VARIoT IoT vulnerabilities database

Array index error in the xnu (Mach) kernel in Apple Mac OS X 10.5 before 10.5.7 allows local users to gain privileges or cause a denial of service (system shutdown) via unspecified vectors related to workqueues. Apple Mac OS X is prone to a local privilege-escalation vulnerability. A local attacker can exploit this issue to gain kernel-level privileges, which may lead to a complete compromise of the affected computer. NOTE: This issue was previously covered in BID 34926 (Apple Mac OS X 2009-002 Multiple Security Vulnerabilities), but has been assigned its own record to better document it. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDefense Security Advisory 05.12.09 http://labs.idefense.com/intelligence/vulnerabilities/ May 12, 2009 I. OS X is the tenth major version of Apple's operating system for Macintosh computers and is Unix-based. For more information, see the vendor's site found at the following link. http://www.apple.com/support/leopard/internet/ II. This allows the kernel to schedule events to take place in a task. III. Upon successful exploitation, the attacker could elevate privileges by changing the effective user id to root of an attacker controlled process. Alternatively an attacker could also add or alter kernel code in memory that is commonly referred to as a rootkit. IV. V. WORKAROUND iDefense is currently unaware of any workaround for this issue. VI. VENDOR RESPONSE Apple Inc. has released a patch which addresses this issue. For more information, consult their advisory at the following URL: http://support.apple.com/kb/HT3549 VII. CVE INFORMATION The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2008-1517 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems. VIII. DISCLOSURE TIMELINE 03/19/2008 - Initial Contact 03/31/2009 - Attribution Request 04/01/2009 - Attribution Sent 04/01/2009 - CVE Requested 05/12/2009 - Coordinated Public Disclosure IX. CREDIT This vulnerability was reported to iDefense by Neil Kettle (mu-b) of www.digit-labs.org. Get paid for vulnerability research http://labs.idefense.com/methodology/vulnerability/vcp.php Free tools, research and upcoming events http://labs.idefense.com/ X. LEGAL NOTICES Copyright \xa9 2009 iDefense, Inc. Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDefense. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please e-mail customerservice@idefense.com for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFKDDt8bjs6HoxIfBkRAvXGAJ95Kgxxt6ovkw8gM387yynMaltRGQCgmW9w zBM997tpgIxs1x/LoVZQMIQ= =C4Kw -----END PGP SIGNATURE----- . I. Impact The impacts of these vulnerabilities vary. Potential consequences include arbitrary code execution, sensitive information disclosure, denial of service, or privilege escalation. These and other updates are available via Software Update or via Apple Downloads. References * Apple Security Update 2009-002 - <http://support.apple.com/kb/HT3549> * Safari 3.2.3 - <http://support.apple.com/kb/HT3550> * Apple Downloads - <http://support.apple.com/downloads/> * Software Update - <https://support.apple.com/kb/HT1338?viewlocale=en_US> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA09-133A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA09-133A Feedback VU#175188" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2009 by US-CERT, a government organization. ---------------------------------------------------------------------- Are you missing: SECUNIA ADVISORY ID: Critical: Impact: Where: within the advisory below? This is now part of the Secunia commercial solutions. 1) A vulnerability in Apache when handling FTP proxy requests can be exploited by malicious people to conduct cross-site scripting attacks. For more information: SA31384 2) A boundary error in the handling of Compact Font Format (CFF) fonts in Apple Type Services can be exploited to cause a heap-based buffer overflow when specially crafted document is downloaded or viewed. Successful exploitation allows execution of arbitrary code. 3) A vulnerability in BIND can potentially be exploited by malicious people to conduct spoofing attacks. For more information: SA33404 4) An error in the parsing of Set-Cookie headers in CFNetwork can result in applications using CFNetwork sending sensitive information in unencrypted HTTP requests. 5) An unspecified error in the processing of HTTP headers in CFNetwork can be exploited to cause a heap-based buffer overflow when visiting a malicious web site. Successful exploitation allows execution of arbitrary code. 6) Multiple errors exist in the processing of PDF files in CoreGraphics, which can be exploited to corrupt memory and execute arbitrary code via a specially crafted PDF file. 7) An integer underflow error in the processing of PDF files in CoreGraphics can be exploited to cause a heap-based buffer overflow when specially crafted PDF files is opened. Successful exploitation allows execution of arbitrary code. 8) Multiple vulnerabilities in the processing of JBIG2 streams within PDF files in CoreGraphics can be exploited by malicious people to compromise a user's system. For more information: SA34291 9) Multiple vulnerabilities in cscope can be exploited by malicious people to compromise a user's system. For more information: SA34978: 10) A boundary error in the handling of disk images can be exploited to cause a stack-based buffer overflow when a specially crafted disk image is mounted. 11) Multiple unspecified errors in the handling of disk images can be exploited to cause memory corruptions when a specially crafted disk image is mounted. Successful exploitation of vulnerabilities #10 and #11 allows execution of arbitrary code. 12) Multiple vulnerabilities in enscript can be exploited by malicious people to compromise a vulnerable system. For more information: SA13968 SA32137 13) Multiple vulnerabilities in the Flash Player plugin can be exploited by malicious people to compromise a user's system. For more information: SA34012 14) An error in Help Viewer when loading Cascading Style Sheets referenced in URL parameters can be exploited to invoke arbitrary AppleScript files. 15) A vulnerability exists due to Help Viewer not validating that full paths to HTML documents are within registered help books, which can be exploited to invoke arbitrary AppleScript files. Successful exploitation of vulnerabilities #14 and #15 allows execution of arbitrary code. 16) An error in iChat can result in AIM communication configured for SSL to be sent in plaintext. 17) An error in the handling of certain character encodings in ICU can be exploited to bypass filters on websites that attempt to mitigate cross-site scripting. 18) Some vulnerabilities in IPSec can be exploited by malicious users and malicious people to cause a DoS (Denial of Service). For more information: SA31450 SA31478 19) Multiple vulnerabilities in Kerberos can be exploited by malicious people to potentially disclose sensitive information, cause a DoS (Denial of Service), or potentially compromise a vulnerable system. For more information: SA34347 20) An error in the handling of workqueues within the kernel can be exploited by malicious, local users to cause a DoS or execute arbitrary code with Kernel privileges. 21) An error in Launch Services can cause Finder to repeatedly terminate and relaunch when a specially crafted Mach-O is downloaded. 22) A vulnerability in libxml can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise an application using the library. For more information: SA31558 23) A vulnerability in Net-SNMP can be exploited by malicious people to cause a DoS (Denial of Service). For more information: SA32560 24) A vulnerability in Network Time can be exploited by malicious people to conduct spoofing attacks. For more information: SA33406 25) A vulnerability in Network Time can be exploited by malicious people to potentially compromise a user's system. For more information: SA34608 26) A vulnerability in Networking can be exploited by malicious people to cause a DoS (Denial of Service). For more information: SA31745 27) A vulnerability in OpenSSL can be exploited by malicious people to conduct spoofing attacks. For more information: SA33338 28) Some vulnerabilities in PHP can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system, and by malicious, local users to bypass certain security restrictions. For more information: SA32964 29) An unspecified error in QuickDraw Manager can be exploited to cause a memory corruption and potentially execute arbitrary code via a specially crafted PICT image. 30) An integer underflow error in the handling of PICT images in QuickDraw Manager can be exploited to cause a heap-based buffer overflow via a specially crafted PICT file. Successful exploitation allows execution of arbitrary code. 31) Multiple vulnerabilities in ruby can be exploited by malicious people to bypass certain security restrictions, cause a DoS (Denial of Service), and conduct spoofing attacks. For more information: SA31430 SA31602 32) An error in the use of the OpenSSL library in ruby can cause revoked certificates to be accepted. 33) A vulnerability in Safari when handling "feed:" URLs can be exploited to compromise a user's system. For more information: SA35056 34) Multiple unspecified errors in Spotlight can be exploited to cause memory corruptions and execute arbitrary code when a specially crafted Office document is downloaded. 35) An error when invoking the "login" command can result in unexpected high privileges. 36) A boundary error in telnet can be exploited to cause a stack-based buffer overflow when connecting to a server with an overly long canonical name in its DNS address record. Successful exploitation may allow execution of arbitrary code. 37) A vulnerability in WebKit when handling SVGList objects can be exploited to corrupt memory and potentially execute arbitrary code. For more information: SA35056 38) Multiple vulnerabilities in FreeType can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise applications using the library. For more information: SA20100 SA25350 SA34723 39) A vulnerability in xterm can be exploited by malicious people to compromise a user's system. For more information: SA33318 40) Multiple vulnerabilities in libpng can be exploited by malicious people to cause a DoS (Denial of Service) or to potentially compromise an application using the library. For more information: SA29792 SA33970 SOLUTION: Update to Mac OS X v10.5.7 or apply Security Update 2009-002. Security Update 2009-002 (Server Tiger PPC): http://support.apple.com/downloads/DL819/SecUpdSrvr2009-002PPC.dmg Security Update 2009-002 (Tiger Intel): http://support.apple.com/downloads/DL817/SecUpd2009-002Intel.dmg Security Update 2009-002 (Server Universal): http://support.apple.com/downloads/DL816/SecUpdSrvr2009-002Univ.dmg Mac OS X Server 10.5.7 Update: http://support.apple.com/downloads/DL828/MacOSXServerUpd10.5.7.dmg Mac OS X Server Combo 10.5.7: http://support.apple.com/downloads/DL829/MacOSXServerUpdCombo10.5.7.dmg Security Update 2009-002 (Tiger PPC): http://support.apple.com/downloads/DL818/SecUpd2009-002PPC.dmg Mac OS X 10.5.7 Update: http://support.apple.com/downloads/DL826/MacOSXUpd10.5.7.dmg Mac OS X 10.5.7 Combo Update: http://support.apple.com/downloads/DL827/MacOSXUpdCombo10.5.7.dmg PROVIDED AND/OR DISCOVERED BY: The vendor credits: 2) Charlie Miller of Independent Security Evaluators 4) Andrew Mortensen of the University of Michigan 5) Moritz Jodeit, n.runs AG 7) Barry K. Nathan 8) Alin Rad Pop, Secunia Research and Will Dormann, CERT/CC 10) Tiller Beauchamp, IOActive 14, 15) Brian Mastenbrook 17) Chris Weber of Casaba Security 20) An anonymous researcher working with Verisign iDefense VCP 30) Damian Put and Sebastian Apelt, working with ZDI, and Chris Ries of Carnegie Mellon University Computing Services 38) Tavis Ormandy of the Google Security Team OTHER REFERENCES: SA13968: http://secunia.com/advisories/13968/ SA20100: http://secunia.com/advisories/20100/ SA25350: http://secunia.com/advisories/25350/ SA29792: http://secunia.com/advisories/29792/ SA31384: http://secunia.com/advisories/31384/ SA31430: http://secunia.com/advisories/31430/ SA31450: http://secunia.com/advisories/31450/ SA31478: http://secunia.com/advisories/31478/ SA31558: http://secunia.com/advisories/31558/ SA31602: http://secunia.com/advisories/31602/ SA31745: http://secunia.com/advisories/31745/ SA32137: http://secunia.com/advisories/32137/ SA32560: http://secunia.com/advisories/32560/ SA32964: http://secunia.com/advisories/32964/ SA33318: http://secunia.com/advisories/33318/ SA33338: http://secunia.com/advisories/33338/ SA33404: http://secunia.com/advisories/33404/ SA33406: http://secunia.com/advisories/33406/ SA33970: http://secunia.com/advisories/33970/ SA34012: http://secunia.com/advisories/34012/ SA34291: http://secunia.com/advisories/34291/ SA34347: http://secunia.com/advisories/34347/ SA34608: http://secunia.com/advisories/34608/ SA34723: http://secunia.com/advisories/34723/ SA34978: http://secunia.com/advisories/34978/ SA35056: http://secunia.com/advisories/35056/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Array index error in the insertItemBefore method in WebKit, as used in Apple Safari before 3.2.3 and 4 Public Beta, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome Stable before 1.0.154.65, and possibly other products allows remote attackers to execute arbitrary code via a document with a SVGPathList data structure containing a negative index in the (1) SVGTransformList, (2) SVGStringList, (3) SVGNumberList, (4) SVGPathSegList, (5) SVGPointList, or (6) SVGLengthList SVGList object, which triggers memory corruption. WebKit of insertItemBefore Methods include SVGPathList A vulnerability exists in the execution of arbitrary code due to flaws in the processing of documents with data structures.A third party may execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page.The specific flaw exists during the parsing of malformed SVGLists via the SVGPathList data structure, the following lists are affected: SVGTransformList, SVGStringList, SVGNumberList, SVGPathSegList, SVGPointList, SVGLengthList. When a negative index argument is suppled to the insertItemBefore() method, a memory corruption occurs resulting in the ability to execute arbitrary code. WebKit is prone to a remote memory-corruption vulnerability. Failed exploit attempts will result in a denial-of-service condition. The issue also affects the following: Apple Safari prior to 3.2.3 Apple Mac OS X v10.5 through v10.5.6, Apple Mac OS X Server v10.5 through v10.5.6 Google Chrome prior to 1.0.154.65. Safari is the web browser bundled by default in the Apple operating system. There is a memory corruption vulnerability in the processing of SVGList objects in WebKit in Safari. Safari has multiple input validation errors in its handling of the feed: URL, and accessing a malicious feed: URL can lead to arbitrary JavaScript execution. NOTE: the JBIG2Stream.cxx vector may overlap CVE-2009-1179. (CVE-2009-0791). (CVE-2009-1709). This update provides a solution to this vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2010:027 http://www.mandriva.com/security/ _______________________________________________________________________ Package : kdelibs4 Date : January 27, 2010 Affected: 2009.1 _______________________________________________________________________ Problem Description: Multiple vulnerabilities was discovered and corrected in kdelibs4: KDE KSSL in kdelibs 3.5.4, 4.2.4, and 4.3 does not properly handle a \'\0\' (NUL) character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408 (CVE-2009-2702). (CVE-2009-1687). (CVE-2009-1690). KDE Konqueror allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692 (CVE-2009-2537). The gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc in FreeBSD 6.4 and 7.2, NetBSD 5.0, and OpenBSD 4.5 allows context-dependent attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a large precision value in the format argument to a printf function, related to an array overrun. (CVE-2009-0689). The updated packages have been patched to correct these issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2702 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1687 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1725 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1690 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1698 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2537 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0689 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0945 _______________________________________________________________________ Updated Packages: Mandriva Linux 2009.1: c08161eacba6cdb1b0ba26babe5f8cc5 2009.1/i586/kdelibs4-core-4.2.4-0.8mdv2009.1.i586.rpm 933468cf4109252dac5119edd958f73d 2009.1/i586/kdelibs4-devel-4.2.4-0.8mdv2009.1.i586.rpm 96703a0ef0baf299647ff27d64cb0680 2009.1/i586/libkde3support4-4.2.4-0.8mdv2009.1.i586.rpm e5f60ba41e5919fa77c313b204e1f712 2009.1/i586/libkdecore5-4.2.4-0.8mdv2009.1.i586.rpm cf8af6e467cd1585c44e1cce01362526 2009.1/i586/libkdefakes5-4.2.4-0.8mdv2009.1.i586.rpm 1c9c04b5f6c0c59d2e5860b077e0c6e3 2009.1/i586/libkdesu5-4.2.4-0.8mdv2009.1.i586.rpm 89fe7c33c7e5bcc23595560ae4664bf6 2009.1/i586/libkdeui5-4.2.4-0.8mdv2009.1.i586.rpm 30b73ef58ac3a45ff86756ad09d0d555 2009.1/i586/libkdnssd4-4.2.4-0.8mdv2009.1.i586.rpm a1f00af00ea7e52d9f187f1fe5ccdfe2 2009.1/i586/libkfile4-4.2.4-0.8mdv2009.1.i586.rpm 553486988b945307ee038cb41dcb76e6 2009.1/i586/libkhtml5-4.2.4-0.8mdv2009.1.i586.rpm 9d9501ff70e709c5ea32b35aa985688a 2009.1/i586/libkimproxy4-4.2.4-0.8mdv2009.1.i586.rpm a2ec3f440eb6cf545abbc63a3d34c1e5 2009.1/i586/libkio5-4.2.4-0.8mdv2009.1.i586.rpm 4168e955b60a5a69d8f1e085b30d0424 2009.1/i586/libkjs4-4.2.4-0.8mdv2009.1.i586.rpm bfcece9c73348c6415c48ec266877908 2009.1/i586/libkjsapi4-4.2.4-0.8mdv2009.1.i586.rpm 228ca7dc2a86fdc868a5937b16a7a08c 2009.1/i586/libkjsembed4-4.2.4-0.8mdv2009.1.i586.rpm f6297ae0630eb6207895df9f2f971eb6 2009.1/i586/libkmediaplayer4-4.2.4-0.8mdv2009.1.i586.rpm cf6113c17858d5e6e3c0e04622f8a66c 2009.1/i586/libknewstuff2_4-4.2.4-0.8mdv2009.1.i586.rpm da55a2f428ad020834f7b91c0023ecf6 2009.1/i586/libknotifyconfig4-4.2.4-0.8mdv2009.1.i586.rpm 9fef466138ff78a3d6d3244998a9ba30 2009.1/i586/libkntlm4-4.2.4-0.8mdv2009.1.i586.rpm 4f7c0ad254ec1990f5dab1c0b959629d 2009.1/i586/libkparts4-4.2.4-0.8mdv2009.1.i586.rpm 8c58d6a9a6ec7fc21f287b2f4c2e9858 2009.1/i586/libkpty4-4.2.4-0.8mdv2009.1.i586.rpm 8ed500d050b95560d7eff6db26fa05ee 2009.1/i586/libkrosscore4-4.2.4-0.8mdv2009.1.i586.rpm 2d8d12d8a7bbfe18f6b04b9807795077 2009.1/i586/libkrossui4-4.2.4-0.8mdv2009.1.i586.rpm 8cc5c226e381b122983440b3440c1476 2009.1/i586/libktexteditor4-4.2.4-0.8mdv2009.1.i586.rpm 3c53941130fb8cc6d12b8cdea488f536 2009.1/i586/libkunittest4-4.2.4-0.8mdv2009.1.i586.rpm 3996bfcff0b2465c39c6ccdb8367f401 2009.1/i586/libkutils4-4.2.4-0.8mdv2009.1.i586.rpm 129a26ab20c792994113b5db00b7f7c4 2009.1/i586/libnepomuk4-4.2.4-0.8mdv2009.1.i586.rpm 0b88090e1cba0db59a3fb85c34e6b726 2009.1/i586/libplasma3-4.2.4-0.8mdv2009.1.i586.rpm 79b484a6c8e20db156fbe130c81e2001 2009.1/i586/libsolid4-4.2.4-0.8mdv2009.1.i586.rpm ddd09e03af15f421b2e38b6f06c0247a 2009.1/i586/libthreadweaver4-4.2.4-0.8mdv2009.1.i586.rpm fe70dc01416cc986d1e19c15a0b5cfa7 2009.1/SRPMS/kdelibs4-4.2.4-0.8mdv2009.1.src.rpm Mandriva Linux 2009.1/X86_64: 89f77418ccda86b51c7d32d011e88e9b 2009.1/x86_64/kdelibs4-core-4.2.4-0.8mdv2009.1.x86_64.rpm d0b009e595350648b12cca1ee094802e 2009.1/x86_64/kdelibs4-devel-4.2.4-0.8mdv2009.1.x86_64.rpm 03db494c356e0b0823ddf697d42c0f50 2009.1/x86_64/lib64kde3support4-4.2.4-0.8mdv2009.1.x86_64.rpm 6d98531ba95a096fd49801f7df452776 2009.1/x86_64/lib64kdecore5-4.2.4-0.8mdv2009.1.x86_64.rpm bf3845f586eeeaafab5e25442f4d8950 2009.1/x86_64/lib64kdefakes5-4.2.4-0.8mdv2009.1.x86_64.rpm b9767fb69262886d60a7844ad6569e27 2009.1/x86_64/lib64kdesu5-4.2.4-0.8mdv2009.1.x86_64.rpm