ubuntu-security-announce Digest, Vol 97, Issue 17

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."


Today's Topics:

1. [USN-1618-1] Exim vulnerability (Marc Deslauriers)
2. [USN-1619-1] OpenJDK vulnerabilities (Jamie Strandboge)
3. [USN-1620-1] Firefox vulnerabilities (Jamie Strandboge)


----------------------------------------------------------------------

Message: 1
Date: Fri, 26 Oct 2012 08:19:42 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1618-1] Exim vulnerability
Message-ID: <508A7FDE.2050404@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"

==========================================================================
Ubuntu Security Notice USN-1618-1
October 26, 2012

exim4 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS

Summary:

Exim could be made to run programs if it received specially crafted network
traffic.

Software Description:
- exim4: Exim is a mail transport agent

Details:

It was discovered that Exim incorrectly handled DKIM DNS decoding. This
flaw could allow a remote attacker to execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
exim4-daemon-custom 4.80-3ubuntu1.1
exim4-daemon-heavy 4.80-3ubuntu1.1
exim4-daemon-light 4.80-3ubuntu1.1

Ubuntu 12.04 LTS:
exim4-daemon-custom 4.76-3ubuntu3.1
exim4-daemon-heavy 4.76-3ubuntu3.1
exim4-daemon-light 4.76-3ubuntu3.1

Ubuntu 11.10:
exim4-daemon-custom 4.76-2ubuntu1.1
exim4-daemon-heavy 4.76-2ubuntu1.1
exim4-daemon-light 4.76-2ubuntu1.1

Ubuntu 11.04:
exim4-daemon-custom 4.74-1ubuntu1.3
exim4-daemon-heavy 4.74-1ubuntu1.3
exim4-daemon-light 4.74-1ubuntu1.3

Ubuntu 10.04 LTS:
exim4-daemon-custom 4.71-3ubuntu1.4
exim4-daemon-heavy 4.71-3ubuntu1.4
exim4-daemon-light 4.71-3ubuntu1.4

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1618-1
CVE-2012-5671

Package Information:
https://launchpad.net/ubuntu/+source/exim4/4.80-3ubuntu1.1
https://launchpad.net/ubuntu/+source/exim4/4.76-3ubuntu3.1
https://launchpad.net/ubuntu/+source/exim4/4.76-2ubuntu1.1
https://launchpad.net/ubuntu/+source/exim4/4.74-1ubuntu1.3
https://launchpad.net/ubuntu/+source/exim4/4.71-3ubuntu1.4


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121026/14dd2cba/attachment-0001.pgp>

------------------------------

Message: 2
Date: Fri, 26 Oct 2012 11:05:00 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1619-1] OpenJDK vulnerabilities
Message-ID: <508AB4AC.4000904@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"


==========================================================================
Ubuntu Security Notice USN-1619-1
October 26, 2012

openjdk-6, openjdk-7 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS

Summary:

Several security issues were fixed in OpenJDK.

Software Description:
- openjdk-7: Open Source Java implementation
- openjdk-6: Open Source Java implementation

Details:

Several information disclosure vulnerabilities were discovered in the
OpenJDK JRE. (CVE-2012-3216, CVE-2012-5069, CVE-2012-5072, CVE-2012-5075,
CVE-2012-5077, CVE-2012-5085)

Vulnerabilities were discovered in the OpenJDK JRE related to information
disclosure and data integrity. (CVE-2012-4416, CVE-2012-5071)

Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure and data integrity. An attacker could exploit these
to cause a denial of service. (CVE-2012-1531, CVE-2012-1532, CVE-2012-1533,
CVE-2012-3143, CVE-2012-3159, CVE-2012-5068, CVE-2012-5083, CVE-2012-5084,
CVE-2012-5086, CVE-2012-5089)

Information disclosure vulnerabilities were discovered in the OpenJDK JRE.
These issues only affected Ubuntu 12.10. (CVE-2012-5067, CVE-2012-5070)

Vulnerabilities were discovered in the OpenJDK JRE related to data
integrity. (CVE-2012-5073, CVE-2012-5079)

A vulnerability was discovered in the OpenJDK JRE related to information
disclosure and data integrity. This issue only affected Ubuntu 12.10.
(CVE-2012-5074)

Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure and data integrity. An attacker could exploit these
to cause a denial of service. These issues only affected Ubuntu 12.10.
(CVE-2012-5076, CVE-2012-5087, CVE-2012-5088)

A denial of service vulnerability was found in OpenJDK. (CVE-2012-5081)

Please see the following for more information:
http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
icedtea-7-jre-cacao 7u9-2.3.3-0ubuntu1~12.10.1
icedtea-7-jre-jamvm 7u9-2.3.3-0ubuntu1~12.10.1
openjdk-7-jre 7u9-2.3.3-0ubuntu1~12.10.1
openjdk-7-jre-headless 7u9-2.3.3-0ubuntu1~12.10.1
openjdk-7-jre-lib 7u9-2.3.3-0ubuntu1~12.10.1
openjdk-7-jre-zero 7u9-2.3.3-0ubuntu1~12.10.1

Ubuntu 12.04 LTS:
icedtea-6-jre-cacao 6b24-1.11.5-0ubuntu1~12.04.1
icedtea-6-jre-jamvm 6b24-1.11.5-0ubuntu1~12.04.1
openjdk-6-jre 6b24-1.11.5-0ubuntu1~12.04.1
openjdk-6-jre-headless 6b24-1.11.5-0ubuntu1~12.04.1
openjdk-6-jre-lib 6b24-1.11.5-0ubuntu1~12.04.1
openjdk-6-jre-zero 6b24-1.11.5-0ubuntu1~12.04.1

