.org/pkg/linux-source-2.6.15","statuses":[{"release_codename":"dapper","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.20","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.20","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.20","debian":"https://tracker.debian.org/pkg/linux-source-2.6.20","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.22","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.22","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.22","debian":"https://tracker.debian.org/pkg/linux-source-2.6.22","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-3825","published":"2008-10-03T15:07:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\npam_krb5 2.2.14 in Red Hat Enterprise Linux (RHEL) 5 and earlier, when the\nexisting_ticket option is enabled, uses incorrect privileges when reading a\nKerberos credential cache, which allows local users to gain privileges by\nsetting the KRB5CCNAME environment variable to an arbitrary cache filename\nand running the (1) su or (2) sudo program. NOTE: there may be a related\nvector involving sshd that has limited relevance.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-3825"],"bugs":[""],"patches":{"libpam-krb5":[]},"tags":{},"packages":[{"name":"libpam-krb5","source":"https://ubuntu.com/security/cve?package=libpam-krb5","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=libpam-krb5","debian":"https://tracker.debian.org/pkg/libpam-krb5","statuses":[{"release_codename":"dapper","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-2236","published":"2008-10-03T15:07:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nCross-site scripting (XSS) vulnerability in blosxom.cgi in Blosxom before\n2.1.2 allows remote attackers to inject arbitrary web script or HTML via\nthe flav parameter (flavour variable).  NOTE: some of these details are\nobtained from third party information.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-2236"],"bugs":[""],"patches":{"blosxom":[]},"tags":{},"packages":[{"name":"blosxom","source":"https://ubuntu.com/security/cve?package=blosxom","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=blosxom","debian":"https://tracker.debian.org/pkg/blosxom","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"2.1.2-1","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"2.1.2-1","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"2.1.2-1","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"2.1.2-1","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"2.1.2-1","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"2.1.2-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.1.2","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-4382","published":"2008-10-02T18:18:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nKonqueror in KDE 3.5.9 allows remote attackers to cause a denial of service\n(application crash) via Javascript that calls the alert function with a\nURL-encoded string of a large number of invalid characters.","ubuntu_description":"","notes":[{"author":"kees","note":"Browser DoS is not strictly a security issue."},{"author":"mdeslaur","note":"as of 2009-08-21, no details, no fix\nbrowser DoS, no security issue, ignoring."}],"codename":null,"priority":"negligible","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-4382"],"bugs":[""],"patches":{"kdebase":[]},"tags":{},"packages":[{"name":"kdebase","source":"https://ubuntu.com/security/cve?package=kdebase","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=kdebase","debian":"https://tracker.debian.org/pkg/kdebase","statuses":[{"release_codename":"dapper","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needed","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-3522","published":"2008-10-02T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent\nattackers to have an unknown impact via vectors related to the mif_hdr_put\nfunction and use of vsprintf.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-742-1","https://ubuntu.com/security/notices/USN-1317-1","https://www.cve.org/CVERecord?id=CVE-2008-3522"],"bugs":["http://bugs.gentoo.org/show_bug.cgi?id=222819","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-3522","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=501021"],"patches":{"jasper":["vendor: https://bugzilla.redhat.com/attachment.cgi?id=316079","vendor: http://patch-tracking.debian.net/patch/series/view/jasper/1.900.1-5.1/02_security.dpatch"],"ghostscript":[]},"tags":{},"packages":[{"name":"ghostscript","source":"https://ubuntu.com/security/cve?package=ghostscript","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ghostscript","debian":"https://tracker.debian.org/pkg/ghostscript","statuses":[{"release_codename":"hardy","status":"released","description":"8.61.dfsg.1-1ubuntu3.4","component":null,"pocket":"security"},{"release_codename":"lucid","status":"released","description":"8.71.dfsg.1-0ubuntu5.4","component":null,"pocket":"security"},{"release_codename":"maverick","status":"released","description":"8.71.dfsg.2-0ubuntu7.1","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"uses system jasper","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"uses system jasper","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"jasper","source":"https://ubuntu.com/security/cve?package=jasper","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=jasper","debian":"https://tracker.debian.org/pkg/jasper","statuses":[{"release_codename":"dapper","status":"released","description":"1.701.0-2ubuntu0.6.06.1","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"1.900.1-3ubuntu0.7.10.1","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"1.900.1-3ubuntu0.8.04.1","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"1.900.1-5ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.900.1-5.1","component":null,"pocket":"security"}]}],"notices_ids":["USN-742-1","USN-1317-1"],"notices":[{"id":"USN-742-1","title":"JasPer vulnerabilities","summary":"JasPer vulnerabilities","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.\n","references":[],"published":"2009-03-19T17:09:50.144253","description":"It was discovered that JasPer did not correctly handle memory allocation\nwhen parsing certain malformed JPEG2000 images. If a user were tricked into\nopening a specially crafted image with an application that uses libjasper,\nan attacker could cause a denial of service and possibly execute arbitrary\ncode with the user's privileges. (CVE-2008-3520)\n\nIt was discovered that JasPer created temporary files in an insecure way.\nLocal users could exploit a race condition and cause a denial of service in\nlibjasper applications.\n(CVE-2008-3521)\n\nIt was discovered that JasPer did not correctly handle certain formatting\noperations. If a user were tricked into opening a specially crafted image\nwith an application that uses libjasper, an attacker could cause a denial\nof service and possibly execute arbitrary code with the user's privileges.