d709c9fb8874c432d1b4e415e9c06858 2009.1/x86_64/lib64kdeui5-4.2.4-0.8mdv2009.1.x86_64.rpm 6d062780a7629eed7e93ab9e66daf633 2009.1/x86_64/lib64kdnssd4-4.2.4-0.8mdv2009.1.x86_64.rpm f39c44bc7572d06921061c0ac5ef78c9 2009.1/x86_64/lib64kfile4-4.2.4-0.8mdv2009.1.x86_64.rpm 90f8ecd4967830ebff3b81732162fe33 2009.1/x86_64/lib64khtml5-4.2.4-0.8mdv2009.1.x86_64.rpm 005d7de69a0063a8dc396b9dffdf20ed 2009.1/x86_64/lib64kimproxy4-4.2.4-0.8mdv2009.1.x86_64.rpm 3924d83bf43990f7a7ba5d2eea29ef5d 2009.1/x86_64/lib64kio5-4.2.4-0.8mdv2009.1.x86_64.rpm 9124f0ce5f1643e4310ef0bfc5fda970 2009.1/x86_64/lib64kjs4-4.2.4-0.8mdv2009.1.x86_64.rpm 573504d0c305e757b3c163b9132264e4 2009.1/x86_64/lib64kjsapi4-4.2.4-0.8mdv2009.1.x86_64.rpm 917e5b175a3a5480e848dee6201e99d9 2009.1/x86_64/lib64kjsembed4-4.2.4-0.8mdv2009.1.x86_64.rpm 604cce29c11b2452b2744ff72e248b7c 2009.1/x86_64/lib64kmediaplayer4-4.2.4-0.8mdv2009.1.x86_64.rpm bd75d3e4feaa98a3659ae5d113fe45f6 2009.1/x86_64/lib64knewstuff2_4-4.2.4-0.8mdv2009.1.x86_64.rpm 0a7d48b91c673f5908ce2d47a77746e2 2009.1/x86_64/lib64knotifyconfig4-4.2.4-0.8mdv2009.1.x86_64.rpm a91967cfec8b470cc7520ac17590d41b 2009.1/x86_64/lib64kntlm4-4.2.4-0.8mdv2009.1.x86_64.rpm 0159bb033c507f20fb8bd77a7a8be43a 2009.1/x86_64/lib64kparts4-4.2.4-0.8mdv2009.1.x86_64.rpm a062d0124cdea9dfcafb82ed2c5dfd54 2009.1/x86_64/lib64kpty4-4.2.4-0.8mdv2009.1.x86_64.rpm 8c0950479a23531a03836f7744d6b90d 2009.1/x86_64/lib64krosscore4-4.2.4-0.8mdv2009.1.x86_64.rpm ca61efacf989bd4421d2c88abc440e3f 2009.1/x86_64/lib64krossui4-4.2.4-0.8mdv2009.1.x86_64.rpm bcd31e87995de0f86ad9c363e87ea0d4 2009.1/x86_64/lib64ktexteditor4-4.2.4-0.8mdv2009.1.x86_64.rpm 23a0f2c640a20dd1be2b4475a9102cd6 2009.1/x86_64/lib64kunittest4-4.2.4-0.8mdv2009.1.x86_64.rpm e49987a6d8016b6ac39011b6cac0b570 2009.1/x86_64/lib64kutils4-4.2.4-0.8mdv2009.1.x86_64.rpm 90d6806fa9dcd2ac1b71fc3b72dd4f81 2009.1/x86_64/lib64nepomuk4-4.2.4-0.8mdv2009.1.x86_64.rpm 4808080c578223d0bcb156e78f5d661f 2009.1/x86_64/lib64plasma3-4.2.4-0.8mdv2009.1.x86_64.rpm e8cecb137634dfc738617b67a6d34122 2009.1/x86_64/lib64solid4-4.2.4-0.8mdv2009.1.x86_64.rpm 35c8778eaaa5465a8f15c27a57d8ed60 2009.1/x86_64/lib64threadweaver4-4.2.4-0.8mdv2009.1.x86_64.rpm fe70dc01416cc986d1e19c15a0b5cfa7 2009.1/SRPMS/kdelibs4-4.2.4-0.8mdv2009.1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFLX/3wmqjQ0CJFipgRApr4AKC7I0w56Y9GFgmZeeNIeUDGaXgxHQCg6N5C YuntVxGlOXktJ3qUQl1SZ1Y= =5Avg -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ZDI-09-022: Apple Safari Malformed SVGList Parsing Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-022 May 13, 2009 -- CVE ID: CVE-2009-0945 -- Affected Vendors: Apple -- Affected Products: Apple Safari -- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 6960. -- Vendor Response: Apple has issued an update to correct this vulnerability. More details can be found at: http://support.apple.com/kb/HT3549 -- Disclosure Timeline: 2009-03-19 - Vulnerability reported to vendor 2009-05-13 - Coordinated public release of advisory -- Credit: This vulnerability was discovered by: * Nils -- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities. Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at: http://www.zerodayinitiative.com The ZDI is unique in how the acquired vulnerability information is used. TippingPoint does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product. Our vulnerability disclosure policy is available online at: http://www.zerodayinitiative.com/advisories/disclosure_policy/ . =========================================================== Ubuntu Security Notice USN-857-1 November 10, 2009 qt4-x11 vulnerabilities CVE-2009-0945, CVE-2009-1687, CVE-2009-1690, CVE-2009-1698, CVE-2009-1699, CVE-2009-1711, CVE-2009-1712, CVE-2009-1713, CVE-2009-1725 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 8.10 Ubuntu 9.04 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 8.10: libqt4-webkit 4.4.3-0ubuntu1.4 Ubuntu 9.04: libqt4-webkit 4.5.0-0ubuntu4.3 After a standard system upgrade you need to restart your session to effect the necessary changes. Details follow: It was discovered that QtWebKit did not properly handle certain SVGPathList data structures. (CVE-2009-0945) Several flaws were discovered in the QtWebKit browser and JavaScript engines. (CVE-2009-1687, CVE-2009-1690, CVE-2009-1698, CVE-2009-1711, CVE-2009-1725) It was discovered that QtWebKit did not properly handle certain XSL stylesheets. If a user were tricked into viewing a malicious website, an attacker could exploit this to read arbitrary local files, and possibly files from different security zones. (CVE-2009-1699, CVE-2009-1713) It was discovered that QtWebKit did not prevent the loading of local Java applets. (CVE-2009-1712) Updated packages for Ubuntu 8.10: Source archives: http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-x11_4.4.3-0ubuntu1.4.diff.gz Size/MD5: 116770 f73a330179df7d453f50b286ea3a2c7a http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-x11_4.4.3-0ubuntu1.4.dsc Size/MD5: 2506 711cb90dfd206bd6553dbe0fb8ecd1e2 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-x11_4.4.3.orig.tar.gz Size/MD5: 112939803 376c003317c4417326ba2116370227d0 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-doc-html_4.4.3-0ubuntu1.4_all.deb Size/MD5: 25758932 0b783fa95d4d41487e58d43823806355 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-doc_4.4.3-0ubuntu1.4_all.deb Size/MD5: 52821772 7d1f3762baf09178176e99e41a502a2b amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-assistant_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 19104 bdc4880e85e007e64d6c5fe8c7c1d81e http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-core_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 7560 b65d2d20cdac05a7e8a04c7b51bc6417 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-dbg_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 87571534 73643e89deb481e7a42785d6c65b4594 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-dbus_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 216798 85994fe5c3b286b137ec4f8f3ed9d55a http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-designer_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 2046478 9f4f973c93c20f88838b3b0e48548c75 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-dev_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 5880176 87946243b9f91e6421a8275417bbecd5 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-gui_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 7548 df209948939090506a2f3315aa8bb63a http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-help_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 213524 556f130d7e1c1ec8f3c427888715807a http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-network_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 432962 a8f5b6db939fd74616b7e666d32dbcbb http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-opengl-dev_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 42350 6281fc06f2395d8462c2fd30ea3f1883 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-opengl_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 162238 3379fc614bd58cc9647b8c40782a45f3 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-qt3support_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 1352676 528c9e209ba652d994292fbfb461cb60 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-script_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 435712 af2919097110286db882cba8c40958e1 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-mysql_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 34384 438d61efc4b1ec7af46ff7aaf15b9a8c http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-odbc_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 47234 692ccc3fdd023fa61b1646b3a1073e29 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-psql_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 39112 cf94d41a0a91e71d3e6a7905705020c8 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-sqlite2_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 22452 4a020d5b8e2ff02532af056a6765af52 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-sqlite_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 26432 5492f45d25d4dfb271318f662db0e50c http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 109136 0bde853eb0fef921984e5b9b24695a65 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-svg_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 160746 b8a19545836d673dda2d1cad49901e5b http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-test_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 38064 61ee9cd2c51286c698ba738fbd8e4d13 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-webkit-dbg_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 53511494 25179f43545ee4f15fa70ff1c4211c66 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-webkit_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 3427782 f3c50589e42291ac643390b3b5056ad3 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-xml_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 114482 7858ea28ed0ae9e48ebe2d5ebca219ab http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-xmlpatterns-dbg_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 13447008 3b146e17a13acfa50bfa6759232821e1 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-xmlpatterns_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 805718 d14b956e7b2c494ef5e359dff2bdb8fd http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqtcore4_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 2094928 fad1c4be4f9242977cbb6c191ec19f09 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqtgui4_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 4249322 cefb0f909b1913edd97aae55a4ef09c0 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-demos_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 10502594 4af5ca52a2316f9290d0a99bd1683127 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-designer_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 386118 35fd3567e5eaf2ecaefab37fe3f21701 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-dev-tools_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 1507998 8254b4ed13728d957ebf41f74d391c6b http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-qtconfig_4.4.3-0ubuntu1.4_amd64.deb Size/MD5: 110220 8e379f1af97edacc7f40037fa342af7b i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-assistant_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 19202 2303fd6083a47fe5b85ee1e46ff1ff7c http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-core_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 7556 30aabb9f249114d86f823795f7e621ff http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-dbg_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 86379828 eb07fdc2dcecb0f26707148362bb70ce http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-dbus_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 216268 96e19c8dc017357682acac62896c5b40 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-designer_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 2072946 2fc1d9101e2132e43161e2fb600f886a http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-dev_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 5705332 24d5a30fd21ecae4ca3d5bf570b8347d http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-gui_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 7548 527eb6b3bc6fc6fa3d7a4d26c967c919 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-help_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 212706 7bb944917c1fb9be6ce6b1cd056afca1 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-network_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 437368 f086dacfa27998d93fd8f093b0bacce3 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-opengl-dev_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 42348 a2427fa3317fe01341ebe66ee3388c47 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-opengl_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 161130 2c4ebc05d22e3299359b9c64bcb8c3fd http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-qt3support_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 1366348 68fef30b16caa835cd6330eec7c5c346 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-script_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 420458 ac91fb37161830ba3e0fd4b884639afd http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-mysql_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 33724 868ace8cd8b514b367db48a95217035e http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-odbc_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 47056 c918217593ebc473fc3d050285bec49d http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-psql_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 38336 650d40a12071e2a04316edc5860788d1 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-sqlite2_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 22002 9087daddd7762b1df7a4b9df34166521 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-sqlite_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 25898 06bcb1cfcb2df47e758bb89946f9aac6 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 108838 3f80ec6192ebdfd8807450a8aeac928a http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-svg_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 158310 24cf265a2f29818beb73709197bef2c3 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-test_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 37122 b536ef0ebc0dcfa6167cd4285e2ec19d http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-webkit-dbg_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 53126238 bc4c62409883fd6034f07baf1a765853 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-webkit_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 3241850 27d0122caabe919c984b0ff1f59334f9 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-xml_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 112012 130f929f42286ce4927feb7f3dbd8d18 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-xmlpatterns-dbg_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 13302092 2deee7794c76d799c789a56c38147d8a http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-xmlpatterns_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 758112 980c7e2f807f29c95ef51feee1bd6f87 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqtcore4_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 2086300 e1d521ac4ef50e82235b61b0b0309c2a http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqtgui4_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 4285842 f79cbd461f5986a686e35b77e8838c7c http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-demos_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 10346058 cd6b5dd99cc2496e60f65303a4d861e7 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-designer_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 377632 0adfcc3c280368f734658d611c7f0c69 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-dev-tools_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 1487606 2f2e1e5f10fb8a9bbd94c647ae355135 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-qtconfig_4.4.3-0ubuntu1.4_i386.deb Size/MD5: 109322 661b18bee424dcc2a108e960dbe51188 lpia architecture (Low Power Intel Architecture): http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-assistant_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 19118 975962361f82c04fe938397d732d5679 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-core_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 7556 5e9705e3675d4882a9040da75d934db7 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dbg_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 86616234 5f8f6362ef3e45674f8c1480933f4714 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dbus_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 218292 d89f63624713a3e9f34a7622fd754830 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-designer_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 2075540 088236f1cb51516af7efb07eb9e859a5 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dev_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 5791558 693f36209c7728b4da4b3e2a310a2730 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-gui_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 7546 765882dd4710771b9f01801c34173f17 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-help_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 215380 3000fb6b96014944c85f69d9be1e9314 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-network_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 439662 ca410c727f89f68f88ed7c32f08c7496 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-opengl-dev_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 42346 d8670500e205ba66ca588d2020eb6e9b http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-opengl_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 163154 044e27e36b057295b8312b3326bb6d70 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-qt3support_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 1369342 9945efb11009af3f7f875f4aa70c7fd1 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-script_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 429370 47ffb00ebb1918ae6b638872a76412b4 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-mysql_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 34006 b11c44e3a7e1d5ba2277e981de8928d5 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-odbc_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 47638 803c079d0a531b0a84043fc1f7c87d58 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-psql_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 38608 054c5fa2ddbd80efd168dc072e951e0e http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-sqlite2_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 21992 ca7ada6adc17a99b713920b6452b2f87 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-sqlite_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 25962 547542c994e3777e900287da869be0e7 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 108930 48566fe567ab5e3ae14185608cc5bd3a http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-svg_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 159630 48eb3c78b4c28d745ef6862e9f5cac17 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-test_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 37444 695be042708d936061c289d78c86cd77 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-webkit-dbg_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 53250108 4e06206559a3470bad0730e8aec7e615 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-webkit_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 3227648 acbd67fa1648ca9ad1e10f021e66f8d2 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-xml_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 110938 bae7d2f0c2c13b33123357102f19cba7 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-xmlpatterns-dbg_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 13316918 c5c409330384ba74489646dabbe9e1a8 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-xmlpatterns_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 749270 375901cd31337ffcce0677bef73b8e2b http://ports.ubuntu.com/pool/main/q/qt4-x11/libqtcore4_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 2086296 46b733dc7e08126af4b343287396b051 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqtgui4_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 4299788 efc7837ecb1aff0917414f020f4f7710 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-demos_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 10380362 ee64ccc2462a1767363119ab130f86fb http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-designer_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 382986 c5c48c0dc497b68bd661eea92b5678b8 