ubuntu-security-announce Digest, Vol 105, Issue 14

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."


Today's Topics:

1. [USN-1888-1] Mesa vulnerabilities (Marc Deslauriers)
2. [USN-1889-1] HAProxy vulnerability (Marc Deslauriers)


----------------------------------------------------------------------

Message: 1
Date: Thu, 20 Jun 2013 13:18:49 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1888-1] Mesa vulnerabilities
Message-ID: <51C33979.8000504@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"

==========================================================================
Ubuntu Security Notice USN-1888-1
June 20, 2013

mesa, mesa-lts-quantal vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS

Summary:

Mesa could be made to crash or run programs as your login if it received
specially crafted input.

Software Description:
- mesa: free implementation of the EGL API
- mesa-lts-quantal: free implementation of the EGL API

Details:

It was discovered that Mesa incorrectly handled certain memory
calculations. An attacker could use this flaw to cause an application to
crash, or possibly execute arbitrary code. (CVE-2013-1872)

Ilja van Sprundel discovered that Mesa incorrectly handled certain memory
calculations. An attacker could use this flaw to cause an application to
crash, or possibly execute arbitrary code. (CVE-2013-1993)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
libegl1-mesa 9.1.3-0ubuntu0.3
libgbm1 9.1.3-0ubuntu0.3
libgl1-mesa-dri 9.1.3-0ubuntu0.3
libgl1-mesa-glx 9.1.3-0ubuntu0.3
libglapi-mesa 9.1.3-0ubuntu0.3
libgles1-mesa 9.1.3-0ubuntu0.3
libgles2-mesa 9.1.3-0ubuntu0.3
libopenvg1-mesa 9.1.3-0ubuntu0.3
libosmesa6 9.1.3-0ubuntu0.3
libxatracker1 9.1.3-0ubuntu0.3

Ubuntu 12.10:
libegl1-mesa 9.0.3-0ubuntu0.2
libgbm1 9.0.3-0ubuntu0.2
libgl1-mesa-dri 9.0.3-0ubuntu0.2
libgl1-mesa-glx 9.0.3-0ubuntu0.2
libglapi-mesa 9.0.3-0ubuntu0.2
libgles1-mesa 9.0.3-0ubuntu0.2
libgles2-mesa 9.0.3-0ubuntu0.2
libopenvg1-mesa 9.0.3-0ubuntu0.2
libosmesa6 9.0.3-0ubuntu0.2
libxatracker1 9.0.3-0ubuntu0.2

Ubuntu 12.04 LTS:
libegl1-mesa 8.0.4-0ubuntu0.6
libegl1-mesa-lts-quantal 9.0.3-0ubuntu0.1~precise3
libgbm1 8.0.4-0ubuntu0.6
libgbm1-lts-quantal 9.0.3-0ubuntu0.1~precise3
libgl1-mesa-dri 8.0.4-0ubuntu0.6
libgl1-mesa-dri-lts-quantal 9.0.3-0ubuntu0.1~precise3
libgl1-mesa-glx 8.0.4-0ubuntu0.6
libgl1-mesa-glx-lts-quantal 9.0.3-0ubuntu0.1~precise3
libgl1-mesa-swx11 8.0.4-0ubuntu0.6
libglapi-mesa 8.0.4-0ubuntu0.6
libglapi-mesa-lts-quantal 9.0.3-0ubuntu0.1~precise3
libgles1-mesa 8.0.4-0ubuntu0.6
libgles1-mesa-lts-quantal 9.0.3-0ubuntu0.1~precise3
libgles2-mesa 8.0.4-0ubuntu0.6
libgles2-mesa-lts-quantal 9.0.3-0ubuntu0.1~precise3
libglu1-mesa 8.0.4-0ubuntu0.6
libopenvg1-mesa 8.0.4-0ubuntu0.6
libopenvg1-mesa-lts-quantal 9.0.3-0ubuntu0.1~precise3
libosmesa6 8.0.4-0ubuntu0.6
libxatracker1 8.0.4-0ubuntu0.6
libxatracker1-lts-quantal 9.0.3-0ubuntu0.1~precise3

After a standard system update you need to restart your session to make all
the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1888-1
CVE-2013-1872, CVE-2013-1993

Package Information:
https://launchpad.net/ubuntu/+source/mesa/9.1.3-0ubuntu0.3
https://launchpad.net/ubuntu/+source/mesa/9.0.3-0ubuntu0.2
https://launchpad.net/ubuntu/+source/mesa/8.0.4-0ubuntu0.6

https://launchpad.net/ubuntu/+source/mesa-lts-quantal/9.0.3-0ubuntu0.1~precise3


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130620/4c07b53f/attachment-0001.pgp>

------------------------------

Message: 2
Date: Thu, 20 Jun 2013 17:13:08 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1889-1] HAProxy vulnerability
Message-ID: <51C37064.5040109@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"

==========================================================================
Ubuntu Security Notice USN-1889-1
June 20, 2013

haproxy vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS

Summary:

HAProxy could be made to crash if it received specially crafted network
traffic.

Software Description:
- haproxy: fast and reliable load balancing reverse proxy

Details:

David Torgerson discovered that HAProxy incorrectly parsed certain HTTP
headers. A remote attacker could use this issue to cause HAProxy to stop
responding, resulting in a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
haproxy 1.4.18-0ubuntu3.1

Ubuntu 12.10:
haproxy 1.4.18-0ubuntu2.2

Ubuntu 12.04 LTS:
haproxy 1.4.18-0ubuntu1.2

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1889-1
CVE-2013-2175

Package Information:
https://launchpad.net/ubuntu/+source/haproxy/1.4.18-0ubuntu3.1
https://launchpad.net/ubuntu/+source/haproxy/1.4.18-0ubuntu2.2
https://launchpad.net/ubuntu/+source/haproxy/1.4.18-0ubuntu1.2


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130620/32f6dd92/attachment-0001.pgp>

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce


End of ubuntu-security-announce Digest, Vol 105, Issue 14
*********************************************************