\n(CVE-2008-3522)\n","is_hidden":false,"release_packages":{"gutsy":[{"name":"jasper","version":"1.900.1-3ubuntu0.7.10.1","description":"","is_source":true},{"name":"libjasper1","version":"1.900.1-3ubuntu0.7.10.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/jasper","version_link":"https://launchpad.net/ubuntu/+source/jasper/1.900.1-3ubuntu0.7.10.1"}],"dapper":[{"name":"jasper","version":"1.701.0-2ubuntu0.6.06.1","description":"","is_source":true},{"name":"libjasper-1.701-1","version":"1.701.0-2ubuntu0.6.06.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/jasper","version_link":"https://launchpad.net/ubuntu/+source/jasper/1.701.0-2ubuntu0.6.06.1"}],"intrepid":[{"name":"jasper","version":"1.900.1-5ubuntu0.1","description":"","is_source":true},{"name":"libjasper1","version":"1.900.1-5ubuntu0.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/jasper","version_link":"https://launchpad.net/ubuntu/+source/jasper/1.900.1-5ubuntu0.1"}],"hardy":[{"name":"jasper","version":"1.900.1-3ubuntu0.8.04.1","description":"","is_source":true},{"name":"libjasper1","version":"1.900.1-3ubuntu0.8.04.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/jasper","version_link":"https://launchpad.net/ubuntu/+source/jasper/1.900.1-3ubuntu0.8.04.1"}]},"type":"USN","cves_ids":["CVE-2008-3520","CVE-2008-3521","CVE-2008-3522"]},{"id":"USN-1317-1","title":"Ghostscript vulnerabilities","summary":"Ghostscript could be made to crash or run programs as your login if it\nopened a specially crafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2012-01-04T14:29:33.662972","description":"It was discovered that Ghostscript did not correctly handle memory\nallocation when parsing certain malformed JPEG-2000 images. If a user or\nautomated system were tricked into opening a specially crafted image, an\nattacker could cause a denial of service and possibly execute arbitrary\ncode with user privileges. (CVE-2008-3520)\n\nIt was discovered that Ghostscript did not correctly handle certain\nformatting operations when parsing JPEG-2000 images. If a user or automated\nsystem were tricked into opening a specially crafted image, an attacker\ncould cause a denial of service and possibly execute arbitrary code with\nuser privileges. (CVE-2008-3522)\n\nIt was discovered that Ghostscript incorrectly handled certain malformed\nTrueType fonts. If a user or automated system were tricked into opening a\ndocument containing a specially crafted font, an attacker could cause a\ndenial of service and possibly execute arbitrary code with user privileges.\nThis issue only affected Ubuntu 8.04 LTS. (CVE-2009-3743)\n\nIt was discovered that Ghostscript incorrectly handled certain malformed\nType 2 fonts. If a user or automated system were tricked into opening a\ndocument containing a specially crafted font, an attacker could cause a\ndenial of service and possibly execute arbitrary code with user privileges.\nThis issue only affected Ubuntu 8.04 LTS. (CVE-2010-4054)\n\nJonathan Foote discovered that Ghostscript incorrectly handled certain\nmalformed JPEG-2000 image files. If a user or automated system were tricked\ninto opening a specially crafted JPEG-2000 image file, an attacker could\ncause Ghostscript to crash or possibly execute arbitrary code with user\nprivileges. (CVE-2011-4516, CVE-2011-4517)\n","is_hidden":false,"release_packages":{"hardy":[{"name":"ghostscript","version":"8.61.dfsg.1-1ubuntu3.4","description":"The GPL Ghostscript PostScript/PDF interpreter","is_source":true},{"name":"libgs8","version":"8.61.dfsg.1-1ubuntu3.4","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/ghostscript","version_link":"https://launchpad.net/ubuntu/+source/ghostscript/8.61.dfsg.1-1ubuntu3.4"}],"lucid":[{"name":"ghostscript","version":"8.71.dfsg.1-0ubuntu5.4","description":"The GPL Ghostscript PostScript/PDF interpreter","is_source":true},{"name":"libgs8","version":"8.71.dfsg.1-0ubuntu5.4","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/ghostscript","version_link":"https://launchpad.net/ubuntu/+source/ghostscript/8.71.dfsg.1-0ubuntu5.4"}],"maverick":[{"name":"ghostscript","version":"8.71.dfsg.2-0ubuntu7.1","description":"The GPL Ghostscript PostScript/PDF interpreter","is_source":true},{"name":"libgs8","version":"8.71.dfsg.2-0ubuntu7.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/ghostscript","version_link":"https://launchpad.net/ubuntu/+source/ghostscript/8.71.dfsg.2-0ubuntu7.1"}]},"type":"USN","cves_ids":["CVE-2008-3520","CVE-2008-3522","CVE-2009-3743","CVE-2010-4054","CVE-2011-4516","CVE-2011-4517"]}]},{"id":"CVE-2008-3521","published":"2008-10-02T00:00:00","updated_at":"2025-08-04T19:23:19.328030+00:00","description":"\nRace condition in the jas_stream_tmpfile function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 allows local users to cause a\ndenial of service (program exit) by creating the appropriate tmp.XXXXXXXXXX\ntemporary file, which causes Jasper to exit.  NOTE: this was originally\nreported as a symlink issue, but this was incorrect.  NOTE: some vendors\ndispute the severity of this issue, but it satisfies CVE's requirements for\ninclusion.","ubuntu_description":"","notes":[{"author":"kees","note":"opened with O_EXCL"},{"author":"mdeslaur","note":"ghostscript jasper already uses appropriate temp filename"}],"codename":null,"priority":"negligible","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-742-1","https://www.cve.org/CVERecord?id=CVE-2008-3521"],"bugs":["http://bugs.gentoo.org/show_bug.cgi?id=222819","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-3521","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=501021"],"patches":{"jasper":["vendor: http://patch-tracking.debian.net/patch/series/view/jasper/1.900.1-5.1/02_security.dpatch"],"ghostscript":[]},"tags":{},"packages":[{"name":"ghostscript","source":"https://ubuntu.com/security/cve?package=ghostscript","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ghostscript","debian":"https://tracker.debian.org/pkg/ghostscript","statuses":[{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"uses system jasper","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"uses system jasper","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"jasper","source":"https://ubuntu.com/security/cve?package=jasper","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=jasper","debian":"https://tracker.debian.org/pkg/jasper","statuses":[{"release_codename":"dapper","status":"released","description":"1.701.0-2ubuntu0.6.06.1","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"1.900.1-3ubuntu0.7.10.1","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"1.900.1-3ubuntu0.8.04.1","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"1.900.1-5ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.900.1-5.1","component":null,"pocket":"security"}]}],"notices_ids":["USN-742-1"],"notices":[{"id":"USN-742-1","title":"JasPer vulnerabilities","summary":"JasPer vulnerabilities","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.