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-dev-tools_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 1501518 06d78b9cb426e70bc1823f755b47cb16 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-qtconfig_4.4.3-0ubuntu1.4_lpia.deb Size/MD5: 111312 2d5f5829685d661dc3b7408c99233f57 powerpc architecture (Apple Macintosh G3/G4/G5): http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-assistant_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 21316 45b1ea5b5050b2c0c876872af540089a http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-core_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 7562 4dea3a46b67dca117f5c8924389b90ef http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dbg_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 90621650 d41925c8e7b667daed298626937652ab http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dbus_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 226524 48a6eaf02c23089cdf5271b81386ac8c http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-designer_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 2127276 685f37c1fdc371cfac83711b1dcbe425 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dev_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 5876318 f9777dc66d06e8a241a1a08171eca1ce http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-gui_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 7546 446de6e1e94e17f515641bd91bc34e0f http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-help_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 221776 ed54fe99be13d94c994a8dc27a16d0e5 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-network_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 459056 586952d7ae2b7729d95db536f40b87b1 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-opengl-dev_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 42336 2d51e9ef35064b75b94ff171ca51cbd0 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-opengl_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 173132 a8dce02d86a0341b4e73830baa2ff6ae http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-qt3support_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 1435512 9fe6abc1dbc92dba076b088154406ae2 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-script_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 438202 72b3f451ee05252b81ff73fa22071b71 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-mysql_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 36940 2ff0cfbae3265612c7bfe005333dee20 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-odbc_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 49810 f6ba70b43ec1b6e504b047dad346eb25 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-psql_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 41498 9d558baba4e4fbae203a9f72c1c8c150 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-sqlite2_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 24746 af57d713a5d1e216e350dc70ff7e76e0 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-sqlite_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 28826 709982084d93ca6f9eca9e8554cac7ee http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 117160 56cb8f90e619174bde6f8da70d7deb21 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-svg_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 172392 9598ce1608394ee2888309a6d2c4c943 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-test_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 41680 5cd082858ca6bf4ed2c67556508ff8d5 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-webkit-dbg_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 55519220 92115cc894051fa7bdb29eb6a2f8f088 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-webkit_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 3486770 24e725bf0c47a1108692f4bdd46d23fd http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-xml_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 121160 944ca0755f1b8057c286f6d3c2e1f8ec http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-xmlpatterns-dbg_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 14047876 e1523a10c866ca8dc124947a25aeb34c http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-xmlpatterns_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 835254 d7dda3b37da92ca6cba70f941964a371 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqtcore4_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 2188324 66bd658c0d8f80205ce8aa741a5c25d6 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqtgui4_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 4537294 211ff93e7c8e41ee2881baec57f87b32 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-demos_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 10999204 84090af5c87a89d7d696d00baaf87493 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-designer_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 391756 7ebc072d2a2750262bb6cb1587c5505d http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-dev-tools_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 1530908 3fe67007771638ba35c2935a3432d1e6 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-qtconfig_4.4.3-0ubuntu1.4_powerpc.deb Size/MD5: 111696 1a4f101db96d252c9a93b23f9c20f1fe sparc architecture (Sun SPARC/UltraSPARC): http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-assistant_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 19006 53bc0f17fdc2e7e10938a259b30710c3 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-core_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 7560 3b86547b62162ec391f7945b0a71bbea http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dbg_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 86584472 1490ec1af2900f0515fadf3d10b1c8b1 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dbus_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 214836 b52c445f198c5d4c2fef5d0110862ed3 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-designer_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 2082186 a59e474cf1aea5faa97d3c2f38b79768 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dev_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 5813064 0b29c127800c828ad782ea08f9869b95 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-gui_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 7548 9784e2fd6bad6b99dec68f28bf95c013 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-help_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 221416 98421a8a2735b28ec69a79dcb12bc36a http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-network_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 434660 08d518f50779ab7696a49d5789983d08 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-opengl-dev_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 42328 c483fc06c701a311895a8f912594d0ce http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-opengl_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 162370 6a1a2f6940287071f83b69dd0a2074ff http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-qt3support_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 1351514 4971ee99b0763cdb1b95a350ca97b725 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-script_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 427020 65ee12f6a206cad658d7b4b51cac1c36 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-mysql_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 33654 125d67bc7a3343e16141209ae295f51b http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-odbc_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 46336 97bf93bcf238fb612b6db5254e72bf4e http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-psql_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 38482 3e45668f681c73fe5b2f487e76af92bd http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-sqlite2_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 21700 6ee8cccd7f120782d7ae07d799adea37 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-sqlite_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 25726 14c6e1834745ecf8c24d215bacc7273b http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 109626 46c957419dcf1328dc6e625f5044e087 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-svg_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 157736 a15b042b86fd9af64e5818867a7bc971 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-test_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 36972 2e4f695e58caf79d93f7f929a3f5154a http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-webkit-dbg_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 54818118 ca0d50eb86ac4c4ed69bbfaac082b78d http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-webkit_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 3678126 639241e858bdf4bb280b8c9e24b945e8 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-xml_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 114956 a7d5d4e9c6eb7a28d607a40b72563279 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-xmlpatterns-dbg_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 13545692 049544460c82e22450aee8e5d9db6110 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-xmlpatterns_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 1029752 3fefe6c4a287a6a59acf2494882e8757 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqtcore4_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 2101436 2589e4a81b28459d1e1b9002b5402674 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqtgui4_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 4283628 d2ed704202357f329e22cf5995f62651 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-demos_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 10561886 6cb80130934f4dc83f3449c788251372 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-designer_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 393816 50f8e31568a792c275dfb5dbbb75d2ab http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-dev-tools_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 1542060 e2e1180c629e4d08a56c506b482e2ca3 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-qtconfig_4.4.3-0ubuntu1.4_sparc.deb Size/MD5: 113046 ca0bdbedc0b649fc9745a9c356c2f6e3 Updated packages for Ubuntu 9.04: Source archives: http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-x11_4.5.0-0ubuntu4.3.diff.gz Size/MD5: 113724 cf59da7b0c09550ff78b6164e87ee131 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-x11_4.5.0-0ubuntu4.3.dsc Size/MD5: 2606 d75ba3f2a8b7a0fc5f17a6d013fd3466 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-x11_4.5.0.orig.tar.gz Size/MD5: 125349021 ffbb1aaea2d538df7ec7694cd68750df Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-doc-html_4.5.0-0ubuntu4.3_all.deb Size/MD5: 24035224 db61f130680cbfecaee7b2076d9b5b4b http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-doc_4.5.0-0ubuntu4.3_all.deb Size/MD5: 51777244 2c5967ae92de35d935f22bb8cefdb7fb amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-assistant_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 11622 737452fbf1eb644732601da4afe86d56 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-core_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 2310 4ab7edba7c683c4cd436ca6f6e43cc07 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-dbg_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 49977848 5a39a981a5a46f5b9833856aa8bd75ab http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-dbus_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 175462 33f715129fcbb8fe17cbf233afdd2735 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-designer_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 1798666 b0abe77a5b60e101b8a4f796cee35b9d http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-dev-dbg_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 6442006 3ec2ed8e896375977496d8aaba00fc0f http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-dev_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 2442216 55bcb4ba4d60f160adee52790f282bf5 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-gui_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 2300 b0ee4bbf483c8037799882f47a9ec95b http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-help_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 169046 f5cec0a5df796752c97289a7599a547f http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-network_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 379932 4a675e3de3c9ffeda60720b389dded9b http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-opengl-dev_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 31006 6e065ba12e303945dfd4969c7b0e6108 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-opengl_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 150338 1389003b28ca5f92e5bb8c9577a36fbb http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-qt3support_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 1033060 00e3845cefc2c24d676c64215cd3c1a4 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-script_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 349792 3a0b31c3ad9667c03ecd37efc863e27c http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-scripttools_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 216816 66d2b7a90f14393d259bf12068f44a0a http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-mysql_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 24020 787039fb8afe166961e56b21020c45c4 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-odbc_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 38326 8363daf729bf199a14566ed0054cb110 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-psql_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 27504 cb2ea2f84ea939edcf662024a81187bf http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-sqlite2_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 14198 087d5a3f0143d20d87b346e1ef04b2e6 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-sqlite_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 17152 4ec3302c7e7b40f41f276883eb1f9cf1 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 85832 94f0d14fcfc19c8dfd1a36a29a2d5825 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-svg_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 129138 a32e5231e108b2f1c869b3631fc98dfe http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-test_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 41274 4450aea1e1c1078de1d6d43a77d80ef4 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-webkit-dbg_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 58479264 76487ff20906b41662cacb4cd8c4eedc http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-webkit_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 3635668 5d869921403fc9d4e1994b81b92ef122 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-xml_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 87132 e9da8588cdb3f8995cb440d172f39a56 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-xmlpatterns-dbg_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 5521678 207d3c7382e7f7dab949b4761c819b67 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-xmlpatterns_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 653750 302a9fd3b69b1d41b8e65cd00a4a38b7 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqtcore4_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 1490876 a5d562105e8c1d6f14e6c9e38f2f7c1f http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqtgui4_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 3589934 59404b3094771d8d30fa4085456661b4 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-demos-dbg_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 24216220 10b8cd267a0d68a7a2a08327e1db059a http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-demos_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 5480184 36ccc9b88e638cf13f3cfce9610d778b http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-designer_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 247710 0021d694f10622ef0faac30d8f05ed6a http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-dev-tools-dbg_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 6913490 044d9347469b06b3b5c9a52708fb22d6 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-dev-tools_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 1826192 35ab7279b9e9fe1e93d8c754e0a53f73 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-qmake_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 1301118 10986e4c5ec819a976b7e49161939a16 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-qtconfig_4.5.0-0ubuntu4.3_amd64.deb Size/MD5: 81282 14ffbbbb5b74a10ff0337d6a08fac291 i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-assistant_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 11598 8db87ef71449e31c1ab389e26e305793 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-core_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 2314 ed908ab64c8ddc432935230e227df32c http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-dbg_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 48872540 78c072e9fc494fedd3e56ba2e6c5b14f http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-dbus_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 175422 3d97854e70da9c80dd6187a43c273da2 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-designer_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 1821098 5c0b22bf30f5c0ad3e8e9c35fa29241d http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-dev-dbg_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 6222664 8dc2d38b512ae20cf6c0e48f35446e55 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-dev_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 2426558 bd753136ff81b7879b6d26bd5e6ccbeb http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-gui_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 2302 96334f4e93762dd1a28ce34f6b6855dd http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-help_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 170522 4f124c0feff569d3a7aaf7a537fa5ede http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-network_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 386636 39614ce0a48380ec9c9b82b52d46fc48 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-opengl-dev_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 31006 b8e6ffba684bb6aecfe7cf547d069591 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-opengl_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 150268 fd9fc1d937cc2186a241085727f69e45 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-qt3support_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 1047674 917768ee99ad30e46d8ea162ba2a55a0 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-script_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 345124 783e3146d1d15e7e4b56177c2551dc8c http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-scripttools_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 219532 dd4402ef905fe36edc219977b8b56522 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-mysql_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 23490 e3ae808d9546d39b318f2032a3efb2ed http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-odbc_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 38370 c3912b46f9819db92995814578905aaa http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-psql_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 26944 6942237ccbe925f91da83a58d80257dc http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-sqlite2_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 13910 24fd6fdd62a853df103ccc5eb23f3ae9 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql-sqlite_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 16950 224500aeec4ee6c0bda83f1979f556b7 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-sql_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 