{"cves":[{"id":"CVE-2006-5815","published":"2006-11-08T23:07:00","updated_at":"2025-07-17T16:40:00.027738+00:00","description":"\nStack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and\nearlier allows remote attackers, probably authenticated, to cause a denial\nof service and execute arbitrary code, as demonstrated by vd_proftpd.pm, a\n\"ProFTPD remote exploit.\"","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2006-5815"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"proftpd","source":"https://ubuntu.com/security/cve?package=proftpd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=proftpd","debian":"https://tracker.debian.org/pkg/proftpd","statuses":[{"release_codename":"dapper","status":"released","description":"1.2.10-27ubuntu3.1","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"1.3.0-9ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"proftpd-dfsg","source":"https://ubuntu.com/security/cve?package=proftpd-dfsg","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=proftpd-dfsg","debian":"https://tracker.debian.org/pkg/proftpd-dfsg","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"1.3.0-21ubuntu1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2006-5463","published":"2006-11-08T22:07:00","updated_at":"2025-07-17T16:39:53.951459+00:00","description":"\nUnspecified vulnerability in Mozilla Firefox before 1.5.0.8, Thunderbird\nbefore 1.5.0.8, and SeaMonkey before 1.0.6 allows remote attackers to\nexecute arbitrary JavaScript bytecode via unspecified vectors involving\nmodification of a Script object while it is executing.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-381-1","https://ubuntu.com/security/notices/USN-382-1","https://www.cve.org/CVERecord?id=CVE-2006-5463"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"firefox","source":"https://ubuntu.com/security/cve?package=firefox","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=firefox","debian":"https://tracker.debian.org/pkg/firefox","statuses":[{"release_codename":"dapper","status":"released","description":"1.5.dfsg+1.5.0.13~prepatch070731-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"edgy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"mozilla-thunderbird","source":"https://ubuntu.com/security/cve?package=mozilla-thunderbird","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mozilla-thunderbird","debian":"https://tracker.debian.org/pkg/mozilla-thunderbird","statuses":[{"release_codename":"dapper","status":"released","description":"1.5.0.13-0ubuntu0.6.06","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"1.5.0.13-0ubuntu0.6.10","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"1.5.0.13-0ubuntu0.7.04","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xulrunner","source":"https://ubuntu.com/security/cve?package=xulrunner","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xulrunner","debian":"https://tracker.debian.org/pkg/xulrunner","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"1.8.0.10-3ubuntu1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-382-1","USN-381-1"],"notices":[{"id":"USN-382-1","title":"Thunderbird vulnerabilities","summary":"Thunderbird vulnerabilities","instructions":"After a standard system upgrade you need to restart Thunderbird to\neffect the necessary changes.","references":[],"published":"2006-11-21T19:17:47","description":"USN-352-1 fixed a flaw in the verification of PKCS certificate \nsignatures. Ulrich Kuehn discovered a variant of the original attack \nwhich the original fix did not cover. (CVE-2006-5462)\n\nVarious flaws have been reported that allow an attacker to execute \narbitrary code with user privileges by tricking the user into opening a \nmalicious email containing JavaScript. Please note that JavaScript is \ndisabled by default for emails, and it is not recommended to enable it. \n(CVE-2006-5463, CVE-2006-5464, CVE-2006-5747, CVE-2006-5748)","is_hidden":false,"release_packages":{"dapper":[{"name":"mozilla-thunderbird","version":"1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"mozilla-thunderbird","version":"1.5.0.8-0ubuntu0.5.10","is_source":false,"source_link":"","version_link":""}],"edgy":[{"name":"mozilla-thunderbird","version":"1.5.0.8-0ubuntu0.6.10","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-5462","CVE-2006-5463","CVE-2006-5464","CVE-2006-5747","CVE-2006-5748"]},{"id":"USN-381-1","title":"Firefox vulnerabilities","summary":"Firefox vulnerabilities","instructions":"After a standard system upgrade you need to restart Firefox to\neffect the necessary changes.","references":[],"published":"2006-11-21T19:17:28","description":"USN-351-1 fixed a flaw in the verification of PKCS certificate\nsignatures. Ulrich Kuehn discovered a variant of the original attack\nwhich the original fix did not cover. (CVE-2006-5462)\n\nVarious flaws have been reported that allow an attacker to execute\narbitrary code with user privileges by tricking the user into opening\na malicious web page containing JavaScript. (CVE-2006-5463,\nCVE-2006-5464, CVE-2006-5747, CVE-2006-5748)","is_hidden":false,"release_packages":{"dapper":[{"name":"firefox","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"firefox-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnss-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnss3","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnspr-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnspr4","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"firefox-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.5.10","is_source":false,"source_link":"","version_link":""},{"name":"firefox","version":"1.5.dfsg+1.5.0.8-0ubuntu0.5.10","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-5462","CVE-2006-5463","CVE-2006-5464","CVE-2006-5747","CVE-2006-5748"]}]},{"id":"CVE-2006-5748","published":"2006-11-08T21:07:00","updated_at":"2025-07-17T16:39:58.760641+00:00","description":"\nMultiple unspecified vulnerabilities in the JavaScript engine in Mozilla\nFirefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before\n1.0.6 allow remote attackers to cause a denial of service (crash) and\npossibly execute arbitrary code via unspecified vectors that trigger memory\ncorruption.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-381-1","https://ubuntu.com/security/notices/USN-382-1","https://www.cve.org/CVERecord?id=CVE-2006-5748"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"firefox","source":"https://ubuntu.com/security/cve?package=firefox","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=firefox","debian":"https://tracker.debian.org/pkg/firefox","statuses":[{"release_codename":"dapper","status":"released","description":"1.5.dfsg+1.5.0.13~prepatch070731-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"edgy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"mozilla-thunderbird","source":"https://ubuntu.com/security/cve?package=mozilla-thunderbird","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mozilla-thunderbird","debian":"https://tracker.debian.org/pkg/mozilla-thunderbird","statuses":[{"release_codename":"dapper","status":"released","description":"1.5.0.13-0ubuntu0.6.06","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"1.5.0.13-0ubuntu0.6.10","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"1.5.0.13-0ubuntu0.7.04","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xulrunner","source":"https://ubuntu.com/security/cve?package=xulrunner","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xulrunner","debian":"https://tracker.debian.org/pkg/xulrunner","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"1.8.0.10-3ubuntu1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-382-1","USN-381-1"],"notices":[{"id":"USN-382-1","title":"Thunderbird vulnerabilities","summary":"Thunderbird vulnerabilities","instructions":"After a standard system upgrade you need to restart Thunderbird to\neffect the necessary changes.","references":[],"published":"2006-11-21T19:17:47","description":"USN-352-1 fixed a flaw in the verification of PKCS certificate \nsignatures. Ulrich Kuehn discovered a variant of the original attack \nwhich the original fix did not cover. (CVE-2006-5462)\n\nVarious flaws have been reported that allow an attacker to execute \narbitrary code with user privileges by tricking the user into opening a \nmalicious email containing JavaScript. Please note that JavaScript is \ndisabled by default for emails, and it is not recommended