\n","references":[],"published":"2009-03-19T17:09:50.144253","description":"It was discovered that JasPer did not correctly handle memory allocation\nwhen parsing certain malformed JPEG2000 images. If a user were tricked into\nopening a specially crafted image with an application that uses libjasper,\nan attacker could cause a denial of service and possibly execute arbitrary\ncode with the user's privileges. (CVE-2008-3520)\n\nIt was discovered that JasPer created temporary files in an insecure way.\nLocal users could exploit a race condition and cause a denial of service in\nlibjasper applications.\n(CVE-2008-3521)\n\nIt was discovered that JasPer did not correctly handle certain formatting\noperations. If a user were tricked into opening a specially crafted image\nwith an application that uses libjasper, an attacker could cause a denial\nof service and possibly execute arbitrary code with the user's privileges.\n(CVE-2008-3522)\n","is_hidden":false,"release_packages":{"gutsy":[{"name":"jasper","version":"1.900.1-3ubuntu0.7.10.1","description":"","is_source":true},{"name":"libjasper1","version":"1.900.1-3ubuntu0.7.10.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/jasper","version_link":"https://launchpad.net/ubuntu/+source/jasper/1.900.1-3ubuntu0.7.10.1"}],"dapper":[{"name":"jasper","version":"1.701.0-2ubuntu0.6.06.1","description":"","is_source":true},{"name":"libjasper-1.701-1","version":"1.701.0-2ubuntu0.6.06.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/jasper","version_link":"https://launchpad.net/ubuntu/+source/jasper/1.701.0-2ubuntu0.6.06.1"}],"intrepid":[{"name":"jasper","version":"1.900.1-5ubuntu0.1","description":"","is_source":true},{"name":"libjasper1","version":"1.900.1-5ubuntu0.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/jasper","version_link":"https://launchpad.net/ubuntu/+source/jasper/1.900.1-5ubuntu0.1"}],"hardy":[{"name":"jasper","version":"1.900.1-3ubuntu0.8.04.1","description":"","is_source":true},{"name":"libjasper1","version":"1.900.1-3ubuntu0.8.04.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/jasper","version_link":"https://launchpad.net/ubuntu/+source/jasper/1.900.1-3ubuntu0.8.04.1"}]},"type":"USN","cves_ids":["CVE-2008-3520","CVE-2008-3521","CVE-2008-3522"]}]},{"id":"CVE-2008-3520","published":"2008-10-02T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMultiple integer overflows in JasPer 1.900.1 might allow context-dependent\nattackers to have an unknown impact via a crafted image file, related to\ninteger multiplication for memory allocation.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"RH released netpbm with this CVE, as it shared code with jasper\nour netpbm-free doesn't appear to."}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-742-1","https://ubuntu.com/security/notices/USN-1317-1","https://www.cve.org/CVERecord?id=CVE-2008-3520"],"bugs":["https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-3520","http://bugs.gentoo.org/show_bug.cgi?id=222819","http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=501021"],"patches":{"jasper":["vendor: https://bugzilla.redhat.com/attachment.cgi?id=325790","vendor: http://patch-tracking.debian.net/patch/series/view/jasper/1.900.1-5.1/02_security.dpatch"],"ghostscript":[]},"tags":{},"packages":[{"name":"ghostscript","source":"https://ubuntu.com/security/cve?package=ghostscript","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ghostscript","debian":"https://tracker.debian.org/pkg/ghostscript","statuses":[{"release_codename":"hardy","status":"released","description":"8.61.dfsg.1-1ubuntu3.4","component":null,"pocket":"security"},{"release_codename":"lucid","status":"released","description":"8.71.dfsg.1-0ubuntu5.4","component":null,"pocket":"security"},{"release_codename":"maverick","status":"released","description":"8.71.dfsg.2-0ubuntu7.1","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"uses system jasper","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"uses system jasper","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"jasper","source":"https://ubuntu.com/security/cve?package=jasper","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=jasper","debian":"https://tracker.debian.org/pkg/jasper","statuses":[{"release_codename":"dapper","status":"released","description":"1.701.0-2ubuntu0.6.06.1","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"1.900.1-3ubuntu0.7.10.1","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"1.900.1-3ubuntu0.8.04.1","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"1.900.1-5ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.900.1-5.1","component":null,"pocket":"security"}]}],"notices_ids":["USN-742-1","USN-1317-1"],"notices":[{"id":"USN-742-1","title":"JasPer vulnerabilities","summary":"JasPer vulnerabilities","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.\n","references":[],"published":"2009-03-19T17:09:50.144253","description":"It was discovered that JasPer did not correctly handle memory allocation\nwhen parsing certain malformed JPEG2000 images. If a user were tricked into\nopening a specially crafted image with an application that uses libjasper,\nan attacker could cause a denial of service and possibly execute arbitrary\ncode with the user's privileges. (CVE-2008-3520)\n\nIt was discovered that JasPer created temporary files in an insecure way.\nLocal users could exploit a race condition and cause a denial of service in\nlibjasper applications.\n(CVE-2008-3521)\n\nIt was discovered that JasPer did not correctly handle certain formatting\noperations. If a user were tricked into opening a specially crafted image\nwith an application that uses libjasper, an attacker could cause a denial\nof service and possibly execute arbitrary code with the user's privileges.\n(CVE-2008-3522)\n","is_hidden":false,"release_packages":{"gutsy":[{"name":"jasper","version":"1.900.1-3ubuntu0.7.10.1","description":"","is_source":true},{"name":"libjasper1","version":"1.900.1-3ubuntu0.7.10.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/jasper","version_link":"https://launchpad.net/ubuntu/+source/jasper/1.900.1-3ubuntu0.7.10.1"}],"dapper":[{"name":"jasper","version":"1.701.0-2ubuntu0.6.06.1","description":"","is_source":true},{"name":"libjasper-1.701-1","version":"1.701.0-2ubuntu0.6.06.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/jasper","version_link":"https://launchpad.net/ubuntu/+source/jasper/1.701.0-2ubuntu0.6.06.1"}],"intrepid":[{"name":"jasper","version":"1.900.1-5ubuntu0.1","description":"","is_source":true},{"name":"libjasper1","version":"1.900.1-5ubuntu0.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/jasper","version_link":"https://launchpad.net/ubuntu/+source/jasper/1.900.1-5ubuntu0.1"}],"hardy":[{"name":"jasper","version":"1.900.1-3ubuntu0.8.04.1","description":"","is_source":true},{"name":"libjasper1","version":"1.900.1-3ubuntu0.8.04.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/jasper","version_link":"https://launchpad.net/ubuntu/+source/jasper/1.900.1-3ubuntu0.8.04.1"}]},"type":"USN","cves_ids":["CVE-2008-3520","CVE-2008-3521","CVE-2008-3522"]},{"id":"USN-1317-1","title":"Ghostscript vulnerabilities","summary":"Ghostscript could be made to crash or run programs as your login if it\nopened a specially crafted file.