Details
Maksymilian Arciemowicz discovered that the GNU C library did not
correctly handle integer overflows in the strfmon function. If a user
or automated system were tricked into processing a specially crafted
format string, a remote attacker could crash applications, leading to
a denial of service. (Ubuntu 10.04 was not affected.) (CVE-2008-1391)
Jeff Layton and Dan Rosenberg discovered that the GNU C library did not
correctly handle newlines in the mntent family of functions. If a local
attacker were able to inject newlines into a mount entry through other
vulnerable mount helpers, they could disrupt the system or possibly gain
root privileges. (CVE-2010-0296)
Dan Rosenberg discovered that the GNU C library did not correctly validate
certain ELF program headers. If a user or automated system were tricked
into verifying a specially crafted ELF program,...
Maksymilian Arciemowicz discovered that the GNU C library did not
correctly handle integer overflows in the strfmon function. If a user
or automated system were tricked into processing a specially crafted
format string, a remote attacker could crash applications, leading to
a denial of service. (Ubuntu 10.04 was not affected.) (CVE-2008-1391)
Jeff Layton and Dan Rosenberg discovered that the GNU C library did not
correctly handle newlines in the mntent family of functions. If a local
attacker were able to inject newlines into a mount entry through other
vulnerable mount helpers, they could disrupt the system or possibly gain
root privileges. (CVE-2010-0296)
Dan Rosenberg discovered that the GNU C library did not correctly validate
certain ELF program headers. If a user or automated system were tricked
into verifying a specially crafted ELF program, a remote attacker could
execute arbitrary code with user privileges. (CVE-2010-0830)
Update instructions
After a standard system update you need to restart all services to make the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 9.10 karmic | libc6 – 2.10.1-0ubuntu17 | ||
| 9.04 jaunty | libc6 – 2.9-4ubuntu6.2 | ||
| 8.04 hardy | libc6 – 2.7-10ubuntu6 | ||
| 6.06 dapper | libc6 – 2.3.6-0ubuntu20.6 | ||
| 10.04 lucid | libc6 – 2.11.1-0ubuntu7.1 | ||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.