to enable it. \n(CVE-2006-5463, CVE-2006-5464, CVE-2006-5747, CVE-2006-5748)","is_hidden":false,"release_packages":{"dapper":[{"name":"mozilla-thunderbird","version":"1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"mozilla-thunderbird","version":"1.5.0.8-0ubuntu0.5.10","is_source":false,"source_link":"","version_link":""}],"edgy":[{"name":"mozilla-thunderbird","version":"1.5.0.8-0ubuntu0.6.10","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-5462","CVE-2006-5463","CVE-2006-5464","CVE-2006-5747","CVE-2006-5748"]},{"id":"USN-381-1","title":"Firefox vulnerabilities","summary":"Firefox vulnerabilities","instructions":"After a standard system upgrade you need to restart Firefox to\neffect the necessary changes.","references":[],"published":"2006-11-21T19:17:28","description":"USN-351-1 fixed a flaw in the verification of PKCS certificate\nsignatures. Ulrich Kuehn discovered a variant of the original attack\nwhich the original fix did not cover. (CVE-2006-5462)\n\nVarious flaws have been reported that allow an attacker to execute\narbitrary code with user privileges by tricking the user into opening\na malicious web page containing JavaScript. (CVE-2006-5463,\nCVE-2006-5464, CVE-2006-5747, CVE-2006-5748)","is_hidden":false,"release_packages":{"dapper":[{"name":"firefox","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"firefox-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnss-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnss3","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnspr-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnspr4","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"firefox-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.5.10","is_source":false,"source_link":"","version_link":""},{"name":"firefox","version":"1.5.dfsg+1.5.0.8-0ubuntu0.5.10","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-5462","CVE-2006-5463","CVE-2006-5464","CVE-2006-5747","CVE-2006-5748"]}]},{"id":"CVE-2006-5747","published":"2006-11-08T21:07:00","updated_at":"2025-07-17T16:39:58.760641+00:00","description":"\nUnspecified vulnerability in Mozilla Firefox before 1.5.0.8, Thunderbird\nbefore 1.5.0.8, and SeaMonkey before 1.0.6 allows remote attackers to\nexecute arbitrary code via the XML.prototype.hasOwnProperty JavaScript\nfunction.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-381-1","https://ubuntu.com/security/notices/USN-382-1","https://www.cve.org/CVERecord?id=CVE-2006-5747"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"firefox","source":"https://ubuntu.com/security/cve?package=firefox","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=firefox","debian":"https://tracker.debian.org/pkg/firefox","statuses":[{"release_codename":"dapper","status":"released","description":"1.5.dfsg+1.5.0.13~prepatch070731-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"edgy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"mozilla-thunderbird","source":"https://ubuntu.com/security/cve?package=mozilla-thunderbird","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mozilla-thunderbird","debian":"https://tracker.debian.org/pkg/mozilla-thunderbird","statuses":[{"release_codename":"dapper","status":"released","description":"1.5.0.13-0ubuntu0.6.06","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"1.5.0.13-0ubuntu0.6.10","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"1.5.0.13-0ubuntu0.7.04","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-382-1","USN-381-1"],"notices":[{"id":"USN-382-1","title":"Thunderbird vulnerabilities","summary":"Thunderbird vulnerabilities","instructions":"After a standard system upgrade you need to restart Thunderbird to\neffect the necessary changes.","references":[],"published":"2006-11-21T19:17:47","description":"USN-352-1 fixed a flaw in the verification of PKCS certificate \nsignatures. Ulrich Kuehn discovered a variant of the original attack \nwhich the original fix did not cover. (CVE-2006-5462)\n\nVarious flaws have been reported that allow an attacker to execute \narbitrary code with user privileges by tricking the user into opening a \nmalicious email containing JavaScript. Please note that JavaScript is \ndisabled by default for emails, and it is not recommended to enable it. \n(CVE-2006-5463, CVE-2006-5464, CVE-2006-5747, CVE-2006-5748)","is_hidden":false,"release_packages":{"dapper":[{"name":"mozilla-thunderbird","version":"1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"mozilla-thunderbird","version":"1.5.0.8-0ubuntu0.5.10","is_source":false,"source_link":"","version_link":""}],"edgy":[{"name":"mozilla-thunderbird","version":"1.5.0.8-0ubuntu0.6.10","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-5462","CVE-2006-5463","CVE-2006-5464","CVE-2006-5747","CVE-2006-5748"]},{"id":"USN-381-1","title":"Firefox vulnerabilities","summary":"Firefox vulnerabilities","instructions":"After a standard system upgrade you need to restart Firefox to\neffect the necessary changes.","references":[],"published":"2006-11-21T19:17:28","description":"USN-351-1 fixed a flaw in the verification of PKCS certificate\nsignatures. Ulrich Kuehn discovered a variant of the original attack\nwhich the original fix did not cover. (CVE-2006-5462)\n\nVarious flaws have been reported that allow an attacker to execute\narbitrary code with user privileges by tricking the user into opening\na malicious web page containing JavaScript. (CVE-2006-5463,\nCVE-2006-5464, CVE-2006-5747, CVE-2006-5748)","is_hidden":false,"release_packages":{"dapper":[{"name":"firefox","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"firefox-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnss-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnss3","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnspr-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnspr4","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"firefox-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.5.10","is_source":false,"source_link":"","version_link":""},{"name":"firefox","version":"1.5.dfsg+1.5.0.8-0ubuntu0.5.10","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-5462","CVE-2006-5463","CVE-2006-5464","CVE-2006-5747","CVE-2006-5748"]}]},{"id":"CVE-2006-5464","published":"2006-11-08T21:07:00","updated_at":"2025-07-17T16:39:53.951459+00:00","description":"\nMultiple unspecified vulnerabilities in the layout engine in Mozilla\nFirefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before\n1.0.6 allow remote attackers to cause a denial of service (crash) via\nunspecified vectors.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-381-1","https://ubuntu.com/security/notices/USN-382-1","https://www.cve.org/CVERecord?id=CVE-2006-5464"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"firefox","source":"https://ubuntu.com/security/cve?package=firefox","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=firefox","debian":"https://tracker.debian.org/pkg/firefox","statuses":[{"release_codename":"dapper","status":"released","description":"1.5.dfsg+1.5.0.13~prepatch070731-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"edgy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"mozilla-thunderbird","source":"https://ubuntu.com/security/cve?package=mozilla-thunderbird","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mozilla-thunderbird","debian":"https://tracker.debian.org/pkg/mozilla-thunderbird","statuses":[{"release_codename":"dapper","status":"released","description":"1.5.0.13-0ubuntu0.6.06","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"1.5.0.13-0ubuntu0.6.10","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"1.5.0.13-0ubuntu0.7.04","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xulrunner","source":"https://ubuntu.com/security/cve?package=xulrunner","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xulrunner","debian":"https://tracker.debian.org/pkg/xulrunner","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"1.8.0.10-3ubuntu1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-382-1","USN-381-1"],"notices":[{"id":"USN-382-1","title":"Thunderbird vulnerabilities","summary":"Thunderbird vulnerabilities","instructions":"After a standard system upgrade you need to restart Thunderbird to\neffect the necessary changes.","references":[],"published":"2006-11-21T19:17:47","description":"USN-352-1 fixed a flaw in the verification of PKCS certificate \nsignatures. Ulrich Kuehn discovered a variant of the original