\n","instructions":"In general, a standard system update will make all the necessary changes.\n","references":[],"published":"2012-01-04T14:29:33.662972","description":"It was discovered that Ghostscript did not correctly handle memory\nallocation when parsing certain malformed JPEG-2000 images. If a user or\nautomated system were tricked into opening a specially crafted image, an\nattacker could cause a denial of service and possibly execute arbitrary\ncode with user privileges. (CVE-2008-3520)\n\nIt was discovered that Ghostscript did not correctly handle certain\nformatting operations when parsing JPEG-2000 images. If a user or automated\nsystem were tricked into opening a specially crafted image, an attacker\ncould cause a denial of service and possibly execute arbitrary code with\nuser privileges. (CVE-2008-3522)\n\nIt was discovered that Ghostscript incorrectly handled certain malformed\nTrueType fonts. If a user or automated system were tricked into opening a\ndocument containing a specially crafted font, an attacker could cause a\ndenial of service and possibly execute arbitrary code with user privileges.\nThis issue only affected Ubuntu 8.04 LTS. (CVE-2009-3743)\n\nIt was discovered that Ghostscript incorrectly handled certain malformed\nType 2 fonts. If a user or automated system were tricked into opening a\ndocument containing a specially crafted font, an attacker could cause a\ndenial of service and possibly execute arbitrary code with user privileges.\nThis issue only affected Ubuntu 8.04 LTS. (CVE-2010-4054)\n\nJonathan Foote discovered that Ghostscript incorrectly handled certain\nmalformed JPEG-2000 image files. If a user or automated system were tricked\ninto opening a specially crafted JPEG-2000 image file, an attacker could\ncause Ghostscript to crash or possibly execute arbitrary code with user\nprivileges. (CVE-2011-4516, CVE-2011-4517)\n","is_hidden":false,"release_packages":{"hardy":[{"name":"ghostscript","version":"8.61.dfsg.1-1ubuntu3.4","description":"The GPL Ghostscript PostScript/PDF interpreter","is_source":true},{"name":"libgs8","version":"8.61.dfsg.1-1ubuntu3.4","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/ghostscript","version_link":"https://launchpad.net/ubuntu/+source/ghostscript/8.61.dfsg.1-1ubuntu3.4"}],"lucid":[{"name":"ghostscript","version":"8.71.dfsg.1-0ubuntu5.4","description":"The GPL Ghostscript PostScript/PDF interpreter","is_source":true},{"name":"libgs8","version":"8.71.dfsg.1-0ubuntu5.4","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/ghostscript","version_link":"https://launchpad.net/ubuntu/+source/ghostscript/8.71.dfsg.1-0ubuntu5.4"}],"maverick":[{"name":"ghostscript","version":"8.71.dfsg.2-0ubuntu7.1","description":"The GPL Ghostscript PostScript/PDF interpreter","is_source":true},{"name":"libgs8","version":"8.71.dfsg.2-0ubuntu7.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/ghostscript","version_link":"https://launchpad.net/ubuntu/+source/ghostscript/8.71.dfsg.2-0ubuntu7.1"}]},"type":"USN","cves_ids":["CVE-2008-3520","CVE-2008-3522","CVE-2009-3743","CVE-2010-4054","CVE-2011-4516","CVE-2011-4517"]}]},{"id":"CVE-2008-4094","published":"2008-09-30T17:22:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMultiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow\nremote attackers to execute arbitrary SQL commands via the (1) :limit and\n(2) :offset parameters, related to ActiveRecord, ActiveSupport,\nActiveResource, ActionPack, and ActionMailer.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-4094"],"bugs":[""],"patches":{"rails":[]},"tags":{},"packages":[{"name":"rails","source":"https://ubuntu.com/security/cve?package=rails","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rails","debian":"https://tracker.debian.org/pkg/rails","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"2.1.0-6","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"2.1.0-6","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"2.1.0-6","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"2.1.0-6","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"2.1.0-6","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.1.0-4","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-4326","published":"2008-09-30T16:13:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe PMA_escapeJsString function in libraries/js_escape.lib.php in\nphpMyAdmin before 2.11.9.2, when Internet Explorer is used, allows remote\nattackers to bypass cross-site scripting (XSS) protection mechanisms and\nconduct XSS attacks via a NUL byte inside a \"</script\" sequence.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-4326"],"bugs":[""],"patches":{"phpmyadmin":["upstream: http://phpmyadmin.svn.sourceforge.net/viewvc/phpmyadmin/branches/MAINT_2_11_9/phpMyAdmin/libraries/js_escape.lib.php?view=patch&r1=11514&r2=11603&pathrev=11603"]},"tags":{},"packages":[{"name":"phpmyadmin","source":"https://ubuntu.com/security/cve?package=phpmyadmin","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=phpmyadmin","debian":"https://tracker.debian.org/pkg/phpmyadmin","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"4:2.11.3-1ubuntu1.2","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"4:2.11.8.1-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"4:3.1.2-1","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"4:3.2.0.1-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"4:2.11.8.1-3","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-4325","published":"2008-09-30T16:13:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nlib/viewvc.py in ViewVC 1.0.5 uses the content-type parameter in the HTTP\nrequest for the Content-Type header in the HTTP response, which allows\nremote attackers to cause content to be misinterpreted by the browser via a\ncontent-type parameter that is inconsistent with the requested object.\nNOTE: this issue might not be a vulnerability, since it requires attacker\naccess to the repository that is being viewed.","ubuntu_description":"","notes":[],"codename":null,"priority":"negligible","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-4325"],"bugs":[""],"patches":{"viewvc":[]},"tags":{},"packages":[{"name":"viewvc","source":"https://ubuntu.com/security/cve?package=viewvc","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=viewvc","debian":"https://tracker.debian.org/pkg/viewvc","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"karmic","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"1.0.9-1","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"1.0.9-1","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"1.0.9-1","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"1.0.9-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.0.9-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-4324","published":"2008-09-29T20:09:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe user interface event dispatcher in Mozilla Firefox 3.0.3 on Windows XP\nSP2 allows remote attackers to cause a denial of service (NULL pointer\ndereference and application crash) via a series of keypress, click,\nonkeydown, onkeyup, onmousedown, and onmouseup events.  