{"cves":[{"id":"CVE-2008-3747","published":"2008-08-27T15:21:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe (1) get_edit_post_link and (2) get_edit_comment_link functions in\nwp-includes/link-template.php in WordPress before 2.6.1 do not force SSL\ncommunication in the intended situations, which might allow remote\nattackers to gain administrative access by sniffing the network for a\ncookie.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"per upstream via stefanlsd, SSL functionality doesn't exist\nbefore 2.6.0. However, Debian is trying to backport the SSL functionality,\nbelieving that lack of SSL is an extension of this CVE. stefanlsd and\nupstream feel that this approach is dangerous and messy. It has been\nmarked as Won't Fix in LP, but can be reopened if the Debian patch is\nviable.\nDebian patch is included in 2.5.1-6 (broken) and 2.5.1-7"}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-3747"],"bugs":["https://bugs.edge.launchpad.net/ubuntu/+source/wordpress/+bug/269301","http://bugs.debian.org/497216","http://bugs.debian.org/497524"],"patches":{"wordpress":["other: http://trac.wordpress.org/ticket/7359"]},"tags":{},"packages":[{"name":"wordpress","source":"https://ubuntu.com/security/cve?package=wordpress","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=wordpress","debian":"https://tracker.debian.org/pkg/wordpress","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life, was deferred","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was deferred","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was deferred","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life, was deferred","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"ignored","description":"end of life, was deferred","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"2.7.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"2.7.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"2.7.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"2.7.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"2.7.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"2.7.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"precise","status":"not-affected","description":"2.7.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"quantal","status":"not-affected","description":"2.7.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"raring","status":"not-affected","description":"2.7.1-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.6.1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-3746","published":"2008-08-27T15:21:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nneon 0.28.0 through 0.28.2 allows remote servers to cause a denial of\nservice (NULL pointer dereference and crash) via vectors related to Digest\nauthentication, Digest domain parameter support, and the parse_domain\nfunction.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-835-1","https://www.cve.org/CVERecord?id=CVE-2008-3746"],"bugs":[""],"patches":{"neon27":[]},"tags":{},"packages":[{"name":"neon27","source":"https://ubuntu.com/security/cve?package=neon27","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=neon27","debian":"https://tracker.debian.org/pkg/neon27","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"0.28.2-2ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-835-1"],"notices":[{"id":"USN-835-1","title":"neon vulnerabilities","summary":"neon vulnerabilities","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.\n","references":[],"published":"2009-09-21T18:50:29.258050","description":"Joe Orton discovered that neon did not correctly handle SSL certificates\nwith zero bytes in the Common Name.  A remote attacker could exploit this\nto perform a machine-in-the-middle attack to view sensitive information or\nalter encrypted communications.\n","is_hidden":false,"release_packages":{"dapper":[{"name":"neon","version":"0.25.5.dfsg-5ubuntu0.1","description":"","is_source":true},{"name":"libneon25","version":"0.25.5.dfsg-5ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/neon","version_link":"https://launchpad.net/ubuntu/+source/neon/0.25.5.dfsg-5ubuntu0.1"}],"hardy":[{"name":"neon27","version":"0.27.2-1ubuntu0.1","description":"","is_source":true},{"name":"libneon27","version":"0.27.2-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/neon27","version_link":"https://launchpad.net/ubuntu/+source/neon27/0.27.2-1ubuntu0.1"},{"name":"libneon27-gnutls","version":"0.27.2-1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/neon27","version_link":"https://launchpad.net/ubuntu/+source/neon27/0.27.2-1ubuntu0.1"}],"intrepid":[{"name":"neon27","version":"0.28.2-2ubuntu0.1","description":"","is_source":true},{"name":"libneon27","version":"0.28.2-2ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/neon27","version_link":"https://launchpad.net/ubuntu/+source/neon27/0.28.2-2ubuntu0.1"},{"name":"libneon27-gnutls","version":"0.28.2-2ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/neon27","version_link":"https://launchpad.net/ubuntu/+source/neon27/0.28.2-2ubuntu0.1"}],"jaunty":[{"name":"neon27","version":"0.28.2-6.1ubuntu0.1","description":"","is_source":true},{"name":"libneon27","version":"0.28.2-6.1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/neon27","version_link":"https://launchpad.net/ubuntu/+source/neon27/0.28.2-6.1ubuntu0.1"},{"name":"libneon27-gnutls","version":"0.28.2-6.1ubuntu0.1","is_source":false,"is_visible":true,"source_link":"https://launchpad.net/ubuntu/+source/neon27","version_link":"https://launchpad.net/ubuntu/+source/neon27/0.28.2-6.1ubuntu0.1"}]},"type":"USN","cves_ids":["CVE-2008-3746","CVE-2009-2474"]}]},{"id":"CVE-2008-3745","published":"2008-08-27T15:21:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe Upload module in Drupal 6.x before 6.4 allows remote authenticated\nusers to edit nodes, delete files, and download unauthorized attachments\nvia unspecified vectors.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"Drupal 6 only"}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-3745"],"bugs":[""],"patches":{"drupal":[],"drupal5":[]},"tags":{},"packages":[{"name":"drupal","source":"https://ubuntu.com/security/cve?package=drupal","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=drupal","debian":"https://tracker.debian.org/pkg/drupal","statuses":[{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"dapper","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"drupal5","source":"https://ubuntu.com/security/cve?package=drupal5","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=drupal5","debian":"https://tracker.debian.org/pkg/drupal5","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-3744","published":"2008-08-27T15:21:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMultiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x\nbefore 5.10 and 6.x before 6.4 allow remote attackers to hijack the\nauthentication of administrators for requests that (1) add or (2) delete\nuser access rules.