ubuntu-security-announce Digest, Vol 102, Issue 3

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."


Today's Topics:

1. [USN-1755-2] OpenJDK 7 vulnerabilities (Jamie Strandboge)
2. [USN-1757-1] Django vulnerabilities (Marc Deslauriers)


----------------------------------------------------------------------

Message: 1
Date: Thu, 07 Mar 2013 12:09:45 -0600
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1755-2] OpenJDK 7 vulnerabilities
Message-ID: <5138D7E9.6030201@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"


==========================================================================
Ubuntu Security Notice USN-1755-2
March 07, 2013

openjdk-7 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.10

Summary:

OpenJDK could be made to crash or run programs as your login if it opened a
specially crafted file.

Software Description:
- openjdk-7: Open Source Java implementation

Details:

USN-1755-1 fixed vulnerabilities in OpenJDK 6. This update provides the
corresponding updates for OpenJDK 7.

Original advisory details:

It was discovered that OpenJDK did not properly validate certain types
of images. A remote attacker could exploit this to cause OpenJDK to crash.
(CVE-2013-0809)

It was discovered that OpenJDK did not properly check return values when
performing color conversion for images. If a user were tricked into
opening a crafted image with OpenJDK, such as with the Java plugin, a
remote attacker could cause OpenJDK to crash or execute arbitrary code
outside of the Java sandbox with the privileges of the user invoking the
program. (CVE-2013-1493)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
icedtea-7-jre-cacao 7u15-2.3.7-0ubuntu1~12.10.1
icedtea-7-jre-jamvm 7u15-2.3.7-0ubuntu1~12.10.1
openjdk-7-jre 7u15-2.3.7-0ubuntu1~12.10.1
openjdk-7-jre-headless 7u15-2.3.7-0ubuntu1~12.10.1
openjdk-7-jre-lib 7u15-2.3.7-0ubuntu1~12.10.1
openjdk-7-jre-zero 7u15-2.3.7-0ubuntu1~12.10.1

After a standard system update you need to restart any applications using
OpenJDK, such as your browser, to make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1755-2
http://www.ubuntu.com/usn/usn-1755-1
CVE-2013-0809, CVE-2013-1493

Package Information:
https://launchpad.net/ubuntu/+source/openjdk-7/7u15-2.3.7-0ubuntu1~12.10.1




-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130307/0598402f/attachment-0001.pgp>

------------------------------

Message: 2
Date: Thu, 07 Mar 2013 13:46:32 -0500
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1757-1] Django vulnerabilities
Message-ID: <5138E088.9030202@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"

==========================================================================
Ubuntu Security Notice USN-1757-1
March 07, 2013

python-django vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 10.04 LTS

Summary:

Several security issues were fixed in Django.

Software Description:
- python-django: High-level Python web development framework

Details:

James Kettle discovered that Django did not properly filter the Host HTTP
header when processing certain requests. An attacker could exploit this to
generate and display arbitrary URLs to users. Although this issue had been
previously addressed in USN-1632-1, this update adds additional hardening
measures to host header validation. This update also adds a new
ALLOWED_HOSTS setting that can be set to a list of acceptable values for
headers. (CVE-2012-4520)

Orange Tsai discovered that Django incorrectly performed permission checks
when displaying the history view in the admin interface. An administrator
could use this flaw to view the history of any object, regardless of
intended permissions. (CVE-2013-0305)

It was discovered that Django incorrectly handled a large number of forms
when generating formsets. An attacker could use this flaw to cause Django
to consume memory, resulting in a denial of service. (CVE-2013-0306)

It was discovered that Django incorrectly deserialized XML. An attacker
could use this flaw to perform entity-expansion and external-entity/DTD
attacks. This updated modified Django behaviour to no longer allow DTDs,
perform entity expansion, or fetch external entities/DTDs. (CVE-2013-1664,
CVE-2013-1665)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
python-django 1.4.1-2ubuntu0.3

Ubuntu 12.04 LTS:
python-django 1.3.1-4ubuntu1.6

Ubuntu 11.10:
python-django 1.3-2ubuntu1.6

Ubuntu 10.04 LTS:
python-django 1.1.1-2ubuntu1.8

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1757-1
CVE-2012-4520, CVE-2013-0305, CVE-2013-0306, CVE-2013-1664,
CVE-2013-1665

Package Information:
https://launchpad.net/ubuntu/+source/python-django/1.4.1-2ubuntu0.3
https://launchpad.net/ubuntu/+source/python-django/1.3.1-4ubuntu1.6
https://launchpad.net/ubuntu/+source/python-django/1.3-2ubuntu1.6
https://launchpad.net/ubuntu/+source/python-django/1.1.1-2ubuntu1.8


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130307/9c350f69/attachment-0001.pgp>

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce


End of ubuntu-security-announce Digest, Vol 102, Issue 3
********************************************************