NOTE: it was later\nreported that Firefox 3.0.2 on Mac OS X 10.5 is also affected.","ubuntu_description":"","notes":[{"author":"kees","note":"not treated as a security issue: browser crash-only"}],"codename":null,"priority":"negligible","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-4324"],"bugs":[""],"patches":{"firefox":[],"firefox-3.0":[],"iceweasel":[],"xulrunner":[],"xulrunner-1.9":[],"seamonkey":[],"iceape":[],"thunderbird":[],"mozilla-thunderbird":[],"icedove":[]},"tags":{},"packages":[{"name":"firefox","source":"https://ubuntu.com/security/cve?package=firefox","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=firefox","debian":"https://tracker.debian.org/pkg/firefox","statuses":[{"release_codename":"dapper","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"firefox-3.0","source":"https://ubuntu.com/security/cve?package=firefox-3.0","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=firefox-3.0","debian":"https://tracker.debian.org/pkg/firefox-3.0","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"iceape","source":"https://ubuntu.com/security/cve?package=iceape","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=iceape","debian":"https://tracker.debian.org/pkg/iceape","statuses":[{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"icedove","source":"https://ubuntu.com/security/cve?package=icedove","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=icedove","debian":"https://tracker.debian.org/pkg/icedove","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"iceweasel","source":"https://ubuntu.com/security/cve?package=iceweasel","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=iceweasel","debian":"https://tracker.debian.org/pkg/iceweasel","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"mozilla-thunderbird","source":"https://ubuntu.com/security/cve?package=mozilla-thunderbird","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mozilla-thunderbird","debian":"https://tracker.debian.org/pkg/mozilla-thunderbird","statuses":[{"release_codename":"dapper","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"seamonkey","source":"https://ubuntu.com/security/cve?package=seamonkey","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=seamonkey","debian":"https://tracker.debian.org/pkg/seamonkey","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"thunderbird","source":"https://ubuntu.com/security/cve?package=thunderbird","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=thunderbird","debian":"https://tracker.debian.org/pkg/thunderbird","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xulrunner","source":"https://ubuntu.com/security/cve?package=xulrunner","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xulrunner","debian":"https://tracker.debian.org/pkg/xulrunner","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xulrunner-1.9","source":"https://ubuntu.com/security/cve?package=xulrunner-1.9","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xulrunner-1.9","debian":"https://tracker.debian.org/pkg/xulrunner-1.9","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-3827","published":"2008-09-29T19:25:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMultiple integer underflows in the Real demuxer (demux_real.c) in MPlayer\n1.0_rc2 and earlier allow remote attackers to cause a denial of service\n(process termination) and possibly execute arbitrary code via a crafted\nvideo file that causes the stream_read function to read or write arbitrary\nmemory.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-3827"],"bugs":["https://bugs.launchpad.net/ubuntu/+source/mplayer/+bug/279030"],"patches":{"mplayer":[]},"tags":{},"packages":[{"name":"mplayer","source":"https://ubuntu.com/security/cve?package=mplayer","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mplayer","debian":"https://tracker.debian.org/pkg/mplayer","statuses":[{"release_codename":"dapper","status":"released","description":"2:0.99+1.0pre7try2+cvs20060117-0ubuntu8.3","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"2:1.0~rc1-0ubuntu13.3","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"2:1.0~rc2-0ubuntu13.1","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"2:1.0~rc2-0ubuntu17","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-4302","published":"2008-09-29T17:17:00","updated_at":"2025-08-25T19:39:26.958341+00:00","description":"\nfs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2\ndoes not properly handle a failure of the add_to_page_cache_lru function,\nand subsequently attempts to unlock a page that was not locked, which\nallows local users to cause a denial of service (kernel BUG and system\ncrash), as demonstrated by the fio I/O tool.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":5.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-4302"],"bugs":[""],"patches":{"linux-source-2.6.15":["vendor: http://svn.debian.org/wsvn/kernel/dists/etch-security/linux-2.6/debian/patches/bugfix/splice-fix-bad-unlock_page-in-error-case.patch"],"linux-source-2.6.20":[],"linux-source-2.6.22":[],"linux":[]},"tags":{},"packages":[{"name":"linux","source":"https://ubuntu.com/security/cve?package=linux","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux","debian":"https://tracker.debian.org/pkg/linux","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.6.22.2","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.15","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.15","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.15","debian":"https://tracker.debian.org/pkg/linux-source-2.6.15","statuses":[{"release_codename":"dapper","status":"not-affected","description":"code not present","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"code not present","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.20","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.20","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.20","debian":"https://tracker.debian.org/pkg/linux-source-2.6.20","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needed","description":"","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.22","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.22","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.22","debian":"https://tracker.debian.org/pkg/linux-source-2.6.22","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.6.22.2","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-4210","published":"2008-09-29T17:17:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nfs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid\nand setgid bits when there is a write to a file, which allows local users\nto gain the privileges of a different group, and obtain sensitive\ninformation or possibly have unspecified other impact, by creating an\nexecutable file in a setgid directory through the (1) truncate or (2)\nftruncate function in conjunction with memory-mapped I/O.","ubuntu_description":"\nDavid Watson discovered that the kernel did not correctly strip\npermissions when creating files in setgid directories.  