Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1620-2] Thunderbird vulnerabilities (Micah Gersten)
----------------------------------------------------------------------
Message: 1
Date: Tue, 30 Oct 2012 02:30:58 +0100
From: Micah Gersten <micah@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1620-2] Thunderbird vulnerabilities
Message-ID: <508F2DD2.3020201@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-1620-2
October 30, 2012
thunderbird vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in Thunderbird.
Software Description:
- thunderbird: Mozilla Open Source mail and newsgroup client
Details:
USN-1620-1 fixed vulnerabilities in Firefox. This update provides the
corresponding updates for Thunderbird. Please note that Thunderbird is only
affected by window.location issues through RSS feeds and extensions that
load web content.
Original advisory details:
Mariusz Mlynski and others discovered several flaws in Firefox that allowed
a remote attacker to conduct cross-site scripting (XSS) attacks.
(CVE-2012-4194, CVE-2012-4195)
Antoine Delignat-Lavaud discovered a flaw in the way Firefox handled the
Location object. If a user were tricked into opening a specially crafted
page, a remote attacker could exploit this to bypass security protections
and perform cross-origin reading of the Location object. (CVE-2012-4196)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.10:
thunderbird 16.0.2+build1-0ubuntu0.12.10.1
Ubuntu 12.04 LTS:
thunderbird 16.0.2+build1-0ubuntu0.12.04.1
Ubuntu 11.10:
thunderbird 16.0.2+build1-0ubuntu0.11.10.1
Ubuntu 10.04 LTS:
thunderbird 16.0.2+build1-0ubuntu0.10.04.1
After a standard system update you need to restart Thunderbird to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1620-2
http://www.ubuntu.com/usn/usn-1620-1
CVE-2012-4194, CVE-2012-4195, CVE-2012-4196, https://launchpad.net/bugs/1072362
Package Information:
https://launchpad.net/ubuntu/+source/thunderbird/16.0.2+build1-0ubuntu0.12.10.1
https://launchpad.net/ubuntu/+source/thunderbird/16.0.2+build1-0ubuntu0.12.04.1
https://launchpad.net/ubuntu/+source/thunderbird/16.0.2+build1-0ubuntu0.11.10.1
https://launchpad.net/ubuntu/+source/thunderbird/16.0.2+build1-0ubuntu0.10.04.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121030/0a7337f5/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 19
********************************************************
Tuesday, October 30, 2012
Monday, October 29, 2012
ubuntu-security-announce Digest, Vol 97, Issue 18
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. Ubuntu 11.04 (Natty Narwhal) end-of-life reached on October
28, 2012 (Kate Stewart)
----------------------------------------------------------------------
Message: 1
Date: Sun, 28 Oct 2012 11:24:47 -0500
From: Kate Stewart <kate.stewart@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com,
ubuntu-announce@lists.ubuntu.com
Cc: ubuntu-release@lists.ubuntu.com
Subject: Ubuntu 11.04 (Natty Narwhal) end-of-life reached on October
28, 2012
Message-ID: <1351441488.14862.106.camel@veni>
Content-Type: text/plain; charset="UTF-8"
This note is just to confirm that the support period for Ubuntu 11.04
(Natty Narwhal) formally ends on October 28, 2012 and Ubuntu Security
Notices no longer includes information or updated packages for
Ubuntu 11.04.
The supported upgrade path from Ubuntu 11.04 is via Ubuntu 11.10
(Oneiric Ocelot). Instructions and caveats for the upgrade may be
found at https://help.ubuntu.com/community/OneiricUpgrades. Note
that upgrades to version 11.10 and beyond are only supported in
multiple steps, via an upgrade first to 11.10, then to 12.04.
Both Ubuntu 11.10 and Ubuntu 12.04 continue to be actively
supported with security updates and select high-impact bug fixes.
All announcements of official security updates for Ubuntu releases
are sent to the ubuntu-security-announce mailing list, information
about which may be found at:
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce.
Since its launch in October 2004 Ubuntu has become one of the most
highly regarded Linux distributions with millions of users in homes,
schools, businesses and governments around the world. Ubuntu is Open
Source software, costs nothing to download, and users are free to
customize or alter their software in order to meet their needs.
on behalf of the Release Team,
Kate Stewart
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 18
********************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. Ubuntu 11.04 (Natty Narwhal) end-of-life reached on October
28, 2012 (Kate Stewart)
----------------------------------------------------------------------
Message: 1
Date: Sun, 28 Oct 2012 11:24:47 -0500
From: Kate Stewart <kate.stewart@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com,
ubuntu-announce@lists.ubuntu.com
Cc: ubuntu-release@lists.ubuntu.com
Subject: Ubuntu 11.04 (Natty Narwhal) end-of-life reached on October
28, 2012
Message-ID: <1351441488.14862.106.camel@veni>
Content-Type: text/plain; charset="UTF-8"
This note is just to confirm that the support period for Ubuntu 11.04
(Natty Narwhal) formally ends on October 28, 2012 and Ubuntu Security
Notices no longer includes information or updated packages for
Ubuntu 11.04.
The supported upgrade path from Ubuntu 11.04 is via Ubuntu 11.10
(Oneiric Ocelot). Instructions and caveats for the upgrade may be
found at https://help.ubuntu.com/community/OneiricUpgrades. Note
that upgrades to version 11.10 and beyond are only supported in
multiple steps, via an upgrade first to 11.10, then to 12.04.
Both Ubuntu 11.10 and Ubuntu 12.04 continue to be actively
supported with security updates and select high-impact bug fixes.
All announcements of official security updates for Ubuntu releases
are sent to the ubuntu-security-announce mailing list, information
about which may be found at:
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce.
Since its launch in October 2004 Ubuntu has become one of the most
highly regarded Linux distributions with millions of users in homes,
schools, businesses and governments around the world. Ubuntu is Open
Source software, costs nothing to download, and users are free to
customize or alter their software in order to meet their needs.
on behalf of the Release Team,
Kate Stewart
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 18
********************************************************
Saturday, October 27, 2012
ubuntu-security-announce Digest, Vol 97, Issue 17
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1618-1] Exim vulnerability (Marc Deslauriers)
2. [USN-1619-1] OpenJDK vulnerabilities (Jamie Strandboge)
3. [USN-1620-1] Firefox vulnerabilities (Jamie Strandboge)
----------------------------------------------------------------------
Message: 1
Date: Fri, 26 Oct 2012 08:19:42 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1618-1] Exim vulnerability
Message-ID: <508A7FDE.2050404@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1618-1
October 26, 2012
exim4 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Exim could be made to run programs if it received specially crafted network
traffic.
Software Description:
- exim4: Exim is a mail transport agent
Details:
It was discovered that Exim incorrectly handled DKIM DNS decoding. This
flaw could allow a remote attacker to execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.10:
exim4-daemon-custom 4.80-3ubuntu1.1
exim4-daemon-heavy 4.80-3ubuntu1.1
exim4-daemon-light 4.80-3ubuntu1.1
Ubuntu 12.04 LTS:
exim4-daemon-custom 4.76-3ubuntu3.1
exim4-daemon-heavy 4.76-3ubuntu3.1
exim4-daemon-light 4.76-3ubuntu3.1
Ubuntu 11.10:
exim4-daemon-custom 4.76-2ubuntu1.1
exim4-daemon-heavy 4.76-2ubuntu1.1
exim4-daemon-light 4.76-2ubuntu1.1
Ubuntu 11.04:
exim4-daemon-custom 4.74-1ubuntu1.3
exim4-daemon-heavy 4.74-1ubuntu1.3
exim4-daemon-light 4.74-1ubuntu1.3
Ubuntu 10.04 LTS:
exim4-daemon-custom 4.71-3ubuntu1.4
exim4-daemon-heavy 4.71-3ubuntu1.4
exim4-daemon-light 4.71-3ubuntu1.4
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1618-1
CVE-2012-5671
Package Information:
https://launchpad.net/ubuntu/+source/exim4/4.80-3ubuntu1.1
https://launchpad.net/ubuntu/+source/exim4/4.76-3ubuntu3.1
https://launchpad.net/ubuntu/+source/exim4/4.76-2ubuntu1.1
https://launchpad.net/ubuntu/+source/exim4/4.74-1ubuntu1.3
https://launchpad.net/ubuntu/+source/exim4/4.71-3ubuntu1.4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121026/14dd2cba/attachment-0001.pgp>
------------------------------
Message: 2
Date: Fri, 26 Oct 2012 11:05:00 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1619-1] OpenJDK vulnerabilities
Message-ID: <508AB4AC.4000904@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1619-1
October 26, 2012
openjdk-6, openjdk-7 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in OpenJDK.
Software Description:
- openjdk-7: Open Source Java implementation
- openjdk-6: Open Source Java implementation
Details:
Several information disclosure vulnerabilities were discovered in the
OpenJDK JRE. (CVE-2012-3216, CVE-2012-5069, CVE-2012-5072, CVE-2012-5075,
CVE-2012-5077, CVE-2012-5085)
Vulnerabilities were discovered in the OpenJDK JRE related to information
disclosure and data integrity. (CVE-2012-4416, CVE-2012-5071)
Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure and data integrity. An attacker could exploit these
to cause a denial of service. (CVE-2012-1531, CVE-2012-1532, CVE-2012-1533,
CVE-2012-3143, CVE-2012-3159, CVE-2012-5068, CVE-2012-5083, CVE-2012-5084,
CVE-2012-5086, CVE-2012-5089)
Information disclosure vulnerabilities were discovered in the OpenJDK JRE.
These issues only affected Ubuntu 12.10. (CVE-2012-5067, CVE-2012-5070)
Vulnerabilities were discovered in the OpenJDK JRE related to data
integrity. (CVE-2012-5073, CVE-2012-5079)
A vulnerability was discovered in the OpenJDK JRE related to information
disclosure and data integrity. This issue only affected Ubuntu 12.10.
(CVE-2012-5074)
Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure and data integrity. An attacker could exploit these
to cause a denial of service. These issues only affected Ubuntu 12.10.