attack \nwhich the original fix did not cover. (CVE-2006-5462)\n\nVarious flaws have been reported that allow an attacker to execute \narbitrary code with user privileges by tricking the user into opening a \nmalicious email containing JavaScript. Please note that JavaScript is \ndisabled by default for emails, and it is not recommended to enable it. \n(CVE-2006-5463, CVE-2006-5464, CVE-2006-5747, CVE-2006-5748)","is_hidden":false,"release_packages":{"dapper":[{"name":"mozilla-thunderbird","version":"1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"mozilla-thunderbird","version":"1.5.0.8-0ubuntu0.5.10","is_source":false,"source_link":"","version_link":""}],"edgy":[{"name":"mozilla-thunderbird","version":"1.5.0.8-0ubuntu0.6.10","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-5462","CVE-2006-5463","CVE-2006-5464","CVE-2006-5747","CVE-2006-5748"]},{"id":"USN-381-1","title":"Firefox vulnerabilities","summary":"Firefox vulnerabilities","instructions":"After a standard system upgrade you need to restart Firefox to\neffect the necessary changes.","references":[],"published":"2006-11-21T19:17:28","description":"USN-351-1 fixed a flaw in the verification of PKCS certificate\nsignatures. Ulrich Kuehn discovered a variant of the original attack\nwhich the original fix did not cover. (CVE-2006-5462)\n\nVarious flaws have been reported that allow an attacker to execute\narbitrary code with user privileges by tricking the user into opening\na malicious web page containing JavaScript. (CVE-2006-5463,\nCVE-2006-5464, CVE-2006-5747, CVE-2006-5748)","is_hidden":false,"release_packages":{"dapper":[{"name":"firefox","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"firefox-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnss-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnss3","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnspr-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnspr4","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"firefox-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.5.10","is_source":false,"source_link":"","version_link":""},{"name":"firefox","version":"1.5.dfsg+1.5.0.8-0ubuntu0.5.10","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-5462","CVE-2006-5463","CVE-2006-5464","CVE-2006-5747","CVE-2006-5748"]}]},{"id":"CVE-2006-5462","published":"2006-11-08T21:07:00","updated_at":"2025-07-17T16:39:53.951459+00:00","description":"\nMozilla Network Security Service (NSS) library before 3.11.3, as used in\nMozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey\nbefore 1.0.6, when using an RSA key with exponent 3, does not properly\nhandle extra data in a signature, which allows remote attackers to forge\nsignatures for SSL/TLS and email certificates. NOTE: this identifier is for\nunpatched product versions that were originally intended to be addressed by\nCVE-2006-4340.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-381-1","https://ubuntu.com/security/notices/USN-382-1","https://www.cve.org/CVERecord?id=CVE-2006-5462"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"firefox","source":"https://ubuntu.com/security/cve?package=firefox","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=firefox","debian":"https://tracker.debian.org/pkg/firefox","statuses":[{"release_codename":"dapper","status":"released","description":"1.5.dfsg+1.5.0.13~prepatch070731-0ubuntu1","component":null,"pocket":"security"},{"release_codename":"edgy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"mozilla-thunderbird","source":"https://ubuntu.com/security/cve?package=mozilla-thunderbird","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=mozilla-thunderbird","debian":"https://tracker.debian.org/pkg/mozilla-thunderbird","statuses":[{"release_codename":"dapper","status":"released","description":"1.5.0.13-0ubuntu0.6.06","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"1.5.0.13-0ubuntu0.6.10","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"1.5.0.13-0ubuntu0.7.04","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"xulrunner","source":"https://ubuntu.com/security/cve?package=xulrunner","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=xulrunner","debian":"https://tracker.debian.org/pkg/xulrunner","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"1.8.0.10-3ubuntu1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-382-1","USN-381-1"],"notices":[{"id":"USN-382-1","title":"Thunderbird vulnerabilities","summary":"Thunderbird vulnerabilities","instructions":"After a standard system upgrade you need to restart Thunderbird to\neffect the necessary changes.","references":[],"published":"2006-11-21T19:17:47","description":"USN-352-1 fixed a flaw in the verification of PKCS certificate \nsignatures. Ulrich Kuehn discovered a variant of the original attack \nwhich the original fix did not cover. (CVE-2006-5462)\n\nVarious flaws have been reported that allow an attacker to execute \narbitrary code with user privileges by tricking the user into opening a \nmalicious email containing JavaScript. Please note that JavaScript is \ndisabled by default for emails, and it is not recommended to enable it. \n(CVE-2006-5463, CVE-2006-5464, CVE-2006-5747, CVE-2006-5748)","is_hidden":false,"release_packages":{"dapper":[{"name":"mozilla-thunderbird","version":"1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"mozilla-thunderbird","version":"1.5.0.8-0ubuntu0.5.10","is_source":false,"source_link":"","version_link":""}],"edgy":[{"name":"mozilla-thunderbird","version":"1.5.0.8-0ubuntu0.6.10","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-5462","CVE-2006-5463","CVE-2006-5464","CVE-2006-5747","CVE-2006-5748"]},{"id":"USN-381-1","title":"Firefox vulnerabilities","summary":"Firefox vulnerabilities","instructions":"After a standard system upgrade you need to restart Firefox to\neffect the necessary changes.","references":[],"published":"2006-11-21T19:17:28","description":"USN-351-1 fixed a flaw in the verification of PKCS certificate\nsignatures. Ulrich Kuehn discovered a variant of the original attack\nwhich the original fix did not cover. (CVE-2006-5462)\n\nVarious flaws have been reported that allow an attacker to execute\narbitrary code with user privileges by tricking the user into opening\na malicious web page containing JavaScript. (CVE-2006-5463,\nCVE-2006-5464, CVE-2006-5747, CVE-2006-5748)","is_hidden":false,"release_packages":{"dapper":[{"name":"firefox","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"firefox-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnss-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnss3","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnspr-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""},{"name":"libnspr4","version":"1.5.dfsg+1.5.0.8-0ubuntu0.6.06","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"firefox-dev","version":"1.5.dfsg+1.5.0.8-0ubuntu0.5.10","is_source":false,"source_link":"","version_link":""},{"name":"firefox","version":"1.5.dfsg+1.5.0.8-0ubuntu0.5.10","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-5462","CVE-2006-5463","CVE-2006-5464","CVE-2006-5747","CVE-2006-5748"]}]},{"id":"CVE-2006-4810","published":"2006-11-08T21:07:00","updated_at":"2025-07-17T16:39:46.035635+00:00","description":"\nBuffer overflow in the readline function in util/texindex.c, as used by the\n(1) texi2dvi and (2) texindex commands, in texinfo 4.8 and earlier allows\nlocal users to execute arbitrary code via a crafted Texinfo file.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-379-1","https://www.cve.org/CVERecord?id=CVE-2006-4810"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"texinfo","source":"https://ubuntu.com/security/cve?package=texinfo","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=texinfo","debian":"https://tracker.debian.org/pkg/texinfo","statuses":[{"release_codename":"dapper","status":"released","description":"4.8-4ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"4.8.dfsg.1-1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"4.8.dfsg.1-4build1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-379-1"],"notices":[{"id":"USN-379-1","title":"texinfo vulnerability","summary":"texinfo vulnerability","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.","references":[],"published":"2006-11-09T19:17:19","description":"Miloslav Trmac discovered a buffer overflow in texinfo's index \nprocessor.  