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://drupal.org/node/295053","https://www.cve.org/CVERecord?id=CVE-2008-3744"],"bugs":[""],"patches":{"drupal":[],"drupal5":[]},"tags":{},"packages":[{"name":"drupal","source":"https://ubuntu.com/security/cve?package=drupal","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=drupal","debian":"https://tracker.debian.org/pkg/drupal","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"drupal5","source":"https://ubuntu.com/security/cve?package=drupal5","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=drupal5","debian":"https://tracker.debian.org/pkg/drupal5","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"5.7-1ubuntu1.2","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"5.10","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-3743","published":"2008-08-27T15:21:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nMultiple cross-site request forgery (CSRF) vulnerabilities in forms in\nDrupal 6.x before 6.4 allow remote attackers to perform unspecified actions\nvia unknown vectors, related to improper token validation for (1) cached\nforms and (2) forms with AHAH elements.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"per Debian, vulnerable code not present"}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-3743"],"bugs":[""],"patches":{"drupal":[],"drupal5":[]},"tags":{},"packages":[{"name":"drupal","source":"https://ubuntu.com/security/cve?package=drupal","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=drupal","debian":"https://tracker.debian.org/pkg/drupal","statuses":[{"release_codename":"dapper","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"drupal5","source":"https://ubuntu.com/security/cve?package=drupal5","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=drupal5","debian":"https://tracker.debian.org/pkg/drupal5","statuses":[{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-3742","published":"2008-08-27T15:21:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nUnrestricted file upload vulnerability in the BlogAPI module in Drupal 5.x\nbefore 5.10 and 6.x before 6.4 allows remote authenticated users to execute\narbitrary code by uploading a file with an executable extension, which is\nnot validated.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://drupal.org/node/295053","https://www.cve.org/CVERecord?id=CVE-2008-3742"],"bugs":[""],"patches":{"drupal":[],"drupal5":[]},"tags":{},"packages":[{"name":"drupal","source":"https://ubuntu.com/security/cve?package=drupal","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=drupal","debian":"https://tracker.debian.org/pkg/drupal","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"drupal5","source":"https://ubuntu.com/security/cve?package=drupal5","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=drupal5","debian":"https://tracker.debian.org/pkg/drupal5","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"5.7-1ubuntu1.2","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"5.10","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-3741","published":"2008-08-27T15:21:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe private filesystem in Drupal 5.x before 5.10 and 6.x before 6.4 trusts\nthe MIME type sent by a web browser, which allows remote authenticated\nusers to conduct cross-site scripting (XSS) attacks by uploading files\ncontaining arbitrary web script or HTML.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://drupal.org/node/295053","https://www.cve.org/CVERecord?id=CVE-2008-3741"],"bugs":[""],"patches":{"drupal":[],"drupal5":[]},"tags":{},"packages":[{"name":"drupal","source":"https://ubuntu.com/security/cve?package=drupal","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=drupal","debian":"https://tracker.debian.org/pkg/drupal","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"drupal5","source":"https://ubuntu.com/security/cve?package=drupal5","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=drupal5","debian":"https://tracker.debian.org/pkg/drupal5","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"5.7-1ubuntu1.2","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"5.10","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-3740","published":"2008-08-27T15:21:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nCross-site scripting (XSS) vulnerability in the output filter in Drupal 5.x\nbefore 5.10 and 6.x before 6.4 allows remote attackers to inject arbitrary\nweb script or HTML via unspecified vectors.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://drupal.org/node/295053","https://www.cve.org/CVERecord?id=CVE-2008-3740"],"bugs":[""],"patches":{"drupal":[],"drupal5":[]},"tags":{},"packages":[{"name":"drupal","source":"https://ubuntu.com/security/cve?package=drupal","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=drupal","debian":"https://tracker.debian.org/pkg/drupal","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"drupal5","source":"https://ubuntu.com/security/cve?package=drupal5","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=drupal5","debian":"https://tracker.debian.org/pkg/drupal5","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"5.7-1ubuntu1.2","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-3790","published":"2008-08-27T00:00:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72,\nand 1.9 allows context-dependent attackers to cause a denial of service\n(CPU consumption) via an XML document with recursively nested entities, aka\nan \"XML entity explosion.