(CVE-2012-5076, CVE-2012-5087, CVE-2012-5088)
A denial of service vulnerability was found in OpenJDK. (CVE-2012-5081)
Please see the following for more information:
http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.10:
icedtea-7-jre-cacao 7u9-2.3.3-0ubuntu1~12.10.1
icedtea-7-jre-jamvm 7u9-2.3.3-0ubuntu1~12.10.1
openjdk-7-jre 7u9-2.3.3-0ubuntu1~12.10.1
openjdk-7-jre-headless 7u9-2.3.3-0ubuntu1~12.10.1
openjdk-7-jre-lib 7u9-2.3.3-0ubuntu1~12.10.1
openjdk-7-jre-zero 7u9-2.3.3-0ubuntu1~12.10.1
Ubuntu 12.04 LTS:
icedtea-6-jre-cacao 6b24-1.11.5-0ubuntu1~12.04.1
icedtea-6-jre-jamvm 6b24-1.11.5-0ubuntu1~12.04.1
openjdk-6-jre 6b24-1.11.5-0ubuntu1~12.04.1
openjdk-6-jre-headless 6b24-1.11.5-0ubuntu1~12.04.1
openjdk-6-jre-lib 6b24-1.11.5-0ubuntu1~12.04.1
openjdk-6-jre-zero 6b24-1.11.5-0ubuntu1~12.04.1
Ubuntu 11.10:
icedtea-6-jre-cacao 6b24-1.11.5-0ubuntu1~11.10.1
icedtea-6-jre-jamvm 6b24-1.11.5-0ubuntu1~11.10.1
openjdk-6-jre 6b24-1.11.5-0ubuntu1~11.10.1
openjdk-6-jre-headless 6b24-1.11.5-0ubuntu1~11.10.1
openjdk-6-jre-lib 6b24-1.11.5-0ubuntu1~11.10.1
openjdk-6-jre-zero 6b24-1.11.5-0ubuntu1~11.10.1
Ubuntu 11.04:
icedtea-6-jre-cacao 6b24-1.11.5-0ubuntu1~11.04.1
icedtea-6-jre-jamvm 6b24-1.11.5-0ubuntu1~11.04.1
openjdk-6-jre 6b24-1.11.5-0ubuntu1~11.04.1
openjdk-6-jre-headless 6b24-1.11.5-0ubuntu1~11.04.1
openjdk-6-jre-lib 6b24-1.11.5-0ubuntu1~11.04.1
openjdk-6-jre-zero 6b24-1.11.5-0ubuntu1~11.04.1
Ubuntu 10.04 LTS:
icedtea-6-jre-cacao 6b24-1.11.5-0ubuntu1~10.04.2
openjdk-6-jre 6b24-1.11.5-0ubuntu1~10.04.2
openjdk-6-jre-headless 6b24-1.11.5-0ubuntu1~10.04.2
openjdk-6-jre-lib 6b24-1.11.5-0ubuntu1~10.04.2
openjdk-6-jre-zero 6b24-1.11.5-0ubuntu1~10.04.2
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications or applets to make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1619-1
CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-3143,
CVE-2012-3159, CVE-2012-3216, CVE-2012-4416, CVE-2012-5067,
CVE-2012-5068, CVE-2012-5069, CVE-2012-5070, CVE-2012-5071,
CVE-2012-5072, CVE-2012-5073, CVE-2012-5074, CVE-2012-5075,
CVE-2012-5076, CVE-2012-5077, CVE-2012-5079, CVE-2012-5081,
CVE-2012-5083, CVE-2012-5084, CVE-2012-5085, CVE-2012-5086,
CVE-2012-5087, CVE-2012-5088, CVE-2012-5089
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-7/7u9-2.3.3-0ubuntu1~12.10.1
https://launchpad.net/ubuntu/+source/openjdk-6/6b24-1.11.5-0ubuntu1~12.04.1
https://launchpad.net/ubuntu/+source/openjdk-6/6b24-1.11.5-0ubuntu1~11.10.1
https://launchpad.net/ubuntu/+source/openjdk-6/6b24-1.11.5-0ubuntu1~11.04.1
https://launchpad.net/ubuntu/+source/openjdk-6/6b24-1.11.5-0ubuntu1~10.04.2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121026/ed05be28/attachment-0001.pgp>
------------------------------
Message: 3
Date: Fri, 26 Oct 2012 16:37:17 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1620-1] Firefox vulnerabilities
Message-ID: <508B028D.6060405@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1620-1
October 26, 2012
firefox vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in Firefox.
Software Description:
- firefox: Mozilla Open Source web browser
Details:
Mariusz Mlynski and others discovered several flaws in Firefox that allowed
a remote attacker to conduct cross-site scripting (XSS) attacks.
(CVE-2012-4194, CVE-2012-4195)
Antoine Delignat-Lavaud discovered a flaw in the way Firefox handled the
Location object. If a user were tricked into opening a specially crafted
page, a remote attacker could exploit this to bypass security protections
and perform cross-origin reading of the Location object. (CVE-2012-4196)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.10:
firefox 16.0.2+build1-0ubuntu0.12.10.1
Ubuntu 12.04 LTS:
firefox 16.0.2+build1-0ubuntu0.12.04.1
Ubuntu 11.10:
firefox 16.0.2+build1-0ubuntu0.11.10.1
Ubuntu 11.04:
firefox 16.0.2+build1-0ubuntu0.11.04.1
Ubuntu 10.04 LTS:
firefox 16.0.2+build1-0ubuntu0.10.04.1
After a standard system update you need to restart Firefox to make all the
necessary changes.
References:
http://www.ubuntu.com/usn/usn-1620-1
CVE-2012-4194, CVE-2012-4195, CVE-2012-4196
Package Information:
https://launchpad.net/ubuntu/+source/firefox/16.0.2+build1-0ubuntu0.12.10.1
https://launchpad.net/ubuntu/+source/firefox/16.0.2+build1-0ubuntu0.12.04.1
https://launchpad.net/ubuntu/+source/firefox/16.0.2+build1-0ubuntu0.11.10.1
https://launchpad.net/ubuntu/+source/firefox/16.0.2+build1-0ubuntu0.11.04.1
https://launchpad.net/ubuntu/+source/firefox/16.0.2+build1-0ubuntu0.10.04.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121026/5451d71d/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 17
********************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1618-1] Exim vulnerability (Marc Deslauriers)
2. [USN-1619-1] OpenJDK vulnerabilities (Jamie Strandboge)
3. [USN-1620-1] Firefox vulnerabilities (Jamie Strandboge)
----------------------------------------------------------------------
Message: 1
Date: Fri, 26 Oct 2012 08:19:42 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1618-1] Exim vulnerability
Message-ID: <508A7FDE.2050404@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1618-1
October 26, 2012
exim4 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Exim could be made to run programs if it received specially crafted network
traffic.
Software Description:
- exim4: Exim is a mail transport agent
Details:
It was discovered that Exim incorrectly handled DKIM DNS decoding. This
flaw could allow a remote attacker to execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.10:
exim4-daemon-custom 4.80-3ubuntu1.1
exim4-daemon-heavy 4.80-3ubuntu1.1
exim4-daemon-light 4.80-3ubuntu1.1
Ubuntu 12.04 LTS:
exim4-daemon-custom 4.76-3ubuntu3.1
exim4-daemon-heavy 4.76-3ubuntu3.1
exim4-daemon-light 4.76-3ubuntu3.1
Ubuntu 11.10:
exim4-daemon-custom 4.76-2ubuntu1.1
exim4-daemon-heavy 4.76-2ubuntu1.1
exim4-daemon-light 4.76-2ubuntu1.1
Ubuntu 11.04:
exim4-daemon-custom 4.74-1ubuntu1.3
exim4-daemon-heavy 4.74-1ubuntu1.3
exim4-daemon-light 4.74-1ubuntu1.3
Ubuntu 10.04 LTS:
exim4-daemon-custom 4.71-3ubuntu1.4
exim4-daemon-heavy 4.71-3ubuntu1.4
exim4-daemon-light 4.71-3ubuntu1.4
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1618-1
CVE-2012-5671
Package Information:
https://launchpad.net/ubuntu/+source/exim4/4.80-3ubuntu1.1
https://launchpad.net/ubuntu/+source/exim4/4.76-3ubuntu3.1
https://launchpad.net/ubuntu/+source/exim4/4.76-2ubuntu1.1
https://launchpad.net/ubuntu/+source/exim4/4.74-1ubuntu1.3
https://launchpad.net/ubuntu/+source/exim4/4.71-3ubuntu1.4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121026/14dd2cba/attachment-0001.pgp>
------------------------------
Message: 2
Date: Fri, 26 Oct 2012 11:05:00 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1619-1] OpenJDK vulnerabilities
Message-ID: <508AB4AC.4000904@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1619-1
October 26, 2012
openjdk-6, openjdk-7 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in OpenJDK.
Software Description:
- openjdk-7: Open Source Java implementation
- openjdk-6: Open Source Java implementation
Details:
Several information disclosure vulnerabilities were discovered in the
OpenJDK JRE. (CVE-2012-3216, CVE-2012-5069, CVE-2012-5072, CVE-2012-5075,
CVE-2012-5077, CVE-2012-5085)
Vulnerabilities were discovered in the OpenJDK JRE related to information
disclosure and data integrity. (CVE-2012-4416, CVE-2012-5071)
Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure and data integrity. An attacker could exploit these
to cause a denial of service. (CVE-2012-1531, CVE-2012-1532, CVE-2012-1533,
CVE-2012-3143, CVE-2012-3159, CVE-2012-5068, CVE-2012-5083, CVE-2012-5084,
CVE-2012-5086, CVE-2012-5089)
Information disclosure vulnerabilities were discovered in the OpenJDK JRE.
These issues only affected Ubuntu 12.10. (CVE-2012-5067, CVE-2012-5070)
Vulnerabilities were discovered in the OpenJDK JRE related to data
integrity. (CVE-2012-5073, CVE-2012-5079)
A vulnerability was discovered in the OpenJDK JRE related to information
disclosure and data integrity. This issue only affected Ubuntu 12.10.
(CVE-2012-5074)
Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure and data integrity. An attacker could exploit these
to cause a denial of service. These issues only affected Ubuntu 12.10.
(CVE-2012-5076, CVE-2012-5087, CVE-2012-5088)
A denial of service vulnerability was found in OpenJDK. (CVE-2012-5081)
Please see the following for more information:
http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.10:
icedtea-7-jre-cacao 7u9-2.3.3-0ubuntu1~12.10.1
icedtea-7-jre-jamvm 7u9-2.3.3-0ubuntu1~12.10.1
openjdk-7-jre 7u9-2.3.3-0ubuntu1~12.10.1
openjdk-7-jre-headless 7u9-2.3.3-0ubuntu1~12.10.1
openjdk-7-jre-lib 7u9-2.3.3-0ubuntu1~12.10.1
openjdk-7-jre-zero 7u9-2.3.3-0ubuntu1~12.10.1
Ubuntu 12.04 LTS:
icedtea-6-jre-cacao 6b24-1.11.5-0ubuntu1~12.04.1
icedtea-6-jre-jamvm 6b24-1.11.5-0ubuntu1~12.04.1
openjdk-6-jre 6b24-1.11.5-0ubuntu1~12.04.1
openjdk-6-jre-headless 6b24-1.11.5-0ubuntu1~12.04.1
openjdk-6-jre-lib 6b24-1.11.5-0ubuntu1~12.04.1
openjdk-6-jre-zero 6b24-1.11.5-0ubuntu1~12.04.1
Ubuntu 11.10:
icedtea-6-jre-cacao 6b24-1.11.5-0ubuntu1~11.10.1
icedtea-6-jre-jamvm 6b24-1.11.5-0ubuntu1~11.10.1
openjdk-6-jre 6b24-1.11.5-0ubuntu1~11.10.1
openjdk-6-jre-headless 6b24-1.11.5-0ubuntu1~11.10.1
openjdk-6-jre-lib 6b24-1.11.5-0ubuntu1~11.10.1
openjdk-6-jre-zero 6b24-1.11.5-0ubuntu1~11.10.1
Ubuntu 11.04:
icedtea-6-jre-cacao 6b24-1.11.5-0ubuntu1~11.04.1
icedtea-6-jre-jamvm 6b24-1.11.5-0ubuntu1~11.04.1
openjdk-6-jre 6b24-1.11.5-0ubuntu1~11.04.1
openjdk-6-jre-headless 6b24-1.11.5-0ubuntu1~11.04.1
openjdk-6-jre-lib 6b24-1.11.5-0ubuntu1~11.04.1
openjdk-6-jre-zero 6b24-1.11.5-0ubuntu1~11.04.1
Ubuntu 10.04 LTS:
icedtea-6-jre-cacao 6b24-1.11.5-0ubuntu1~10.04.2
openjdk-6-jre 6b24-1.11.5-0ubuntu1~10.04.2
openjdk-6-jre-headless 6b24-1.11.5-0ubuntu1~10.04.2
openjdk-6-jre-lib 6b24-1.11.5-0ubuntu1~10.04.2
openjdk-6-jre-zero 6b24-1.11.5-0ubuntu1~10.04.2
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications or applets to make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1619-1
CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-3143,
CVE-2012-3159, CVE-2012-3216, CVE-2012-4416, CVE-2012-5067,
CVE-2012-5068, CVE-2012-5069, CVE-2012-5070, CVE-2012-5071,
CVE-2012-5072, CVE-2012-5073, CVE-2012-5074, CVE-2012-5075,
CVE-2012-5076, CVE-2012-5077, CVE-2012-5079, CVE-2012-5081,
CVE-2012-5083, CVE-2012-5084, CVE-2012-5085, CVE-2012-5086,
CVE-2012-5087, CVE-2012-5088, CVE-2012-5089
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-7/7u9-2.3.3-0ubuntu1~12.10.1
https://launchpad.net/ubuntu/+source/openjdk-6/6b24-1.11.5-0ubuntu1~12.04.1
https://launchpad.net/ubuntu/+source/openjdk-6/6b24-1.11.5-0ubuntu1~11.10.1
https://launchpad.net/ubuntu/+source/openjdk-6/6b24-1.11.5-0ubuntu1~11.04.1
https://launchpad.net/ubuntu/+source/openjdk-6/6b24-1.11.5-0ubuntu1~10.04.2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121026/ed05be28/attachment-0001.pgp>
------------------------------
Message: 3
Date: Fri, 26 Oct 2012 16:37:17 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1620-1] Firefox vulnerabilities
Message-ID: <508B028D.6060405@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1620-1
October 26, 2012
firefox vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in Firefox.