If a user is tricked into processing a .texi file with \ntexindex, this could lead to arbitrary code execution with user \nprivileges.","is_hidden":false,"release_packages":{"dapper":[{"name":"texinfo","version":"4.8-4ubuntu0.1","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"texinfo","version":"4.7-2.2ubuntu2.2","is_source":false,"source_link":"","version_link":""}],"edgy":[{"name":"texinfo","version":"4.8.dfsg.1-1ubuntu0.1","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-4810"]}]},{"id":"CVE-2006-5794","published":"2006-11-08T20:07:00","updated_at":"2025-07-17T16:40:00.027738+00:00","description":"\nUnspecified vulnerability in the sshd Privilege Separation Monitor in\nOpenSSH before 4.5 causes weaker verification that authentication has been\nsuccessful, which might allow attackers to bypass authentication. NOTE: as\nof 20061108, it is believed that this issue is only exploitable by\nleveraging vulnerabilities in the unprivileged process, which are not known\nto exist.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2006-5794"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"openssh","source":"https://ubuntu.com/security/cve?package=openssh","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openssh","debian":"https://tracker.debian.org/pkg/openssh","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2006-5791","published":"2006-11-07T23:07:00","updated_at":"2025-07-17T16:40:00.027738+00:00","description":"\nMultiple cross-site scripting (XSS) vulnerabilities in elogd.c in ELOG\n2.6.2 and earlier allow remote attackers to inject arbitrary HTML or web\nscript via (1) the filename for downloading, which is not quoted in an\nerror message by the send_file_direct function, and (2) the Type or\nCategory values in a New entry, which is not properly handled in an error\nmessage by the submit_elog function.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2006-5791"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"elog","source":"https://ubuntu.com/security/cve?package=elog","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=elog","debian":"https://tracker.debian.org/pkg/elog","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"2.6.2+r1754-1","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"2.6.2+r1754-1","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"2.6.2+r1754-1","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2006-5790","published":"2006-11-07T23:07:00","updated_at":"2025-07-17T16:40:00.027738+00:00","description":"\nMultiple format string vulnerabilities in elogd.c in ELOG 2.6.2 and earlier\nallow remote attackers to cause a denial of service (crash) and possibly\nexecute arbitrary code via (1) an entry with an attachment whose name\ncontains format string specifiers (el_submit function), and possibly other\nvectors in the (2) receive_config, (3) show_rss_feed, (4) show_elog_list,\n(5) show_logbook_node, and (6) server_loop functions.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2006-5790"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"elog","source":"https://ubuntu.com/security/cve?package=elog","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=elog","debian":"https://tracker.debian.org/pkg/elog","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"2.6.2+r1754-1","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"2.6.2+r1754-1","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"2.6.2+r1754-1","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"karmic","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2006-5783","published":"2006-11-07T23:07:00","updated_at":"2025-08-04T19:18:39.145764+00:00","description":"\nFirefox 1.5.0.7 on Kubuntu Linux allows remote attackers to cause a denial\nof service (crash) via a long URL in an A tag.  NOTE: this issue has been\ndisputed by several vendors, who could not reproduce the report. In\naddition, the scope of the impact - system freeze - suggests an issue that\nis not related to Firefox. Due to this impact, CVE concurs with the dispute","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2006-5783"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"firefox","source":"https://ubuntu.com/security/cve?package=firefox","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=firefox","debian":"https://tracker.debian.org/pkg/firefox","statuses":[{"release_codename":"dapper","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2006-5779","published":"2006-11-07T18:07:00","updated_at":"2025-07-17T16:40:00.027738+00:00","description":"\nOpenLDAP before 2.3.29 allows remote attackers to cause a denial of service\n(daemon crash) via LDAP BIND requests with long authcid names, which\ntriggers an assertion failure.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":7.5,"impact":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH"}}},"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-384-1","https://www.cve.org/CVERecord?id=CVE-2006-5779"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"openldap2.2","source":"https://ubuntu.com/security/cve?package=openldap2.2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openldap2.2","debian":"https://tracker.debian.org/pkg/openldap2.2","statuses":[{"release_codename":"dapper","status":"released","description":"2.2.26-5ubuntu2.2","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"2.2.26-5ubuntu3.1","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"openldap2.3","source":"https://ubuntu.com/security/cve?package=openldap2.3","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openldap2.3","debian":"https://tracker.debian.org/pkg/openldap2.3","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"2.3.30-2","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-384-1"],"notices":[{"id":"USN-384-1","title":"OpenLDAP vulnerability","summary":"OpenLDAP vulnerability","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.","references":[],"published":"2006-11-21T00:46:53","description":"Evgeny Legerov discovered that the OpenLDAP libraries did not correctly \ntruncate authcid names.  This situation would trigger an assert and \nabort the program using the libraries.  A remote attacker could send \nspecially crafted bind requests that would lead to an LDAP server denial \nof service.","is_hidden":false,"release_packages":{"dapper":[{"name":"libldap-2.2-7","version":"2.2.26-5ubuntu2.2","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"libldap-2.2-7","version":"2.2.26-3ubuntu0.2","is_source":false,"source_link":"","version_link":""}],"edgy":[{"name":"libldap-2.2-7","version":"2.2.26-5ubuntu3.1","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-5779"]}]},{"id":"CVE-2006-5778","published":"2006-11-07T18:07:00","updated_at":"2025-07-17T16:39:58.760641+00:00","description":"\nftpd in linux-ftpd 0.17, and possibly other versions, performs a chdir\nbefore setting the UID, which allows local users to bypass intended access\nrestrictions by redirecting their home directory to a restricted directory.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://www.cve.org/CVERecord?id=CVE-2006-5778"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"linux-ftpd","source":"https://ubuntu.com/security/cve?package=linux-ftpd","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-ftpd","debian":"https://tracker.debian.org/pkg/linux-ftpd","statuses":[{"release_codename":"dapper","status":"ignored","description":"end of life","component":null,"pocket":"security"},{"release_codename":"edgy","status":"ignored","description":"end of life, was needed","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"0.17-23","component":null,"pocket":"security"},{"release_codename":"gutsy","status":"released","description":"0.17-23","component":null,"pocket":"security"},{"release_codename":"hardy","status":"released","description":"0.17-23","component":null,"pocket":"security"},{"release_codename":"intrepid","status":"released","description":"0.17-23","component":null,"pocket":"security"},{"release_codename":"jaunty","status":"released","description":"0.17-23","component":null,"pocket":"security"},{"release_codename":"karmic","status":"released","description":"0.17-23","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":[],"notices":[]},{"id":"CVE-2006-4809","published":"2006-11-07T00:07:00","updated_at":"2025-07-17T16:39:46.035635+00:00","description":"\nStack-based buffer overflow in loader_pnm.c in imlib2 before 1.2.1, and\npossibly other versions, allows user-assisted remote attackers to cause a\ndenial of service (crash) and possibly execute arbitrary code via a crafted\nPNM image.