\"","ubuntu_description":"","notes":[{"author":"jdstrand","note":"PoC http://downloads.securityfocus.com/vulnerabilities/exploits/30802.rb"}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/","https://ubuntu.com/security/notices/USN-651-1","https://ubuntu.com/security/notices/USN-691-1","https://www.cve.org/CVERecord?id=CVE-2008-3790"],"bugs":["https://bugs.launchpad.net/ubuntu/+source/ruby1.8/+bug/261459","https://bugs.launchpad.net/ubuntu/intrepid/+source/ruby1.9/+bug/257122","https://bugs.launchpad.net/ubuntu/+source/ruby1.9/+bug/281456"],"patches":{"ruby1.8":[],"ruby1.9":[]},"tags":{},"packages":[{"name":"ruby1.8","source":"https://ubuntu.com/security/cve?package=ruby1.8","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby1.8","debian":"https://tracker.debian.org/pkg/ruby1.8","statuses":[{"release_codename":"dapper","status":"released","description":"1.8.4-1ubuntu1.6","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"1.8.5-4ubuntu2.3","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"1.8.6.36-1ubuntu3.3","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"1.8.6.111-2ubuntu1.2","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"1.8.7.72-1","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"1.8.7.72-1","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"1.8.7.72-1","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"1.8.7.72-1","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"1.8.7.72-1","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"1.8.7.72-1","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"1.8.7.72-1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.8.7.72-1","component":null,"pocket":"security"}]},{"name":"ruby1.9","source":"https://ubuntu.com/security/cve?package=ruby1.9","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=ruby1.9","debian":"https://tracker.debian.org/pkg/ruby1.9","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"1.9.0.2-7","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"released","description":"1.9.0.2-7","component":null,"pocket":"security"},{"release_codename":"karmic","status":"released","description":"1.9.0.2-7","component":null,"pocket":"security"},{"release_codename":"lucid","status":"released","description":"1.9.0.2-7","component":null,"pocket":"security"},{"release_codename":"maverick","status":"DNE","description":"pulled 2010-07-27","component":null,"pocket":"security"},{"release_codename":"natty","status":"DNE","description":"pulled 2010-07-27","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"DNE","description":"pulled 2010-07-27","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.9.0.2-7","component":null,"pocket":"security"}]}],"notices_ids":["USN-651-1","USN-691-1"],"notices":[{"id":"USN-651-1","title":"Ruby vulnerabilities","summary":"Ruby vulnerabilities","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.\n","references":[],"published":"2008-10-10T02:21:12.914228","description":"Akira Tagoh discovered a vulnerability in Ruby which lead to an integer\noverflow. If a user or automated system were tricked into running a\nmalicious script, an attacker could cause a denial of service or\npossibly execute arbitrary code with the privileges of the user\ninvoking the program. (CVE-2008-2376)\n\nLaurent Gaffie discovered that Ruby did not properly check for memory\nallocation failures. If a user or automated system were tricked into\nrunning a malicious script, an attacker could cause a denial of\nservice. (CVE-2008-3443)\n\nKeita Yamaguchi discovered several safe level vulnerabilities in Ruby.\nAn attacker could use this to bypass intended access restrictions.\n(CVE-2008-3655)\n\nKeita Yamaguchi discovered that WEBrick in Ruby did not properly\nvalidate paths ending with \".\". A remote attacker could send a crafted\nHTTP request and cause a denial of service. (CVE-2008-3656)\n\nKeita Yamaguchi discovered that the dl module in Ruby did not check\nthe taintness of inputs. An attacker could exploit this vulnerability\nto bypass safe levels and execute dangerous functions. (CVE-2008-3657)\n\nLuka Treiber and Mitja Kolsek discovered that REXML in Ruby did not\nalways use expansion limits when processing XML documents. If a user or\nautomated system were tricked into open a crafted XML file, an attacker\ncould cause a denial of service via CPU consumption. (CVE-2008-3790)\n\nJan Lieskovsky discovered several flaws in the name resolver of Ruby. A\nremote attacker could exploit this to spoof DNS entries, which could\nlead to misdirected traffic. This is a different vulnerability from\nCVE-2008-1447. (CVE-2008-3905)\n","is_hidden":false,"release_packages":{"gutsy":[{"name":"ruby1.8","version":"1.8.6.36-1ubuntu3.3","description":"","is_source":true},{"name":"ruby1.8","version":"1.8.6.36-1ubuntu3.3","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/ruby1.8","version_link":"https://launchpad.net/ubuntu/+source/ruby1.8/1.8.6.36-1ubuntu3.3"},{"name":"libruby1.8","version":"1.8.6.36-1ubuntu3.3","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/ruby1.8","version_link":"https://launchpad.net/ubuntu/+source/ruby1.8/1.8.6.36-1ubuntu3.3"}],"dapper":[{"name":"ruby1.8","version":"1.8.4-1ubuntu1.6","description":"","is_source":true},{"name":"ruby1.8","version":"1.8.4-1ubuntu1.6","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/ruby1.8","version_link":"https://launchpad.net/ubuntu/+source/ruby1.8/1.8.4-1ubuntu1.6"},{"name":"libruby1.8","version":"1.8.4-1ubuntu1.6","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/ruby1.8","version_link":"https://launchpad.net/ubuntu/+source/ruby1.8/1.8.4-1ubuntu1.6"}],"feisty":[{"name":"ruby1.8","version":"1.8.5-4ubuntu2.3","description":"","is_source":true},{"name":"ruby1.8","version":"1.8.5-4ubuntu2.3","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/ruby1.8","version_link":"https://launchpad.net/ubuntu/+source/ruby1.8/1.8.5-4ubuntu2.3"},{"name":"libruby1.8","version":"1.8.5-4ubuntu2.3","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/ruby1.8","version_link":"https://launchpad.net/ubuntu/+source/ruby1.8/1.8.5-4ubuntu2.3"}],"hardy":[{"name":"ruby1.8","version":"1.8.6.111-2ubuntu1.2","description":"","is_source":true},{"name":"ruby1.8","version":"1.8.6.111-2ubuntu1.2","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/ruby1.8","version_link":"https://launchpad.net/ubuntu/+source/ruby1.8/1.8.6.111-2ubuntu1.2"},{"name":"libruby1.8","version":"1.8.6.111-2ubuntu1.2","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/ruby1.8","version_link":"https://launchpad.net/ubuntu/+source/ruby1.8/1.8.6.111-2ubuntu1.2"}]},"type":"USN","cves_ids":["CVE-2008-3790","CVE-2008-2376","CVE-2008-3657","CVE-2008-3443","CVE-2008-3656","CVE-2008-3905","CVE-2008-3655"]},{"id":"USN-691-1","title":"Ruby vulnerability","summary":"Ruby vulnerability","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.\n","references":[],"published":"2008-12-16T14:54:54.635161","description":"Laurent Gaffie discovered that Ruby did not properly check for memory\nallocation failures. If a user or automated system were tricked into\nrunning a malicious script, an attacker could cause a denial of\nservice. (CVE-2008-3443)\n\nThis update also fixes a regression in the upstream patch previously\napplied to fix CVE-2008-3790. The regression would cause parsing of\nsome XML documents to fail.