A new rpm vulnerability update is available for Ubuntu Linux. Here the announcement:
Ubuntu Security Notice USN-151-4 November 09, 2005
rpm vulnerability
CVE-2005-1849, CVE-2005-2096
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)
Ubuntu 5.10 (Breezy Badger)
The following packages are affected:
lsb-rpm
The problem can be corrected by upgrading the affected package to
version 4.0.4-28ubuntu2.1 (for Ubuntu 4.10), 4.0.4-29ubuntu1.1 (for
Ubuntu 5.04), or 4.0.4-31ubuntu1.1 (for Ubuntu 5.10). In general, a
standard system upgrade is sufficient to effect the necessary changes.
Details follow:
USN-148-1 and USN-151-1 fixed two security flaws in zlib, which could
be exploited to cause Denial of Service attacks or even arbitrary code
execution with malicious data streams.
Since lsb-rpm is statically linked against the zlib library, it is also
affected by these issues. The updated packagages have been rebuilt
against the fixed zlib.
Please note that lsb-rpm is not officially supported (it is in the "universe"
component of the archive).
Updated packages for Ubuntu 4.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/rpm_4.0.4-28ubuntu2.1.diff.gz
Size/MD5: 104152 3512e5a5982e80eec9c47097c1abcab0
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/rpm_4.0.4-28ubuntu2.1.dsc
Size/MD5: 743 75a216bf04376b2965fdc6f421da9117
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/rpm_4.0.4.orig.tar.gz
Size/MD5: 5865692 b0c3093d2f0d850760e59ac1db9bf152
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/librpm-dev_4.0.4-28ubuntu2.1_amd64.deb
Size/MD5: 484306 8d65173dc64656d07670eb76ef50c48c
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/librpm4_4.0.4-28ubuntu2.1_amd64.deb
Size/MD5: 382618 ab876104c24d65d40a42f4464b2cc2a4
http://security.ubuntu.com/ubuntu/pool/universe/r/rpm/lsb-rpm_4.0.4-28ubuntu2.1_amd64.deb
Size/MD5: 879240 1e904758215537cb71185114d2d2fdce
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/rpm_4.0.4-28ubuntu2.1_amd64.deb
Size/MD5: 519706 be983d50f61cfd0260617aa1a5364686
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/librpm-dev_4.0.4-28ubuntu2.1_i386.deb
Size/MD5: 437176 6b366219315af863fbdaea691badc6e1
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/librpm4_4.0.4-28ubuntu2.1_i386.deb
Size/MD5: 359618 b395c5dc497897b59e64d389b0f06060
http://security.ubuntu.com/ubuntu/pool/universe/r/rpm/lsb-rpm_4.0.4-28ubuntu2.1_i386.deb
Size/MD5: 815882 f4c442e7de8efd84c6f649debcd34200
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/rpm_4.0.4-28ubuntu2.1_i386.deb
Size/MD5: 516424 a16cc0c0303275537df571a683b48c61
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/librpm-dev_4.0.4-28ubuntu2.1_powerpc.deb
Size/MD5: 509710 89a59a25b06bd82d9b279ce44bff12b5
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/librpm4_4.0.4-28ubuntu2.1_powerpc.deb
Size/MD5: 386056 3f02d5ed65df1a5924d0b58f61966e03
http://security.ubuntu.com/ubuntu/pool/universe/r/rpm/lsb-rpm_4.0.4-28ubuntu2.1_powerpc.deb
Size/MD5: 906620 b81695bb99a459690415851b704016b8
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/rpm_4.0.4-28ubuntu2.1_powerpc.deb
Size/MD5: 525366 8a6775242836a0ff0f031508a9b7f1f6
Updated packages for Ubuntu 5.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/rpm_4.0.4-29ubuntu1.1.diff.gz
Size/MD5: 104605 ded8ebf7a2e2f17f3c73eb761b2e688d
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/rpm_4.0.4-29ubuntu1.1.dsc
Size/MD5: 743 6cc9d90aa7fc16b8f4b4bc0943e0999c
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/rpm_4.0.4.orig.tar.gz
Size/MD5: 5865692 b0c3093d2f0d850760e59ac1db9bf152
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/librpm-dev_4.0.4-29ubuntu1.1_amd64.deb
Size/MD5: 484510 031b93a22f11539c77bdde4c7a7fd942
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/librpm4_4.0.4-29ubuntu1.1_amd64.deb