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-376-1","https://www.cve.org/CVERecord?id=CVE-2006-4809"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"imlib2","source":"https://ubuntu.com/security/cve?package=imlib2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=imlib2","debian":"https://tracker.debian.org/pkg/imlib2","statuses":[{"release_codename":"dapper","status":"released","description":"1.2.1-2ubuntu0.2","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"1.2.1-2ubuntu1.2","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.3.0.0","component":null,"pocket":"security"}]}],"notices_ids":["USN-376-1"],"notices":[{"id":"USN-376-1","title":"imlib2 vulnerabilities","summary":"imlib2 vulnerabilities","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.","references":[],"published":"2006-11-03T23:37:09","description":"M. Joonas Pihlaja discovered that imlib2 did not sufficiently verify the \nvalidity of ARGB, JPG, LBM, PNG, PNM, TGA, and TIFF images.  If a user \nwere tricked into viewing or processing a specially crafted image with \nan application that uses imlib2, the flaws could be exploited to execute \narbitrary code with the user's privileges.","is_hidden":false,"release_packages":{"dapper":[{"name":"libimlib2","version":"1.2.1-2ubuntu0.1","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"libimlib2","version":"1.2.0-2.2ubuntu2.1","is_source":false,"source_link":"","version_link":""}],"edgy":[{"name":"libimlib2","version":"1.2.1-2ubuntu1.1","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-4806","CVE-2006-4807","CVE-2006-4808","CVE-2006-4809"]}]},{"id":"CVE-2006-4808","published":"2006-11-07T00:07:00","updated_at":"2025-07-17T16:39:46.035635+00:00","description":"\nHeap-based buffer overflow in loader_tga.c in imlib2 before 1.2.1, and\npossibly other versions, allows user-assisted remote attackers to cause a\ndenial of service (crash) and possibly execute arbitrary code via a crafted\nTGA image.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-376-1","https://www.cve.org/CVERecord?id=CVE-2006-4808"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"imlib2","source":"https://ubuntu.com/security/cve?package=imlib2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=imlib2","debian":"https://tracker.debian.org/pkg/imlib2","statuses":[{"release_codename":"dapper","status":"released","description":"1.2.1-2ubuntu0.2","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"1.2.1-2ubuntu1.2","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.3.0.0","component":null,"pocket":"security"}]}],"notices_ids":["USN-376-1"],"notices":[{"id":"USN-376-1","title":"imlib2 vulnerabilities","summary":"imlib2 vulnerabilities","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.","references":[],"published":"2006-11-03T23:37:09","description":"M. Joonas Pihlaja discovered that imlib2 did not sufficiently verify the \nvalidity of ARGB, JPG, LBM, PNG, PNM, TGA, and TIFF images.  If a user \nwere tricked into viewing or processing a specially crafted image with \nan application that uses imlib2, the flaws could be exploited to execute \narbitrary code with the user's privileges.","is_hidden":false,"release_packages":{"dapper":[{"name":"libimlib2","version":"1.2.1-2ubuntu0.1","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"libimlib2","version":"1.2.0-2.2ubuntu2.1","is_source":false,"source_link":"","version_link":""}],"edgy":[{"name":"libimlib2","version":"1.2.1-2ubuntu1.1","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-4806","CVE-2006-4807","CVE-2006-4808","CVE-2006-4809"]}]},{"id":"CVE-2006-4807","published":"2006-11-07T00:07:00","updated_at":"2025-07-17T16:39:46.035635+00:00","description":"\nloader_tga.c in imlib2 before 1.2.1, and possibly other versions, allows\nuser-assisted remote attackers to cause a denial of service (crash) via a\ncrafted TGA image that triggers an out-of-bounds memory read, a different\nissue than CVE-2006-4808.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-376-1","https://www.cve.org/CVERecord?id=CVE-2006-4807"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"imlib2","source":"https://ubuntu.com/security/cve?package=imlib2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=imlib2","debian":"https://tracker.debian.org/pkg/imlib2","statuses":[{"release_codename":"dapper","status":"released","description":"1.2.1-2ubuntu0.2","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"1.2.1-2ubuntu1.2","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.3.0.0","component":null,"pocket":"security"}]}],"notices_ids":["USN-376-1"],"notices":[{"id":"USN-376-1","title":"imlib2 vulnerabilities","summary":"imlib2 vulnerabilities","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.","references":[],"published":"2006-11-03T23:37:09","description":"M. Joonas Pihlaja discovered that imlib2 did not sufficiently verify the \nvalidity of ARGB, JPG, LBM, PNG, PNM, TGA, and TIFF images.  If a user \nwere tricked into viewing or processing a specially crafted image with \nan application that uses imlib2, the flaws could be exploited to execute \narbitrary code with the user's privileges.","is_hidden":false,"release_packages":{"dapper":[{"name":"libimlib2","version":"1.2.1-2ubuntu0.1","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"libimlib2","version":"1.2.0-2.2ubuntu2.1","is_source":false,"source_link":"","version_link":""}],"edgy":[{"name":"libimlib2","version":"1.2.1-2ubuntu1.1","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-4806","CVE-2006-4807","CVE-2006-4808","CVE-2006-4809"]}]},{"id":"CVE-2006-4806","published":"2006-11-07T00:07:00","updated_at":"2025-07-17T16:39:46.035635+00:00","description":"\nMultiple integer overflows in imlib2 allow user-assisted remote attackers\nto cause a denial of service (crash) and possibly execute arbitrary code\nvia a crafted (1) ARGB (loader_argb.c), (2) PNG (loader_png.c), (3) LBM\n(loader_lbm.c), (4) JPEG (loader_jpeg.c), or (5) TIFF (loader_tiff.c)\nimages.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-376-1","https://www.cve.org/CVERecord?id=CVE-2006-4806"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"imlib2","source":"https://ubuntu.com/security/cve?package=imlib2","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=imlib2","debian":"https://tracker.debian.org/pkg/imlib2","statuses":[{"release_codename":"dapper","status":"released","description":"1.2.1-2ubuntu0.2","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"1.2.1-2ubuntu1.2","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"released","description":"1.3.0.0","component":null,"pocket":"security"}]}],"notices_ids":["USN-376-1"],"notices":[{"id":"USN-376-1","title":"imlib2 vulnerabilities","summary":"imlib2 vulnerabilities","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.","references":[],"published":"2006-11-03T23:37:09","description":"M. Joonas Pihlaja discovered that imlib2 did not sufficiently verify the \nvalidity of ARGB, JPG, LBM, PNG, PNM, TGA, and TIFF images.  If a user \nwere tricked into viewing or processing a specially crafted image with \nan application that uses imlib2, the flaws could be exploited to execute \narbitrary code with the user's privileges.","is_hidden":false,"release_packages":{"dapper":[{"name":"libimlib2","version":"1.2.1-2ubuntu0.1","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"libimlib2","version":"1.2.0-2.2ubuntu2.1","is_source":false,"source_link":"","version_link":""}],"edgy":[{"name":"libimlib2","version":"1.2.1-2ubuntu1.1","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-4806","CVE-2006-4807","CVE-2006-4808","CVE-2006-4809"]}]},{"id":"CVE-2006-4572","published":"2006-11-07T00:07:00","updated_at":"2025-07-17T16:39:42.807693+00:00","description":"\nip6_tables in netfilter in the Linux kernel before 2.6.16.31 allows remote\nattackers to (1) bypass a rule that disallows a protocol, via a packet with\nthe protocol header not located immediately after the fragment header, aka\n\"ip6_tables protocol bypass bug;\" and (2) bypass a rule that looks for a\ncertain extension header, via a packet with an extension header outside the\nfirst fragment, aka \"ip6_tables extension header bypass bug.