Software Description:
- firefox: Mozilla Open Source web browser
Details:
Mariusz Mlynski and others discovered several flaws in Firefox that allowed
a remote attacker to conduct cross-site scripting (XSS) attacks.
(CVE-2012-4194, CVE-2012-4195)
Antoine Delignat-Lavaud discovered a flaw in the way Firefox handled the
Location object. If a user were tricked into opening a specially crafted
page, a remote attacker could exploit this to bypass security protections
and perform cross-origin reading of the Location object. (CVE-2012-4196)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.10:
firefox 16.0.2+build1-0ubuntu0.12.10.1
Ubuntu 12.04 LTS:
firefox 16.0.2+build1-0ubuntu0.12.04.1
Ubuntu 11.10:
firefox 16.0.2+build1-0ubuntu0.11.10.1
Ubuntu 11.04:
firefox 16.0.2+build1-0ubuntu0.11.04.1
Ubuntu 10.04 LTS:
firefox 16.0.2+build1-0ubuntu0.10.04.1
After a standard system update you need to restart Firefox to make all the
necessary changes.
References:
http://www.ubuntu.com/usn/usn-1620-1
CVE-2012-4194, CVE-2012-4195, CVE-2012-4196
Package Information:
https://launchpad.net/ubuntu/+source/firefox/16.0.2+build1-0ubuntu0.12.10.1
https://launchpad.net/ubuntu/+source/firefox/16.0.2+build1-0ubuntu0.12.04.1
https://launchpad.net/ubuntu/+source/firefox/16.0.2+build1-0ubuntu0.11.10.1
https://launchpad.net/ubuntu/+source/firefox/16.0.2+build1-0ubuntu0.11.04.1
https://launchpad.net/ubuntu/+source/firefox/16.0.2+build1-0ubuntu0.10.04.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121026/5451d71d/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 17
********************************************************
Friday, October 26, 2012
ubuntu-security-announce Digest, Vol 97, Issue 16
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1617-1] WebKit vulnerabilities (Micah Gersten)
----------------------------------------------------------------------
Message: 1
Date: Thu, 25 Oct 2012 12:35:22 -0500
From: Micah Gersten <micah@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1617-1] WebKit vulnerabilities
Message-ID: <5089785A.1040507@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-1617-1
October 25, 2012
webkit vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
Multiple security vulnerabilities were fixed in WebKit.
Software Description:
- webkit: Web content engine library for GTK+
Details:
A large number of security issues were discovered in the WebKit browser and
JavaScript engines. If a user were tricked into viewing a malicious
website, a remote attacker could exploit a variety of issues related to web
browser security, including cross-site scripting attacks, denial of
service attacks, and arbitrary code execution.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
libjavascriptcoregtk-1.0-0 1.8.3-0ubuntu0.12.04.1
libjavascriptcoregtk-3.0-0 1.8.3-0ubuntu0.12.04.1
libwebkitgtk-1.0-0 1.8.3-0ubuntu0.12.04.1
libwebkitgtk-3.0-0 1.8.3-0ubuntu0.12.04.1
After a standard system update you need to restart your session to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1617-1
CVE-2011-3031, CVE-2011-3038, CVE-2011-3042, CVE-2011-3043,
CVE-2011-3044, CVE-2011-3051, CVE-2011-3053, CVE-2011-3059,
CVE-2011-3060, CVE-2011-3064, CVE-2011-3067, CVE-2011-3076,
CVE-2011-3081, CVE-2011-3086, CVE-2011-3090, CVE-2012-1521,
CVE-2012-3598, CVE-2012-3601, CVE-2012-3604, CVE-2012-3611,
CVE-2012-3612, CVE-2012-3617, CVE-2012-3625, CVE-2012-3626,
CVE-2012-3627, CVE-2012-3628, CVE-2012-3645, CVE-2012-3652,
CVE-2012-3657, CVE-2012-3669, CVE-2012-3670, CVE-2012-3671,
CVE-2012-3672, CVE-2012-3674, CVE-2012-3674, https://launchpad.net/bugs/1058339
Package Information:
https://launchpad.net/ubuntu/+source/webkit/1.8.3-0ubuntu0.12.04.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121025/5d4c43bd/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 16
********************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1617-1] WebKit vulnerabilities (Micah Gersten)
----------------------------------------------------------------------
Message: 1
Date: Thu, 25 Oct 2012 12:35:22 -0500
From: Micah Gersten <micah@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1617-1] WebKit vulnerabilities
Message-ID: <5089785A.1040507@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-1617-1
October 25, 2012
webkit vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
Multiple security vulnerabilities were fixed in WebKit.
Software Description:
- webkit: Web content engine library for GTK+
Details:
A large number of security issues were discovered in the WebKit browser and
JavaScript engines. If a user were tricked into viewing a malicious
website, a remote attacker could exploit a variety of issues related to web
browser security, including cross-site scripting attacks, denial of
service attacks, and arbitrary code execution.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
libjavascriptcoregtk-1.0-0 1.8.3-0ubuntu0.12.04.1
libjavascriptcoregtk-3.0-0 1.8.3-0ubuntu0.12.04.1
libwebkitgtk-1.0-0 1.8.3-0ubuntu0.12.04.1
libwebkitgtk-3.0-0 1.8.3-0ubuntu0.12.04.1
After a standard system update you need to restart your session to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1617-1
CVE-2011-3031, CVE-2011-3038, CVE-2011-3042, CVE-2011-3043,
CVE-2011-3044, CVE-2011-3051, CVE-2011-3053, CVE-2011-3059,
CVE-2011-3060, CVE-2011-3064, CVE-2011-3067, CVE-2011-3076,
CVE-2011-3081, CVE-2011-3086, CVE-2011-3090, CVE-2012-1521,
CVE-2012-3598, CVE-2012-3601, CVE-2012-3604, CVE-2012-3611,
CVE-2012-3612, CVE-2012-3617, CVE-2012-3625, CVE-2012-3626,
CVE-2012-3627, CVE-2012-3628, CVE-2012-3645, CVE-2012-3652,
CVE-2012-3657, CVE-2012-3669, CVE-2012-3670, CVE-2012-3671,
CVE-2012-3672, CVE-2012-3674, CVE-2012-3674, https://launchpad.net/bugs/1058339
Package Information:
https://launchpad.net/ubuntu/+source/webkit/1.8.3-0ubuntu0.12.04.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121025/5d4c43bd/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 16
********************************************************
Thursday, October 25, 2012
ubuntu-security-announce Digest, Vol 97, Issue 15
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1616-1] Python 3.1 vulnerabilities (Jamie Strandboge)
----------------------------------------------------------------------
Message: 1
Date: Wed, 24 Oct 2012 12:04:38 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1616-1] Python 3.1 vulnerabilities
Message-ID: <50881FA6.3000702@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1616-1
October 24, 2012
python3.1 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in Python 3.1.
Software Description:
- python3.1: An interactive high-level object-oriented language (version
3.1)
Details:
It was discovered that Python would prepend an empty string to sys.path
under certain circumstances. A local attacker with write access to the
current working directory could exploit this to execute arbitrary code.
This issue only affected Ubuntu 10.04 LTS. (CVE-2008-5983)
It was discovered that the audioop module did not correctly perform input
validation. If a user or automatated system were tricked into opening a
crafted audio file, an attacker could cause a denial of service via
application crash. These issues only affected Ubuntu 10.04 LTS.
(CVE-2010-1634, CVE-2010-2089)
It was discovered that Python distutils contained a race condition when
creating the ~/.pypirc file. A local attacker could exploit this to obtain
sensitive information. (CVE-2011-4944)
It was discovered that SimpleXMLRPCServer did not properly validate its
input when handling HTTP POST requests. A remote attacker could exploit
this to cause a denial of service via excessive CPU utilization.
(CVE-2012-0845)
It was discovered that Python was susceptible to hash algorithm attacks.
An attacker could cause a denial of service under certian circumstances.
This update adds the '-R' command line option and honors setting the
PYTHONHASHSEED environment variable to 'random' to salt str and datetime
objects with an unpredictable value. (CVE-2012-1150)
Serhiy Storchaka discovered that the UTF16 decoder in Python did not
properly reset internal variables after error handling. An attacker could
exploit this to cause a denial of service via memory corruption.
(CVE-2012-2135)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 11.04:
python3.1 3.1.3-1ubuntu1.2
python3.1-minimal 3.1.3-1ubuntu1.2
Ubuntu 10.04 LTS:
python3.1 3.1.2-0ubuntu3.2
python3.1-minimal 3.1.2-0ubuntu3.2
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1616-1
CVE-2008-5983, CVE-2010-1634, CVE-2010-2089, CVE-2011-4944,
CVE-2012-0845, CVE-2012-1150, CVE-2012-2135
Package Information:
https://launchpad.net/ubuntu/+source/python3.1/3.1.3-1ubuntu1.2
https://launchpad.net/ubuntu/+source/python3.1/3.1.2-0ubuntu3.2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121024/384177a9/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 15
********************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1616-1] Python 3.1 vulnerabilities (Jamie Strandboge)
----------------------------------------------------------------------
Message: 1
Date: Wed, 24 Oct 2012 12:04:38 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1616-1] Python 3.1 vulnerabilities
Message-ID: <50881FA6.3000702@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1616-1
October 24, 2012
python3.1 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in Python 3.1.
Software Description:
- python3.1: An interactive high-level object-oriented language (version
3.1)
Details:
It was discovered that Python would prepend an empty string to sys.path
under certain circumstances. A local attacker with write access to the
current working directory could exploit this to execute arbitrary code.
This issue only affected Ubuntu 10.04 LTS. (CVE-2008-5983)
It was discovered that the audioop module did not correctly perform input
validation. If a user or automatated system were tricked into opening a
crafted audio file, an attacker could cause a denial of service via
application crash. These issues only affected Ubuntu 10.04 LTS.
(CVE-2010-1634, CVE-2010-2089)
It was discovered that Python distutils contained a race condition when
creating the ~/.pypirc file. A local attacker could exploit this to obtain
sensitive information. (CVE-2011-4944)
It was discovered that SimpleXMLRPCServer did not properly validate its
input when handling HTTP POST requests. A remote attacker could exploit
this to cause a denial of service via excessive CPU utilization.
(CVE-2012-0845)
It was discovered that Python was susceptible to hash algorithm attacks.
An attacker could cause a denial of service under certian circumstances.
This update adds the '-R' command line option and honors setting the
PYTHONHASHSEED environment variable to 'random' to salt str and datetime
objects with an unpredictable value. (CVE-2012-1150)
Serhiy Storchaka discovered that the UTF16 decoder in Python did not
properly reset internal variables after error handling. An attacker could
exploit this to cause a denial of service via memory corruption.
(CVE-2012-2135)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 11.04:
python3.1 3.1.3-1ubuntu1.2
python3.1-minimal 3.1.3-1ubuntu1.2
Ubuntu 10.04 LTS:
python3.1 3.1.2-0ubuntu3.2
python3.1-minimal 3.1.2-0ubuntu3.2
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1616-1
CVE-2008-5983, CVE-2010-1634, CVE-2010-2089, CVE-2011-4944,
CVE-2012-0845, CVE-2012-1150, CVE-2012-2135
Package Information:
https://launchpad.net/ubuntu/+source/python3.1/3.1.3-1ubuntu1.2
https://launchpad.net/ubuntu/+source/python3.1/3.1.2-0ubuntu3.2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121024/384177a9/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 15
********************************************************
Wednesday, October 24, 2012
ubuntu-security-announce Digest, Vol 97, Issue 14
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1615-1] Python 3.2 vulnerabilities (Jamie Strandboge)
----------------------------------------------------------------------
Message: 1
Date: Tue, 23 Oct 2012 14:30:21 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1615-1] Python 3.2 vulnerabilities
Message-ID: <5086F04D.5050608@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1615-1
October 23, 2012
python3.2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
Summary:
Several security issues were fixed in Python 3.2.