Size/MD5: 382960 f3d2183092c18d4d955dc9f47b8bfd85
http://security.ubuntu.com/ubuntu/pool/universe/r/rpm/lsb-rpm_4.0.4-29ubuntu1.1_amd64.deb
Size/MD5: 917666 fbed813e6386fb855bad364297231dcd
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/rpm_4.0.4-29ubuntu1.1_amd64.deb
Size/MD5: 246620 0d4597422332fe23e596e6843399d5a2
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/librpm-dev_4.0.4-29ubuntu1.1_i386.deb
Size/MD5: 437506 c9d45c2c612849165cb24c4a696b2d99
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/librpm4_4.0.4-29ubuntu1.1_i386.deb
Size/MD5: 360084 62ff35425b9a1282faf601a8b6a42a46
http://security.ubuntu.com/ubuntu/pool/universe/r/rpm/lsb-rpm_4.0.4-29ubuntu1.1_i386.deb
Size/MD5: 817326 f02954eba6d51835d4687ab8f201a94a
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/rpm_4.0.4-29ubuntu1.1_i386.deb
Size/MD5: 242144 3aa62cae004a512e77e5400b4dcdad58
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/librpm-dev_4.0.4-29ubuntu1.1_powerpc.deb
Size/MD5: 510066 f1e4b85c2a191683779cc924713c6089
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/librpm4_4.0.4-29ubuntu1.1_powerpc.deb
Size/MD5: 386662 9ffd067e2f4909b51252fb821e18f918
http://security.ubuntu.com/ubuntu/pool/universe/r/rpm/lsb-rpm_4.0.4-29ubuntu1.1_powerpc.deb
Size/MD5: 892954 d7aede34a0ed6bcc492bbfe264f23d08
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/rpm_4.0.4-29ubuntu1.1_powerpc.deb
Size/MD5: 249702 0aa79e831af41fdf66149a03524ea95f
Updated packages for Ubuntu 5.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/rpm_4.0.4-31ubuntu1.1.diff.gz
Size/MD5: 105623 8e2337bba9b6c8c027bdb68eb75aafc0
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/rpm_4.0.4-31ubuntu1.1.dsc
Size/MD5: 794 d33a163ca10c82c64617b746fb477317
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/rpm_4.0.4.orig.tar.gz
Size/MD5: 5865692 b0c3093d2f0d850760e59ac1db9bf152
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/librpm-dev_4.0.4-31ubuntu1.1_amd64.deb
Size/MD5: 495044 c31549b7e13a14e0893188bf6cb2f6c9
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/librpm4_4.0.4-31ubuntu1.1_amd64.deb
Size/MD5: 394174 c7c3a20b9e7fbb06a289db6f364fd6a6
http://security.ubuntu.com/ubuntu/pool/universe/r/rpm/lsb-rpm_4.0.4-31ubuntu1.1_amd64.deb
Size/MD5: 983332 f33776b4ce3d03ef05df2ce3c0506189
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/rpm_4.0.4-31ubuntu1.1_amd64.deb
Size/MD5: 246344 218b855da8afb60b9cb0b8c080593820
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/librpm-dev_4.0.4-31ubuntu1.1_i386.deb
Size/MD5: 437468 303a7fcf82954da89bd2cee396ce6ba6
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/librpm4_4.0.4-31ubuntu1.1_i386.deb
Size/MD5: 362410 35532ce8b4cdcdce6ae2408bda1384fa
http://security.ubuntu.com/ubuntu/pool/universe/r/rpm/lsb-rpm_4.0.4-31ubuntu1.1_i386.deb
Size/MD5: 841566 88c9fa9c782451462f2d2b94d8b73431
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/rpm_4.0.4-31ubuntu1.1_i386.deb
Size/MD5: 242302 a6fc5dd5819b6f76431e32e095d9e971
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/librpm-dev_4.0.4-31ubuntu1.1_powerpc.deb
Size/MD5: 505094 82125d87ee950a5445d123cc487513df
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/librpm4_4.0.4-31ubuntu1.1_powerpc.deb
Size/MD5: 385584 6871ddddccc683c0e2c37aec8426850b
http://security.ubuntu.com/ubuntu/pool/universe/r/rpm/lsb-rpm_4.0.4-31ubuntu1.1_powerpc.deb
Size/MD5: 1015290 c34ad68589b0eebaba5b99c6f1ee95f5
http://security.ubuntu.com/ubuntu/pool/main/r/rpm/rpm_4.0.4-31ubuntu1.1_powerpc.deb
Size/MD5: 250512 dcea419a1d0640e65d4889d392b8353e
--Q68bSM7Ycu6FN28Q
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFDcj4xDecnbV4Fd/IRAkJ+AJ401gRgaMp2wB4u/4Wzher6y2ojfgCeO1/3
XAcKOZOKzjFflUeYGNJqgsw=
=kzD7
-----END PGP SIGNATURE-----