A local user\ncould exploit this to gain additional group privileges.  This issue\nonly affected Ubuntu 6.06.","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-679-1","https://www.cve.org/CVERecord?id=CVE-2008-4210"],"bugs":[""],"patches":{"linux-source-2.6.15":["vendor: http://svn.debian.org/wsvn/kernel/dists/etch-security/linux-2.6/debian/patches/bugfix/open-allows-sgid-in-sgid-directory.patch"],"linux-source-2.6.20":[],"linux-source-2.6.22":[],"linux":[]},"tags":{},"packages":[{"name":"linux","source":"https://ubuntu.com/security/cve?package=linux","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux","debian":"https://tracker.debian.org/pkg/linux","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.6.22","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.15","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.15","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.15","debian":"https://tracker.debian.org/pkg/linux-source-2.6.15","statuses":[{"release_codename":"dapper","status":"released","description":"2.6.15-53.74","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needed","description":"","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.20","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.20","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.20","debian":"https://tracker.debian.org/pkg/linux-source-2.6.20","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needed","description":"","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.22","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.22","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.22","debian":"https://tracker.debian.org/pkg/linux-source-2.6.22","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-679-1"],"notices":[{"id":"USN-679-1","title":"Linux kernel vulnerabilities","summary":"Linux kernel vulnerabilities","instructions":"After a standard system upgrade you need to reboot your computer to\neffect the necessary changes.\n\nATTENTION: Due to an unavoidable ABI change the kernel updates have\nbeen given a new version number, which requires you to recompile and\nreinstall all third party kernel modules you might have installed. If\nyou use linux-restricted-modules, you have to update that package as\nwell to get modules which work with the new kernel version. Unless you\nmanually uninstalled the standard kernel metapackages (e.g. linux-generic,\nlinux-server, linux-powerpc), a standard system upgrade will automatically\nperform this as well.\n","references":[],"published":"2008-11-27T17:43:01.542705","description":"It was discovered that the Xen hypervisor block driver did not correctly\nvalidate requests. A user with root privileges in a guest OS could make a\nmalicious IO request with a large number of blocks that would crash the\nhost OS, leading to a denial of service. This only affected Ubuntu 7.10.\n(CVE-2007-5498)\n\nIt was discovered the the i915 video driver did not correctly validate\nmemory addresses. A local attacker could exploit this to remap memory that\ncould cause a system crash, leading to a denial of service. This issue did\nnot affect Ubuntu 6.06 and was previous fixed for Ubuntu 7.10 and 8.04 in\nUSN-659-1. Ubuntu 8.10 has now been corrected as well. (CVE-2008-3831)\n\nDavid Watson discovered that the kernel did not correctly strip permissions\nwhen creating files in setgid directories. A local user could exploit this\nto gain additional group privileges. This issue only affected Ubuntu 6.06.\n(CVE-2008-4210)\n\nOlaf Kirch and Miklos Szeredi discovered that the Linux kernel did\nnot correctly reject the \"append\" flag when handling file splice\nrequests. A local attacker could bypass append mode and make changes to\narbitrary locations in a file. This issue only affected Ubuntu 7.10 and\n8.04. (CVE-2008-4554)\n\nIt was discovered that the SCTP stack did not correctly handle INIT-ACK. A\nremote user could exploit this by sending specially crafted SCTP traffic\nwhich would trigger a crash in the system, leading to a denial of service.\nThis issue did not affect Ubuntu 8.10. (CVE-2008-4576)\n\nIt was discovered that the SCTP stack did not correctly handle bad packet\nlengths. A remote user could exploit this by sending specially crafted SCTP\ntraffic which would trigger a crash in the system, leading to a denial of\nservice. This issue did not affect Ubuntu 8.10. (CVE-2008-4618)\n\nEric Sesterhenn discovered multiple flaws in the HFS+ filesystem. If a\nlocal user or automated system were tricked into mounting a malicious HFS+\nfilesystem, the system could crash, leading to a denial of service.\n(CVE-2008-4933, CVE-2008-4934, CVE-2008-5025)\n\nIt was discovered that the Unix Socket handler did not correctly process\nthe SCM_RIGHTS message. A local attacker could make a malicious socket\nrequest that would crash the system, leading to a denial of service.\n(CVE-2008-5029)\n\nIt was discovered that the driver for simple i2c audio interfaces did not\ncorrectly validate certain function pointers. A local user could exploit\nthis to gain root privileges or crash the system, leading to a denial of\nservice. (CVE-2008-5033)\n","is_hidden":false,"release_packages":{"gutsy":[{"name":"linux-backports-modules-2.6.22","version":"2.6.22-16.17","description":"","is_source":true},{"name":"linux-ubuntu-modules-2.6.22","version":"2.6.22-16.41","description":"","is_source":true},{"name":"linux-restricted-modules-2.6.22","version":"2.6.22.4-16.12","description":"","is_source":true},{"name":"linux-source-2.6.22","version":"2.6.22-16.60","description":"","is_source":true},{"name":"linux-image-2.6.22-16-mckinley","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"},{"name":"linux-image-2.6.22-16-powerpc64-smp","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"},{"name":"linux-image-2.6.22-16-virtual","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"},{"name":"linux-image-2.6.22-16-cell","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"},{"name":"linux-image-2.6.22-16-hppa64","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"},{"name":"linux-image-2.6.22-16-sparc64-smp","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"},{"name":"linux-image-2.6.22-16-generic","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"},{"name":"linux-image-2.6.22-16-lpia","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"},{"name":"linux-image-2.6.22-16-powerpc-smp","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"},{"name":"linux-image-2.6.22-16-386","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"},{"name":"linux-image-2.6.22-16-hppa32","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"},{"name":"linux-image-2.6.22-16-rt","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"},{"name":"linux-image-2.6.22-16-xen","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"},{"name":"linux-image-2.6.22-16-powerpc","