Software Description:
- python3.2: Interactive high-level object-oriented language (version 3.2)
Details:
It was discovered that Python distutils contained a race condition when
creating the ~/.pypirc file. A local attacker could exploit this to obtain
sensitive information. (CVE-2011-4944)
It was discovered that SimpleXMLRPCServer did not properly validate its
input when handling HTTP POST requests. A remote attacker could exploit
this to cause a denial of service via excessive CPU utilization. This issue
only affected Ubuntu 11.04 and 11.10. (CVE-2012-0845)
It was discovered that Python was susceptible to hash algorithm attacks.
An attacker could cause a denial of service under certian circumstances.
This updates adds the '-R' command line option and honors setting the
PYTHONHASHSEED environment variable to 'random' to salt str and datetime
objects with an unpredictable value. This issue only affected Ubuntu 11.04
and 11.10. (CVE-2012-1150)
Serhiy Storchaka discovered that the UTF16 decoder in Python did not
properly reset internal variables after error handling. An attacker could
exploit this to cause a denial of service via memory corruption. This issue
did not affect Ubuntu 12.10. (CVE-2012-2135)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.10:
python3.2 3.2.3-6ubuntu3.1
python3.2-minimal 3.2.3-6ubuntu3.1
Ubuntu 12.04 LTS:
python3.2 3.2.3-0ubuntu3.2
python3.2-minimal 3.2.3-0ubuntu3.2
Ubuntu 11.10:
python3.2 3.2.2-0ubuntu1.1
python3.2-minimal 3.2.2-0ubuntu1.1
Ubuntu 11.04:
python3.2 3.2-1ubuntu1.2
python3.2-minimal 3.2-1ubuntu1.2
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1615-1
CVE-2011-4944, CVE-2012-0845, CVE-2012-1150, CVE-2012-2135
Package Information:
https://launchpad.net/ubuntu/+source/python3.2/3.2.3-6ubuntu3.1
https://launchpad.net/ubuntu/+source/python3.2/3.2.3-0ubuntu3.2
https://launchpad.net/ubuntu/+source/python3.2/3.2.2-0ubuntu1.1
https://launchpad.net/ubuntu/+source/python3.2/3.2-1ubuntu1.2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121023/09175e4f/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 14
********************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1615-1] Python 3.2 vulnerabilities (Jamie Strandboge)
----------------------------------------------------------------------
Message: 1
Date: Tue, 23 Oct 2012 14:30:21 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1615-1] Python 3.2 vulnerabilities
Message-ID: <5086F04D.5050608@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1615-1
October 23, 2012
python3.2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
Summary:
Several security issues were fixed in Python 3.2.
Software Description:
- python3.2: Interactive high-level object-oriented language (version 3.2)
Details:
It was discovered that Python distutils contained a race condition when
creating the ~/.pypirc file. A local attacker could exploit this to obtain
sensitive information. (CVE-2011-4944)
It was discovered that SimpleXMLRPCServer did not properly validate its
input when handling HTTP POST requests. A remote attacker could exploit
this to cause a denial of service via excessive CPU utilization. This issue
only affected Ubuntu 11.04 and 11.10. (CVE-2012-0845)
It was discovered that Python was susceptible to hash algorithm attacks.
An attacker could cause a denial of service under certian circumstances.
This updates adds the '-R' command line option and honors setting the
PYTHONHASHSEED environment variable to 'random' to salt str and datetime
objects with an unpredictable value. This issue only affected Ubuntu 11.04
and 11.10. (CVE-2012-1150)
Serhiy Storchaka discovered that the UTF16 decoder in Python did not
properly reset internal variables after error handling. An attacker could
exploit this to cause a denial of service via memory corruption. This issue
did not affect Ubuntu 12.10. (CVE-2012-2135)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.10:
python3.2 3.2.3-6ubuntu3.1
python3.2-minimal 3.2.3-6ubuntu3.1
Ubuntu 12.04 LTS:
python3.2 3.2.3-0ubuntu3.2
python3.2-minimal 3.2.3-0ubuntu3.2
Ubuntu 11.10:
python3.2 3.2.2-0ubuntu1.1
python3.2-minimal 3.2.2-0ubuntu1.1
Ubuntu 11.04:
python3.2 3.2-1ubuntu1.2
python3.2-minimal 3.2-1ubuntu1.2
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1615-1
CVE-2011-4944, CVE-2012-0845, CVE-2012-1150, CVE-2012-2135
Package Information:
https://launchpad.net/ubuntu/+source/python3.2/3.2.3-6ubuntu3.1
https://launchpad.net/ubuntu/+source/python3.2/3.2.3-0ubuntu3.2
https://launchpad.net/ubuntu/+source/python3.2/3.2.2-0ubuntu1.1
https://launchpad.net/ubuntu/+source/python3.2/3.2-1ubuntu1.2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121023/09175e4f/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 14
********************************************************
Tuesday, October 23, 2012
ubuntu-security-announce Digest, Vol 97, Issue 13
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1603-2] Ruby vulnerabilities (Tyler Hicks)
2. [USN-1614-1] Ruby vulnerabilities (Tyler Hicks)
----------------------------------------------------------------------
Message: 1
Date: Mon, 22 Oct 2012 17:22:00 -0700
From: Tyler Hicks <tyhicks@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1603-2] Ruby vulnerabilities
Message-ID: <20121023002200.GF4396@boyd>
Content-Type: text/plain; charset="us-ascii"
==========================================================================
Ubuntu Security Notice USN-1603-2
October 23, 2012
ruby1.8 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10
Summary:
Ruby could allow excessive access in untrusted programs.
Software Description:
- ruby1.8: Interpreter of object-oriented scripting language Ruby 1.8
Details:
USN-1603-1 fixed vulnerabilities in Ruby. This update provides the
corresponding updates for Ubuntu 12.10.
Original advisory details:
Shugo Maedo and Vit Ondruch discovered that Ruby incorrectly allowed untainted
strings to be modified in protective safe levels. An attacker could use this
flaw to bypass intended access restrictions. (CVE-2012-4466, CVE-2012-4481)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.10:
libruby1.8 1.8.7.358-4ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1603-2
http://www.ubuntu.com/usn/usn-1603-1
CVE-2012-4466, CVE-2012-4481
Package Information:
https://launchpad.net/ubuntu/+source/ruby1.8/1.8.7.358-4ubuntu0.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121022/af6a09b2/attachment-0001.pgp>
------------------------------
Message: 2
Date: Mon, 22 Oct 2012 17:20:44 -0700
From: Tyler Hicks <tyhicks@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1614-1] Ruby vulnerabilities
Message-ID: <20121023002043.GE4396@boyd>
Content-Type: text/plain; charset="us-ascii"
==========================================================================
Ubuntu Security Notice USN-1614-1
October 23, 2012
ruby1.9.1 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in Ruby.
Software Description:
- ruby1.9.1: Interpreter of object-oriented scripting language Ruby
Details:
Tyler Hicks and Shugo Maeda discovered that Ruby incorrectly allowed untainted
strings to be modified in protective safe levels. An attacker could use this
flaw to bypass intended access restrictions. USN-1602-1 fixed these
vulnerabilities in other Ubuntu releases. This update provides the
corresponding updates for Ubuntu 12.10. (CVE-2012-4464, CVE-2012-4466)
Peter Bex discovered that Ruby incorrectly handled file path strings when
opening files. An attacker could use this flaw to open or create unexpected
files. (CVE-2012-4522)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.10:
libruby1.9.1 1.9.3.194-1ubuntu1.2
Ubuntu 12.04 LTS:
libruby1.9.1 1.9.3.0-1ubuntu2.4
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1614-1
CVE-2012-4464, CVE-2012-4466, CVE-2012-4522
Package Information:
https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.194-1ubuntu1.2
https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.0-1ubuntu2.4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121022/8d3a841a/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 13
********************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1603-2] Ruby vulnerabilities (Tyler Hicks)
2. [USN-1614-1] Ruby vulnerabilities (Tyler Hicks)
----------------------------------------------------------------------
Message: 1
Date: Mon, 22 Oct 2012 17:22:00 -0700
From: Tyler Hicks <tyhicks@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1603-2] Ruby vulnerabilities
Message-ID: <20121023002200.GF4396@boyd>
Content-Type: text/plain; charset="us-ascii"
==========================================================================
Ubuntu Security Notice USN-1603-2
October 23, 2012
ruby1.8 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10
Summary:
Ruby could allow excessive access in untrusted programs.
Software Description:
- ruby1.8: Interpreter of object-oriented scripting language Ruby 1.8
Details:
USN-1603-1 fixed vulnerabilities in Ruby. This update provides the
corresponding updates for Ubuntu 12.10.
Original advisory details:
Shugo Maedo and Vit Ondruch discovered that Ruby incorrectly allowed untainted
strings to be modified in protective safe levels. An attacker could use this
flaw to bypass intended access restrictions. (CVE-2012-4466, CVE-2012-4481)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.10:
libruby1.8 1.8.7.358-4ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1603-2
http://www.ubuntu.com/usn/usn-1603-1
CVE-2012-4466, CVE-2012-4481
Package Information:
https://launchpad.net/ubuntu/+source/ruby1.8/1.8.7.358-4ubuntu0.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121022/af6a09b2/attachment-0001.pgp>
------------------------------
Message: 2
Date: Mon, 22 Oct 2012 17:20:44 -0700
From: Tyler Hicks <tyhicks@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1614-1] Ruby vulnerabilities
Message-ID: <20121023002043.GE4396@boyd>
Content-Type: text/plain; charset="us-ascii"
==========================================================================
Ubuntu Security Notice USN-1614-1
October 23, 2012
ruby1.9.1 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in Ruby.
Software Description:
- ruby1.9.1: Interpreter of object-oriented scripting language Ruby
Details:
Tyler Hicks and Shugo Maeda discovered that Ruby incorrectly allowed untainted
strings to be modified in protective safe levels. An attacker could use this
flaw to bypass intended access restrictions. USN-1602-1 fixed these
vulnerabilities in other Ubuntu releases. This update provides the
corresponding updates for Ubuntu 12.10. (CVE-2012-4464, CVE-2012-4466)
Peter Bex discovered that Ruby incorrectly handled file path strings when
opening files. An attacker could use this flaw to open or create unexpected
files. (CVE-2012-4522)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.10:
libruby1.9.1 1.9.3.194-1ubuntu1.2
Ubuntu 12.04 LTS:
libruby1.9.1 1.9.3.0-1ubuntu2.4
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1614-1
CVE-2012-4464, CVE-2012-4466, CVE-2012-4522
Package Information:
https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.194-1ubuntu1.2
https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.0-1ubuntu2.4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121022/8d3a841a/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 13
********************************************************
Thursday, October 18, 2012
ubuntu-security-announce Digest, Vol 97, Issue 12
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1613-1] Python 2.5 vulnerabilities (Jamie Strandboge)
2. [USN-1613-2] Python 2.4 vulnerabilities (Jamie Strandboge)
----------------------------------------------------------------------
Message: 1
Date: Wed, 17 Oct 2012 14:54:48 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Cc: Ubuntu Security <security@ubuntu.com>
Subject: [USN-1613-1] Python 2.5 vulnerabilities
Message-ID: <507F0D08.6000504@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1613-1
October 17, 2012
python2.5 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 8.04 LTS
Summary:
Several security issues were fixed in Python 2.5.
Software Description:
- python2.5: An interactive high-level object-oriented language (version
2.5)
Details:
It was discovered that Python would prepend an empty string to sys.path
under certain circumstances. A local attacker with write access to the
current working directory could exploit this to execute arbitrary code.