\"","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-395-1","https://ubuntu.com/security/notices/USN-416-1","https://www.cve.org/CVERecord?id=CVE-2006-4572"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"linux-source-2.6.15","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.15","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.15","debian":"https://tracker.debian.org/pkg/linux-source-2.6.15","statuses":[{"release_codename":"dapper","status":"released","description":"2.6.15-29.58","component":null,"pocket":"security"},{"release_codename":"edgy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.17","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.17","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.17","debian":"https://tracker.debian.org/pkg/linux-source-2.6.17","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"2.6.17.1-12.40","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-416-1","USN-395-1"],"notices":[{"id":"USN-416-1","title":"Linux kernel vulnerabilities","summary":"Linux kernel vulnerabilities","instructions":"After a standard system upgrade you need to reboot your computer to\neffect the necessary changes.\n\nATTENTION: Due to an unavoidable ABI change the Ubuntu 6.06 and Ubuntu\n6.10 kernel updates have been given a new version number, which\nrequires you to recompile and reinstall all third party kernel modules\nyou might have installed. If you use linux-restricted-modules, you\nhave to update that package as well to get modules which work with the\nnew kernel version. Unless you manually uninstalled the standard\nkernel metapackages (linux-386, linux-powerpc, linux-amd64-generic), a\nstandard system upgrade will automatically perform this as well.","references":[],"published":"2007-02-10T03:17:12","description":"Mark Dowd discovered that the netfilter iptables module did not\ncorrecly handle fragmented IPv6 packets. By sending specially crafted\npackets, a remote attacker could exploit this to bypass firewall\nrules. This has has already been fixed for Ubuntu 6.10 in USN-395-1;\nthis is the corresponding fix for Ubuntu 6.06.(CVE-2006-4572)\n\nDoug Chapman discovered an improper lock handling in the mincore()\nfunction. A local attacker could exploit this to cause an eternal hang\nin the kernel, rendering the machine unusable. (CVE-2006-4814)\n\nAl Viro reported that the ISDN PPP module did not initialize the reset\nstate timer. By sending specially crafted ISDN packets, a remote\nattacker could exploit this to crash the kernel. (CVE-2006-5749)\n\nVarious syscalls (like listxattr()) misinterpreted the return value of\nreturn_EIO() when encountering bad inodes. By issuing particular\nsystem calls on a malformed file system, a local attacker could\nexploit this to crash the kernel. (CVE-2006-5753)\n\nThe task switching code did not save and restore EFLAGS of processes.\nBy starting a specially crafted executable, a local attacker could\nexploit this to eventually crash many other running processes. This\nonly affects the amd64 platform. (CVE-2006-5755)\n\nA race condition was found in the grow_buffers() function. By mounting\na specially crafted ISO9660 or NTFS file system, a local attacker\ncould exploit this to trigger an infinite loop in the kernel,\nrendering the machine unusable. (CVE-2006-5757)\n\nA buffer overread was found in the zlib_inflate() function. By\ntricking an user into mounting a specially crafted file system which\nuses zlib compression (such as cramfs), this could be exploited to\ncrash the kernel. (CVE-2006-5823)\n\nThe ext3 file system driver did not properly handle corrupted data\nstructures. By mounting a specially crafted ext3 file system, a local\nattacker could exploit this to crash the kernel. (CVE-2006-6053)\n\nThe ext2 file system driver did not properly handle corrupted data\nstructures. By mounting a specially crafted ext2 file system, a local\nattacker could exploit this to crash the kernel. (CVE-2006-6054)\n\nThe hfs file system driver did not properly handle corrupted data\nstructures. By mounting a specially crafted hfs file system, a local\nattacker could exploit this to crash the kernel. This only affects\nsystems which enable SELinux (Ubuntu disables SELinux by default).\n(CVE-2006-6056)\n\nSeveral vulnerabilities have been found in the GFS2 file system\ndriver. Since this driver has never actually worked in Ubuntu 6.10, it\nhas been disabled. This only affects Ubuntu 6.10. (CVE-2006-6057)\n\nMarcel Holtman discovered several buffer overflows in the Bluetooth\ndriver. By sending Bluetooth packets with specially crafted CAPI\nmessages, a remote attacker could exploit these to crash the kernel.\n(CVE-2006-6106)","is_hidden":false,"release_packages":{"dapper":[{"name":"linux-image-2.6.15-28-amd64-generic","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-powerpc-smp","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-amd64-k8","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-686","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-powerpc64-smp","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-server-bigiron","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-sparc64-smp","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-server","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-k7","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-amd64-server","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-amd64-xeon","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-386","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-powerpc","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-sparc64","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"linux-image-2.6.12-10-amd64-k8-smp","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-686","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-amd64-generic","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-686-smp","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-patch-ubuntu-2.6.12","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-k7-smp","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-amd64-k8","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-amd64-xeon","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-k7","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-powerpc","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-386","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-powerpc64-smp","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-powerpc-smp","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""}],"edgy":[{"name":"linux-image-2.6.17-11-generic","version":"2.6.17.1-11.35","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-11-server-bigiron","version":"2.6.17.1-11.35","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-11-sparc64-smp","version":"2.6.17.1-11.35","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-11-powerpc","version":"2.6.17.1-11.35","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-11-386","version":"2.6.17.1-11.35","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-11-powerpc-smp","version":"2.6.17.1-11.35","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-11-sparc64","version":"2.6.17.1-11.35","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-11-server","version":"2.6.17.1-11.35","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-11-powerpc64-smp","version":"2.6.17.1-11.35","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-4572","CVE-2006-4814","CVE-2006-5749","CVE-2006-5753","CVE-2006-5755","CVE-2006-5757","CVE-2006-5823","CVE-2006-6053","CVE-2006-6054","CVE-2006-6056","CVE-2006-6057","CVE-2006-6106"]},{"id":"USN-395-1","title":"Linux kernel vulnerabilities","summary":"Linux kernel vulnerabilities","instructions":"After a standard system upgrade you need to reboot your computer to\neffect the necessary changes.","references":[],"published":"2006-12-14T00:46:35","description":"Mark Dowd discovered that the netfilter iptables module did not\ncorrecly handle fragmented packets. By sending specially crafted\npackets, a remote attacker could exploit this to bypass firewall\nrules. This has only be fixed for Ubuntu 6.10; the corresponding fix\nfor Ubuntu 5.10 and 6.06 will follow soon. (CVE-2006-4572)\n\nDmitriy Monakhov discovered an information leak in the\n__block_prepare_write() function. During error recovery, this function\ndid not properly clear memory buffers which could allow local users to\nread portions of unlinked files. This only affects Ubuntu 5.10.