Ubuntu: Tomboy vulnerability

    Date07 Jan 2008
    CategoryUbuntu
    3507
    Posted ByLinuxSecurity Advisories
    Jan Oravec discovered that Tomboy did not properly setup the LD_LIBRARY_PATH environment variable. A local attacker could exploit this to execute arbitrary code as the user invoking the program.
    =========================================================== 
    Ubuntu Security Notice USN-560-1           January 07, 2008
    tomboy vulnerability
    CVE-2005-4790
    ===========================================================
    
    A security issue affects the following Ubuntu releases:
    
    Ubuntu 6.06 LTS
    Ubuntu 6.10
    Ubuntu 7.04
    Ubuntu 7.10
    
    This advisory also applies to the corresponding versions of
    Kubuntu, Edubuntu, and Xubuntu.
    
    The problem can be corrected by upgrading your system to the
    following package versions:
    
    Ubuntu 6.06 LTS:
      tomboy                          0.3.5-1ubuntu3.1
    
    Ubuntu 6.10:
      tomboy                          0.4.1-0ubuntu3.1
    
    Ubuntu 7.04:
      tomboy                          0.6.3-0ubuntu1.1
    
    Ubuntu 7.10:
      tomboy                          0.8.0-1ubuntu0.1
    
    After a standard system upgrade you need to restart Tomboy to effect
    the necessary changes.
    
    Details follow:
    
    Jan Oravec discovered that Tomboy did not properly setup the
    LD_LIBRARY_PATH environment variable. A local attacker could
    exploit this to execute arbitrary code as the user invoking
    the program.
    
    
    Updated packages for Ubuntu 6.06 LTS:
    
      Source archives:
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.3.5-1ubuntu3.1.diff.gz
          Size/MD5:    23933 6c9f715503954349ea56aeb86da98da6
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.3.5-1ubuntu3.1.dsc
          Size/MD5:      887 67368aeea634e7ea85404c08c7203752
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.3.5.orig.tar.gz
          Size/MD5:   665911 63da1e4c752fa8802b40eb5b4726ff35
    
      amd64 architecture (Athlon64, Opteron, EM64T Xeon):
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.3.5-1ubuntu3.1_amd64.deb
          Size/MD5:   151414 66f0431f00f2b408d36142573e0ae81a
    
      i386 architecture (x86 compatible Intel/AMD):
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.3.5-1ubuntu3.1_i386.deb
          Size/MD5:   148058 20c1fad5297117a6b7a42ce22c542c09
    
      powerpc architecture (Apple Macintosh G3/G4/G5):
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.3.5-1ubuntu3.1_powerpc.deb
          Size/MD5:   149712 314fdc7e7c09989828f867076f3a9916
    
      sparc architecture (Sun SPARC/UltraSPARC):
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.3.5-1ubuntu3.1_sparc.deb
          Size/MD5:   148738 b966585a564a3a8485195ebc445c8811
    
    Updated packages for Ubuntu 6.10:
    
      Source archives:
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.4.1-0ubuntu3.1.diff.gz
          Size/MD5:     7320 9ee233ef334cd4df7ed06ca10f66a29f
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.4.1-0ubuntu3.1.dsc
          Size/MD5:      921 663cff08a633aea0a39432269e702bb5
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.4.1.orig.tar.gz
          Size/MD5:   937041 7e9ab15b8c799d265676173f8a8de7ce
    
      amd64 architecture (Athlon64, Opteron, EM64T Xeon):
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.4.1-0ubuntu3.1_amd64.deb
          Size/MD5:   425900 4e7c700e7997cd0ea9c125d907765b47
    
      i386 architecture (x86 compatible Intel/AMD):
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.4.1-0ubuntu3.1_i386.deb
          Size/MD5:   423536 2233018b7964415d4d92f2226cceacae
    
      powerpc architecture (Apple Macintosh G3/G4/G5):
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.4.1-0ubuntu3.1_powerpc.deb
          Size/MD5:   424412 0658a6b6650b43cca494c6c54bc36a7c
    
      sparc architecture (Sun SPARC/UltraSPARC):
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.4.1-0ubuntu3.1_sparc.deb
          Size/MD5:   422726 279345713a6a1a2aad6f94ba95926a0e
    
    Updated packages for Ubuntu 7.04:
    
      Source archives:
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.6.3-0ubuntu1.1.diff.gz
          Size/MD5:    14285 c99ec66159af23c7c8bf0b34034c010a
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.6.3-0ubuntu1.1.dsc
          Size/MD5:     1142 f7be2cce138282dcadee5df308b756ae
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.6.3.orig.tar.gz
          Size/MD5:  1878094 566af33c4956e05512a57ae7a63c849f
    
      amd64 architecture (Athlon64, Opteron, EM64T Xeon):
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.6.3-0ubuntu1.1_amd64.deb
          Size/MD5:  1198448 78c9f1957ebe8496234fb583ed577909
    
      i386 architecture (x86 compatible Intel/AMD):
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.6.3-0ubuntu1.1_i386.deb
          Size/MD5:  1196104 542d2466b008e9e258dc1cb4375a06f4
    
      powerpc architecture (Apple Macintosh G3/G4/G5):
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.6.3-0ubuntu1.1_powerpc.deb
          Size/MD5:  1200260 58b6d75c2db39bb929f5e1566bee9462
    
      sparc architecture (Sun SPARC/UltraSPARC):
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.6.3-0ubuntu1.1_sparc.deb
          Size/MD5:  1195606 8b2cce4383671a94d02f81f3492cf9f4
    
    Updated packages for Ubuntu 7.10:
    
      Source archives:
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.8.0-1ubuntu0.1.diff.gz
          Size/MD5:    12763 2c560717c1a85b755c88a868a9ae541c
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.8.0-1ubuntu0.1.dsc
          Size/MD5:     1070 4c87625903828c6a5405f75e1a9f4501
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.8.0.orig.tar.gz
          Size/MD5:  2535671 28cf74d74090c7479c5716d8cbe6ed6a
    
      amd64 architecture (Athlon64, Opteron, EM64T Xeon):
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.8.0-1ubuntu0.1_amd64.deb
          Size/MD5:  2392716 7f03c42d8f7f06c413ea1e265582e446
    
      i386 architecture (x86 compatible Intel/AMD):
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.8.0-1ubuntu0.1_i386.deb
          Size/MD5:  2389672 09bb10c6e415f3d5310f4966b7871478
    
      powerpc architecture (Apple Macintosh G3/G4/G5):
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.8.0-1ubuntu0.1_powerpc.deb
          Size/MD5:  2396612 f3be6029861078af5aabb0c39760cbe2
    
      sparc architecture (Sun SPARC/UltraSPARC):
    
        http://security.ubuntu.com/ubuntu/pool/main/t/tomboy/tomboy_0.8.0-1ubuntu0.1_sparc.deb
          Size/MD5:  2388798 0aacedaf7c9a2b32ffa59562651df420
    
    
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"36","type":"x","order":"1","pct":50.7,"resources":[]},{"id":"88","title":"Should be more technical","votes":"10","type":"x","order":"2","pct":14.08,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"25","type":"x","order":"3","pct":35.21,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.