(CVE-2008-5983)
It was discovered that the audioop module did not correctly perform input
validation. If a user or automatated system were tricked into opening a
crafted audio file, an attacker could cause a denial of service via
application crash. (CVE-2010-1634, CVE-2010-2089)
Giampaolo Rodola discovered several race conditions in the smtpd module.
A remote attacker could exploit this to cause a denial of service via
daemon outage. (CVE-2010-3493)
It was discovered that the CGIHTTPServer module did not properly perform
input validation on certain HTTP GET requests. A remote attacker could
potentially obtain access to CGI script source files. (CVE-2011-1015)
Niels Heinen discovered that the urllib and urllib2 modules would process
Location headers that specify a redirection to file: URLs. A remote
attacker could exploit this to obtain sensitive information or cause a
denial of service. (CVE-2011-1521)
It was discovered that SimpleHTTPServer did not use a charset parameter in
the Content-Type HTTP header. An attacker could potentially exploit this
to conduct cross-site scripting (XSS) attacks against Internet Explorer 7
users. (CVE-2011-4940)
It was discovered that Python distutils contained a race condition when
creating the ~/.pypirc file. A local attacker could exploit this to obtain
sensitive information. (CVE-2011-4944)
It was discovered that SimpleXMLRPCServer did not properly validate its
input when handling HTTP POST requests. A remote attacker could exploit
this to cause a denial of service via excessive CPU utilization.
(CVE-2012-0845)
It was discovered that the Expat module in Python 2.5 computed hash values
without restricting the ability to trigger hash collisions predictably. If
a user or application using pyexpat were tricked into opening a crafted XML
file, an attacker could cause a denial of service by consuming excessive
CPU resources. (CVE-2012-0876)
Tim Boddy discovered that the Expat module in Python 2.5 did not properly
handle memory reallocation when processing XML files. If a user or
application using pyexpat were tricked into opening a crafted XML file, an
attacker could cause a denial of service by consuming excessive memory
resources. (CVE-2012-1148)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 8.04 LTS:
python2.5 2.5.2-2ubuntu6.2
python2.5-minimal 2.5.2-2ubuntu6.2
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1613-1
CVE-2008-5983, CVE-2010-1634, CVE-2010-2089, CVE-2010-3493,
CVE-2011-1015, CVE-2011-1521, CVE-2011-4940, CVE-2011-4944,
CVE-2012-0845, CVE-2012-0876, CVE-2012-1148
Package Information:
https://launchpad.net/ubuntu/+source/python2.5/2.5.2-2ubuntu6.2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121017/7cc3e1b5/attachment-0001.pgp>
------------------------------
Message: 2
Date: Wed, 17 Oct 2012 15:06:20 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Cc: Ubuntu Security <security@ubuntu.com>
Subject: [USN-1613-2] Python 2.4 vulnerabilities
Message-ID: <507F0FBC.8000208@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1613-2
October 17, 2012
python2.4 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 8.04 LTS
Summary:
Several security issues were fixed in Python 2.4.
Software Description:
- python2.4: An interactive high-level object-oriented language (version
2.4)
Details:
USN-1613-1 fixed vulnerabilities in Python 2.5. This update provides the
corresponding updates for Python 2.4.
Original advisory details:
It was discovered that Python would prepend an empty string to sys.path
under certain circumstances. A local attacker with write access to the
current working directory could exploit this to execute arbitrary code.
(CVE-2008-5983)
It was discovered that the audioop module did not correctly perform input
validation. If a user or automatated system were tricked into opening a
crafted audio file, an attacker could cause a denial of service via
application crash. (CVE-2010-1634, CVE-2010-2089)
Giampaolo Rodola discovered several race conditions in the smtpd module.
A remote attacker could exploit this to cause a denial of service via
daemon outage. (CVE-2010-3493)
It was discovered that the CGIHTTPServer module did not properly perform
input validation on certain HTTP GET requests. A remote attacker could
potentially obtain access to CGI script source files. (CVE-2011-1015)
Niels Heinen discovered that the urllib and urllib2 modules would process
Location headers that specify a redirection to file: URLs. A remote
attacker could exploit this to obtain sensitive information or cause a
denial of service. (CVE-2011-1521)
It was discovered that SimpleHTTPServer did not use a charset parameter in
the Content-Type HTTP header. An attacker could potentially exploit this
to conduct cross-site scripting (XSS) attacks against Internet Explorer 7
users. (CVE-2011-4940)
It was discovered that Python distutils contained a race condition when
creating the ~/.pypirc file. A local attacker could exploit this to obtain
sensitive information. (CVE-2011-4944)
It was discovered that SimpleXMLRPCServer did not properly validate its
input when handling HTTP POST requests. A remote attacker could exploit
this to cause a denial of service via excessive CPU utilization.
(CVE-2012-0845)
It was discovered that the Expat module in Python 2.5 computed hash values
without restricting the ability to trigger hash collisions predictably. If
a user or application using pyexpat were tricked into opening a crafted XML
file, an attacker could cause a denial of service by consuming excessive
CPU resources. (CVE-2012-0876)
Tim Boddy discovered that the Expat module in Python 2.5 did not properly
handle memory reallocation when processing XML files. If a user or
application using pyexpat were tricked into opening a crafted XML file, an
attacker could cause a denial of service by consuming excessive memory
resources. (CVE-2012-1148)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 8.04 LTS:
python2.4 2.4.5-1ubuntu4.4
python2.4-minimal 2.4.5-1ubuntu4.4
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1613-2
http://www.ubuntu.com/usn/usn-1613-1
CVE-2008-5983, CVE-2010-1634, CVE-2010-2089, CVE-2010-3493,
CVE-2011-1015, CVE-2011-1521, CVE-2011-4940, CVE-2011-4944,
CVE-2012-0845, CVE-2012-0876, CVE-2012-1148
Package Information:
https://launchpad.net/ubuntu/+source/python2.4/2.4.5-1ubuntu4.4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121017/9476a4f3/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 12
********************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1613-1] Python 2.5 vulnerabilities (Jamie Strandboge)
2. [USN-1613-2] Python 2.4 vulnerabilities (Jamie Strandboge)
----------------------------------------------------------------------
Message: 1
Date: Wed, 17 Oct 2012 14:54:48 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Cc: Ubuntu Security <security@ubuntu.com>
Subject: [USN-1613-1] Python 2.5 vulnerabilities
Message-ID: <507F0D08.6000504@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1613-1
October 17, 2012
python2.5 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 8.04 LTS
Summary:
Several security issues were fixed in Python 2.5.
Software Description:
- python2.5: An interactive high-level object-oriented language (version
2.5)
Details:
It was discovered that Python would prepend an empty string to sys.path
under certain circumstances. A local attacker with write access to the
current working directory could exploit this to execute arbitrary code.
(CVE-2008-5983)
It was discovered that the audioop module did not correctly perform input
validation. If a user or automatated system were tricked into opening a
crafted audio file, an attacker could cause a denial of service via
application crash. (CVE-2010-1634, CVE-2010-2089)
Giampaolo Rodola discovered several race conditions in the smtpd module.
A remote attacker could exploit this to cause a denial of service via
daemon outage. (CVE-2010-3493)
It was discovered that the CGIHTTPServer module did not properly perform
input validation on certain HTTP GET requests. A remote attacker could
potentially obtain access to CGI script source files. (CVE-2011-1015)
Niels Heinen discovered that the urllib and urllib2 modules would process
Location headers that specify a redirection to file: URLs. A remote
attacker could exploit this to obtain sensitive information or cause a
denial of service. (CVE-2011-1521)
It was discovered that SimpleHTTPServer did not use a charset parameter in
the Content-Type HTTP header. An attacker could potentially exploit this
to conduct cross-site scripting (XSS) attacks against Internet Explorer 7
users. (CVE-2011-4940)
It was discovered that Python distutils contained a race condition when
creating the ~/.pypirc file. A local attacker could exploit this to obtain
sensitive information. (CVE-2011-4944)
It was discovered that SimpleXMLRPCServer did not properly validate its
input when handling HTTP POST requests. A remote attacker could exploit
this to cause a denial of service via excessive CPU utilization.
(CVE-2012-0845)
It was discovered that the Expat module in Python 2.5 computed hash values
without restricting the ability to trigger hash collisions predictably. If
a user or application using pyexpat were tricked into opening a crafted XML
file, an attacker could cause a denial of service by consuming excessive
CPU resources. (CVE-2012-0876)
Tim Boddy discovered that the Expat module in Python 2.5 did not properly
handle memory reallocation when processing XML files. If a user or
application using pyexpat were tricked into opening a crafted XML file, an
attacker could cause a denial of service by consuming excessive memory
resources. (CVE-2012-1148)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 8.04 LTS:
python2.5 2.5.2-2ubuntu6.2
python2.5-minimal 2.5.2-2ubuntu6.2
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1613-1
CVE-2008-5983, CVE-2010-1634, CVE-2010-2089, CVE-2010-3493,
CVE-2011-1015, CVE-2011-1521, CVE-2011-4940, CVE-2011-4944,
CVE-2012-0845, CVE-2012-0876, CVE-2012-1148
Package Information:
https://launchpad.net/ubuntu/+source/python2.5/2.5.2-2ubuntu6.2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121017/7cc3e1b5/attachment-0001.pgp>
------------------------------
Message: 2
Date: Wed, 17 Oct 2012 15:06:20 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Cc: Ubuntu Security <security@ubuntu.com>
Subject: [USN-1613-2] Python 2.4 vulnerabilities
Message-ID: <507F0FBC.8000208@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1613-2
October 17, 2012
python2.4 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 8.04 LTS
Summary:
Several security issues were fixed in Python 2.4.
Software Description:
- python2.4: An interactive high-level object-oriented language (version
2.4)
Details:
USN-1613-1 fixed vulnerabilities in Python 2.5. This update provides the
corresponding updates for Python 2.4.
Original advisory details:
It was discovered that Python would prepend an empty string to sys.path
under certain circumstances. A local attacker with write access to the
current working directory could exploit this to execute arbitrary code.
(CVE-2008-5983)
It was discovered that the audioop module did not correctly perform input
validation. If a user or automatated system were tricked into opening a
crafted audio file, an attacker could cause a denial of service via
application crash. (CVE-2010-1634, CVE-2010-2089)
Giampaolo Rodola discovered several race conditions in the smtpd module.
A remote attacker could exploit this to cause a denial of service via
daemon outage. (CVE-2010-3493)
It was discovered that the CGIHTTPServer module did not properly perform
input validation on certain HTTP GET requests. A remote attacker could
potentially obtain access to CGI script source files. (CVE-2011-1015)
Niels Heinen discovered that the urllib and urllib2 modules would process
Location headers that specify a redirection to file: URLs. A remote
attacker could exploit this to obtain sensitive information or cause a
denial of service. (CVE-2011-1521)
It was discovered that SimpleHTTPServer did not use a charset parameter in
the Content-Type HTTP header. An attacker could potentially exploit this
to conduct cross-site scripting (XSS) attacks against Internet Explorer 7
users. (CVE-2011-4940)
It was discovered that Python distutils contained a race condition when
creating the ~/.pypirc file. A local attacker could exploit this to obtain
sensitive information. (CVE-2011-4944)
It was discovered that SimpleXMLRPCServer did not properly validate its
input when handling HTTP POST requests. A remote attacker could exploit
this to cause a denial of service via excessive CPU utilization.
