Ubuntu 12.04 LTS USN-1546-1 Critical: libgc Integer Overflow Attack

ubuntu

August 28, 2012

Applications using libgc could be made to crash or run arbitraryprograms as your login.

Summary

Applications using libgc could be made to crash or run arbitrary

programs as your login.

Software Description:

- libgc: Boehm-Demers-Weiser garbage collecting storage allocator library

Details:

It was discovered that multiple integer overflows existed in the

malloc and calloc implementations in the Boehm-Demers-Weiser garbage

collecting memory allocator (libgc). These could allow an attacker

to cause a denial of service or possibly execute arbitrary code.

Topics Covered

security advisory denial of service critical arbitrary code execution ubuntu libgc

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  libgc1c2                        1:7.1-8ubuntu0.12.04.1

Ubuntu 11.10:
  libgc1c2                        1:7.1-8ubuntu0.11.10.1

Ubuntu 11.04:
  libgc1c2                        1:6.8-1.2ubuntu3.2

Ubuntu 10.04 LTS:
  libgc1c2                        1:6.8-1.2ubuntu1.1

Ubuntu 8.04 LTS:
  libgc1c2                        1:6.8-1.1ubuntu0.1

In general, a standard system update will make all the necessary changes.