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"},{"name":"linux-image-2.6.22-16-itanium","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"},{"name":"linux-image-2.6.22-16-lpiacompat","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"},{"name":"linux-image-2.6.22-16-ume","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"},{"name":"linux-image-2.6.22-16-sparc64","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"},{"name":"linux-image-2.6.22-16-server","version":"2.6.22-16.60","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-16.60"}],"dapper":[{"name":"linux-restricted-modules-2.6.15","version":"2.6.15.12-53.4","description":"","is_source":true},{"name":"linux-source-2.6.15","version":"2.6.15-53.74","description":"","is_source":true},{"name":"linux-backports-modules-2.6.15","version":"2.6.15-53.11","description":"","is_source":true},{"name":"linux-image-2.6.15-53-powerpc64-smp","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-powerpc","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-amd64-xeon","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-386","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-amd64-generic","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-686","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-hppa64","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-sparc64","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-amd64-server","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-amd64-k8","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-hppa64-smp","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-sparc64-smp","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-itanium-smp","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-hppa32","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-hppa32-smp","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-mckinley","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-powerpc-smp","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-server-bigiron","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-mckinley-smp","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-server","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-itanium","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"},{"name":"linux-image-2.6.15-53-k7","version":"2.6.15-53.74","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-53.74"}],"intrepid":[{"name":"linux-restricted-modules","version":"2.6.27-9.13","description":"","is_source":true},{"name":"linux-backports-modules-2.6.27","version":"2.6.27-9.5","description":"","is_source":true},{"name":"linux","version":"2.6.27-9.19","description":"","is_source":true},{"name":"linux-image-2.6.27-9-virtual","version":"2.6.27-9.19","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.27-9.19"},{"name":"linux-image-2.6.27-9-generic","version":"2.6.27-9.19","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.27-9.19"},{"name":"linux-image-2.6.27-9-server","version":"2.6.27-9.19","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.27-9.19"}],"hardy":[{"name":"linux-restricted-modules-2.6.24","version":"2.6.24.14-22.53","description":"","is_source":true},{"name":"linux-ubuntu-modules-2.6.24","version":"2.6.24-22.35","description":"","is_source":true},{"name":"linux","version":"2.6.24-22.45","description":"","is_source":true},{"name":"linux-backports-modules-2.6.24","version":"2.6.24-22.29","description":"","is_source":true},{"name":"linux-image-2.6.24-22-powerpc","version":"2.6.24-22.45","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-22.45"},{"name":"linux-image-2.6.24-22-sparc64","version":"2.6.24-22.45","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-22.45"},{"name":"linux-image-2.6.24-22-virtual","version":"2.6.24-22.45","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-22.45"},{"name":"linux-image-2.6.24-22-server","version":"2.6.24-22.45","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-22.45"},{"name":"linux-image-2.6.24-22-lpia","version":"2.6.24-22.45","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-22.45"},{"name":"linux-image-2.6.24-22-hppa32","version":"2.6.24-22.45","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-22.45"},{"name":"linux-image-2.6.24-22-lpiacompat","version":"2.6.24-22.45","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-22.45"},{"name":"linux-image-2.6.24-22-rt","version":"2.6.24-22.45","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-22.45"},{"name":"linux-image-2.6.24-22-generic","version":"2.6.24-22.45","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-22.45"},{"name":"linux-image-2.6.24-22-hppa64","version":"2.6.24-22.45","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-22.45"},{"name":"linux-image-2.6.24-22-xen","version":"2.6.24-22.45","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-22.45"},{"name":"linux-image-2.6.24-22-mckinley","version":"2.6.24-22.45","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-22.45"},{"name":"linux-image-2.6.24-22-powerpc64-smp","version":"2.6.24-22.45","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-22.45"},{"name":"linux-image-2.6.24-22-itanium","version":"2.6.24-22.45","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-22.45"},{"name":"linux-image-2.6.24-22-openvz","version":"2.6.24-22.45","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-22.45"},{"name":"linux-image-2.6.24-22-386","version":"2.6.24-22.45","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-22.45"},{"name":"linux-image-2.6.24-22-sparc64-smp","version":"2.6.24-22.45","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-22.45"},{"name":"linux-image-2.6.24-22-powerpc-smp","version":"2.6.24-22.45","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-22.45"}]},"type":"USN","cves_ids":["CVE-2007-5498","CVE-2008-3831","CVE-2008-4210","CVE-2008-4554","CVE-2008-4576","CVE-2008-4618","CVE-2008-4933","CVE-2008-4934","CVE-2008-5025","CVE-2008-5029","CVE-2008-5033"]}]},{"id":"CVE-2008-4192","published":"2008-09-29T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe pserver_shutdown function in fence_egenera in cman 2.20080629 and\n2.20080801 allows local users to overwrite arbitrary files via a symlink\nattack on the /tmp/eglog temporary file.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"up priority to low, as it may be possible to DoS the system (eg\noverwriting /etc/shadow with garbage data)"}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-875-1","https://www.cve.org/CVERecord?id=CVE-2008-4192"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496410"],"patches":{"redhat-cluster-suite":[],"redhat-cluster":[]},"tags":{},"packages":[{"name":"redhat-cluster","source":"https://ubuntu.com/security/cve?package=redhat-cluster","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=redhat-cluster","debian":"https://tracker.debian.org/pkg/redhat-cluster","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"2.20080826-0ubuntu1.3","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"2.20090112-0ubuntu4","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"2.20090112-0ubuntu4","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.20081102-1","component":null,"pocket":"security"}]},{"name":"redhat-cluster-suite","source":"https://ubuntu.com/security/cve?package=redhat-cluster-suite","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=redhat-cluster-suite","debian":"https://tracker.debian.org/pkg/redhat-cluster-suite","statuses":[{"release_codename":"dapper","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-875-1"],"notices":[{"id":"USN-875-1","title":"Red Hat Cluster Suite vulnerabilities","summary":"Red Hat Cluster Suite vulnerabilities","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.