[USN-675-2] Gaim vulnerability
Subject: [USN-675-2] Gaim vulnerability
From: Marc Deslauriers <marc.deslauriers@canonical.com.>
To: [email protected]
Cc: "[email protected]" <bugtraq@securityfocus.com.>,
[email protected]
X-Original-To: [email protected]
X-Mailcontrol-Inbound:
uq3drnD2P+ps5SfEb0fvr78+NoP1DHBZwGqKpaXB2eTgNv8D6KLIxb8+NoP1DHBZ8VSaBg0k0xw=
X-Spam-Score: -4.2
X-Scanned-By: MailControl A_08_51_00 (www.mailcontrol.com) on 10.74.0.136
Content-Type: multipart/signed; micalg="pgp-sha1"; protocol="application/pgp-signature"; boundary="=-050/cRnQeOOdDK3EGjgV"
Date: Mon, 24 Nov 2008 12:37:24 -0500
Message-Id: <1227548244.7339.9.camel@mdlinux.technorage.com.>
Mime-Version: 1.0
X-Mailer: Evolution 2.24.1
X-Virus-Scanned: antivirus-gw at tyumen.ru
--=-050/cRnQeOOdDK3EGjgV
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
Ubuntu Security Notice USN-675-2 November 24, 2008
gaim vulnerability
CVE-2008-2927
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 6.06 LTS:
gaim 1:1.5.0+1.5.1cvs20051015-1ubuntu10.1
After a standard system upgrade you need to restart Gaim to effect
the necessary changes.
Details follow:
It was discovered that Gaim did not properly handle certain malformed
messages in the MSN protocol handler. A remote attacker could send a specia=
lly
crafted message and possibly execute arbitrary code with user privileges.
(CVE-2008-2927)
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim_1.5.0+1.5.1cvs2=
0051015-1ubuntu10.1.diff.gz
Size/MD5: 34051 dde2b4483bc14d671228c8a512c9fd0c
http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim_1.5.0+1.5.1cvs2=
0051015-1ubuntu10.1.dsc
Size/MD5: 1061 0293c5a43587d3db41a2437da5254206
http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim_1.5.0+1.5.1cvs2=
0051015.orig.tar.gz
Size/MD5: 4299145 949ae755e9be1af68eef6c09c36a7530
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim-data_1.5.0+1.5.=
1cvs20051015-1ubuntu10.1_all.deb
Size/MD5: 613282 4b5fd4fd6053473bf10db0634e993af0
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim-dev_1.5.0+1.5.1=
cvs20051015-1ubuntu10.1_amd64.deb
Size/MD5: 103266 05b0562cf37fb5c72063566134aa7369
http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim_1.5.0+1.5.1cvs2=
0051015-1ubuntu10.1_amd64.deb
Size/MD5: 954258 7da66022c5ea3372d097f3f7404610f2
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim-dev_1.5.0+1.5.1=
cvs20051015-1ubuntu10.1_i386.deb
Size/MD5: 103248 81eebc45938e22bae57d3278682eee4b
http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim_1.5.0+1.5.1cvs2=
0051015-1ubuntu10.1_i386.deb
Size/MD5: 836378 82ecc0d267bb90f7669786ea2092cb93
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim-dev_1.5.0+1.5.1=
cvs20051015-1ubuntu10.1_powerpc.deb
Size/MD5: 103256 0fba1bcef36f3b6369effaf634c1a1df
http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim_1.5.0+1.5.1cvs2=
0051015-1ubuntu10.1_powerpc.deb
Size/MD5: 924628 5f2721e0fcbaf536e4bcbd7a74a6b06e
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim-dev_1.5.0+1.5.1=
cvs20051015-1ubuntu10.1_sparc.deb
Size/MD5: 103250 e43bfb56d37e3617b7bee0644c3948a8
http://security.ubuntu.com/ubuntu/pool/main/g/gaim/gaim_1.5.0+1.5.1cvs2=
0051015-1ubuntu10.1_sparc.deb
Size/MD5: 856760 66a004eff69e42183c6c58d732761b86
--=-050/cRnQeOOdDK3EGjgV
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEABECAAYFAkkq5lEACgkQLMAs/0C4zNrMwwCfZKI+yBjrk6cIt4+G7SRI2+mM
BFUAnRofPqY7qLjUXnzcTLSSLcX5gqU5
=R08k
-----END PGP SIGNATURE-----
--=-050/cRnQeOOdDK3EGjgV--