(CVE-2012-0845)
It was discovered that the Expat module in Python 2.5 computed hash values
without restricting the ability to trigger hash collisions predictably. If
a user or application using pyexpat were tricked into opening a crafted XML
file, an attacker could cause a denial of service by consuming excessive
CPU resources. (CVE-2012-0876)
Tim Boddy discovered that the Expat module in Python 2.5 did not properly
handle memory reallocation when processing XML files. If a user or
application using pyexpat were tricked into opening a crafted XML file, an
attacker could cause a denial of service by consuming excessive memory
resources. (CVE-2012-1148)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 8.04 LTS:
python2.4 2.4.5-1ubuntu4.4
python2.4-minimal 2.4.5-1ubuntu4.4
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1613-2
http://www.ubuntu.com/usn/usn-1613-1
CVE-2008-5983, CVE-2010-1634, CVE-2010-2089, CVE-2010-3493,
CVE-2011-1015, CVE-2011-1521, CVE-2011-4940, CVE-2011-4944,
CVE-2012-0845, CVE-2012-0876, CVE-2012-1148
Package Information:
https://launchpad.net/ubuntu/+source/python2.4/2.4.5-1ubuntu4.4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121017/9476a4f3/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 12
********************************************************
Tuesday, October 16, 2012
ubuntu-security-announce Digest, Vol 97, Issue 11
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1612-1] libgssglue vulnerability (Tyler Hicks)
----------------------------------------------------------------------
Message: 1
Date: Mon, 15 Oct 2012 10:30:40 -0700
From: Tyler Hicks <tyhicks@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1612-1] libgssglue vulnerability
Message-ID: <20121015173039.GC20382@boyd>
Content-Type: text/plain; charset="us-ascii"
==========================================================================
Ubuntu Security Notice USN-1612-1
October 15, 2012
libgssglue vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Privilege escalation via the GSSAPI_MECH_CONF environment variable with setuid
programs.
Software Description:
- libgssglue: header files and docs for libgssglue
Details:
It was discovered that libgssglue incorrectly handled the GSSAPI_MECH_CONF
environment variable when running a privileged binary. A local attacker could
exploit this to gain root privileges. (CVE-2011-2709)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
libgssglue1 0.3-4ubuntu0.1
Ubuntu 11.10:
libgssglue1 0.3-1ubuntu1.1
Ubuntu 11.04:
libgssglue1 0.1-4ubuntu1.1
Ubuntu 10.04 LTS:
libgssglue1 0.1-4ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1612-1
CVE-2011-2709
Package Information:
https://launchpad.net/ubuntu/+source/libgssglue/0.3-4ubuntu0.1
https://launchpad.net/ubuntu/+source/libgssglue/0.3-1ubuntu1.1
https://launchpad.net/ubuntu/+source/libgssglue/0.1-4ubuntu1.1
https://launchpad.net/ubuntu/+source/libgssglue/0.1-4ubuntu0.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121015/58093aea/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 11
********************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1612-1] libgssglue vulnerability (Tyler Hicks)
----------------------------------------------------------------------
Message: 1
Date: Mon, 15 Oct 2012 10:30:40 -0700
From: Tyler Hicks <tyhicks@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1612-1] libgssglue vulnerability
Message-ID: <20121015173039.GC20382@boyd>
Content-Type: text/plain; charset="us-ascii"
==========================================================================
Ubuntu Security Notice USN-1612-1
October 15, 2012
libgssglue vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Privilege escalation via the GSSAPI_MECH_CONF environment variable with setuid
programs.
Software Description:
- libgssglue: header files and docs for libgssglue
Details:
It was discovered that libgssglue incorrectly handled the GSSAPI_MECH_CONF
environment variable when running a privileged binary. A local attacker could
exploit this to gain root privileges. (CVE-2011-2709)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
libgssglue1 0.3-4ubuntu0.1
Ubuntu 11.10:
libgssglue1 0.3-1ubuntu1.1
Ubuntu 11.04:
libgssglue1 0.1-4ubuntu1.1
Ubuntu 10.04 LTS:
libgssglue1 0.1-4ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1612-1
CVE-2011-2709
Package Information:
https://launchpad.net/ubuntu/+source/libgssglue/0.3-4ubuntu0.1
https://launchpad.net/ubuntu/+source/libgssglue/0.3-1ubuntu1.1
https://launchpad.net/ubuntu/+source/libgssglue/0.1-4ubuntu1.1
https://launchpad.net/ubuntu/+source/libgssglue/0.1-4ubuntu0.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121015/58093aea/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 11
********************************************************
Saturday, October 13, 2012
ubuntu-security-announce Digest, Vol 97, Issue 10
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1611-1] Thunderbird vulnerabilities (Micah Gersten)
----------------------------------------------------------------------
Message: 1
Date: Fri, 12 Oct 2012 13:42:24 -0500
From: Micah Gersten <micah@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1611-1] Thunderbird vulnerabilities
Message-ID: <50786490.6060503@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-1611-1
October 12, 2012
thunderbird vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in Thunderbird.
Software Description:
- thunderbird: Mozilla Open Source mail and newsgroup client
Details:
Henrik Skupin, Jesse Ruderman, Christian Holler, Soroush Dalili and others
discovered several memory corruption flaws in Thunderbird. If a user were
tricked into opening a malicious website and had JavaScript enabled, an
attacker could exploit these to execute arbitrary JavaScript code within
the context of another website or arbitrary code as the user invoking the
program. (CVE-2012-3982, CVE-2012-3983, CVE-2012-3988, CVE-2012-3989,
CVE-2012-4191)
David Bloom and Jordi Chancel discovered that Thunderbird did not always
properly handle the <select> element. If a user were tricked into opening a
malicious website and had JavaScript enabled, a remote attacker could
exploit this to conduct URL spoofing and clickjacking attacks.
(CVE-2012-3984)
Collin Jackson discovered that Thunderbird did not properly follow the
HTML5 specification for document.domain behavior. If a user were tricked
into opening a malicious website and had JavaScript enabled, a remote
attacker could exploit this to conduct cross-site scripting (XSS) attacks
via JavaScript execution. (CVE-2012-3985)
Johnny Stenback discovered that Thunderbird did not properly perform
security checks on test methods for DOMWindowUtils. (CVE-2012-3986)
Alice White discovered that the security checks for GetProperty could be
bypassed when using JSAPI. If a user were tricked into opening a specially
crafted web page and had JavaScript enabled, a remote attacker could
exploit this to execute arbitrary code as the user invoking the program.
(CVE-2012-3991)
Mariusz Mlynski discovered a history state error in Thunderbird. If a user
were tricked into opening a malicious website and had JavaScript enabled, a
remote attacker could exploit this to spoof the location property to inject
script or intercept posted data. (CVE-2012-3992)
Mariusz Mlynski and others discovered several flaws in Thunderbird that
allowed a remote attacker to conduct cross-site scripting (XSS) attacks.
With cross-site scripting vulnerabilities, if a user were tricked into
viewing a specially crafted page and had JavaScript enabled, a remote
attacker could exploit these to modify the contents, or steal confidential
data, within the same domain. (CVE-2012-3993, CVE-2012-3994, CVE-2012-4184)
Abhishek Arya, Atte Kettunen and others discovered several memory flaws in
Thunderbird when using the Address Sanitizer tool. If a user were tricked
into opening a malicious website and had JavaScript enabled, an attacker
could exploit these to execute arbitrary JavaScript code within the context
of another website or execute arbitrary code as the user invoking the
program. (CVE-2012-3990, CVE-2012-3995, CVE-2012-4179, CVE-2012-4180,
CVE-2012-4181, CVE-2012-4182, CVE-2012-4183, CVE-2012-4185, CVE-2012-4186,
CVE-2012-4187, CVE-2012-4188)
It was discovered that Thunderbird allowed improper access to the Location
object. An attacker could exploit this to obtain sensitive information.
Under certain circumstances, a remote attacker could use this vulnerability
to potentially execute arbitrary code as the user invoking the program.
(CVE-2012-4192, CVE-2012-4193)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
thunderbird 16.0.1+build1-0ubuntu0.12.04.1
Ubuntu 11.10:
thunderbird 16.0.1+build1-0ubuntu0.11.10.1
Ubuntu 11.04:
thunderbird 16.0.1+build1-0ubuntu0.11.04.1
Ubuntu 10.04 LTS:
thunderbird 16.0.1+build1-0ubuntu0.10.04.1
After a standard system update you need to restart Thunderbird to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1611-1
CVE-2012-3982, CVE-2012-3983, CVE-2012-3984, CVE-2012-3985,
CVE-2012-3986, CVE-2012-3988, CVE-2012-3989, CVE-2012-3990,
CVE-2012-3991, CVE-2012-3992, CVE-2012-3993, CVE-2012-3994,
CVE-2012-3995, CVE-2012-4179, CVE-2012-4180, CVE-2012-4181,
CVE-2012-4182, CVE-2012-4183, CVE-2012-4184, CVE-2012-4185,
CVE-2012-4186, CVE-2012-4187, CVE-2012-4188, CVE-2012-4191,
CVE-2012-4192, CVE-2012-4193, https://launchpad.net/bugs/1062587, https://launchpad.net/bugs/1065292
Package Information:
https://launchpad.net/ubuntu/+source/thunderbird/16.0.1+build1-0ubuntu0.12.04.1
https://launchpad.net/ubuntu/+source/thunderbird/16.0.1+build1-0ubuntu0.11.10.1
https://launchpad.net/ubuntu/+source/thunderbird/16.0.1+build1-0ubuntu0.11.04.1
https://launchpad.net/ubuntu/+source/thunderbird/16.0.1+build1-0ubuntu0.10.04.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121012/75e12abe/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 10
********************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1611-1] Thunderbird vulnerabilities (Micah Gersten)
----------------------------------------------------------------------
Message: 1
Date: Fri, 12 Oct 2012 13:42:24 -0500
From: Micah Gersten <micah@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1611-1] Thunderbird vulnerabilities
Message-ID: <50786490.6060503@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-1611-1
October 12, 2012
thunderbird vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in Thunderbird.
Software Description:
- thunderbird: Mozilla Open Source mail and newsgroup client
Details:
Henrik Skupin, Jesse Ruderman, Christian Holler, Soroush Dalili and others
discovered several memory corruption flaws in Thunderbird. If a user were
tricked into opening a malicious website and had JavaScript enabled, an
attacker could exploit these to execute arbitrary JavaScript code within
the context of another website or arbitrary code as the user invoking the
program. (CVE-2012-3982, CVE-2012-3983, CVE-2012-3988, CVE-2012-3989,
CVE-2012-4191)
David Bloom and Jordi Chancel discovered that Thunderbird did not always
properly handle the <select> element. If a user were tricked into opening a
malicious website and had JavaScript enabled, a remote attacker could
exploit this to conduct URL spoofing and clickjacking attacks.
(CVE-2012-3984)
Collin Jackson discovered that Thunderbird did not properly follow the
HTML5 specification for document.domain behavior. If a user were tricked
into opening a malicious website and had JavaScript enabled, a remote
attacker could exploit this to conduct cross-site scripting (XSS) attacks
via JavaScript execution. (CVE-2012-3985)
Johnny Stenback discovered that Thunderbird did not properly perform
security checks on test methods for DOMWindowUtils. (CVE-2012-3986)
Alice White discovered that the security checks for GetProperty could be
bypassed when using JSAPI. If a user were tricked into opening a specially
crafted web page and had JavaScript enabled, a remote attacker could
exploit this to execute arbitrary code as the user invoking the program.
(CVE-2012-3991)
Mariusz Mlynski discovered a history state error in Thunderbird. If a user
were tricked into opening a malicious website and had JavaScript enabled, a
remote attacker could exploit this to spoof the location property to inject
script or intercept posted data. (CVE-2012-3992)
Mariusz Mlynski and others discovered several flaws in Thunderbird that
allowed a remote attacker to conduct cross-site scripting (XSS) attacks.
With cross-site scripting vulnerabilities, if a user were tricked into
viewing a specially crafted page and had JavaScript enabled, a remote
attacker could exploit these to modify the contents, or steal confidential
data, within the same domain. (CVE-2012-3993, CVE-2012-3994, CVE-2012-4184)
Abhishek Arya, Atte Kettunen and others discovered several memory flaws in
Thunderbird when using the Address Sanitizer tool. If a user were tricked
into opening a malicious website and had JavaScript enabled, an attacker
could exploit these to execute arbitrary JavaScript code within the context
of another website or execute arbitrary code as the user invoking the
program. (CVE-2012-3990, CVE-2012-3995, CVE-2012-4179, CVE-2012-4180,
CVE-2012-4181, CVE-2012-4182, CVE-2012-4183, CVE-2012-4185, CVE-2012-4186,
CVE-2012-4187, CVE-2012-4188)
It was discovered that Thunderbird allowed improper access to the Location
object. An attacker could exploit this to obtain sensitive information.