Ubuntu 11.10:
icedtea-6-jre-cacao 6b24-1.11.5-0ubuntu1~11.10.1
icedtea-6-jre-jamvm 6b24-1.11.5-0ubuntu1~11.10.1
openjdk-6-jre 6b24-1.11.5-0ubuntu1~11.10.1
openjdk-6-jre-headless 6b24-1.11.5-0ubuntu1~11.10.1
openjdk-6-jre-lib 6b24-1.11.5-0ubuntu1~11.10.1
openjdk-6-jre-zero 6b24-1.11.5-0ubuntu1~11.10.1

Ubuntu 11.04:
icedtea-6-jre-cacao 6b24-1.11.5-0ubuntu1~11.04.1
icedtea-6-jre-jamvm 6b24-1.11.5-0ubuntu1~11.04.1
openjdk-6-jre 6b24-1.11.5-0ubuntu1~11.04.1
openjdk-6-jre-headless 6b24-1.11.5-0ubuntu1~11.04.1
openjdk-6-jre-lib 6b24-1.11.5-0ubuntu1~11.04.1
openjdk-6-jre-zero 6b24-1.11.5-0ubuntu1~11.04.1

Ubuntu 10.04 LTS:
icedtea-6-jre-cacao 6b24-1.11.5-0ubuntu1~10.04.2
openjdk-6-jre 6b24-1.11.5-0ubuntu1~10.04.2
openjdk-6-jre-headless 6b24-1.11.5-0ubuntu1~10.04.2
openjdk-6-jre-lib 6b24-1.11.5-0ubuntu1~10.04.2
openjdk-6-jre-zero 6b24-1.11.5-0ubuntu1~10.04.2

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications or applets to make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1619-1
CVE-2012-1531, CVE-2012-1532, CVE-2012-1533, CVE-2012-3143,
CVE-2012-3159, CVE-2012-3216, CVE-2012-4416, CVE-2012-5067,
CVE-2012-5068, CVE-2012-5069, CVE-2012-5070, CVE-2012-5071,
CVE-2012-5072, CVE-2012-5073, CVE-2012-5074, CVE-2012-5075,
CVE-2012-5076, CVE-2012-5077, CVE-2012-5079, CVE-2012-5081,
CVE-2012-5083, CVE-2012-5084, CVE-2012-5085, CVE-2012-5086,
CVE-2012-5087, CVE-2012-5088, CVE-2012-5089

Package Information:
https://launchpad.net/ubuntu/+source/openjdk-7/7u9-2.3.3-0ubuntu1~12.10.1

https://launchpad.net/ubuntu/+source/openjdk-6/6b24-1.11.5-0ubuntu1~12.04.1

https://launchpad.net/ubuntu/+source/openjdk-6/6b24-1.11.5-0ubuntu1~11.10.1

https://launchpad.net/ubuntu/+source/openjdk-6/6b24-1.11.5-0ubuntu1~11.04.1

https://launchpad.net/ubuntu/+source/openjdk-6/6b24-1.11.5-0ubuntu1~10.04.2




-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121026/ed05be28/attachment-0001.pgp>

------------------------------

Message: 3
Date: Fri, 26 Oct 2012 16:37:17 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1620-1] Firefox vulnerabilities
Message-ID: <508B028D.6060405@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"


==========================================================================
Ubuntu Security Notice USN-1620-1
October 26, 2012

firefox vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS

Summary:

Several security issues were fixed in Firefox.

Software Description:
- firefox: Mozilla Open Source web browser

Details:

Mariusz Mlynski and others discovered several flaws in Firefox that allowed
a remote attacker to conduct cross-site scripting (XSS) attacks.
(CVE-2012-4194, CVE-2012-4195)

Antoine Delignat-Lavaud discovered a flaw in the way Firefox handled the
Location object. If a user were tricked into opening a specially crafted
page, a remote attacker could exploit this to bypass security protections
and perform cross-origin reading of the Location object. (CVE-2012-4196)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
firefox 16.0.2+build1-0ubuntu0.12.10.1

Ubuntu 12.04 LTS:
firefox 16.0.2+build1-0ubuntu0.12.04.1

Ubuntu 11.10:
firefox 16.0.2+build1-0ubuntu0.11.10.1

Ubuntu 11.04:
firefox 16.0.2+build1-0ubuntu0.11.04.1

Ubuntu 10.04 LTS:
firefox 16.0.2+build1-0ubuntu0.10.04.1

After a standard system update you need to restart Firefox to make all the
necessary changes.

References:
http://www.ubuntu.com/usn/usn-1620-1
CVE-2012-4194, CVE-2012-4195, CVE-2012-4196

Package Information:

https://launchpad.net/ubuntu/+source/firefox/16.0.2+build1-0ubuntu0.12.10.1

https://launchpad.net/ubuntu/+source/firefox/16.0.2+build1-0ubuntu0.12.04.1

https://launchpad.net/ubuntu/+source/firefox/16.0.2+build1-0ubuntu0.11.10.1

https://launchpad.net/ubuntu/+source/firefox/16.0.2+build1-0ubuntu0.11.04.1

https://launchpad.net/ubuntu/+source/firefox/16.0.2+build1-0ubuntu0.10.04.1




-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 897 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20121026/5451d71d/attachment-0001.pgp>

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce


End of ubuntu-security-announce Digest, Vol 97, Issue 17
********************************************************