\n","is_hidden":false,"release_packages":{"intrepid":[{"name":"ruby1.9","version":"1.9.0.2-7ubuntu1.1","description":"","is_source":true},{"name":"ruby1.9","version":"1.9.0.2-7ubuntu1.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/ruby1.9","version_link":"https://launchpad.net/ubuntu/+source/ruby1.9/1.9.0.2-7ubuntu1.1"}]},"type":"USN","cves_ids":["CVE-2008-3443","CVE-2008-3790"]}]},{"id":"CVE-2008-3794","published":"2008-08-26T15:41:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nInteger signedness error in the mms_ReceiveCommand function in\nmodules/access/mms/mmstu.c in VLC Media Player 0.8.6i allows remote\nattackers to execute arbitrary code via a crafted mmst link with a negative\nsize value, which bypasses a size check and triggers an integer overflow\nfollowed by a heap-based buffer overflow.","ubuntu_description":"","notes":[{"author":"mdeslaur","note":"PoC: http://www.milw0rm.com/exploits/6293"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-3794"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496265"],"patches":{"vlc":["upstream: http://git.videolan.org/?p=vlc.git;a=commit;h=afe3464a1c7c6f9d7640a3f5db17010c34212440"]},"tags":{},"packages":[{"name":"vlc","source":"https://ubuntu.com/security/cve?package=vlc","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=vlc","debian":"https://tracker.debian.org/pkg/vlc","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"0.8.6.release.e+x264svn20071224+faad2.6.1-0ubuntu3.2","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"0.9.4-1ubuntu3.1","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"0.9.9a-2ubuntu1","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"1.0.0~rc2-1ubuntu1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-3732","published":"2008-08-20T16:41:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nInteger overflow in the Open function in modules/demux/tta.c in VLC Media\nPlayer 0.8.6i allows remote attackers to cause a denial of service\n(application crash) or possibly execute arbitrary code via a crafted TTA\nfile, which triggers a heap-based buffer overflow.  NOTE: some of these\ndetails are obtained from third party information.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-3732"],"bugs":[""],"patches":{"vlc":[]},"tags":{},"packages":[{"name":"vlc","source":"https://ubuntu.com/security/cve?package=vlc","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=vlc","debian":"https://tracker.debian.org/pkg/vlc","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"0.8.6.release.e+x264svn20071224+faad2.6.1-0ubuntu3.2","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"0.9.4-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"0.9.4-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"0.9.4-1ubuntu2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.8.6.h-2","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-3714","published":"2008-08-19T19:41:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nCross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8\nallows remote attackers to inject arbitrary web script or HTML via the\nquery_string, a different vulnerability than CVE-2006-3681 and\nCVE-2006-1945.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-686-1","https://www.cve.org/CVERecord?id=CVE-2008-3714"],"bugs":[""],"patches":{"awstats":[]},"tags":{},"packages":[{"name":"awstats","source":"https://ubuntu.com/security/cve?package=awstats","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=awstats","debian":"https://tracker.debian.org/pkg/awstats","statuses":[{"release_codename":"feisty","status":"ignored","description":"end of life, was needs-triage","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"6.6+dfsg-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"6.7.dfsg-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"6.7.dfsg-5ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"dapper","status":"released","description":"6.5-1ubuntu1.3","component":null,"pocket":"security"},{"release_codename":"upstream","status":"pending","description":"6.7.dfsg-6","component":null,"pocket":"security"}]}],"notices_ids":["USN-686-1"],"notices":[{"id":"USN-686-1","title":"AWStats vulnerability","summary":"AWStats vulnerability","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.\n","references":[],"published":"2008-12-04T00:12:46.303999","description":"Morgan Todd discovered that AWStats did not correctly strip quotes from\ncertain parameters, allowing for an XSS attack when running as a CGI.\nIf a user was tricked by a remote attacker into following a specially\ncrafted URL, the user's authentication information could be exposed for\nthe domain where AWStats was hosted.\n","is_hidden":false,"release_packages":{"gutsy":[{"name":"awstats","version":"6.6+dfsg-1ubuntu0.1","description":"","is_source":true},{"name":"awstats","version":"6.6+dfsg-1ubuntu0.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/awstats","version_link":"https://launchpad.net/ubuntu/+source/awstats/6.6+dfsg-1ubuntu0.1"}],"dapper":[{"name":"awstats","version":"6.5-1ubuntu1.3","description":"","is_source":true},{"name":"awstats","version":"6.5-1ubuntu1.3","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/awstats","version_link":"https://launchpad.net/ubuntu/+source/awstats/6.5-1ubuntu1.3"}],"intrepid":[{"name":"awstats","version":"6.7.dfsg-5ubuntu0.1","description":"","is_source":true},{"name":"awstats","version":"6.7.dfsg-5ubuntu0.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/awstats","version_link":"https://launchpad.net/ubuntu/+source/awstats/6.7.dfsg-5ubuntu0.1"}],"hardy":[{"name":"awstats","version":"6.7.dfsg-1ubuntu0.1","description":"","is_source":true},{"name":"awstats","version":"6.7.dfsg-1ubuntu0.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/awstats","version_link":"https://launchpad.net/ubuntu/+source/awstats/6.7.dfsg-1ubuntu0.1"}]},"type":"USN","cves_ids":["CVE-2008-3714","CVE-2008-5080"]}]},{"id":"CVE-2008-2937","published":"2008-08-18T19:41:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nPostfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox\nfile even when this file is not owned by the recipient, which allows local\nusers to read e-mail messages by creating a mailbox file corresponding to\nanother user's account name.