85482 35f8861a0f387877d757af2a4bcb74fb http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-svg_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 127134 74b396cfbdfd52fc01a5b44feafddf40 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-test_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 40384 850f651e7b3692dd8f0359e1f6fa9912 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-webkit-dbg_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 59567434 bbf0c15e2947f809171025aecd169bf2 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-webkit_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 3642492 ccd71c16c7d07bd4883700a95a7e310d http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-xml_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 85662 fc005d23610c7815031ccf67e44d57c2 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-xmlpatterns-dbg_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 5446004 9ceeb69be14e99aa371c34c48e0dd8e1 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqt4-xmlpatterns_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 631616 58a2c5664efbc4969e273be8d3e51cb2 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqtcore4_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 1495212 280e8771adeb6e48a31c1c00c65d097d http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/libqtgui4_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 3638476 617f09457809107814b139fdaa11b2cd http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-demos-dbg_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 23695874 19d12080a314954ef6184589c6e6ef64 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-demos_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 5411704 8ffd319dca0814ec7bf90e392c79d75c http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-designer_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 242498 cf300d706f60b14c9bdb26d38dfca4fc http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-dev-tools-dbg_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 6733760 802cb485899ba1684255b4189383e2a2 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-dev-tools_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 1801834 c95b326cd5047777a9b62cf96b842dfc http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-qmake_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 1275490 744e112dc6d57749d4e7c66043162d48 http://security.ubuntu.com/ubuntu/pool/main/q/qt4-x11/qt4-qtconfig_4.5.0-0ubuntu4.3_i386.deb Size/MD5: 80198 e4025eafa9ef6f848712cbb5d305da0b lpia architecture (Low Power Intel Architecture): http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-assistant_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 11586 35392a8aec66b9f6a80a3f37989a3e84 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-core_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 2310 bba9237a24419b96e34626f301cb53a1 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dbg_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 49102028 35a51944c0b80faa25212c2e5d42af3a http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dbus_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 179254 4dad09ed33bbf71e210fe99628eb8e5d http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-designer_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 1845654 a3ccab02027a27ab368b4d76961f44d8 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dev-dbg_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 6301482 e970557325b93c7d3c82fc04e051ad5c http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dev_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 2460502 bd49c126c36b95c63b6356728557cdbb http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-gui_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 2300 24c70a2289d01c6f1a675f18bd83fb0d http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-help_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 174932 e0b29a559a038c9e52d450d3063ae1c3 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-network_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 392598 cd76e9d7fbb3946eed667e73ff44350d http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-opengl-dev_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 31002 85d63a39a01b18e425b60aa7f70fce23 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-opengl_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 154532 5d40f8b45c5cc367eb56e35680b3f81d http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-qt3support_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 1063636 29e972e6c664c9d7f49f6ecb57b7249e http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-script_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 349202 6e483f50400f9bb3322d12d4cd2088a8 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-scripttools_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 221612 f5cf566f6fae3460c4ffe038a2ca45eb http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-mysql_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 23800 a5e1ba153e219d5de887ab2f4c331724 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-odbc_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 39248 e2a9bf4f5860c536b5f6bb2dd36080ff http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-psql_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 27270 6757ef004282dbcb41911519832e665c http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-sqlite2_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 13914 60e0b2ff89e2fcb170a9bad22fa5a426 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-sqlite_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 17028 dc8248f423afcf49684aff36461b1928 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 86128 0013e3a3d503cd8930215ced2bb7e781 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-svg_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 129896 502e1b866f8b4c93557ccfe37cf84ffd http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-test_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 40860 42258f710eafde8ba98cf0d70ed62bbe http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-webkit-dbg_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 59829124 f5e6ca21fab5632def632f1980d72968 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-webkit_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 3663718 3c60d09c9701b8583ee9b3ea63df1e09 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-xml_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 85456 f4cd1db01939e7bea4cf1a14350318d0 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-xmlpatterns-dbg_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 5462674 73f928cbc1e2ab2a8b0cb35750e33363 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-xmlpatterns_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 635968 2ba32c9934c37fb858ef293861296660 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqtcore4_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 1503558 71a10407ee8e2b0d8faca71803516543 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqtgui4_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 3703968 70254633149e0177b8f40306e1c40119 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-demos-dbg_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 23831210 a47cc662c799d56d39a098a55c7ff860 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-demos_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 5460356 d0f2731a66583fca365275b4bf15bd43 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-designer_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 247224 45221df9fac6b935e70f3d49f1641ec3 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-dev-tools-dbg_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 6766074 699d8557725cbc1d98b3facf908aa1af http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-dev-tools_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 1843474 1c07f5258466db532f77d046fc0464b4 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-qmake_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 1316972 524683da13e66e47fa34a6ddb7067473 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-qtconfig_4.5.0-0ubuntu4.3_lpia.deb Size/MD5: 82774 b3f8e382739f03da9cb94626a2f5211f powerpc architecture (Apple Macintosh G3/G4/G5): http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-assistant_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 12608 f70d7f88f98c710f00b8dec826a14945 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-core_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 2312 fc55af80a812eb5ffbf75ec3a7ee62aa http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dbg_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 48136850 2863a8886de595c43068283ff45beb90 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dbus_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 163234 3d9febce56214962ba436358228df2d4 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-designer_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 1623414 d8dcdedae518133907c850aa8230bf56 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dev-dbg_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 6172098 8d8f8518ff54c90933966fe61729c7dd http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dev_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 2264658 67bb52a5f6d6b60300adfb85423c76ac http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-gui_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 2304 30e86f2760dac7fd3f47c476447bd941 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-help_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 157492 6739e773252eb1cd70806bdb96665439 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-network_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 360428 215dd6ef03babb6a638c45781bb26af2 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-opengl-dev_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 30994 4b457917bdeb91ba6cfcc02d9e0f1e77 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-opengl_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 148258 ebf113910c60bf1e199cd0e76f8b3115 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-qt3support_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 957976 4d49fb9926a4219667b31b76fb75f58e http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-script_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 313972 4def22b0b2bf687f3d2f6a2f669230d5 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-scripttools_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 203240 d56786ea920eb436f4ccbef49260eb4a http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-mysql_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 24312 b935bc753bd5ffdc7c97e542e55e0e6d http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-odbc_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 36972 a4079076c4edf8f0f2cd22be7866f2f6 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-psql_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 27426 b36d025e2cf5335c15f6ee7d2314cf9e http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-sqlite2_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 15134 3be81591afc0f3e5614d582a982e17e7 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-sqlite_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 18100 dffa427f519211a592132e1d2a5a48e7 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 83246 0c963279944d17e32d467758e84728ec http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-svg_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 124342 f21e4e8d73ec525468ac0265c1c6ed3e http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-test_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 40800 721a48d0c19c7036ec6f7f3e8a1796e4 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-webkit-dbg_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 56672370 a1b88f4ee8294b49ebaab9ddd5fcf2df http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-webkit_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 3283702 f46252f44921409a43fa89af3a5b7e6f http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-xml_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 83654 02ea31ab550db40086f5419daeb8bc24 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-xmlpatterns-dbg_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 5444754 86c71dabb153ac371a3a878a5bfa017f http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-xmlpatterns_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 582304 4ef1ec5872ab6fb0cfc33aef011dd051 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqtcore4_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 1431880 fd055110524b4102c88431c9a094b6d5 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqtgui4_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 3356692 414febb0dcdc2224bbc4d322bf071471 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-demos-dbg_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 23665304 69d7736174682533b91910e9e9c4e221 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-demos_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 5394298 4f88263c866b42b011ac6f70b999aa63 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-designer_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 234970 a30574534ddc200af008c4aef6f830c9 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-dev-tools-dbg_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 6719304 be9f1a32584792b598c76560e7d4a75b http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-dev-tools_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 1681322 40d865a463a5d25a076bf6f55af65b90 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-qmake_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 1135018 91e9ded3076f1f141d29895358b062fa http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-qtconfig_4.5.0-0ubuntu4.3_powerpc.deb Size/MD5: 76466 1c75a4de6f3f7a61c41dc97c1ed3bc56 sparc architecture (Sun SPARC/UltraSPARC): http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-assistant_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 10942 a7a4483b64af47318cdabbde9976a65b http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-core_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 2308 b0258f54da89aeda6b40cd6798e6f3ec http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dbg_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 45231402 d00aea2071e583a895b6a89ff0234e12 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dbus_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 151694 be8ca9b3ee9a1d47a98867c0aba4160e http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-designer_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 1577576 93f34052ac88e45426f7e45a9c12d206 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dev-dbg_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 5656966 83e7d65e9aa03882c9a0e20605230a69 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-dev_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 2225980 eac4944686a27b18f3d0e3a0dbfacc17 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-gui_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 2302 c318da351836628e9c671eae39dafa9a http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-help_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 151930 3adca0e45ff6ad23b8258a6717e645cb http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-network_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 339444 4bf57591f2c0cc91b69ec0dd1ad0fd30 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-opengl-dev_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 30998 80ecbcd1452055000371a473d8d5fcf5 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-opengl_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 132308 d31962f23a576d6ed29b81d92107d353 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-qt3support_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 895788 305fff66ad3943d35384fcb245391228 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-script_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 287534 0b5d15fd5302e8430dedad0a002a2503 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-scripttools_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 195514 8073d183a54598751563df5efe14f135 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-mysql_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 21426 a8e378abcf5f61aa9085346481b2c7e0 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-odbc_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 31290 d18c888585cfc914c046777d61de2189 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-psql_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 24464 1a69a86a46673d987ccd6d85f578ee0e http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-sqlite2_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 12748 5538aadc52d0481f0512e2d87289dc15 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql-sqlite_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 15496 27b6dde8f85dda5c9bdaa7c165b639b4 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-sql_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 75964 31c5dbb4d87a23faa146d7224df6fa02 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-svg_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 109566 79711b8ffb0fb8ea2afa7582375449d4 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-test_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 36522 c2f8d5c388c435d666a7339ecf4829df http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-webkit-dbg_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 56966338 c120bb1bb4e2edde9bd6349db63bc76a http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-webkit_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 3409284 28669d24488ef04d5bca9220839f7767 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-xml_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 76352 70dd584dc3c8c9964b427ce0ed3fe5a6 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-xmlpatterns-dbg_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 5165042 73f9ba9346195ffacf82f84d1ba44c03 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqt4-xmlpatterns_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 660376 90e3f41308b8bb4188314c4ec57069a0 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqtcore4_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 1352448 0661edc6b955441c5feeb681fe740831 http://ports.ubuntu.com/pool/main/q/qt4-x11/libqtgui4_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 3175982 7a704629253865d41165a33e60a57763 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-demos-dbg_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 22594146 b071a350741d3c8ee3094c887839108e http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-demos_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 5333208 d0538ce1add58ae9eb2709a28aace8bd http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-designer_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 233350 bc5b53dfcba69468f73eabd6988a3a62 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-dev-tools-dbg_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 6177274 233d55a34a9c290561f714970196859a http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-dev-tools_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 1678528 27d97ffe2e9c93cf2412004d03a793fe http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-qmake_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 1093456 20100354350ea3a0150400a593fbb401 http://ports.ubuntu.com/pool/main/q/qt4-x11/qt4-qtconfig_4.5.0-0ubuntu4.3_sparc.deb Size/MD5: 76636 6aa6be976ebfa14c11ef8ae811cfb711

