Update: the official ubuntu security advisory is here:
http://www.ubuntu.com/usn/usn-262-1
and secunia has a writeup here:
http://secunia.com/advisories/19200/

Thanks Juha-Matti!

----------------

https://launchpad.net/distros/ubuntu/+bug/34606

  * Tidy up after Malone bug #34606, which left passwords exposed in
    /var/log/installer/cdebconf/questions.dat, by removing those passwords;
    for good measure, make /var/log/installer/cdebconf/* world-unreadable if
    this bug is detected.

Cheers,

Adrien