ubuntu-security-announce Digest, Vol 106, Issue 6

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."


Today's Topics:

1. [USN-1905-1] PHP vulnerabilities (Marc Deslauriers)
2. [USN-1906-1] File Roller vulnerability (Marc Deslauriers)
3. [USN-1907-1] OpenJDK 7 vulnerabilities (Jamie Strandboge)
4. [USN-1907-2] IcedTea Web update (Jamie Strandboge)


----------------------------------------------------------------------

Message: 1
Date: Tue, 16 Jul 2013 08:40:16 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1905-1] PHP vulnerabilities
Message-ID: <51E53F30.1090904@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-1905-1
July 16, 2013

php5 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS

Summary:

Several security issues were fixed in PHP.

Software Description:
- php5: HTML-embedded scripting language interpreter

Details:

It was discovered that PHP incorrectly handled the xml_parse_into_struct
function. If a PHP application parsed untrusted XML, an attacker could use
this flaw with a specially-crafted XML document to cause PHP to crash,
resulting in a denial of service, or to possibly execute arbitrary code.
(CVE-2013-4113)

It was discovered that PHP incorrectly handled the jdtojewish function. An
attacker could use this flaw to cause PHP to crash, resulting in a denial
of service. (CVE-2013-4635)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
libapache2-mod-php5 5.4.9-4ubuntu2.2
php5-cgi 5.4.9-4ubuntu2.2
php5-cli 5.4.9-4ubuntu2.2

Ubuntu 12.10:
libapache2-mod-php5 5.4.6-1ubuntu1.3
php5-cgi 5.4.6-1ubuntu1.3
php5-cli 5.4.6-1ubuntu1.3

Ubuntu 12.04 LTS:
libapache2-mod-php5 5.3.10-1ubuntu3.7
php5-cgi 5.3.10-1ubuntu3.7
php5-cli 5.3.10-1ubuntu3.7

Ubuntu 10.04 LTS:
libapache2-mod-php5 5.3.2-1ubuntu4.20
php5-cgi 5.3.2-1ubuntu4.20
php5-cli 5.3.2-1ubuntu4.20

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1905-1
CVE-2013-4113, CVE-2013-4635

Package Information:
https://launchpad.net/ubuntu/+source/php5/5.4.9-4ubuntu2.2
https://launchpad.net/ubuntu/+source/php5/5.4.6-1ubuntu1.3
https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.7
https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.20


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130716/9a088f43/attachment-0001.pgp>

------------------------------

Message: 2
Date: Tue, 16 Jul 2013 09:48:59 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1906-1] File Roller vulnerability
Message-ID: <51E54F4B.4010802@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-1906-1
July 16, 2013

file-roller vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04
- Ubuntu 12.10

Summary:

File Roller could be made to create or overwrite files.

Software Description:
- file-roller: archive manager for GNOME

Details:

Yorick Koster discovered that File Roller incorrectly sanitized paths. If a
user were tricked into extracting a specially-crafted archive, an attacker
could create and overwrite files outside of the extraction directory.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
file-roller 3.6.3-1ubuntu4.1

Ubuntu 12.10:
file-roller 3.6.1.1-0ubuntu1.2

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1906-1
CVE-2013-4668

Package Information:
https://launchpad.net/ubuntu/+source/file-roller/3.6.3-1ubuntu4.1
https://launchpad.net/ubuntu/+source/file-roller/3.6.1.1-0ubuntu1.2


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130716/d1184233/attachment-0001.pgp>

------------------------------

Message: 3
Date: Tue, 16 Jul 2013 12:29:21 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1907-1] OpenJDK 7 vulnerabilities
Message-ID: <51E582F1.5020002@canonical.com>
Content-Type: text/plain; charset="utf-8"


==========================================================================
Ubuntu Security Notice USN-1907-1
July 16, 2013

openjdk-7 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04
- Ubuntu 12.10

Summary:

Several security issues were fixed in OpenJDK 7.

Software Description:
- openjdk-7: Open Source Java implementation

Details:

Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure and data integrity. An attacker could exploit these
to expose sensitive data over the network. (CVE-2013-1500, CVE-2013-2454,
CVE-2013-2458)

A vulnerability was discovered in the OpenJDK Javadoc related to data
integrity. (CVE-2013-1571)

A vulnerability was discovered in the OpenJDK JRE related to information
disclosure and availability. An attacker could exploit this to cause a
denial of service or expose sensitive data over the network.
(CVE-2013-2407)

Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure. An attacker could exploit these to expose sensitive
data over the network. (CVE-2013-2412, CVE-2013-2443, CVE-2013-2446,
CVE-2013-2447, CVE-2013-2449, CVE-2013-2452, CVE-2013-2456)

Several vulnerabilities were discovered in the OpenJDK JRE related to
availability. An attacker could exploit these to cause a denial of service.
(CVE-2013-2444, CVE-2013-2445, CVE-2013-2450)

Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure, data integrity and availability. An attacker could
exploit these to cause a denial of service or expose sensitive data over
the network. (CVE-2013-2448, CVE-2013-2451, CVE-2013-2459, CVE-2013-2460,
CVE-2013-2461, CVE-2013-2463, CVE-2013-2465, CVE-2013-2469, CVE-2013-2470,
CVE-2013-2471, CVE-2013-2472, CVE-2013-2473)