\n","references":[],"published":"2009-12-18T16:23:20.591158","description":"Multiple insecure temporary file handling vulnerabilities were discovered\nin Red Hat Cluster. A local attacker could exploit these to overwrite\narbitrary local files via symlinks. (CVE-2008-4192, CVE-2008-4579,\nCVE-2008-4580, CVE-2008-6552)\n\nIt was discovered that CMAN did not properly handle malformed configuration\nfiles. An attacker could cause a denial of service (via CPU consumption and\nmemory corruption) in a node if the attacker were able to modify the\ncluster configuration for the node. (CVE-2008-6560)\n","is_hidden":false,"release_packages":{"hardy":[{"name":"redhat-cluster","version":"2.20080227-0ubuntu1.3","description":"","is_source":true},{"name":"gfs2-tools","version":"2.20080227-0ubuntu1.3","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/redhat-cluster","version_link":"https://launchpad.net/ubuntu/+source/redhat-cluster/2.20080227-0ubuntu1.3"},{"name":"cman","version":"2.20080227-0ubuntu1.3","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/redhat-cluster","version_link":"https://launchpad.net/ubuntu/+source/redhat-cluster/2.20080227-0ubuntu1.3"},{"name":"rgmanager","version":"2.20080227-0ubuntu1.3","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/redhat-cluster","version_link":"https://launchpad.net/ubuntu/+source/redhat-cluster/2.20080227-0ubuntu1.3"}],"dapper":[{"name":"redhat-cluster-suite","version":"1.20060222-0ubuntu6.3","description":"","is_source":true},{"name":"libcman1","version":"1.20060222-0ubuntu6.3","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/redhat-cluster-suite","version_link":"https://launchpad.net/ubuntu/+source/redhat-cluster-suite/1.20060222-0ubuntu6.3"},{"name":"ccs","version":"1.20060222-0ubuntu6.3","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/redhat-cluster-suite","version_link":"https://launchpad.net/ubuntu/+source/redhat-cluster-suite/1.20060222-0ubuntu6.3"},{"name":"cman","version":"1.20060222-0ubuntu6.3","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/redhat-cluster-suite","version_link":"https://launchpad.net/ubuntu/+source/redhat-cluster-suite/1.20060222-0ubuntu6.3"},{"name":"fence","version":"1.20060222-0ubuntu6.3","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/redhat-cluster-suite","version_link":"https://launchpad.net/ubuntu/+source/redhat-cluster-suite/1.20060222-0ubuntu6.3"},{"name":"rgmanager","version":"1.20060222-0ubuntu6.3","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/redhat-cluster-suite","version_link":"https://launchpad.net/ubuntu/+source/redhat-cluster-suite/1.20060222-0ubuntu6.3"}],"intrepid":[{"name":"redhat-cluster","version":"2.20080826-0ubuntu1.3","description":"","is_source":true},{"name":"gfs2-tools","version":"2.20080826-0ubuntu1.3","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/redhat-cluster","version_link":"https://launchpad.net/ubuntu/+source/redhat-cluster/2.20080826-0ubuntu1.3"},{"name":"cman","version":"2.20080826-0ubuntu1.3","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/redhat-cluster","version_link":"https://launchpad.net/ubuntu/+source/redhat-cluster/2.20080826-0ubuntu1.3"},{"name":"rgmanager","version":"2.20080826-0ubuntu1.3","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/redhat-cluster","version_link":"https://launchpad.net/ubuntu/+source/redhat-cluster/2.20080826-0ubuntu1.3"}]},"type":"USN","cves_ids":["CVE-2008-4192","CVE-2008-4579","CVE-2008-4580","CVE-2008-6552","CVE-2008-6560"]}]},{"id":"CVE-2007-1265","published":"2008-09-29T00:00:00","updated_at":"2025-07-17T16:40:51.108389+00:00","description":"\nKMail 1.9.5 and earlier does not properly use the --status-fd argument when\ninvoking GnuPG, which prevents KMail from visually distinguishing between\nsigned and unsigned portions of OpenPGP messages with multiple components,\nwhich allows remote attackers to forge the contents of a message without\ndetection.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2007-1265"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"kdepim","source":"https://ubuntu.com/security/cve?package=kdepim","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=kdepim","debian":"https://tracker.debian.org/pkg/kdepim","statuses":[{"release_codename":"dapper","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-4298","published":"2008-09-27T10:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMemory leak in the http_request_parse function in request.c in lighttpd\nbefore 1.4.20 allows remote attackers to cause a denial of service (memory\nconsumption) via a large number of requests with duplicate request headers.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-4298"],"bugs":["https://bugs.launchpad.net/ubuntu/jaunty/+source/lighttpd/+bug/279490"],"patches":{"lighttpd":["debdiff: https://bugs.launchpad.net/ubuntu/jaunty/+source/lighttpd/+bug/279490"]},"tags":{},"packages":[{"name":"lighttpd","source":"https://ubuntu.com/security/cve?package=lighttpd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=lighttpd","debian":"https://tracker.debian.org/pkg/lighttpd","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"1.4.19-0ubuntu3.1","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"1.4.19-5ubuntu6","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"1.4.19-5ubuntu6","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.4.19-5","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-4297","published":"2008-09-27T10:30:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMercurial before 1.0.2 does not enforce the allowpull permission setting\nfor a pull operation from hgweb, which allows remote attackers to read\narbitrary files from a repository via an \"hg pull\" request.","ubuntu_description":"","notes":[{"author":"kees","note":"only part of the examples"}],"codename":null,"priority":"negligible","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-4297"],"bugs":[""],"patches":{"mercurial":[]},"tags":{},"packages":[{"name":"mercurial","source":"https://ubuntu.com/security/cve?package=mercurial","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mercurial","debian":"https://tracker.debian.org/pkg/mercurial","statuses":[{"release_codename":"dapper","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.0.2","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":74960,"limit":20,"total_results":79316}