\n(CVE-2006-4813)\n\nADLab Venustech Info Ltd discovered that the ATM network driver\nreferenced an already released pointer in some circumstances. By\nsending specially crafted packets to a host over ATM, a remote\nattacker could exploit this to crash that host. This does not affect\nUbuntu 6.10. (CVE-2006-4997)\n\nMatthias Andree discovered that the NFS locking management daemon\n(lockd) did not correctly handle mixing of 'lock' and 'nolock' option\nmounts on the same client. A remote attacker could exploit this to\ncrash lockd and thus rendering the NFS imports inaccessible. This only\naffects Ubuntu 5.10. (CVE-2006-5158)\n\nThe task switching code did not save and restore EFLAGS of processes.\nBy starting a specially crafted executable, a local attacker could\nexploit this to eventually crash many other running processes. This\ndoes not affect Ubuntu 6.10. (CVE-2006-5173)\n\nJames Morris discovered that the ip6fl_get_n() function incorrectly\nhandled flow labels. A local attacker could exploit this to crash the\nkernel. (CVE-2006-5619)\n\nFabio Massimo Di Nitto discovered that the sys_get_robust_list and\nsys_set_robust_list system calls lacked proper lock handling on the\npowerpc platform. A local attacker could exploit this to create\nunkillable processes, drain all available CPU/memory, and render the\nmachine unrebootable. This only affects Ubuntu 6.10.  (CVE-2006-5648)\n\nFabio Massimo Di Nitto discovered a flaw in the alignment check\nexception handling on the powerpc platform. A local attacker could\nexploit this to cause a kernel panic and crash the machine.\n(CVE-2006-5649)\n\nCertain corrupted squashfs file system images caused a memory\nallocation to be freed twice. By mounting a specially crafted squashfs\nfile system, a local attacker could exploit this to crash the kernel.\nThis does not affect Ubuntu 5.10. (CVE-2006-5701)\n\nAn integer overflow was found in the get_fdb_entries() function of the\nnetwork bridging code. By executing a specially crafted ioctl, a local\nattacker could exploit this to execute arbitrary code with root\nprivileges. (CVE-2006-5751)","is_hidden":false,"release_packages":{"dapper":[{"name":"linux-image-2.6.15-27-powerpc-smp","version":"2.6.15-27.50","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-27-amd64-xeon","version":"2.6.15-27.50","is_source":false,"source_link":"","version_link":""},{"name":"linux-source-2.6.15","version":"2.6.15-27.50","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-27-k7","version":"2.6.15-27.50","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-27-sparc64","version":"2.6.15-27.50","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-27-686","version":"2.6.15-27.50","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-27-amd64-k8","version":"2.6.15-27.50","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-27-powerpc","version":"2.6.15-27.50","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-27-server-bigiron","version":"2.6.15-27.50","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-27-amd64-generic","version":"2.6.15-27.50","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-27-386","version":"2.6.15-27.50","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-27-powerpc64-smp","version":"2.6.15-27.50","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-27-sparc64-smp","version":"2.6.15-27.50","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-27-server","version":"2.6.15-27.50","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-27-amd64-server","version":"2.6.15-27.50","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"linux-image-2.6.12-10-amd64-k8-smp","version":"2.6.12-10.42","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-686","version":"2.6.12-10.42","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-amd64-generic","version":"2.6.12-10.42","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-686-smp","version":"2.6.12-10.42","is_source":false,"source_link":"","version_link":""},{"name":"linux-patch-ubuntu-2.6.12","version":"2.6.12-10.42","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-k7-smp","version":"2.6.12-10.42","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-amd64-k8","version":"2.6.12-10.42","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-sparc64-smp","version":"2.6.12-10.42","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-amd64-xeon","version":"2.6.12-10.42","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-k7","version":"2.6.12-10.42","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-sparc64","version":"2.6.12-10.42","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-powerpc","version":"2.6.12-10.42","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-386","version":"2.6.12-10.42","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-powerpc64-smp","version":"2.6.12-10.42","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-powerpc-smp","version":"2.6.12-10.42","is_source":false,"source_link":"","version_link":""}],"edgy":[{"name":"linux-image-2.6.17-10-powerpc-smp","version":"2.6.17.1-10.34","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-10-386","version":"2.6.17.1-10.34","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-10-sparc64-smp","version":"2.6.17.1-10.34","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-10-sparc64","version":"2.6.17.1-10.34","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-10-generic","version":"2.6.17.1-10.34","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-10-powerpc","version":"2.6.17.1-10.34","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-10-server-bigiron","version":"2.6.17.1-10.34","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-10-powerpc64-smp","version":"2.6.17.1-10.34","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-10-server","version":"2.6.17.1-10.34","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-5619","CVE-2006-5158","CVE-2006-4997","CVE-2006-5649","CVE-2006-4813","CVE-2006-5648","CVE-2006-5173","CVE-2006-5751","CVE-2006-5701","CVE-2006-4572"]}]},{"id":"CVE-2006-5757","published":"2006-11-06T20:07:00","updated_at":"2025-07-17T16:39:58.760641+00:00","description":"\nRace condition in the __find_get_block_slow function in the ISO9660\nfilesystem in Linux 2.6.18 and possibly other versions allows local users\nto cause a denial of service (infinite loop) by mounting a crafted ISO9660\nfilesystem containing malformed data structures.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-416-1","https://www.cve.org/CVERecord?id=CVE-2006-5757"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"linux-source-2.6.15","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.15","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.15","debian":"https://tracker.debian.org/pkg/linux-source-2.6.15","statuses":[{"release_codename":"dapper","status":"released","description":"2.6.15-29.58","component":null,"pocket":"security"},{"release_codename":"edgy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.17","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.17","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.17","debian":"https://tracker.debian.org/pkg/linux-source-2.6.17","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"2.6.17.1-12.40","component":null,"pocket":"security"},{"release_codename":"feisty","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]},{"name":"linux-source-2.6.20","source":"https://ubuntu.com/security/cve?package=linux-source-2.6.20","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=linux-source-2.6.20","debian":"https://tracker.debian.org/pkg/linux-source-2.6.20","statuses":[{"release_codename":"dapper","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"edgy","status":"DNE","description":"","component":null,"pocket":"security"},{"release_codename":"feisty","status":"not-affected","description":"","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-416-1"],"notices":[{"id":"USN-416-1","title":"Linux kernel vulnerabilities","summary":"Linux kernel vulnerabilities","instructions":"After a standard system upgrade you need to reboot your computer to\neffect the necessary changes.