Several vulnerabilities were discovered in the OpenJDK JRE related to data
integrity. (CVE-2013-2453, CVE-2013-2455, CVE-2013-2457)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
icedtea-7-jre-jamvm 7u25-2.3.10-1ubuntu0.13.04.2
openjdk-7-doc 7u25-2.3.10-1ubuntu0.13.04.2
openjdk-7-jre 7u25-2.3.10-1ubuntu0.13.04.2
openjdk-7-jre-headless 7u25-2.3.10-1ubuntu0.13.04.2
openjdk-7-jre-lib 7u25-2.3.10-1ubuntu0.13.04.2
openjdk-7-jre-zero 7u25-2.3.10-1ubuntu0.13.04.2

Ubuntu 12.10:
icedtea-7-jre-cacao 7u25-2.3.10-1ubuntu0.12.10.2
icedtea-7-jre-jamvm 7u25-2.3.10-1ubuntu0.12.10.2
openjdk-7-doc 7u25-2.3.10-1ubuntu0.12.10.2
openjdk-7-jre 7u25-2.3.10-1ubuntu0.12.10.2
openjdk-7-jre-headless 7u25-2.3.10-1ubuntu0.12.10.2
openjdk-7-jre-lib 7u25-2.3.10-1ubuntu0.12.10.2
openjdk-7-jre-zero 7u25-2.3.10-1ubuntu0.12.10.2

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications or applets to make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1907-1
CVE-2013-1500, CVE-2013-1571, CVE-2013-2407, CVE-2013-2412,
CVE-2013-2443, CVE-2013-2444, CVE-2013-2445, CVE-2013-2446,
CVE-2013-2447, CVE-2013-2448, CVE-2013-2449, CVE-2013-2450,
CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454,
CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2458,
CVE-2013-2459, CVE-2013-2460, CVE-2013-2461, CVE-2013-2463,
CVE-2013-2465, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471,
CVE-2013-2472, CVE-2013-2473

Package Information:
https://launchpad.net/ubuntu/+source/openjdk-7/7u25-2.3.10-1ubuntu0.13.04.2
https://launchpad.net/ubuntu/+source/openjdk-7/7u25-2.3.10-1ubuntu0.12.10.2




-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130716/610f02c2/attachment-0001.pgp>

------------------------------

Message: 4
Date: Tue, 16 Jul 2013 12:57:14 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1907-2] IcedTea Web update
Message-ID: <51E5897A.7010506@canonical.com>
Content-Type: text/plain; charset="utf-8"


==========================================================================
Ubuntu Security Notice USN-1907-2
July 16, 2013

icedtea-web update
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS

Summary:

IcedTea Web updated to work with new OpenJDK 7.

Software Description:
- icedtea-web: A web browser plugin to execute Java applets

Details:

USN-1907-1 fixed vulnerabilities in OpenJDK 7. Due to upstream changes,
IcedTea Web needed an update to work with the new OpenJDK 7.

Original advisory details:

Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure and data integrity. An attacker could exploit these
to expose sensitive data over the network. (CVE-2013-1500, CVE-2013-2454,
CVE-2013-2458)

A vulnerability was discovered in the OpenJDK Javadoc related to data
integrity. (CVE-2013-1571)

A vulnerability was discovered in the OpenJDK JRE related to information
disclosure and availability. An attacker could exploit this to cause a
denial of service or expose sensitive data over the network.
(CVE-2013-2407)

Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure. An attacker could exploit these to expose sensitive
data over the network. (CVE-2013-2412, CVE-2013-2443, CVE-2013-2446,
CVE-2013-2447, CVE-2013-2449, CVE-2013-2452, CVE-2013-2456)

Several vulnerabilities were discovered in the OpenJDK JRE related to
availability. An attacker could exploit these to cause a denial of service.
(CVE-2013-2444, CVE-2013-2445, CVE-2013-2450)

Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure, data integrity and availability. An attacker could
exploit these to cause a denial of service or expose sensitive data over
the network. (CVE-2013-2448, CVE-2013-2451, CVE-2013-2459, CVE-2013-2460,
CVE-2013-2461, CVE-2013-2463, CVE-2013-2465, CVE-2013-2469, CVE-2013-2470,
CVE-2013-2471, CVE-2013-2472, CVE-2013-2473)

Several vulnerabilities were discovered in the OpenJDK JRE related to data
integrity. (CVE-2013-2453, CVE-2013-2455, CVE-2013-2457)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
icedtea-netx 1.3.2-1ubuntu1.1

Ubuntu 12.10:
icedtea-netx 1.3.2-1ubuntu0.12.10.2

Ubuntu 12.04 LTS:
icedtea-netx 1.2.3-0ubuntu0.12.04.3

After a standard system update you need to restart your browser to make
all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1907-2
http://www.ubuntu.com/usn/usn-1907-1
https://launchpad.net/bugs/1201908

Package Information:
https://launchpad.net/ubuntu/+source/icedtea-web/1.3.2-1ubuntu1.1
https://launchpad.net/ubuntu/+source/icedtea-web/1.3.2-1ubuntu0.12.10.2
https://launchpad.net/ubuntu/+source/icedtea-web/1.2.3-0ubuntu0.12.04.3




-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130716/27ae2116/attachment-0001.pgp>

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce


End of ubuntu-security-announce Digest, Vol 106, Issue 6
********************************************************