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-2937"],"bugs":[""],"patches":{"postfix":[]},"tags":{},"packages":[{"name":"postfix","source":"https://ubuntu.com/security/cve?package=postfix","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=postfix","debian":"https://tracker.debian.org/pkg/postfix","statuses":[{"release_codename":"dapper","status":"not-affected","description":"system not installed with a+w /var/mail","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"system not installed with a+w /var/mail","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"not-affected","description":"system not installed with a+w /var/mail","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"system not installed with a+w /var/mail","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.5.4","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-2936","published":"2008-08-18T19:41:00","updated_at":"2025-08-04T19:23:19.328030+00:00","description":"\nPostfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before\n2.6-20080814, when the operating system supports hard links to symlinks,\nallows local users to append e-mail messages to a file to which a\nroot-owned symlink points, by creating a hard link to this symlink and then\nsending a message.  NOTE: this can be leveraged to gain privileges if there\nis a symlink to an init script.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"requires postfix as delivery agent, no root alias, no mail delivered\nto root, and the 'mail' account (or an application in the 'mail' group) to\nbe compromised"}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-636-1","https://www.cve.org/CVERecord?id=CVE-2008-2936"],"bugs":["https://bugs.launchpad.net/ubuntu/+source/postfix/+bug/258162"],"patches":{"postfix":[]},"tags":{},"packages":[{"name":"postfix","source":"https://ubuntu.com/security/cve?package=postfix","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=postfix","debian":"https://tracker.debian.org/pkg/postfix","statuses":[{"release_codename":"dapper","status":"released","description":"2.2.10-1ubuntu0.2","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"2.3.8-2ubuntu0.2","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"2.4.5-3ubuntu1.2","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"2.5.1-2ubuntu1.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"2.5.4","component":null,"pocket":"security"}]}],"notices_ids":["USN-636-1"],"notices":[{"id":"USN-636-1","title":"Postfix vulnerability","summary":"Postfix vulnerability","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.\n","references":[],"published":"2008-08-19T20:29:20.451686","description":"Sebastian Krahmer discovered that Postfix was not correctly handling\nmailbox ownership when dealing with Linux's implementation of hardlinking\nto symlinks.  In certain mail spool configurations, a local attacker\ncould exploit this to append data to arbitrary files as the root user.\nThe default Ubuntu configuration was not vulnerable.\n","is_hidden":false,"release_packages":{"gutsy":[{"name":"postfix","version":"2.4.5-3ubuntu1.2","description":"","is_source":true},{"name":"postfix","version":"2.4.5-3ubuntu1.2","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/postfix","version_link":"https://launchpad.net/ubuntu/+source/postfix/2.4.5-3ubuntu1.2"}],"dapper":[{"name":"postfix","version":"2.2.10-1ubuntu0.2","description":"","is_source":true},{"name":"postfix","version":"2.2.10-1ubuntu0.2","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/postfix","version_link":"https://launchpad.net/ubuntu/+source/postfix/2.2.10-1ubuntu0.2"}],"feisty":[{"name":"postfix","version":"2.3.8-2ubuntu0.2","description":"","is_source":true},{"name":"postfix","version":"2.3.8-2ubuntu0.2","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/postfix","version_link":"https://launchpad.net/ubuntu/+source/postfix/2.3.8-2ubuntu0.2"}],"hardy":[{"name":"postfix","version":"2.5.1-2ubuntu1.1","description":"","is_source":true},{"name":"postfix","version":"2.5.1-2ubuntu1.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/postfix","version_link":"https://launchpad.net/ubuntu/+source/postfix/2.5.1-2ubuntu1.1"}]},"type":"USN","cves_ids":["CVE-2008-2936"]}]},{"id":"CVE-2008-3533","published":"2008-08-18T17:41:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nFormat string vulnerability in the window_error function in yelp-window.c\nin yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to\nexecute arbitrary code via format string specifiers in an invalid URI on\nthe command line, as demonstrated by use of yelp within (1) man or (2)\nghelp URI handlers in Firefox, Evolution, and unspecified other programs.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-638-1","https://www.cve.org/CVERecord?id=CVE-2008-3533"],"bugs":["https://bugs.launchpad.net/ubuntu/hardy/+source/yelp/+bug/254860"],"patches":{"yelp":[]},"tags":{},"packages":[{"name":"yelp","source":"https://ubuntu.com/security/cve?package=yelp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=yelp","debian":"https://tracker.debian.org/pkg/yelp","statuses":[{"release_codename":"dapper","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"2.20.0-0ubuntu3.1","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"2.22.1-0ubuntu2.8.04.3","component":null,"pocket":"security"},{"release_codename":"upstream","status":"pending","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-638-1"],"notices":[{"id":"USN-638-1","title":"Yelp vulnerability","summary":"Yelp vulnerability","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.\n","references":[],"published":"2008-08-27T20:08:16.513460","description":"Aaron Grattafiori discovered that the Gnome Help Viewer did not\nhandle format strings correctly when displaying certain error messages.\nIf a user were tricked into opening a specially crafted URI, a remote\nattacker could execute arbitrary code with user privileges.\n","is_hidden":false,"release_packages":{"gutsy":[{"name":"yelp","version":"2.20.0-0ubuntu3.1","description":"","is_source":true},{"name":"yelp","version":"2.20.0-0ubuntu3.