\n\nATTENTION: Due to an unavoidable ABI change the Ubuntu 6.06 and Ubuntu\n6.10 kernel updates have been given a new version number, which\nrequires you to recompile and reinstall all third party kernel modules\nyou might have installed. If you use linux-restricted-modules, you\nhave to update that package as well to get modules which work with the\nnew kernel version. Unless you manually uninstalled the standard\nkernel metapackages (linux-386, linux-powerpc, linux-amd64-generic), a\nstandard system upgrade will automatically perform this as well.","references":[],"published":"2007-02-10T03:17:12","description":"Mark Dowd discovered that the netfilter iptables module did not\ncorrecly handle fragmented IPv6 packets. By sending specially crafted\npackets, a remote attacker could exploit this to bypass firewall\nrules. This has has already been fixed for Ubuntu 6.10 in USN-395-1;\nthis is the corresponding fix for Ubuntu 6.06.(CVE-2006-4572)\n\nDoug Chapman discovered an improper lock handling in the mincore()\nfunction. A local attacker could exploit this to cause an eternal hang\nin the kernel, rendering the machine unusable. (CVE-2006-4814)\n\nAl Viro reported that the ISDN PPP module did not initialize the reset\nstate timer. By sending specially crafted ISDN packets, a remote\nattacker could exploit this to crash the kernel. (CVE-2006-5749)\n\nVarious syscalls (like listxattr()) misinterpreted the return value of\nreturn_EIO() when encountering bad inodes. By issuing particular\nsystem calls on a malformed file system, a local attacker could\nexploit this to crash the kernel. (CVE-2006-5753)\n\nThe task switching code did not save and restore EFLAGS of processes.\nBy starting a specially crafted executable, a local attacker could\nexploit this to eventually crash many other running processes. This\nonly affects the amd64 platform. (CVE-2006-5755)\n\nA race condition was found in the grow_buffers() function. By mounting\na specially crafted ISO9660 or NTFS file system, a local attacker\ncould exploit this to trigger an infinite loop in the kernel,\nrendering the machine unusable. (CVE-2006-5757)\n\nA buffer overread was found in the zlib_inflate() function. By\ntricking an user into mounting a specially crafted file system which\nuses zlib compression (such as cramfs), this could be exploited to\ncrash the kernel. (CVE-2006-5823)\n\nThe ext3 file system driver did not properly handle corrupted data\nstructures. By mounting a specially crafted ext3 file system, a local\nattacker could exploit this to crash the kernel. (CVE-2006-6053)\n\nThe ext2 file system driver did not properly handle corrupted data\nstructures. By mounting a specially crafted ext2 file system, a local\nattacker could exploit this to crash the kernel. (CVE-2006-6054)\n\nThe hfs file system driver did not properly handle corrupted data\nstructures. By mounting a specially crafted hfs file system, a local\nattacker could exploit this to crash the kernel. This only affects\nsystems which enable SELinux (Ubuntu disables SELinux by default).\n(CVE-2006-6056)\n\nSeveral vulnerabilities have been found in the GFS2 file system\ndriver. Since this driver has never actually worked in Ubuntu 6.10, it\nhas been disabled. This only affects Ubuntu 6.10. (CVE-2006-6057)\n\nMarcel Holtman discovered several buffer overflows in the Bluetooth\ndriver. By sending Bluetooth packets with specially crafted CAPI\nmessages, a remote attacker could exploit these to crash the kernel.\n(CVE-2006-6106)","is_hidden":false,"release_packages":{"dapper":[{"name":"linux-image-2.6.15-28-amd64-generic","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-powerpc-smp","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-amd64-k8","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-686","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-powerpc64-smp","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-server-bigiron","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-sparc64-smp","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-server","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-k7","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-amd64-server","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-amd64-xeon","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-386","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-powerpc","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.15-28-sparc64","version":"2.6.15-28.51","is_source":false,"source_link":"","version_link":""}],"breezy":[{"name":"linux-image-2.6.12-10-amd64-k8-smp","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-686","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-amd64-generic","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-686-smp","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-patch-ubuntu-2.6.12","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-k7-smp","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-amd64-k8","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-amd64-xeon","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-k7","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-powerpc","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-386","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-powerpc64-smp","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.12-10-powerpc-smp","version":"2.6.12-10.45","is_source":false,"source_link":"","version_link":""}],"edgy":[{"name":"linux-image-2.6.17-11-generic","version":"2.6.17.1-11.35","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-11-server-bigiron","version":"2.6.17.1-11.35","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-11-sparc64-smp","version":"2.6.17.1-11.35","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-11-powerpc","version":"2.6.17.1-11.35","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-11-386","version":"2.6.17.1-11.35","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-11-powerpc-smp","version":"2.6.17.1-11.35","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-11-sparc64","version":"2.6.17.1-11.35","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-11-server","version":"2.6.17.1-11.35","is_source":false,"source_link":"","version_link":""},{"name":"linux-image-2.6.17-11-powerpc64-smp","version":"2.6.17.1-11.35","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-4572","CVE-2006-4814","CVE-2006-5749","CVE-2006-5753","CVE-2006-5755","CVE-2006-5757","CVE-2006-5823","CVE-2006-6053","CVE-2006-6054","CVE-2006-6056","CVE-2006-6057","CVE-2006-6106"]}]},{"id":"CVE-2006-5466","published":"2006-11-06T17:07:00","updated_at":"2025-07-17T16:39:53.951459+00:00","description":"\nHeap-based buffer overflow in the showQueryPackage function in librpm in\nRPM Package Manager 4.4.8, when the LANG environment variable is set to\nru_RU.UTF-8, might allow user-assisted attackers to execute arbitrary code\nvia crafted RPM packages.","ubuntu_description":"","notes":[],"codename":null,"priority":"medium","cvss3":null,"impact":null,"status":"active","mitigation":"","references":["https://ubuntu.com/security/notices/USN-378-1","https://www.cve.org/CVERecord?id=CVE-2006-5466"],"bugs":[""],"patches":{},"tags":{},"packages":[{"name":"rpm","source":"https://ubuntu.com/security/cve?package=rpm","ubuntu":"https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=rpm","debian":"https://tracker.debian.org/pkg/rpm","statuses":[{"release_codename":"dapper","status":"released","description":"4.4.1-5ubuntu2.1","component":null,"pocket":"security"},{"release_codename":"edgy","status":"released","description":"4.4.1-9.1ubuntu0.1","component":null,"pocket":"security"},{"release_codename":"feisty","status":"released","description":"4.4.1-14build1","component":null,"pocket":"security"},{"release_codename":"upstream","status":"needs-triage","description":"","component":null,"pocket":"security"}]}],"notices_ids":["USN-378-1"],"notices":[{"id":"USN-378-1","title":"RPM vulnerability","summary":"RPM vulnerability","instructions":"In general, a standard system upgrade is sufficient to effect the\nnecessary changes.","references":[],"published":"2006-11-04T03:12:35","description":"An error was found in the RPM library's handling of query reports.  In \nsome locales, certain RPM packages would cause the library to crash.  If \na user was tricked into querying a specially crafted RPM package, the \nflaw could be exploited to execute arbitrary code with the user's \nprivileges.","is_hidden":false,"release_packages":{"dapper":[{"name":"librpm4","version":"4.4.1-5ubuntu2.1","is_source":false,"source_link":"","version_link":""}],"edgy":[{"name":"librpm4","version":"4.4.1-9.1ubuntu0.1","is_source":false,"source_link":"","version_link":""}]},"type":"USN","cves_ids":["CVE-2006-5466"]}]}],"offset":77120,"limit":20,"total_results":79316}