Earlier quoted context omitted.
You're conflating collision attacks like the Flame malware with a preimage attack that would be necessary to produce a malicious Ubuntu release with the same MD5SUM. I.e. what's "broken" about MD5 is if you have a lot of CPU time and I allow you to give me two unrelated blobs, you can craft those blobs to have the same MD5 sum. What's not "broken" (beyond a theoretical 2^123.4 attack) with MD5 and not broken at all f…
What? Pretty sure you're wrong. Yes, MD5 preimage resistance is not broken (to a reasonable degree). If you have the Ubuntu 16.04 ISO (you do), and if you have its hash, the attack to craft a different ISO with the same hash is a collision attack. A preimage attack is if you had some hash y where y=H(x) where x is some file/whatever, and trying to find out possible values of u that give rise to y when you do H(u), wi…
Not having knowledge of x is just one type of preimage attack, a "preimage resistance". You can also know x, then it's a "second-preimage resistance".[1]
Which is not the same as a collision attack. Where you're trying to find x and y such that h(x) = h(y) without anyone specifying x or y in advance.
By definition a collision attack is an attack where you specifically craft both x and y such that they exploit weaknesses in the algorithm.
It's not enough to know an arbitrary x or y that someone else has made, because that value isn't going to be exploiting the weakness.