Apple Safari executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote attackers to bypass intended Adobe Acrobat JavaScript restrictions on accessing the document object, as demonstrated by a web site that permits PDF uploads by untrusted users, and therefore has a shared document.domain between the web site and this javascript: URI. NOTE: the researcher reports that Adobe's position is "a PDF file is active content.". Safari is prone to a security bypass vulnerability. Safari is Apple Computer's bundled web browser

The Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 stores passwords and wireless-network keys in cleartext in (1) pass_wd.htm and (2) Wsecurity.htm, which allows remote attackers to obtain sensitive information by reading the HTML source code. Wvc54gc is prone to a information disclosure vulnerability. The Linksys WVC54GCA is a wireless network camera

The default configuration of the Security global settings on the Citrix NetScaler Access Gateway appliance with Enterprise Edition firmware 9.0, 8.1, and earlier specifies Allow for the Default Authorization Action option, which might allow remote authenticated users to bypass intended access restrictions. Citrix NetScaler Access Gateway is prone to a vulnerability that can allow an attacker to gain unauthorized access to network resources, which may help in other attacks. This issue affects NetScaler Access Gateway Enterprise Edition with firmware 8.1 and earlier. NOTE: Appliances running version 9.0 that were upgraded from a previous version are also affected

The PayPal app before 3.0.1 for iOS does not verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof a PayPal web server via an arbitrary certificate. eBay PayPal is prone to a security-bypass vulnerability because it fails to properly verify x.509 certificates. Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers which will aid in further attacks. NOTE: This issue affects connections on unsecured Wi-Fi networks. Versions prior to PayPal 3.0.1 for iOS-based mobile devices are vulnerable. ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics Request the full 2008 Report here: http://secunia.com/advisories/try_vi/request_2008_report/ Stay Secure, Secunia ---------------------------------------------------------------------- TITLE: McAfee Products Archive Handling Security Bypass SECUNIA ADVISORY ID: SA34949 VERIFY ADVISORY: http://secunia.com/advisories/34949/ DESCRIPTION: Some weaknesses have been reported in various McAfee products, which can be exploited by malware to bypass the scanning functionality. The weaknesses are caused due to errors in the handling of archive file formats (e.g. SOLUTION: Update .DAT files to DAT 5600 or later. http://www.mcafee.com/apps/downloads/security_updates/dat.asp PROVIDED AND/OR DISCOVERED BY: * Thierry Zoller * The vendor also credits Mickael Roger. ORIGINAL ADVISORY: McAfee: https://kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENT Thierry Zoller: http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . ________________________________________________________________________ From the low-hanging-fruit-department - Mcafee multiple generic evasions ________________________________________________________________________ Release mode: Coordinated but limited disclosure. Ref : TZO-182009 - Mcafee multiple generic evasions WWW : http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html Vendor : http://www.mcafee.com Status : Patched CVE : CVE-2009-1348 (provided by mcafee) https://kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENT Security notification reaction rating : very good Notification to patch window : +-27 days (Eastern holidays in between) Disclosure Policy : http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html Affected products : - McAfee VirusScan\xae Plus 2009 - McAfee Total Protection\x99 2009 - McAfee Internet Security - McAfee VirusScan USB - McAfee VirusScan Enterprise - McAfee VirusScan Enterprise Linux - McAfee VirusScan Enterprise for SAP - McAfee VirusScan Enterprise for Storage - McAfee VirusScan Commandline - Mcafee SecurityShield for Microsoft ISA Server - Mcafee Security for Microsoft Sharepoint - Mcafee Security for Email Servers - McAfee Email Gateyway - McAfee Total Protection for Endpoint - McAfee Active Virus Defense - McAfee Active VirusScan It is unkown whether SaaS were affected (tough likely) : - McAfee Email Security Service - McAfee Total Protection Service Advanced I. Background ~~~~~~~~~~~~~ Quote: "McAfee proactively secures systems and networks from known and as yet undiscovered threats worldwide. Home users, businesses, service providers, government agencies, and our partners all trust our unmatched security expertise and have confidence in our comprehensive and proven solutions to effectively block attacks and prevent disruptions." II. Description ~~~~~~~~~~~~~~~ The parsing engine can be bypassed by a specially crafted and formated RAR (Headflags and Packsize),ZIP (Filelenght) archive. III. Impact ~~~~~~~~~~~ A general description of the impact and nature of AV Bypasses/evasions can be read at : http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html The bug results in denying the engine the possibility to inspect code within RAR and ZIP archives. There is no inspection of the content at all and hence the impossibility to detect malicious code. IV. Disclosure timeline ~~~~~~~~~~~~~~~~~~~~~~~~~ DD/MM/YYYY 04/04/2009 : Send proof of concept RAR I, description the terms under which I cooperate and the planned disclosure date 06/04/2009 : Send proof of concept RAR II, description the terms under which I cooperate and the planned disclosure date 06/04/2009 : Mcafee acknowledges receipt and reproduction of RAR I, ack acknowledges receipt of RARII 10/04/2009 : Send proof of concept ZIP I, description the terms under which I cooperate and the planned disclosure date 21/04/2009 : Mcafee provides CVE number CVE-2009-1348 28/04/2009 : Mcafee informs me that the patch might be released on the 29th 29/04/2009 : Mcafee confirms patch release and provides URL https://kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENT 29/04/2009 : Ask for affected versions 29/04/2009 : Mcafee replies " This issue does affect all vs engine products, including both gateway and endpoint" _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

HTC Touch Pro and HTC Touch Cruise vCard allows remote attackers to cause denial of service (CPU consumption, SMS consumption, and connectivity loss) via a flood of vCards to UDP port 9204

Apple Safari detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages.". Multiple browsers are prone to a security-bypass vulnerability because they fail to display warnings when pages operating in a secure context try to request resources through insecure methods. Attackers may exploit this vulnerability to aid in phishing attacks or to obtain sensitive information. Other attacks are also possible. Note that to take advantage of this issue, an attacker must be able to intercept or control network traffic. This would normally be possible through a man-in-the-middle attack, DNS poisoning, or similar vectors. The following are vulnerable: Microsoft Internet Explorer Mozilla Firefox Apple Safari Opera Google Chrome Other browsers may also be affected

Apple Safari before 3.2.2 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site. Multiple browsers are prone to a man-in-the-middle vulnerability. Attackers may exploit this vulnerability to aid in phishing attacks or to obtain sensitive information. Other attacks are also possible. Note that to take advantage of this issue, an attacker must be able to intercept or control network traffic. This would normally be possible through a man-in-the-middle attack, DNS poisoning, or similar vectors. The following are vulnerable: Mozilla Firefox prior to 3.0.10 Apple Safari prior to 3.2.2 Opera prior to 9.25 Additional browsers may also be affected. A man-in-the-middle attacker can modify the content of an http site by modifying the response of the content and causing an attack on any http network site. A 302 redirect message to execute arbitrary web scripts

The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive. Multiple McAfee products are prone to a vulnerability that may allow certain compressed archives to bypass the scan engine. Successful exploits will allow attackers to distribute files containing malicious code that the antivirus application will fail to detect. The issue affects all McAfee software that uses DAT files. ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics Request the full 2008 Report here: http://secunia.com/advisories/try_vi/request_2008_report/ Stay Secure, Secunia ---------------------------------------------------------------------- TITLE: McAfee Products Archive Handling Security Bypass SECUNIA ADVISORY ID: SA34949 VERIFY ADVISORY: http://secunia.com/advisories/34949/ DESCRIPTION: Some weaknesses have been reported in various McAfee products, which can be exploited by malware to bypass the scanning functionality. The weaknesses are caused due to errors in the handling of archive file formats (e.g. SOLUTION: Update .DAT files to DAT 5600 or later. http://www.mcafee.com/apps/downloads/security_updates/dat.asp PROVIDED AND/OR DISCOVERED BY: * Thierry Zoller * The vendor also credits Mickael Roger. ORIGINAL ADVISORY: McAfee: https://kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENT Thierry Zoller: http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . ________________________________________________________________________ From the low-hanging-fruit-department - Mcafee multiple generic evasions ________________________________________________________________________ Release mode: Coordinated but limited disclosure. Ref : TZO-182009 - Mcafee multiple generic evasions WWW : http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html Vendor : http://www.mcafee.com Status : Patched CVE : CVE-2009-1348 (provided by mcafee) https://kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENT Security notification reaction rating : very good Notification to patch window : +-27 days (Eastern holidays in between) Disclosure Policy : http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html Affected products : - McAfee VirusScan\xae Plus 2009 - McAfee Total Protection\x99 2009 - McAfee Internet Security - McAfee VirusScan USB - McAfee VirusScan Enterprise - McAfee VirusScan Enterprise Linux - McAfee VirusScan Enterprise for SAP - McAfee VirusScan Enterprise for Storage - McAfee VirusScan Commandline - Mcafee SecurityShield for Microsoft ISA Server - Mcafee Security for Microsoft Sharepoint - Mcafee Security for Email Servers - McAfee Email Gateyway - McAfee Total Protection for Endpoint - McAfee Active Virus Defense - McAfee Active VirusScan It is unkown whether SaaS were affected (tough likely) : - McAfee Email Security Service - McAfee Total Protection Service Advanced I. Background ~~~~~~~~~~~~~ Quote: "McAfee proactively secures systems and networks from known and as yet undiscovered threats worldwide. Home users, businesses, service providers, government agencies, and our partners all trust our unmatched security expertise and have confidence in our comprehensive and proven solutions to effectively block attacks and prevent disruptions." II. Description ~~~~~~~~~~~~~~~ The parsing engine can be bypassed by a specially crafted and formated RAR (Headflags and Packsize),ZIP (Filelenght) archive. III. Impact ~~~~~~~~~~~ A general description of the impact and nature of AV Bypasses/evasions can be read at : http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html The bug results in denying the engine the possibility to inspect code within RAR and ZIP archives. There is no inspection of the content at all and hence the impossibility to detect malicious code. IV. Disclosure timeline ~~~~~~~~~~~~~~~~~~~~~~~~~ DD/MM/YYYY 04/04/2009 : Send proof of concept RAR I, description the terms under which I cooperate and the planned disclosure date 06/04/2009 : Send proof of concept RAR II, description the terms under which I cooperate and the planned disclosure date 06/04/2009 : Mcafee acknowledges receipt and reproduction of RAR I, ack acknowledges receipt of RARII 10/04/2009 : Send proof of concept ZIP I, description the terms under which I cooperate and the planned disclosure date 21/04/2009 : Mcafee provides CVE number CVE-2009-1348 28/04/2009 : Mcafee informs me that the patch might be released on the 29th 29/04/2009 : Mcafee confirms patch release and provides URL https://kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENT 29/04/2009 : Ask for affected versions 29/04/2009 : Mcafee replies " This issue does affect all vs engine products, including both gateway and endpoint" _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/. Description ~~~~~~~~~~~~~~~ Improper parsing of the PDF structure leads to evasion of detection of malicious PDF documents at scantime and runtime. This has been tested with several malicious PDF files and represents a generic evasion of all PDF signatures and heuristics. General information about evasion/bypasses can be found at : http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html III. Impact ~~~~~~~~~~~ Known PDF exploits/malware may evade signature detection, 0day exploits may evade heuristics. Disclosure timeline ~~~~~~~~~~~~~~~~~~~~~~~~~ DD.MM.YYYY 01.06.2009 - Reported 20.10.2009 - McAfee informed us that they published the advisory on their website < waiting for others vendors to patch > 27.10.2009 - G-SEC releases this advisory About G-SEC ~~~~~~~~~~~ G-SEC\x99 is a vendor independent luxemburgish led IT security consulting group. More information available at : http://www.g-sec.lu/ _______________________________________________ Full-Disclosure - We believe in it. ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia

The BGP daemon (bgpd) in Quagga 0.99.11 and earlier allows remote attackers to cause a denial of service (crash) via an AS path containing ASN elements whose string representation is longer than expected, which triggers an assert error. Quagga is prone to a remote denial-of-service vulnerability. Exploiting this issue allows remote attackers to cause the vulnerable process to crash, denying further service to legitimate users. Quagga 0.99.11 is vulnerable; other versions may also be affected. ---------------------------------------------------------------------- Are you missing: SECUNIA ADVISORY ID: Critical: Impact: Where: within the advisory below? This is now part of the Secunia commercial solutions. -- Debian GNU/Linux 5.0 alias lenny -- Source archives: http://security.debian.org/pool/updates/main/q/quagga/quagga_0.99.10.orig.tar.gz Size/MD5 checksum: 2424191 c7a2d92e1c42214afef9b2e1cd4b5d06 http://security.debian.org/pool/updates/main/q/quagga/quagga_0.99.10-1lenny2.diff.gz Size/MD5 checksum: 40070 b72e19ed913b32923cf4ef293c67f71c http://security.debian.org/pool/updates/main/q/quagga/quagga_0.99.10-1lenny2.dsc Size/MD5 checksum: 1651 a8ef80d57fd5a5a5b08c7ccc70e6a179 Architecture independent packages: http://security.debian.org/pool/updates/main/q/quagga/quagga-doc_0.99.10-1lenny2_all.deb Size/MD5 checksum: 661226 720947423143cb35eb5c26a0d420066b alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/q/quagga/quagga_0.99.10-1lenny2_alpha.deb Size/MD5 checksum: 1902736 570becd04ecb3dd8a0581010884928df amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/q/quagga/quagga_0.99.10-1lenny2_amd64.deb Size/MD5 checksum: 1748838 f3fcd731d119c422463c36bb4f08be1a arm architecture (ARM) http://security.debian.org/pool/updates/main/q/quagga/quagga_0.99.10-1lenny2_arm.deb Size/MD5 checksum: 1449222 6b654e2d4e1a4f00169309ebbbd3dbf9 hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/q/quagga/quagga_0.99.10-1lenny2_hppa.deb Size/MD5 checksum: 1681872 8894106d57df0a3d92bb84f148150c2d i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/q/quagga/quagga_0.99.10-1lenny2_i386.deb Size/MD5 checksum: 1606310 80046937a2da8a949a8167f753a583ce mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/q/quagga/quagga_0.99.10-1lenny2_mipsel.deb Size/MD5 checksum: 1600660 716f61415932929c2f668f99faea448e powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/q/quagga/quagga_0.99.10-1lenny2_powerpc.deb Size/MD5 checksum: 1715848 995194031d563994b7d77018d8a4ca3e s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/q/quagga/quagga_0.99.10-1lenny2_s390.deb Size/MD5 checksum: 1794568 b1b47e8dae153461f73c98a61c653e1e sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/q/quagga/quagga_0.99.10-1lenny2_sparc.deb Size/MD5 checksum: 1670342 18f98f0978f510ac18636ca1ccc9dfe7 -- Debian GNU/Linux unstable alias sid -- Fixed in version 0.99.11-2. Updated packages are available that bring Quagga to version 0.99.12 which provides numerous bugfixes over the previous 0.99.9 version, and also corrects this issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1572 _______________________________________________________________________ Updated Packages: Corporate 4.0: 48c1d2504e08d2a26ac6ace2bc01124d corporate/4.0/i586/libquagga0-0.99.12-0.1.20060mlcs4.i586.rpm df93a452f47b8926f65a51231dd11f36 corporate/4.0/i586/libquagga0-devel-0.99.12-0.1.20060mlcs4.i586.rpm d2386e488423fbb81e44cb6dda4de9df corporate/4.0/i586/quagga-0.99.12-0.1.20060mlcs4.i586.rpm d4b9c5e2cec03ce49a76adcfe0e4a42e corporate/4.0/i586/quagga-contrib-0.99.12-0.1.20060mlcs4.i586.rpm 15e76c29c25f7730eae72c18da15b772 corporate/4.0/SRPMS/quagga-0.99.12-0.1.20060mlcs4.src.rpm Corporate 4.0/X86_64: afc986d05e0bde73541f0cfe5b147d2c corporate/4.0/x86_64/lib64quagga0-0.99.12-0.1.20060mlcs4.x86_64.rpm 4cc0bec07f2b919abeac75dc06d7f3c0 corporate/4.0/x86_64/lib64quagga0-devel-0.99.12-0.1.20060mlcs4.x86_64.rpm 3d606fef235993483e9a448665e4e377 corporate/4.0/x86_64/quagga-0.99.12-0.1.20060mlcs4.x86_64.rpm f549ced36115d6609ac835c5aca0863d corporate/4.0/x86_64/quagga-contrib-0.99.12-0.1.20060mlcs4.x86_64.rpm 15e76c29c25f7730eae72c18da15b772 corporate/4.0/SRPMS/quagga-0.99.12-0.1.20060mlcs4.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFKBsjAmqjQ0CJFipgRAkoyAJ4o+uz6I6p3tycZQfB5GbqTsTL5TwCgjJHK lIRHZW4+jB0P4UXMSyVUpxo= =2fxe -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . =========================================================== Ubuntu Security Notice USN-775-1 May 12, 2009 quagga vulnerability CVE-2009-1572 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 8.04 LTS Ubuntu 8.10 Ubuntu 9.04 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: quagga 0.99.2-1ubuntu3.5 Ubuntu 8.04 LTS: quagga 0.99.9-2ubuntu1.2 Ubuntu 8.10: quagga 0.99.9-6ubuntu0.1 Ubuntu 9.04: quagga 0.99.11-1ubuntu0.1 In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: It was discovered that the BGP service in Quagga did not correctly handle certain AS paths containing 4-byte ASNs. ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: SUSE Update for Multiple Packages SECUNIA ADVISORY ID: SA35685 VERIFY ADVISORY: http://secunia.com/advisories/35685/ DESCRIPTION: SUSE has issued an update for multiple packages. This fixes some vulnerabilities, which can be exploited by malicious users to disclose sensitive information, manipulate certain data, and by malicious people to disclose sensitive information, cause a DoS (Denial of Service), and potentially compromise a vulnerable system. For more information: SA33338 SA33853 SA33884 SA34035 SA34481 SA34746 SA34797 SA35021 SA35128 SA35216 SA35296 SA35344 SA35422 1) A boundary error exists within the "pg_db_putline()" function in perl-DBD-Pg's dbdimp.c. This can be exploited to cause a heap-based buffer overflow if malicious rows are retrieved from the database using the "pg_getline()" or "getline()" function. 2) A memory leak exists within the function "dequote_bytea()" in perl-DBD-Pg's quote.c, which can be exploited to cause a memory exhaustion. 3) Various integer overflow errors exist within the "pdftops" application. This can be exploited to e.g. cause a crash or potentially execute arbitrary code by printing a specially crafted PDF file. 4) A vulnerability is caused due to an assertion error in bgpd when handling an AS path containing multiple 4 byte AS numbers, which can be exploited to crash to the daemon by advertising specially crafted AS paths. SOLUTION: Apply updated packages via YaST Online Update or the SUSE FTP server. ORIGINAL ADVISORY: SUSE-SR:2009:012: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html OTHER REFERENCES: SA33338: http://secunia.com/advisories/33338/ SA33853: http://secunia.com/advisories/33853/ SA33884: http://secunia.com/advisories/33884/ SA34035: http://secunia.com/advisories/34035/ SA34481: http://secunia.com/advisories/34481/ SA34746: http://secunia.com/advisories/34746/ SA34797: http://secunia.com/advisories/34797/ SA35021: http://secunia.com/advisories/35021/ SA35128: http://secunia.com/advisories/35128/ SA35216: http://secunia.com/advisories/35216/ SA35296: http://secunia.com/advisories/35296/ SA35344: http://secunia.com/advisories/35344/ SA35422: http://secunia.com/advisories/35422/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Multiple Trend Micro products are prone to a vulnerability that may allow certain compressed archives to bypass the scan engine. Successful exploits will allow attackers to distribute files containing malicious code that the antivirus application will fail to detect. ServerProtect for Microsoft Windows/Novell NetWare ServerProtect for EMC Celerra ServerProtect for NetApp ServerProtect for Linux ServerProtect for Network Appliance Filers Internet Security Pro Internet Security OfficeScan Component Worry Free Business Security - Standard Worry Free Business Security - Advanced Worry Free Business Security Hosted Housecall InterScan Web Security Suite InterScan Web Protect for ISA InterScan Messaging Security Appliance Neatsuite Advanced ScanMail for Exchange ScanMail for Domino Suites

Multiple unspecified vulnerabilities in Citrix Licensing 11.5 have unknown impact and attack vectors, related to "underlying components of the License Management Console.". The impact of this vulnerability is currently unknown. Very few details are available regarding this issue. We will update this BID as more information emerges. Citrix Licensing 11.5 is vulnerable. ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. SOLUTION: Update to the latest version of the Licensing Server. https://www.citrix.com/site/SS/downloads/ PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://support.citrix.com/article/CTX120742 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

SQL injection vulnerability in index.php Pragyan CMS 2.6.4 allows remote attackers to execute arbitrary SQL commands via the fileget parameter in a view action and other unspecified vectors. Pragyan CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Pragyan CMS 2.6.4 is vulnerable; other versions may also be affected

Heap-based buffer overflow in the loadexponentialfunc function in mupdf/pdf_function.c in MuPDF in the mupdf-20090223-win32 package, as used in SumatraPDF 0.9.3 and earlier, allows remote attackers to execute arbitrary code via a crafted PDF file. NOTE: some of these details are obtained from third party information. MuPDF is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code with the privileges of the user running the application or crash the application, denying service to legitimate users. ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics Request the full 2008 Report here: http://secunia.com/advisories/try_vi/request_2008_report/ Stay Secure, Secunia ---------------------------------------------------------------------- TITLE: MuPDF "loadexponentialfunc()" Buffer Overflow Vulnerability SECUNIA ADVISORY ID: SA34916 VERIFY ADVISORY: http://secunia.com/advisories/34916/ DESCRIPTION: c has discovered a vulnerability in MuPDF, which can be exploited by malicious people to potentially compromise an application using the library. The vulnerability is caused due to a boundary error within the "loadexponentialfunc()" function in pdf_function.c. Successful exploitation may allow execution of arbitrary code. The vulnerability is confirmed in the MuPDF library included in the mupdf-20090223-win32 package. Other versions may also be affected. SOLUTION: Do not process untrusted PDF files using the library. PROVIDED AND/OR DISCOVERED BY: c ORIGINAL ADVISORY: http://archives.neohapsis.com/archives/fulldisclosure/2009-04/0258.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Directory traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R22 and 1.00R24 allows remote attackers to read arbitrary files via a %2e. (encoded dot dot) or an absolute pathname in the next_file parameter. Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera is prone to multiple directory-traversal vulnerabilities because the software fails to sufficiently sanitize user-supplied input. An attacker can exploit these issues using directory-traversal strings ('../') to download arbitrary files with the privileges of the server process. Information obtained may aid in further attacks. Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera firmware 1.00R22 and 1.00R24 are affected; other versions may also be vulnerable. The Linksys WVC54GCA is a wireless network camera

Multiple unspecified vulnerabilities in the Control Center in Symantec Brightmail Gateway Appliance before 8.0.1 allow remote authenticated users to gain privileges, and possibly obtain sensitive information or hijack sessions of arbitrary users, via vectors involving (1) administrative scripts or (2) console functions. Symantec Brightmail Gateway is prone to a remote privilege-escalation vulnerability. Remote authorized attackers who have access to the targeted host's local network can exploit this issue to gain elevated access. Successful exploits may compromise the affected computer and may aid in other attacks. Versions prior to Brightmail Gateway 8.0.1 are vulnerable. Brightmail Gateway is Symantec's information security management platform. ---------------------------------------------------------------------- Secunia is pleased to announce the release of the annual Secunia report for 2008. Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics Request the full 2008 Report here: http://secunia.com/advisories/try_vi/request_2008_report/ Stay Secure, Secunia ---------------------------------------------------------------------- TITLE: Symantec Brightmail Gateway Control Center Multiple Vulnerabilities SECUNIA ADVISORY ID: SA34885 VERIFY ADVISORY: http://secunia.com/advisories/34885/ DESCRIPTION: Some vulnerabilities have been reported in Symantec Brightmail Gateway, which can be exploited by malicious people to conduct cross-site scripting attacks and by malicious users to bypass certain security restrictions. 1) Certain unspecified input passed to the Control Center is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. SOLUTION: Update to version 8.0.1 or later. PROVIDED AND/OR DISCOVERED BY: Marian Ventuneac, Perot Systems ORIGINAL ADVISORY: SYM09-005: http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090423_01 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Absolute path traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R24 and possibly 1.00R22 allows remote attackers to read arbitrary files via an absolute pathname in the this_file parameter. NOTE: traversal via a .. (dot dot) is probably also possible. Wvc54gca is prone to a directory traversal vulnerability. Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera is prone to multiple directory-traversal vulnerabilities because the software fails to sufficiently sanitize user-supplied input. An attacker can exploit these issues using directory-traversal strings ('../') to download arbitrary files with the privileges of the server process. Information obtained may aid in further attacks. Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera firmware 1.00R22 and 1.00R24 are affected; other versions may also be vulnerable. The Linksys WVC54GCA is a wireless network camera