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/yelp","version_link":"https://launchpad.net/ubuntu/+source/yelp/2.20.0-0ubuntu3.1"}],"hardy":[{"name":"yelp","version":"2.22.1-0ubuntu2.8.04.3","description":"","is_source":true},{"name":"yelp","version":"2.22.1-0ubuntu2.8.04.3","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/yelp","version_link":"https://launchpad.net/ubuntu/+source/yelp/2.22.1-0ubuntu2.8.04.3"}]},"type":"USN","cves_ids":["CVE-2008-3533"]}]},{"id":"CVE-2008-3276","published":"2008-08-18T17:41:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nInteger overflow in the dccp_setsockopt_change function in net/dccp/proto.c\nin the Datagram Congestion Control Protocol (DCCP) subsystem in the Linux\nkernel 2.6.17-rc1 through 2.6.26.2 allows remote attackers to cause a\ndenial of service (panic) via a crafted integer value, related to Change L\nand Change R options without at least one byte in the dccpsf_val field.","ubuntu_description":"\nIt was discovered that the Datagram Congestion Control Protocol (DCCP)\ndid not correctly validate its arguments.  If DCCP was in use, a remote\nattacker could send specially crafted network traffic and cause a system\ncrash, leading to a denial of service.","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-659-1","https://www.cve.org/CVERecord?id=CVE-2008-3276"],"bugs":["https://bugs.launchpad.net/bugs/cve/CVE-2008-3276"],"patches":{"linux-source-2.6.15":[],"linux-source-2.6.20":[],"linux-source-2.6.22":[],"linux":[]},"tags":{},"packages":[{"name":"linux","source":"https://ubuntu.com/security/cve?package=linux","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux","debian":"https://tracker.debian.org/pkg/linux","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"2.6.24-21.43","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.15","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.15","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.15","debian":"https://tracker.debian.org/pkg/linux-source-2.6.15","statuses":[{"release_codename":"dapper","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.20","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.20","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.20","debian":"https://tracker.debian.org/pkg/linux-source-2.6.20","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.22","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.22","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.22","debian":"https://tracker.debian.org/pkg/linux-source-2.6.22","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"2.6.22-15.59","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-659-1"],"notices":[{"id":"USN-659-1","title":"Linux kernel vulnerabilities","summary":"Linux kernel vulnerabilities","instructions":"After a standard system upgrade you need to reboot your computer to\neffect the necessary changes.\n\nATTENTION: For systems without the hardy-updates pocket enabled, the 8.04\nkernel update will include an unavoidable ABI change. The kernel update\nhas been given a new version number, which requires you to recompile and\nreinstall all third party kernel modules you might have installed. If\nyou use linux-restricted-modules, you have to update that package as\nwell to get modules which work with the new kernel version. Unless you\nmanually uninstalled the standard kernel metapackages (e.g. linux-386,\nlinux-powerpc, linux-amd64-generic), a standard system upgrade will\nautomatically perform this as well.\n","references":[],"published":"2008-10-27T20:22:50.932571","description":"It was discovered that the direct-IO subsystem did not correctly validate\ncertain structures. A local attacker could exploit this to cause a system\ncrash, leading to a denial of service. (CVE-2007-6716)\n\nIt was discovered that the disabling of the ZERO_PAGE optimization could\nlead to large memory consumption. A local attacker could exploit this to\nallocate all available memory, leading to a denial of service.\n(CVE-2008-2372)\n\nIt was discovered that the Datagram Congestion Control Protocol (DCCP) did\nnot correctly validate its arguments. If DCCP was in use, a remote attacker\ncould send specially crafted network traffic and cause a system crash,\nleading to a denial of service. (CVE-2008-3276)\n\nIt was discovered that the SBNI WAN driver did not correctly check for the\nNET_ADMIN capability. A malicious local root user lacking CAP_NET_ADMIN\nwould be able to change the WAN device configuration, leading to a denial\nof service. (CVE-2008-3525)\n\nIt was discovered that the Stream Control Transmission Protocol (SCTP) did\nnot correctly validate the key length in the SCTP_AUTH_KEY option. If SCTP\nis in use, a remote attacker could send specially crafted network traffic\nthat would crash the system, leading to a denial of service.\n(CVE-2008-3526)\n\nIt was discovered that the tmpfs implementation did not correctly handle\ncertain sequences of inode operations. A local attacker could exploit this\nto crash the system, leading to a denial of service. (CVE-2008-3534)\n\nIt was discovered that the readv/writev functions did not correctly handle\ncertain sequences of file operations. A local attacker could exploit this\nto crash the system, leading to a denial of service. (CVE-2008-3535)\n\nIt was discovered that SCTP did not correctly validate its userspace\narguments. A local attacker could call certain sctp_* functions with\nmalicious options and cause a system crash, leading to a denial of service.\n(CVE-2008-3792, CVE-2008-4113, CVE-2008-4445)\n\nIt was discovered the the i915 video driver did not correctly validate\nmemory addresses.  A local attacker could exploit this to remap memory\nthat could cause a system crash, leading to a denial of service.\n(CVE-2008-3831)\n\nJohann Dahm and David Richter discovered that NFSv4 did not correctly\nhandle certain file ACLs. If NFSv4 is in use, a local attacker could create\na malicious ACL that could cause a system crash, leading to a denial of\nservice. (CVE-2008-3915)\n","is_hidden":false,"release_packages":{"gutsy":[{"name":"linux-source-2.6.22","version":"2.6.22-15.59","description":"","is_source":true},{"name":"linux-image-2.6.22-15-mckinley","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"},{"name":"linux-image-2.6.22-15-generic","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"},{"name":"linux-image-2.6.22-15-hppa32","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"},{"name":"linux-image-2.6.22-15-xen","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"},{"name":"linux-image-2.6.22-15-sparc64-smp","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"},{"name":"linux-image-2.6.22-15-powerpc","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"},{"name":"linux-image-2.6.22-15-itanium","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"},{"name":"linux-image-2.6.22-15-lpiacompat","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"},{"name":"linux-image-2.6.22-15-386","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"},{"name":"linux-image-2.6.22-15-powerpc-smp","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"},{"name":"linux-image-2.6.22-15-lpia","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"},{"name":"linux-image-2.6.22-15-sparc64","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"},{"name":"linux-image-2.6.22-15-rt","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"},{"name":"linux-image-2.6.22-15-virtual","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"},{"name":"linux-image-2.6.22-15-server","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"},{"name":"linux-image-2.6.22-15-powerpc64-smp","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"},{"name":"linux-image-2.6.22-15-hppa64","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"},{"name":"linux-image-2.6.22-15-cell","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"},{"name":"linux-image-2.6.22-15-ume","version":"2.6.22-15.59","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.22/2.6.22-15.59"}],"dapper":[{"name":"linux-source-2.6.15","version":"2.6.15-52.73","description":"","is_source":true},{"name":"linux-image-2.6.15-52-386","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-mckinley","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-amd64-server","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-hppa32","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-k7","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-686","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-amd64-k8","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-server-bigiron","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-powerpc64-smp","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-sparc64-smp","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-itanium","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-server","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-hppa32-smp","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-amd64-xeon","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-mckinley-smp","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-hppa64-smp","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-hppa64","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-powerpc","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-powerpc-smp","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-amd64-generic","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-itanium-smp","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"},{"name":"linux-image-2.6.15-52-sparc64","version":"2.6.15-52.73","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15","version_link":"https://launchpad.net/ubuntu/+source/linux-source-2.6.15/2.6.15-52.73"}],"hardy":[{"name":"linux","version":"2.6.24-21.43","description":"","is_source":true},{"name":"linux-image-2.6.24-21-powerpc","version":"2.6.24-21.43","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-21.43"},{"name":"linux-image-2.6.24-21-powerpc64-smp","version":"2.6.24-21.43","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-21.43"},{"name":"linux-image-2.6.24-21-sparc64","version":"2.6.24-21.43","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-21.43"},{"name":"linux-image-2.6.24-21-server","version":"2.6.24-21.43","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-21.43"},{"name":"linux-image-2.6.24-21-openvz","version":"2.6.24-21.43","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-21.43"},{"name":"linux-image-2.6.24-21-itanium","version":"2.6.24-21.43","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-21.43"},{"name":"linux-image-2.6.24-21-lpiacompat","version":"2.6.24-21.43","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-21.43"},{"name":"linux-image-2.6.24-21-386","version":"2.6.24-21.43","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-21.43"},{"name":"linux-image-2.6.24-21-generic","version":"2.6.24-21.43","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-21.43"},{"name":"linux-image-2.6.24-21-lpia","version":"2.6.24-21.43","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-21.43"},{"name":"linux-image-2.6.24-21-xen","version":"2.6.24-21.43","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-21.43"},{"name":"linux-image-2.6.24-21-hppa64","version":"2.6.24-21.43","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-21.43"},{"name":"linux-image-2.6.24-21-powerpc-smp","version":"2.6.24-21.43","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-21.43"},{"name":"linux-image-2.6.24-21-mckinley","version":"2.6.24-21.43","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-21.43"},{"name":"linux-image-2.6.24-21-hppa32","version":"2.6.24-21.43","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-21.43"},{"name":"linux-image-2.6.24-21-rt","version":"2.6.24-21.43","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-21.43"},{"name":"linux-image-2.6.24-21-virtual","version":"2.6.24-21.43","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-21.43"},{"name":"linux-image-2.6.24-21-sparc64-smp","version":"2.6.24-21.43","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/linux","version_link":"https://launchpad.net/ubuntu/+source/linux/2.6.24-21.43"}]},"type":"USN","cves_ids":["CVE-2007-6716","CVE-2008-2372","CVE-2008-3276","CVE-2008-3525","CVE-2008-3526","CVE-2008-3534","CVE-2008-3535","CVE-2008-3792","CVE-2008-3831","CVE-2008-3915","CVE-2008-4113","CVE-2008-4445"]}]},{"id":"CVE-2008-3699","published":"2008-08-14T23:41:00","updated_at":"2025-05-26T12:47:06.895653+00:00","description":"\nThe MagnatuneBrowser::listDownloadComplete function in\nmagnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local\nusers to overwrite arbitrary files via a symlink attack on the\nalbum_info.xml temporary file.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"Ubuntu 6.06 LTS (Dapper) does not contain the vulnerable code\namarok tries to remove the file before opening it, so there is\na TOCTOU vulnerability and a symlink could be inserted before open. This\nmakes the attack much harder, but still possible."