Under certain circumstances, a remote attacker could use this vulnerability
to potentially execute arbitrary code as the user invoking the program.
(CVE-2012-4192, CVE-2012-4193)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
thunderbird 16.0.1+build1-0ubuntu0.12.04.1
Ubuntu 11.10:
thunderbird 16.0.1+build1-0ubuntu0.11.10.1
Ubuntu 11.04:
thunderbird 16.0.1+build1-0ubuntu0.11.04.1
Ubuntu 10.04 LTS:
thunderbird 16.0.1+build1-0ubuntu0.10.04.1
After a standard system update you need to restart Thunderbird to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1611-1
CVE-2012-3982, CVE-2012-3983, CVE-2012-3984, CVE-2012-3985,
CVE-2012-3986, CVE-2012-3988, CVE-2012-3989, CVE-2012-3990,
CVE-2012-3991, CVE-2012-3992, CVE-2012-3993, CVE-2012-3994,
CVE-2012-3995, CVE-2012-4179, CVE-2012-4180, CVE-2012-4181,
CVE-2012-4182, CVE-2012-4183, CVE-2012-4184, CVE-2012-4185,
CVE-2012-4186, CVE-2012-4187, CVE-2012-4188, CVE-2012-4191,
CVE-2012-4192, CVE-2012-4193, https://launchpad.net/bugs/1062587, https://launchpad.net/bugs/1065292
Package Information:
https://launchpad.net/ubuntu/+source/thunderbird/16.0.1+build1-0ubuntu0.12.04.1
https://launchpad.net/ubuntu/+source/thunderbird/16.0.1+build1-0ubuntu0.11.10.1
https://launchpad.net/ubuntu/+source/thunderbird/16.0.1+build1-0ubuntu0.11.04.1
https://launchpad.net/ubuntu/+source/thunderbird/16.0.1+build1-0ubuntu0.10.04.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121012/75e12abe/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 10
********************************************************
Friday, October 12, 2012
ubuntu-security-announce Digest, Vol 97, Issue 9
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1610-1] Linux kernel vulnerability (John Johansen)
----------------------------------------------------------------------
Message: 1
Date: Fri, 12 Oct 2012 03:16:20 -0700
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1610-1] Linux kernel vulnerability
Message-ID: <5077EDF4.6050404@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1610-1
October 12, 2012
linux vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
The system could be made to perform privileged actions as an administrator.
Software Description:
- linux: Linux kernel
Details:
Pablo Neira Ayuso discovered a flaw in the credentials of netlink messages.
An unprivileged local attacker could exploit this by getting a netlink
based service, that relies on netlink credentials, to perform privileged
actions.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
linux-image-3.2.0-32-generic 3.2.0-32.51
linux-image-3.2.0-32-generic-pae 3.2.0-32.51
linux-image-3.2.0-32-highbank 3.2.0-32.51
linux-image-3.2.0-32-omap 3.2.0-32.51
linux-image-3.2.0-32-powerpc-smp 3.2.0-32.51
linux-image-3.2.0-32-powerpc64-smp 3.2.0-32.51
linux-image-3.2.0-32-virtual 3.2.0-32.51
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-1610-1
CVE-2012-3520
Package Information:
https://launchpad.net/ubuntu/+source/linux/3.2.0-32.51
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121012/893b754f/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 9
*******************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1610-1] Linux kernel vulnerability (John Johansen)
----------------------------------------------------------------------
Message: 1
Date: Fri, 12 Oct 2012 03:16:20 -0700
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1610-1] Linux kernel vulnerability
Message-ID: <5077EDF4.6050404@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1610-1
October 12, 2012
linux vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
The system could be made to perform privileged actions as an administrator.
Software Description:
- linux: Linux kernel
Details:
Pablo Neira Ayuso discovered a flaw in the credentials of netlink messages.
An unprivileged local attacker could exploit this by getting a netlink
based service, that relies on netlink credentials, to perform privileged
actions.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
linux-image-3.2.0-32-generic 3.2.0-32.51
linux-image-3.2.0-32-generic-pae 3.2.0-32.51
linux-image-3.2.0-32-highbank 3.2.0-32.51
linux-image-3.2.0-32-omap 3.2.0-32.51
linux-image-3.2.0-32-powerpc-smp 3.2.0-32.51
linux-image-3.2.0-32-powerpc64-smp 3.2.0-32.51
linux-image-3.2.0-32-virtual 3.2.0-32.51
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-1610-1
CVE-2012-3520
Package Information:
https://launchpad.net/ubuntu/+source/linux/3.2.0-32.51
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121012/893b754f/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 9
*******************************************************
ubuntu-security-announce Digest, Vol 97, Issue 8
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1604-1] MoinMoin vulnerabilities (Marc Deslauriers)
2. [USN-1605-1] Quagga vulnerability (Marc Deslauriers)
3. [USN-1606-1] Linux kernel vulnerabilities (John Johansen)
4. [USN-1607-1] Linux kernel vulnerabilities (John Johansen)
5. [USN-1608-1] Firefox vulnerabilities (Micah Gersten)
6. [USN-1609-1] Linux kernel (OMAP4) vulnerability (John Johansen)
----------------------------------------------------------------------
Message: 1
Date: Thu, 11 Oct 2012 08:29:45 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1604-1] MoinMoin vulnerabilities
Message-ID: <5076BBB9.4030205@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1604-1
October 11, 2012
moin vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in MoinMoin.
Software Description:
- moin: Collaborative hypertext environment
Details:
It was discovered that MoinMoin did not properly sanitize certain input,
resulting in a cross-site scripting (XSS) vulnerability. With cross-site
scripting vulnerabilities, if a user were tricked into viewing server
output during a crafted server request, a remote attacker could exploit
this to modify the contents, or steal confidential data, within the same
domain. (CVE-2011-1058)
It was discovered that MoinMoin incorrectly handled group names that
contain virtual group names such as "All", "Known" or "Trusted". This could
result in a remote user having incorrect permissions. (CVE-2012-4404)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
python-moinmoin 1.9.3-1ubuntu2.1
Ubuntu 11.10:
python-moinmoin 1.9.3-1ubuntu1.11.10.1
Ubuntu 11.04:
python-moinmoin 1.9.3-1ubuntu1.11.04.1
Ubuntu 10.04 LTS:
python-moinmoin 1.9.2-2ubuntu3.2
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1604-1
CVE-2011-1058, CVE-2012-4404
Package Information:
https://launchpad.net/ubuntu/+source/moin/1.9.3-1ubuntu2.1
https://launchpad.net/ubuntu/+source/moin/1.9.3-1ubuntu1.11.10.1
https://launchpad.net/ubuntu/+source/moin/1.9.3-1ubuntu1.11.04.1
https://launchpad.net/ubuntu/+source/moin/1.9.2-2ubuntu3.2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121011/051e25bd/attachment-0001.pgp>
------------------------------
Message: 2
Date: Thu, 11 Oct 2012 14:16:10 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1605-1] Quagga vulnerability
Message-ID: <50770CEA.1090004@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1605-1
October 11, 2012
quagga vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Quagga could be made to crash if it received specially crafted network
traffic.
Software Description:
- quagga: BGP/OSPF/RIP routing daemon
Details:
It was discovered that Quagga incorrectly handled certain malformed
messages. A remote attacker could use this flaw to cause Quagga to crash,
resulting in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
quagga 0.99.20.1-0ubuntu0.12.04.3
Ubuntu 11.10:
quagga 0.99.20.1-0ubuntu0.11.10.3
Ubuntu 11.04:
quagga 0.99.20.1-0ubuntu0.11.04.3
Ubuntu 10.04 LTS:
quagga 0.99.20.1-0ubuntu0.10.04.3
After a standard system update you need to restart Quagga to make all the
necessary changes.
References:
http://www.ubuntu.com/usn/usn-1605-1
CVE-2012-1820
Package Information:
https://launchpad.net/ubuntu/+source/quagga/0.99.20.1-0ubuntu0.12.04.3
https://launchpad.net/ubuntu/+source/quagga/0.99.20.1-0ubuntu0.11.10.3
https://launchpad.net/ubuntu/+source/quagga/0.99.20.1-0ubuntu0.11.04.3
https://launchpad.net/ubuntu/+source/quagga/0.99.20.1-0ubuntu0.10.04.3
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121011/858500d4/attachment-0001.pgp>
------------------------------
Message: 3
Date: Thu, 11 Oct 2012 12:01:58 -0700
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1606-1] Linux kernel vulnerabilities
Message-ID: <507717A6.80004@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1606-1
October 11, 2012
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux: Linux kernel
Details:
A flaw was found in how the Linux kernel's KVM (Kernel-based Virtual
Machine) subsystem handled MSI (Message Signaled Interrupts). A local
unprivileged user could exploit this flaw to cause a denial of service or
potentially elevate privileges. (CVE-2012-2137)
A flaw was found in how the Linux kernel passed the replacement session
keyring to a child process. An unprivileged local user could exploit this
flaw to cause a denial of service (panic). (CVE-2012-2745)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 10.04 LTS:
linux-image-2.6.32-44-386 2.6.32-44.98
linux-image-2.6.32-44-generic 2.6.32-44.98
linux-image-2.6.32-44-generic-pae 2.6.32-44.98
linux-image-2.6.32-44-ia64 2.6.32-44.98
linux-image-2.6.32-44-lpia 2.6.32-44.98
linux-image-2.6.32-44-powerpc 2.6.32-44.98
linux-image-2.6.32-44-powerpc-smp 2.6.32-44.98
linux-image-2.6.32-44-powerpc64-smp 2.6.32-44.98
linux-image-2.6.32-44-preempt 2.6.32-44.98
linux-image-2.6.32-44-server 2.6.32-44.98
linux-image-2.6.32-44-sparc64 2.6.32-44.98
linux-image-2.6.32-44-sparc64-smp 2.6.32-44.98
linux-image-2.6.32-44-versatile 2.6.32-44.98
linux-image-2.6.32-44-virtual 2.6.32-44.98
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-1606-1
CVE-2012-2137, CVE-2012-2745
Package Information:
https://launchpad.net/ubuntu/+source/linux/2.6.32-44.98
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121011/80d011c0/attachment-0001.pgp>
------------------------------
Message: 4
Date: Thu, 11 Oct 2012 12:28:37 -0700
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1607-1] Linux kernel vulnerabilities
Message-ID: <50771DE5.5060408@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1607-1
October 11, 2012
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.10
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux: Linux kernel
Details:
Vadim Ponomarev discovered a flaw in the Linux kernel causing a reference
leak when PID namespaces are used. A remote attacker could exploit this
flaw causing a denial of service. (CVE-2012-2127)
A flaw was found in how the Linux kernel's KVM (Kernel-based Virtual
Machine) subsystem handled MSI (Message Signaled Interrupts). A local
unprivileged user could exploit this flaw to cause a denial of service or
potentially elevate privileges. (CVE-2012-2137)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 11.10:
linux-image-3.0.0-26-generic 3.0.0-26.43
linux-image-3.0.0-26-generic-pae 3.0.0-26.43
linux-image-3.0.0-26-omap 3.0.0-26.43
linux-image-3.0.0-26-powerpc 3.0.0-26.43
linux-image-3.0.0-26-powerpc-smp 3.0.0-26.43
linux-image-3.0.0-26-powerpc64-smp 3.0.0-26.43
linux-image-3.0.0-26-server 3.0.0-26.43
linux-image-3.0.0-26-virtual 3.0.0-26.43
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1607-1
CVE-2012-2127, CVE-2012-2137
Package Information:
https://launchpad.net/ubuntu/+source/linux/3.0.0-26.43
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121011/e4c09b8d/attachment-0001.pgp>
------------------------------
Message: 5
Date: Thu, 11 Oct 2012 15:26:58 -0500
From: Micah Gersten <micah@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1608-1] Firefox vulnerabilities
Message-ID: <50772B92.1000909@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-1608-1
October 11, 2012
firefox vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in Firefox.
Software Description:
- firefox: Mozilla Open Source web browser
Details:
It was discovered that the browser engine used in Firefox contained a
memory corruption flaw. If a user were tricked into opening a specially
crafted web page, a remote attacker could cause Firefox to crash or
potentially execute arbitrary code as the user invoking the program.