Multiple memory leaks in Ipsec-tools before 0.7.2 allow remote attackers to cause a denial of service (memory consumption) via vectors involving (1) signature verification during user authentication with X.509 certificates, related to the eay_check_x509sign function in src/racoon/crypto_openssl.c; and (2) the NAT-Traversal (aka NAT-T) keepalive implementation, related to src/racoon/nattraversal.c. IPsec-Tools is affected by multiple remote denial-of-service vulnerabilities because the software fails to properly handle certain network packets. A successful attack allows a remote attacker to cause the application to crash or to consume excessive memory, denying further service to legitimate users. Versions prior to IPsec-Tools 0.7.2 are vulnerable. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200905-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: IPSec Tools: Denial of Service Date: May 24, 2009 Bugs: #267135 ID: 200905-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple errors in the IPSec Tools racoon daemon might allow remote attackers to cause a Denial of Service. Background ========== The IPSec Tools are a port of KAME's IPsec utilities to the Linux-2.6 IPsec implementation. They include racoon, an Internet Key Exchange daemon for automatically keying IPsec connections. Impact ====== A remote attacker could send specially crafted fragmented ISAKMP packets without a payload or exploit vectors related to X.509 certificate authentication and NAT traversal, possibly resulting in a crash of the racoon daemon. Workaround ========== There is no known workaround at this time. Resolution ========== All IPSec Tools users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-firewall/ipsec-tools-0.7.2" References ========== [ 1 ] CVE-2009-1574 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1574 [ 2 ] CVE-2009-1632 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1632 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200905-03.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA-1804-1 security@debian.org http://www.debian.org/security/ Nico Golde May 20th, 2009 http://www.debian.org/security/faq - -------------------------------------------------------------------------- Package : ipsec-tools Vulnerability : null pointer dereference, memory leaks Problem type : remote Debian-specific: no Debian bug : 527634 528933 CVE ID : CVE-2009-1574 CVE-2009-1632 Several remote vulnerabilities have been discovered in racoon, the Internet Key Exchange daemon of ipsec-tools. The The Common Vulnerabilities and Exposures project identified the following problems: Neil Kettle discovered a NULL pointer dereference on crafted fragmented packets that contain no payload. This results in the daemon crashing which can be used for denial of service attacks (CVE-2009-1574). For the oldstable distribution (etch), this problem has been fixed in version 0.6.6-3.1etch3. For the stable distribution (lenny), this problem has been fixed in version 0.7.1-1.3+lenny2. For the testing distribution (squeeze), this problem will be fixed soon. For the unstable distribution (sid), this problem has been fixed in version 1:0.7.1-1.5. We recommend that you upgrade your ipsec-tools packages. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - ------------------------------- Debian (oldstable) - ------------------ Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3.dsc Size/MD5 checksum: 722 8b561cf84ac9c46ec07b037ce3ad06f1 http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3.diff.gz Size/MD5 checksum: 49875 7444fb4ad448ccfffe878801a2b88d2e amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_amd64.deb Size/MD5 checksum: 343790 9cee9f8c479a3a2952d2913d7bdc4c5d http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_amd64.deb Size/MD5 checksum: 89184 5ccd4554eec28da6d933dc20a8a39393 arm architecture (ARM) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_arm.deb Size/MD5 checksum: 325706 9ce7988b74bccee252be7dac7ac8b5f7 http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_arm.deb Size/MD5 checksum: 89748 513ded0e4a33200710444e1bf4ab67d8 hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_hppa.deb Size/MD5 checksum: 353066 c56644b426ae945ca420d4ca37fc3f2a http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_hppa.deb Size/MD5 checksum: 94092 80b46b6fd60e857c84c588432b098957 i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_i386.deb Size/MD5 checksum: 330258 b905d30958bd5c51d355f286f81b8be1 http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_i386.deb Size/MD5 checksum: 85046 294ccbc4b51e4942edaeec7cd746dfa3 ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_ia64.deb Size/MD5 checksum: 113356 111f0daa2075584c100efc9c11ecef73 http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_ia64.deb Size/MD5 checksum: 468296 bd4d69b5e0d4ee39ec564e1304f7649c mips architecture (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_mips.deb Size/MD5 checksum: 89018 b6af57d65d43a7433132bee9657ba608 http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_mips.deb Size/MD5 checksum: 344558 aba2d85d5196c2a46555ad9e478d338a mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_mipsel.deb Size/MD5 checksum: 346856 97e04d97bdd55f852392d7461bad7f4d http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_mipsel.deb Size/MD5 checksum: 90308 9e780cda3df3384d0f1e33637d003f21 powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_powerpc.deb Size/MD5 checksum: 91048 98174626d8ad1fba940c81001c337a4f http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_powerpc.deb Size/MD5 checksum: 337266 9f636e6d8904103b0096a4eed99e9cae s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_s390.deb Size/MD5 checksum: 341586 b42ddbad323dcdbd775d502f786ab449 http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_s390.deb Size/MD5 checksum: 90750 62d4c3e618a6c69d532b8d8d33bb27b9 sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_sparc.deb Size/MD5 checksum: 85710 9f1f526be4f2df4eb64d46023d87c6b3 http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_sparc.deb Size/MD5 checksum: 317136 38e50e9d97b46b51d12429b9ea727858 Debian GNU/Linux 5.0 alias lenny - -------------------------------- Debian (stable) - --------------- Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2.diff.gz Size/MD5 checksum: 49472 4bc8ba2bd520a7514f2c33021c64e8ce http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1.orig.tar.gz Size/MD5 checksum: 1039057 ddff5ec5a06b804ca23dc41268368853 http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2.dsc Size/MD5 checksum: 1144 46d3f28156ee183512a451588ef414e4 alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_alpha.deb Size/MD5 checksum: 428532 052c13540da3fab19fdca83e9a389a39 http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_alpha.deb Size/MD5 checksum: 114088 78065dd99d3732291e8d499383af17d9 amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_amd64.deb Size/MD5 checksum: 409514 a421f12270f5b22639d67be8d2cc8b4e http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_amd64.deb Size/MD5 checksum: 104612 9ec93c697cf64232728d0dd5658efac8 arm architecture (ARM) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_arm.deb Size/MD5 checksum: 104604 78fa45a7e0503e4ee87e7508294cb0b0 http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_arm.deb Size/MD5 checksum: 381692 f1943edf9599189d16a2f936fa971abc armel architecture (ARM EABI) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_armel.deb Size/MD5 checksum: 387510 63ebe895d019d2362a0a11a0de0842c6 http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_armel.deb Size/MD5 checksum: 104268 6c224349c910ffce5bb892f2a06dc243 i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_i386.deb Size/MD5 checksum: 375004 5a43cbb6106d576ab686e9e4eb78c245 http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_i386.deb Size/MD5 checksum: 99098 6c81df8c4653265f10ad6abf68091329 ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_ia64.deb Size/MD5 checksum: 131288 dfa8646655028ae53bddad7f41e9f3a4 http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_ia64.deb Size/MD5 checksum: 544150 8e274b6b73125efe0fa8392398e0c5ea mips architecture (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_mips.deb Size/MD5 checksum: 103502 5bd00dfdef0862a63bb666ed949e26ef http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_mips.deb Size/MD5 checksum: 388820 46fc10315192943b912126fe68ffeea9 mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_mipsel.deb Size/MD5 checksum: 104216 a271cb33c891084479ed441945672f14 http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_mipsel.deb Size/MD5 checksum: 390562 352f78906e08ddb861053dfed30640bf powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_powerpc.deb Size/MD5 checksum: 403162 0210fa37088d78ee9aa53395aa0148e8 http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_powerpc.deb Size/MD5 checksum: 109438 26f043be5fb248d33b605d1987fa472a s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_s390.deb Size/MD5 checksum: 107474 aa6203b0e9e6dacbe39520be6b849eea http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_s390.deb Size/MD5 checksum: 399386 e965abdcf32838fff7753e789e703205 sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_sparc.deb Size/MD5 checksum: 102486 57b2e115a15e08518f00158c1fe36cf2 http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_sparc.deb Size/MD5 checksum: 373916 7e2278ac7b4f0b352814ad2f55b1213a These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkoUDnMACgkQHYflSXNkfP8LtgCdF9LmW/TOn9JDPTVGlt+7dccI 3MYAoJVcwmqHztsGgCgBps9hyqzrQJ5l =84V/ -----END PGP SIGNATURE----- . _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1632 _______________________________________________________________________ Updated Packages: Corporate 4.0: 4ccc0eafc222a8a5976a0e9eebbc7499 corporate/4.0/i586/ipsec-tools-0.6.5-2.4.20060mlcs4.i586.rpm f244df60a927a7aa4a539c2e8d9c699a corporate/4.0/i586/libipsec0-0.6.5-2.4.20060mlcs4.i586.rpm 95443caad35eb54d1f291f7368aac511 corporate/4.0/i586/libipsec0-devel-0.6.5-2.4.20060mlcs4.i586.rpm 0e9a4820ef81a4917d9c0a9c5befa27b corporate/4.0/SRPMS/ipsec-tools-0.6.5-2.4.20060mlcs4.src.rpm Corporate 4.0/X86_64: a1ccfd8a891340f52aa2f64d69e46e47 corporate/4.0/x86_64/ipsec-tools-0.6.5-2.4.20060mlcs4.x86_64.rpm 44ed76407c8633fcea7f4a3ab94f1842 corporate/4.0/x86_64/lib64ipsec0-0.6.5-2.4.20060mlcs4.x86_64.rpm d7a3ecf831ecfcbc1319558303a1be17 corporate/4.0/x86_64/lib64ipsec0-devel-0.6.5-2.4.20060mlcs4.x86_64.rpm 0e9a4820ef81a4917d9c0a9c5befa27b corporate/4.0/SRPMS/ipsec-tools-0.6.5-2.4.20060mlcs4.src.rpm Multi Network Firewall 2.0: f43aaba27d5ff88b38db39ebeaaaf5cd mnf/2.0/i586/ipsec-tools-0.2.5-0.7.M20mdk.i586.rpm fb19d1e75fd8f08ce9dc1586cdf9fa3b mnf/2.0/i586/libipsec-tools0-0.2.5-0.7.M20mdk.i586.rpm 2db168e39d44b361bab9ada981edaa90 mnf/2.0/SRPMS/ipsec-tools-0.2.5-0.7.M20mdk.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFKETmdmqjQ0CJFipgRAloWAJ9wHsc3F9b0lI8E87n8+gT7j4t+jACg8OD2 obN0TVwX9QBtElK0wQeibi8= =dlxS -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: SUSE Update for Multiple Packages SECUNIA ADVISORY ID: SA35685 VERIFY ADVISORY: http://secunia.com/advisories/35685/ DESCRIPTION: SUSE has issued an update for multiple packages. This fixes some vulnerabilities, which can be exploited by malicious users to disclose sensitive information, manipulate certain data, and by malicious people to disclose sensitive information, cause a DoS (Denial of Service), and potentially compromise a vulnerable system. For more information: SA33338 SA33853 SA33884 SA34035 SA34481 SA34746 SA34797 SA35021 SA35128 SA35216 SA35296 SA35344 SA35422 1) A boundary error exists within the "pg_db_putline()" function in perl-DBD-Pg's dbdimp.c. This can be exploited to cause a heap-based buffer overflow if malicious rows are retrieved from the database using the "pg_getline()" or "getline()" function. 2) A memory leak exists within the function "dequote_bytea()" in perl-DBD-Pg's quote.c, which can be exploited to cause a memory exhaustion. 3) Various integer overflow errors exist within the "pdftops" application. This can be exploited to e.g. cause a crash or potentially execute arbitrary code by printing a specially crafted PDF file. 4) A vulnerability is caused due to an assertion error in bgpd when handling an AS path containing multiple 4 byte AS numbers, which can be exploited to crash to the daemon by advertising specially crafted AS paths. SOLUTION: Apply updated packages via YaST Online Update or the SUSE FTP server. ORIGINAL ADVISORY: SUSE-SR:2009:012: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html OTHER REFERENCES: SA33338: http://secunia.com/advisories/33338/ SA33853: http://secunia.com/advisories/33853/ SA33884: http://secunia.com/advisories/33884/ SA34035: http://secunia.com/advisories/34035/ SA34481: http://secunia.com/advisories/34481/ SA34746: http://secunia.com/advisories/34746/ SA34797: http://secunia.com/advisories/34797/ SA35021: http://secunia.com/advisories/35021/ SA35128: http://secunia.com/advisories/35128/ SA35216: http://secunia.com/advisories/35216/ SA35296: http://secunia.com/advisories/35296/ SA35344: http://secunia.com/advisories/35344/ SA35422: http://secunia.com/advisories/35422/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . =========================================================== Ubuntu Security Notice USN-785-1 June 09, 2009 ipsec-tools vulnerabilities CVE-2009-1574, CVE-2009-1632 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 8.04 LTS Ubuntu 8.10 Ubuntu 9.04 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: racoon 1:0.6.5-4ubuntu1.3 Ubuntu 8.04 LTS: racoon 1:0.6.7-1.1ubuntu1.2 Ubuntu 8.10: racoon 1:0.7-2.1ubuntu1.8.10.1 Ubuntu 9.04: racoon 1:0.7-2.1ubuntu1.9.04.1 In general, a standard system upgrade is sufficient to effect the necessary changes. (CVE-2009-1574) It was discovered that ipsec-tools did not properly handle memory usage when verifying certificate signatures or processing nat-traversal keep-alive messages. A remote attacker could send specially crafted packets to the server and exhaust available memory, leading to a denial of service. ---------------------------------------------------------------------- Are you missing: SECUNIA ADVISORY ID: Critical: Impact: Where: within the advisory below? This is now part of the Secunia commercial solutions