}],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-3699","https://ubuntu.com/security/notices/USN-657-1"],"bugs":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765"],"patches":{"amarok":["other: http://websvn.kde.org/?view=rev&revision=846626","vendor: http://security.gentoo.org/glsa/glsa-200809-08.xml","vendor: http://www.mandriva.com/security/advisories?name=MDVSA-2008:172"]},"tags":{},"packages":[{"name":"amarok","source":"https://ubuntu.com/security/cve?package=amarok","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=amarok","debian":"https://tracker.debian.org/pkg/amarok","statuses":[{"release_codename":"dapper","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"2:1.4.7-0ubuntu3.1","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"2:1.4.9.1-0ubuntu3.1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.4.10","component":null,"pocket":"security"}]}],"notices_ids":["USN-657-1"],"notices":[{"id":"USN-657-1","title":"Amarok vulnerability","summary":"Amarok vulnerability","instructions":"After a standard system upgrade you need to restart Amarok to effect\nthe necessary changes.\n","references":[],"published":"2008-10-21T01:48:04.963312","description":"Dwayne Litzenberger discovered that Amarok created temporary files in\nan insecure way. Local users could exploit a race condition to create\nor overwrite files with the privileges of the user invoking the\nprogram. (CVE-2008-3699)\n","is_hidden":false,"release_packages":{"gutsy":[{"name":"amarok","version":"2:1.4.7-0ubuntu3.1","description":"","is_source":true},{"name":"amarok","version":"2:1.4.7-0ubuntu3.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/amarok","version_link":"https://launchpad.net/ubuntu/+source/amarok/2:1.4.7-0ubuntu3.1"}],"hardy":[{"name":"amarok","version":"2:1.4.9.1-0ubuntu3.1","description":"","is_source":true},{"name":"amarok","version":"2:1.4.9.1-0ubuntu3.1","is_source":false,"source_link":"https://launchpad.net/ubuntu/+source/amarok","version_link":"https://launchpad.net/ubuntu/+source/amarok/2:1.4.9.1-0ubuntu3.1"}]},"type":"USN","cves_ids":["CVE-2008-3699"]}]},{"id":"CVE-2008-3688","published":"2008-08-14T22:41:00","updated_at":"2025-08-25T19:38:35.553235+00:00","description":"\nsockethandler.cpp in HTTP Antivirus Proxy (HAVP) 0.88 allows remote\nattackers to cause a denial of service (hang) by connecting to a\nnon-responsive server, which triggers an infinite loop due to an\nuninitialized variable.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-3688"],"bugs":[""],"patches":{"havp":["other: https://sourceforge.net/mailarchive/message.php?msg_name=487CDF51.5060201%40endian.com"]},"tags":{},"packages":[{"name":"havp","source":"https://ubuntu.com/security/cve?package=havp","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=havp","debian":"https://tracker.debian.org/pkg/havp","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"feisty","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"hardy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"lucid","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"maverick","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"natty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"oneiric","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"0.89-1","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-3687","published":"2008-08-14T22:41:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nHeap-based buffer overflow in the flask_security_label function in Xen 3.3,\nwhen compiled with the XSM:FLASK module, allows unprivileged domain users\n(domU) to execute arbitrary code via the flask_op hypercall.","ubuntu_description":"","notes":[],"codename":null,"priority":"low","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-3687"],"bugs":[""],"patches":{"xen-3.0":[],"xen-3.1":[],"xen-3.2":[],"xen":[]},"tags":{},"packages":[{"name":"xen","source":"https://ubuntu.com/security/cve?package=xen","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen","debian":"https://tracker.debian.org/pkg/xen","statuses":[{"release_codename":"dapper","status":"not-affected","description":"not compiled with XSM:FLASK","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.0","source":"https://ubuntu.com/security/cve?package=xen-3.0","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.0","debian":"https://tracker.debian.org/pkg/xen-3.0","statuses":[{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"not compiled with XSM:FLASK","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.1","source":"https://ubuntu.com/security/cve?package=xen-3.1","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.1","debian":"https://tracker.debian.org/pkg/xen-3.1","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"not-affected","description":"not compiled with XSM:FLASK","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"not compiled with XSM:FLASK","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xen-3.2","source":"https://ubuntu.com/security/cve?package=xen-3.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xen-3.2","debian":"https://tracker.debian.org/pkg/xen-3.2","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"not compiled with XSM:FLASK","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2008-3686","published":"2008-08-14T22:41:00","updated_at":"2024-07-24T15:57:39.284958+00:00","description":"\nThe rt6_fill_node function in net/ipv6/route.c in Linux kernel 2.6.26-rc4,\n2.6.26.2, and possibly other 2.6.26 versions, allows local users to cause a\ndenial of service (kernel OOPS) via IPv6 requests when no IPv6 input device\nis in use, which triggers a NULL pointer dereference.","ubuntu_description":"","notes":[{"author":"jdstrand","note":"2.6.26 only"}],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2008-3686"],"bugs":[""],"patches":{"linux-source-2.6.15":[],"linux-source-2.6.20":[],"linux-source-2.6.22":[],"linux":[]},"tags":{},"packages":[{"name":"linux","source":"https://ubuntu.com/security/cve?package=linux","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux","debian":"https://tracker.debian.org/pkg/linux","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.15","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.15","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.15","debian":"https://tracker.debian.org/pkg/linux-source-2.6.15","statuses":[{"release_codename":"dapper","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.20","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.20","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.20","debian":"https://tracker.debian.org/pkg/linux-source-2.6.20","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.22","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.22","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.22","debian":"https://tracker.debian.org/pkg/linux-source-2.6.22","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"hardy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"not-affected","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]}],"offset":75100,"limit":20,"total_results":79316}