(CVE-2012-4191)
It was discovered that Firefox allowed improper access to the Location
object. An attacker could exploit this to obtain sensitive information.
(CVE-2012-4192)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
firefox 16.0.1+build1-0ubuntu0.12.04.1
Ubuntu 11.10:
firefox 16.0.1+build1-0ubuntu0.11.10.1
Ubuntu 11.04:
firefox 16.0.1+build1-0ubuntu0.11.04.1
Ubuntu 10.04 LTS:
firefox 16.0.1+build1-0ubuntu0.10.04.1
After a standard system update you need to restart Firefox to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1608-1
CVE-2012-4191, CVE-2012-4192, https://launchpad.net/bugs/1065285
Package Information:
https://launchpad.net/ubuntu/+source/firefox/16.0.1+build1-0ubuntu0.12.04.1
https://launchpad.net/ubuntu/+source/firefox/16.0.1+build1-0ubuntu0.11.10.1
https://launchpad.net/ubuntu/+source/firefox/16.0.1+build1-0ubuntu0.11.04.1
https://launchpad.net/ubuntu/+source/firefox/16.0.1+build1-0ubuntu0.10.04.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121011/26d2713d/attachment-0001.pgp>
------------------------------
Message: 6
Date: Fri, 12 Oct 2012 02:54:29 -0700
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1609-1] Linux kernel (OMAP4) vulnerability
Message-ID: <5077E8D5.8010304@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1609-1
October 12, 2012
linux-ti-omap4 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.10
Summary:
The system could be made to crash under certain conditions.
Software Description:
- linux-ti-omap4: Linux kernel for OMAP4
Details:
A flaw was found in how the Linux kernel's KVM (Kernel-based Virtual
Machine) subsystem handled MSI (Message Signaled Interrupts). A local
unprivileged user could exploit this flaw to cause a denial of service or
potentially elevate privileges.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 11.10:
linux-image-3.0.0-1216-omap4 3.0.0-1216.29
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1609-1
CVE-2012-2137
Package Information:
https://launchpad.net/ubuntu/+source/linux-ti-omap4/3.0.0-1216.29
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121012/863abf92/attachment.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 8
*******************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1604-1] MoinMoin vulnerabilities (Marc Deslauriers)
2. [USN-1605-1] Quagga vulnerability (Marc Deslauriers)
3. [USN-1606-1] Linux kernel vulnerabilities (John Johansen)
4. [USN-1607-1] Linux kernel vulnerabilities (John Johansen)
5. [USN-1608-1] Firefox vulnerabilities (Micah Gersten)
6. [USN-1609-1] Linux kernel (OMAP4) vulnerability (John Johansen)
----------------------------------------------------------------------
Message: 1
Date: Thu, 11 Oct 2012 08:29:45 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1604-1] MoinMoin vulnerabilities
Message-ID: <5076BBB9.4030205@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1604-1
October 11, 2012
moin vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in MoinMoin.
Software Description:
- moin: Collaborative hypertext environment
Details:
It was discovered that MoinMoin did not properly sanitize certain input,
resulting in a cross-site scripting (XSS) vulnerability. With cross-site
scripting vulnerabilities, if a user were tricked into viewing server
output during a crafted server request, a remote attacker could exploit
this to modify the contents, or steal confidential data, within the same
domain. (CVE-2011-1058)
It was discovered that MoinMoin incorrectly handled group names that
contain virtual group names such as "All", "Known" or "Trusted". This could
result in a remote user having incorrect permissions. (CVE-2012-4404)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
python-moinmoin 1.9.3-1ubuntu2.1
Ubuntu 11.10:
python-moinmoin 1.9.3-1ubuntu1.11.10.1
Ubuntu 11.04:
python-moinmoin 1.9.3-1ubuntu1.11.04.1
Ubuntu 10.04 LTS:
python-moinmoin 1.9.2-2ubuntu3.2
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1604-1
CVE-2011-1058, CVE-2012-4404
Package Information:
https://launchpad.net/ubuntu/+source/moin/1.9.3-1ubuntu2.1
https://launchpad.net/ubuntu/+source/moin/1.9.3-1ubuntu1.11.10.1
https://launchpad.net/ubuntu/+source/moin/1.9.3-1ubuntu1.11.04.1
https://launchpad.net/ubuntu/+source/moin/1.9.2-2ubuntu3.2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121011/051e25bd/attachment-0001.pgp>
------------------------------
Message: 2
Date: Thu, 11 Oct 2012 14:16:10 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1605-1] Quagga vulnerability
Message-ID: <50770CEA.1090004@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1605-1
October 11, 2012
quagga vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Quagga could be made to crash if it received specially crafted network
traffic.
Software Description:
- quagga: BGP/OSPF/RIP routing daemon
Details:
It was discovered that Quagga incorrectly handled certain malformed
messages. A remote attacker could use this flaw to cause Quagga to crash,
resulting in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
quagga 0.99.20.1-0ubuntu0.12.04.3
Ubuntu 11.10:
quagga 0.99.20.1-0ubuntu0.11.10.3
Ubuntu 11.04:
quagga 0.99.20.1-0ubuntu0.11.04.3
Ubuntu 10.04 LTS:
quagga 0.99.20.1-0ubuntu0.10.04.3
After a standard system update you need to restart Quagga to make all the
necessary changes.
References:
http://www.ubuntu.com/usn/usn-1605-1
CVE-2012-1820
Package Information:
https://launchpad.net/ubuntu/+source/quagga/0.99.20.1-0ubuntu0.12.04.3
https://launchpad.net/ubuntu/+source/quagga/0.99.20.1-0ubuntu0.11.10.3
https://launchpad.net/ubuntu/+source/quagga/0.99.20.1-0ubuntu0.11.04.3
https://launchpad.net/ubuntu/+source/quagga/0.99.20.1-0ubuntu0.10.04.3
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121011/858500d4/attachment-0001.pgp>
------------------------------
Message: 3
Date: Thu, 11 Oct 2012 12:01:58 -0700
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1606-1] Linux kernel vulnerabilities
Message-ID: <507717A6.80004@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1606-1
October 11, 2012
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux: Linux kernel
Details:
A flaw was found in how the Linux kernel's KVM (Kernel-based Virtual
Machine) subsystem handled MSI (Message Signaled Interrupts). A local
unprivileged user could exploit this flaw to cause a denial of service or
potentially elevate privileges. (CVE-2012-2137)
A flaw was found in how the Linux kernel passed the replacement session
keyring to a child process. An unprivileged local user could exploit this
flaw to cause a denial of service (panic). (CVE-2012-2745)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 10.04 LTS:
linux-image-2.6.32-44-386 2.6.32-44.98
linux-image-2.6.32-44-generic 2.6.32-44.98
linux-image-2.6.32-44-generic-pae 2.6.32-44.98
linux-image-2.6.32-44-ia64 2.6.32-44.98
linux-image-2.6.32-44-lpia 2.6.32-44.98
linux-image-2.6.32-44-powerpc 2.6.32-44.98
linux-image-2.6.32-44-powerpc-smp 2.6.32-44.98
linux-image-2.6.32-44-powerpc64-smp 2.6.32-44.98
linux-image-2.6.32-44-preempt 2.6.32-44.98
linux-image-2.6.32-44-server 2.6.32-44.98
linux-image-2.6.32-44-sparc64 2.6.32-44.98
linux-image-2.6.32-44-sparc64-smp 2.6.32-44.98
linux-image-2.6.32-44-versatile 2.6.32-44.98
linux-image-2.6.32-44-virtual 2.6.32-44.98
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-1606-1
CVE-2012-2137, CVE-2012-2745
Package Information:
https://launchpad.net/ubuntu/+source/linux/2.6.32-44.98
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121011/80d011c0/attachment-0001.pgp>
------------------------------
Message: 4
Date: Thu, 11 Oct 2012 12:28:37 -0700
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1607-1] Linux kernel vulnerabilities
Message-ID: <50771DE5.5060408@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1607-1
October 11, 2012
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.10
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux: Linux kernel
Details:
Vadim Ponomarev discovered a flaw in the Linux kernel causing a reference
leak when PID namespaces are used. A remote attacker could exploit this
flaw causing a denial of service. (CVE-2012-2127)
A flaw was found in how the Linux kernel's KVM (Kernel-based Virtual
Machine) subsystem handled MSI (Message Signaled Interrupts). A local
unprivileged user could exploit this flaw to cause a denial of service or
potentially elevate privileges. (CVE-2012-2137)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 11.10:
linux-image-3.0.0-26-generic 3.0.0-26.43
linux-image-3.0.0-26-generic-pae 3.0.0-26.43
linux-image-3.0.0-26-omap 3.0.0-26.43
linux-image-3.0.0-26-powerpc 3.0.0-26.43
linux-image-3.0.0-26-powerpc-smp 3.0.0-26.43
linux-image-3.0.0-26-powerpc64-smp 3.0.0-26.43
linux-image-3.0.0-26-server 3.0.0-26.43
linux-image-3.0.0-26-virtual 3.0.0-26.43
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1607-1
CVE-2012-2127, CVE-2012-2137
Package Information:
https://launchpad.net/ubuntu/+source/linux/3.0.0-26.43
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121011/e4c09b8d/attachment-0001.pgp>
------------------------------
Message: 5
Date: Thu, 11 Oct 2012 15:26:58 -0500
From: Micah Gersten <micah@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1608-1] Firefox vulnerabilities
Message-ID: <50772B92.1000909@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-1608-1
October 11, 2012
firefox vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in Firefox.
Software Description:
- firefox: Mozilla Open Source web browser
Details:
It was discovered that the browser engine used in Firefox contained a
memory corruption flaw. If a user were tricked into opening a specially
crafted web page, a remote attacker could cause Firefox to crash or
potentially execute arbitrary code as the user invoking the program.
(CVE-2012-4191)
It was discovered that Firefox allowed improper access to the Location
object. An attacker could exploit this to obtain sensitive information.
(CVE-2012-4192)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
firefox 16.0.1+build1-0ubuntu0.12.04.1
Ubuntu 11.10:
firefox 16.0.1+build1-0ubuntu0.11.10.1
Ubuntu 11.04:
firefox 16.0.1+build1-0ubuntu0.11.04.1
Ubuntu 10.04 LTS:
firefox 16.0.1+build1-0ubuntu0.10.04.1
After a standard system update you need to restart Firefox to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1608-1
CVE-2012-4191, CVE-2012-4192, https://launchpad.net/bugs/1065285
Package Information:
https://launchpad.net/ubuntu/+source/firefox/16.0.1+build1-0ubuntu0.12.04.1
https://launchpad.net/ubuntu/+source/firefox/16.0.1+build1-0ubuntu0.11.10.1
https://launchpad.net/ubuntu/+source/firefox/16.0.1+build1-0ubuntu0.11.04.1
https://launchpad.net/ubuntu/+source/firefox/16.0.1+build1-0ubuntu0.10.04.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121011/26d2713d/attachment-0001.pgp>
------------------------------
Message: 6
Date: Fri, 12 Oct 2012 02:54:29 -0700
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1609-1] Linux kernel (OMAP4) vulnerability
Message-ID: <5077E8D5.8010304@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-1609-1
October 12, 2012
linux-ti-omap4 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.10
Summary:
The system could be made to crash under certain conditions.
Software Description:
- linux-ti-omap4: Linux kernel for OMAP4
Details:
A flaw was found in how the Linux kernel's KVM (Kernel-based Virtual
Machine) subsystem handled MSI (Message Signaled Interrupts). A local
unprivileged user could exploit this flaw to cause a denial of service or
potentially elevate privileges.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 11.10:
linux-image-3.0.0-1216-omap4 3.0.0-1216.29
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1609-1
CVE-2012-2137
Package Information:
https://launchpad.net/ubuntu/+source/linux-ti-omap4/3.0.0-1216.29
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121012/863abf92/attachment.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 97, Issue 8
*******************************************************
Subscribe to:
Posts (Atom)