racoon/isakmp_frag.c in ipsec-tools before 0.7.2 allows remote attackers to cause a denial of service (crash) via crafted fragmented packets without a payload, which triggers a NULL pointer dereference. Ipsec-tools of racoon/isakmp_frag.c Has a deficiency in handling fragmented packets with no payload, resulting in denial of service (DoS) There is a vulnerability that becomes a condition.Service operation disruption to a third party (DoS) There is a possibility of being put into a state. IPsec-Tools is affected by multiple remote denial-of-service vulnerabilities because the software fails to properly handle certain network packets. Versions prior to IPsec-Tools 0.7.2 are vulnerable. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2010-12-16-1 Time Capsule and AirPort Base Station (802.11n) Firmware 7.5.2 Time Capsule and AirPort Base Station (802.11n) Firmware 7.5.2 is now available and addresses the following: CVE-ID: CVE-2008-4309 Available for: AirPort Extreme Base Station with 802.11n, AirPort Express Base Station with 802.11n, Time Capsule Impact: A remote attacker may terminate the operation of the SNMP service Description: An integer overflow exists in the netsnmp_create_subtree_cache function. By default, the 'WAN SNMP' configuration option is disabled, and the SNMP service is accessible only to other devices on the local network. This issue is addressed by applying the Net-SNMP patches. CVE-ID: CVE-2009-2189 Available for: AirPort Extreme Base Station with 802.11n, AirPort Express Base Station with 802.11n, Time Capsule Impact: Receiving a large number of IPv6 Router Advertisement (RA) and Neighbor Discovery (ND) packets from a system on the local network may cause the base station to restart Description: A resource consumption issue exists in the base station's handling of Router Advertisement (RA) and Neighbor Discovery (ND) packets. A system on the local network may send a large number of RA and ND packets that could exhaust the base station's resources, causing it to restart unexpectedly. This issue is addressed by rate limiting incoming ICMPv6 packets. Credit to Shoichi Sakane of the KAME project, Kanai Akira of Internet Multifeed Co., Shirahata Shin and Rodney Van Meter of Keio University, and Tatuya Jinmei of Internet Systems Consortium, Inc. for reporting this issue. CVE-ID: CVE-2010-0039 Available for: AirPort Extreme Base Station with 802.11n, AirPort Express Base Station with 802.11n, Time Capsule Impact: An attacker may be able to query services behind an AirPort Base Station or Time Capsule's NAT from the source IP of the router, if any system behind the NAT has a portmapped FTP server Description: The AirPort Extreme Base Station and Time Capsule's Application-Level Gateway (ALG) rewrites incoming FTP traffic, including PORT commands, to appear as if it is the source. An attacker with write access to an FTP server inside the NAT may issue a malicious PORT command, causing the ALG to send attacker-supplied data to an IP and port behind the NAT. As the data is resent from the Base Station, it could potentially bypass any IP-based restrictions for the service. This issue is addressed by not rewriting inbound PORT commands via the ALG. Credit to Sabahattin Gucukoglu for reporting this issue. This issue is addressed through improved validation of fragmented ISAKMP packets. CVE-ID: CVE-2010-1804 Available for: AirPort Extreme Base Station with 802.11n, AirPort Express Base Station with 802.11n, Time Capsule Impact: A remote attacker may cause the device to stop processing network traffic Description: An implementation issue exists in the network bridge. Sending a maliciously crafted DHCP reply to the device may cause it to stop responding to network traffic. This issue affects devices that have been configured to act as a bridge, or are configured in Network Address Translation (NAT) mode with a default host enabled. By default, the device operates in NAT mode, and no default host is configured. This update addresses the issue through improved handling of DHCP packets on the network bridge. Credit to Stefan R. Filipek for reporting this issue. Installation note for Firmware version 7.5.2 Firmware version 7.5.2 is installed into Time Capsule or AirPort Base Station with 802.11n via AirPort Utility, provided with the device. It is recommended that AirPort Utility 5.5.2 be installed before upgrading to Firmware version 7.5.2. AirPort Utility 5.5.2 may be obtained through Apple's Software Download site: http://www.apple.com/support/downloads/ Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJNCWXyAAoJEGnF2JsdZQeevTQH/0856gTUzzmL371/nSkhn3qq MCPQVaEMe8O/jy96nlskwzp3X0X0QmXePok1enp6QhDhHm0YL3a4q7YHd4zjm6mM JUoVR4JJRSKOb1bVdEXqo+qG/PH7/5ywfrGas+MjOshMa3gnhYVee39N7Xtz0pHD 3ZllZRwGwad1sQLL7DhJKZ92z6t2GfHoJyK4LZNemkQAL1HyUu7Hj9SlljcVB+Ub xNnpmBXJcCZzp4nRQM+fbLf6bdZ1ua5DTc1pXC8vETtxyHc53G/vLCu8SKBnTBlK JmkpGwG5fXNuYLL8ArFUuEu3zhE7kfdeftUrEez3YeL2DgU9iB8m8RkuuSrVJEY= =WPH8 -----END PGP SIGNATURE----- . - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200905-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: IPSec Tools: Denial of Service Date: May 24, 2009 Bugs: #267135 ID: 200905-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple errors in the IPSec Tools racoon daemon might allow remote attackers to cause a Denial of Service. Background ========== The IPSec Tools are a port of KAME's IPsec utilities to the Linux-2.6 IPsec implementation. They include racoon, an Internet Key Exchange daemon for automatically keying IPsec connections. * Multiple memory leaks exist in (1) the eay_check_x509sign() function in racoon/crypto_openssl.c and (2) racoon/nattraversal.c (CVE-2009-1632). Workaround ========== There is no known workaround at this time. Resolution ========== All IPSec Tools users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-firewall/ipsec-tools-0.7.2" References ========== [ 1 ] CVE-2009-1574 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1574 [ 2 ] CVE-2009-1632 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1632 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200905-03.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA-1804-1 security@debian.org http://www.debian.org/security/ Nico Golde May 20th, 2009 http://www.debian.org/security/faq - -------------------------------------------------------------------------- Package : ipsec-tools Vulnerability : null pointer dereference, memory leaks Problem type : remote Debian-specific: no Debian bug : 527634 528933 CVE ID : CVE-2009-1574 CVE-2009-1632 Several remote vulnerabilities have been discovered in racoon, the Internet Key Exchange daemon of ipsec-tools. This results in the daemon crashing which can be used for denial of service attacks (CVE-2009-1574). Various memory leaks in the X.509 certificate authentication handling and the NAT-Traversal keepalive implementation can result in memory exhaustion and thus denial of service (CVE-2009-1632). For the oldstable distribution (etch), this problem has been fixed in version 0.6.6-3.1etch3. For the stable distribution (lenny), this problem has been fixed in version 0.7.1-1.3+lenny2. For the testing distribution (squeeze), this problem will be fixed soon. For the unstable distribution (sid), this problem has been fixed in version 1:0.7.1-1.5. We recommend that you upgrade your ipsec-tools packages. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - ------------------------------- Debian (oldstable) - ------------------ Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3.dsc Size/MD5 checksum: 722 8b561cf84ac9c46ec07b037ce3ad06f1 http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3.diff.gz Size/MD5 checksum: 49875 7444fb4ad448ccfffe878801a2b88d2e amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_amd64.deb Size/MD5 checksum: 343790 9cee9f8c479a3a2952d2913d7bdc4c5d http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_amd64.deb Size/MD5 checksum: 89184 5ccd4554eec28da6d933dc20a8a39393 arm architecture (ARM) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_arm.deb Size/MD5 checksum: 325706 9ce7988b74bccee252be7dac7ac8b5f7 http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_arm.deb Size/MD5 checksum: 89748 513ded0e4a33200710444e1bf4ab67d8 hppa architecture (HP PA RISC) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_hppa.deb Size/MD5 checksum: 353066 c56644b426ae945ca420d4ca37fc3f2a http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_hppa.deb Size/MD5 checksum: 94092 80b46b6fd60e857c84c588432b098957 i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_i386.deb Size/MD5 checksum: 330258 b905d30958bd5c51d355f286f81b8be1 http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_i386.deb Size/MD5 checksum: 85046 294ccbc4b51e4942edaeec7cd746dfa3 ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_ia64.deb Size/MD5 checksum: 113356 111f0daa2075584c100efc9c11ecef73 http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_ia64.deb Size/MD5 checksum: 468296 bd4d69b5e0d4ee39ec564e1304f7649c mips architecture (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_mips.deb Size/MD5 checksum: 89018 b6af57d65d43a7433132bee9657ba608 http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_mips.deb Size/MD5 checksum: 344558 aba2d85d5196c2a46555ad9e478d338a mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_mipsel.deb Size/MD5 checksum: 346856 97e04d97bdd55f852392d7461bad7f4d http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_mipsel.deb Size/MD5 checksum: 90308 9e780cda3df3384d0f1e33637d003f21 powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_powerpc.deb Size/MD5 checksum: 91048 98174626d8ad1fba940c81001c337a4f http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_powerpc.deb Size/MD5 checksum: 337266 9f636e6d8904103b0096a4eed99e9cae s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_s390.deb Size/MD5 checksum: 341586 b42ddbad323dcdbd775d502f786ab449 http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_s390.deb Size/MD5 checksum: 90750 62d4c3e618a6c69d532b8d8d33bb27b9 sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.6.6-3.1etch3_sparc.deb Size/MD5 checksum: 85710 9f1f526be4f2df4eb64d46023d87c6b3 http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.6.6-3.1etch3_sparc.deb Size/MD5 checksum: 317136 38e50e9d97b46b51d12429b9ea727858 Debian GNU/Linux 5.0 alias lenny - -------------------------------- Debian (stable) - --------------- Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2.diff.gz Size/MD5 checksum: 49472 4bc8ba2bd520a7514f2c33021c64e8ce http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1.orig.tar.gz Size/MD5 checksum: 1039057 ddff5ec5a06b804ca23dc41268368853 http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2.dsc Size/MD5 checksum: 1144 46d3f28156ee183512a451588ef414e4 alpha architecture (DEC Alpha) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_alpha.deb Size/MD5 checksum: 428532 052c13540da3fab19fdca83e9a389a39 http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_alpha.deb Size/MD5 checksum: 114088 78065dd99d3732291e8d499383af17d9 amd64 architecture (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_amd64.deb Size/MD5 checksum: 409514 a421f12270f5b22639d67be8d2cc8b4e http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_amd64.deb Size/MD5 checksum: 104612 9ec93c697cf64232728d0dd5658efac8 arm architecture (ARM) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_arm.deb Size/MD5 checksum: 104604 78fa45a7e0503e4ee87e7508294cb0b0 http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_arm.deb Size/MD5 checksum: 381692 f1943edf9599189d16a2f936fa971abc armel architecture (ARM EABI) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_armel.deb Size/MD5 checksum: 387510 63ebe895d019d2362a0a11a0de0842c6 http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_armel.deb Size/MD5 checksum: 104268 6c224349c910ffce5bb892f2a06dc243 i386 architecture (Intel ia32) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_i386.deb Size/MD5 checksum: 375004 5a43cbb6106d576ab686e9e4eb78c245 http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_i386.deb Size/MD5 checksum: 99098 6c81df8c4653265f10ad6abf68091329 ia64 architecture (Intel ia64) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_ia64.deb Size/MD5 checksum: 131288 dfa8646655028ae53bddad7f41e9f3a4 http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_ia64.deb Size/MD5 checksum: 544150 8e274b6b73125efe0fa8392398e0c5ea mips architecture (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_mips.deb Size/MD5 checksum: 103502 5bd00dfdef0862a63bb666ed949e26ef http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_mips.deb Size/MD5 checksum: 388820 46fc10315192943b912126fe68ffeea9 mipsel architecture (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_mipsel.deb Size/MD5 checksum: 104216 a271cb33c891084479ed441945672f14 http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_mipsel.deb Size/MD5 checksum: 390562 352f78906e08ddb861053dfed30640bf powerpc architecture (PowerPC) http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_powerpc.deb Size/MD5 checksum: 403162 0210fa37088d78ee9aa53395aa0148e8 http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_powerpc.deb Size/MD5 checksum: 109438 26f043be5fb248d33b605d1987fa472a s390 architecture (IBM S/390) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_s390.deb Size/MD5 checksum: 107474 aa6203b0e9e6dacbe39520be6b849eea http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_s390.deb Size/MD5 checksum: 399386 e965abdcf32838fff7753e789e703205 sparc architecture (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/i/ipsec-tools/ipsec-tools_0.7.1-1.3+lenny2_sparc.deb Size/MD5 checksum: 102486 57b2e115a15e08518f00158c1fe36cf2 http://security.debian.org/pool/updates/main/i/ipsec-tools/racoon_0.7.1-1.3+lenny2_sparc.deb Size/MD5 checksum: 373916 7e2278ac7b4f0b352814ad2f55b1213a These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkoUDnMACgkQHYflSXNkfP8LtgCdF9LmW/TOn9JDPTVGlt+7dccI 3MYAoJVcwmqHztsGgCgBps9hyqzrQJ5l =84V/ -----END PGP SIGNATURE----- . Updated packages are available that brings ipsec-tools to version 0.7.2 for Mandriva Linux 2008.1/2009.0/2009.1 which provides numerous bugfixes over the previous 0.7.1 version, and also corrects this issue. ipsec-tools for Mandriva Linux Corporate Server 4 has been patched to address this issue. Additionally the flex package required for building ipsec-tools has been fixed due to ipsec-tools build problems and is also available with this update. Update: Packages for 2008.0 are being provided due to extended support for Corporate products. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1574 _______________________________________________________________________ Updated Packages: Mandriva Linux 2008.0: 8256debb7fe84394de70499907060de6 2008.0/i586/flex-2.5.33-2.1mdv2008.0.i586.rpm c03c0f9fe8f564ea777b82789ac95f41 2008.0/i586/ipsec-tools-0.7.2-0.1mdv2008.0.i586.rpm 9da2195c693a7fe40f7afb3c5806aaca 2008.0/i586/libipsec0-0.7.2-0.1mdv2008.0.i586.rpm 29dcc9414a59cba30ce801b9fef416a6 2008.0/i586/libipsec-devel-0.7.2-0.1mdv2008.0.i586.rpm b3ceeee8a3a36388d02426b77a45d862 2008.0/SRPMS/flex-2.5.33-2.1mdv2008.0.src.rpm b0cb7993f29eac3d5f170c7cd3cf0cb5 2008.0/SRPMS/ipsec-tools-0.7.2-0.1mdv2008.0.src.rpm Mandriva Linux 2008.0/X86_64: 36c5d0eb92197c814b90c814d21d3372 2008.0/x86_64/flex-2.5.33-2.1mdv2008.0.x86_64.rpm 7a976c988badcb9fae93509acfe99aa2 2008.0/x86_64/ipsec-tools-0.7.2-0.1mdv2008.0.x86_64.rpm 85b8ed6e328b048c13eb503bfee8dcdc 2008.0/x86_64/lib64ipsec0-0.7.2-0.1mdv2008.0.x86_64.rpm a22f34f1cfac38c9029eb032e3257285 2008.0/x86_64/lib64ipsec-devel-0.7.2-0.1mdv2008.0.x86_64.rpm b3ceeee8a3a36388d02426b77a45d862 2008.0/SRPMS/flex-2.5.33-2.1mdv2008.0.src.rpm b0cb7993f29eac3d5f170c7cd3cf0cb5 2008.0/SRPMS/ipsec-tools-0.7.2-0.1mdv2008.0.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. =========================================================== Ubuntu Security Notice USN-785-1 June 09, 2009 ipsec-tools vulnerabilities CVE-2009-1574, CVE-2009-1632 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 8.04 LTS Ubuntu 8.10 Ubuntu 9.04 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: racoon 1:0.6.5-4ubuntu1.3 Ubuntu 8.04 LTS: racoon 1:0.6.7-1.1ubuntu1.2 Ubuntu 8.10: racoon 1:0.7-2.1ubuntu1.8.10.1 Ubuntu 9.04: racoon 1:0.7-2.1ubuntu1.9.04.1 In general, a standard system upgrade is sufficient to effect the necessary changes. (CVE-2009-1574) It was discovered that ipsec-tools did not properly handle memory usage when verifying certificate signatures or processing nat-traversal keep-alive messages