=========================================================== Ubuntu Security Notice USN-772-1 May 07, 2009 mpfr vulnerability CVE-2009-0757 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 9.04 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 9.04: lib64mpfr1 2.4.0-1ubuntu3.1 libmpfr1ldbl 2.4.0-1ubuntu3.1 In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: It was discovered that MPFR improperly handled string lengths in its print routines. If a user or automated system were tricked into processing specially crafted data with applications linked against MPFR, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program. Updated packages for Ubuntu 9.04: Source archives: http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/mpfr_2.4.0-1ubuntu3.1.diff.gz Size/MD5: 7603 d996b99c39cae2d82db24bd5f123ade1 http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/mpfr_2.4.0-1ubuntu3.1.dsc Size/MD5: 1316 a28e504aedb1c804af4b7156a9dc3573 http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/mpfr_2.4.0.orig.tar.gz Size/MD5: 1336846 232f9d6917898e8277041bcc046fbb72 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/libmpfr-doc_2.4.0-1ubuntu3.1_all.deb Size/MD5: 645652 a0041c74091777ecc87686fab37ab1da amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/libmpfr-dev_2.4.0-1ubuntu3.1_amd64.deb Size/MD5: 459986 a9e110cdaf84103c6c8c5c1b09aa11a8 http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/libmpfr1ldbl_2.4.0-1ubuntu3.1_amd64.deb Size/MD5: 417730 6fba616c8ab42fda163bd35a5993d5e5 i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/libmpfr-dev_2.4.0-1ubuntu3.1_i386.deb Size/MD5: 431566 872b92cab9aa82122435a6d80c3dabb7 http://security.ubuntu.com/ubuntu/pool/main/m/mpfr/libmpfr1ldbl_2.4.0-1ubuntu3.1_i386.deb Size/MD5: 404100 81cee51ae17a92f65a8fe8881c0417ca lpia architecture (Low Power Intel Architecture): http://ports.ubuntu.com/pool/main/m/mpfr/libmpfr-dev_2.4.0-1ubuntu3.1_lpia.deb Size/MD5: 433150 d60c4b1377d722bcdfb881480079e089 http://ports.ubuntu.com/pool/main/m/mpfr/libmpfr1ldbl_2.4.0-1ubuntu3.1_lpia.deb Size/MD5: 404108 eb59aaaefdfa8bf954ca16be35c61896 powerpc architecture (Apple Macintosh G3/G4/G5): http://ports.ubuntu.com/pool/main/m/mpfr/lib64mpfr-dev_2.4.0-1ubuntu3.1_powerpc.deb Size/MD5: 461744 a943b5f7d8566cb91405ff162e07bf14 http://ports.ubuntu.com/pool/main/m/mpfr/lib64mpfr1_2.4.0-1ubuntu3.1_powerpc.deb Size/MD5: 407042 8646e75a38bc8c0f28ab5478a768ffdc http://ports.ubuntu.com/pool/main/m/mpfr/libmpfr-dev_2.4.0-1ubuntu3.1_powerpc.deb Size/MD5: 469676 05b5927c2c359dcf8060d00e14cde769 http://ports.ubuntu.com/pool/main/m/mpfr/libmpfr1ldbl_2.4.0-1ubuntu3.1_powerpc.deb Size/MD5: 421772 e209d7e0b960f4c734547b0fc71fe56d sparc architecture (Sun SPARC/UltraSPARC): http://ports.ubuntu.com/pool/main/m/mpfr/libmpfr-dev_2.4.0-1ubuntu3.1_sparc.deb Size/MD5: 444678 14b90d05922e55b437b7bf613f7a2fce http://ports.ubuntu.com/pool/main/m/mpfr/libmpfr1ldbl_2.4.0-1ubuntu3.1_sparc.deb Size/MD5: 403328 5af0d9a4665f3bdeb58755e32235aceb
Attachment:
signature.asc
Description: This is a digitally signed message part
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/