ubuntu-security-announce Digest, Vol 107, Issue 1

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."


Today's Topics:

1. [USN-1911-2] Ghostscript vulnerability (Jamie Strandboge)
2. [USN-1922-1] Evolution Data Server vulnerability
(Jamie Strandboge)
3. [USN-1923-1] GnuPG, Libgcrypt vulnerability (Seth Arnold)


----------------------------------------------------------------------

Message: 1
Date: Wed, 31 Jul 2013 15:15:26 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1911-2] Ghostscript vulnerability
Message-ID: <51F9705E.8000102@canonical.com>
Content-Type: text/plain; charset="utf-8"


==========================================================================
Ubuntu Security Notice USN-1911-2
July 31, 2013

ghostscript vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04

Summary:

Ghostscript could be made to crash if it opened a specially crafted file.

Software Description:
- ghostscript: PostScript and PDF interpreter

Details:

USN-1911-1 fixed vulnerabilities in Little CMS. This update provides the
corresponding updates for Ghostscript.

Original advisory details:

It was discovered that Little CMS did not properly verify certain memory
allocations. If a user or automated system using Little CMS were tricked
into opening a specially crafted file, an attacker could cause Little CMS
to crash.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
libgs9 9.07~dfsg2-0ubuntu3.1

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1911-2
http://www.ubuntu.com/usn/usn-1911-1
CVE-2013-4160

Package Information:
https://launchpad.net/ubuntu/+source/ghostscript/9.07~dfsg2-0ubuntu3.1




-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130731/75821727/attachment.pgp>

------------------------------

Message: 2
Date: Wed, 31 Jul 2013 18:39:45 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1922-1] Evolution Data Server vulnerability
Message-ID: <51F9A041.9080603@canonical.com>
Content-Type: text/plain; charset="utf-8"


==========================================================================
Ubuntu Security Notice USN-1922-1
July 31, 2013

evolution-data-server vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS

Summary:

Evolution would sometimes encrypt email to the wrong recipient.

Software Description:
- evolution-data-server: Evolution suite data server

Details:

Yves-Alexis Perez discovered that Evolution Data Server did not properly
select GPG recipients. Under certain circumstances, this could result in
Evolution encrypting email to an unintended recipient.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
libcamel-1.2-40 3.6.4-0ubuntu1.1

Ubuntu 12.10:
libcamel-1.2-40 3.6.2-0ubuntu0.2

Ubuntu 12.04 LTS:
libcamel-1.2-29 3.2.3-0ubuntu7.1

After a standard system update you need to restart Evolution to make all
the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1922-1
CVE-2013-4166

Package Information:
https://launchpad.net/ubuntu/+source/evolution-data-server/3.6.4-0ubuntu1.1
https://launchpad.net/ubuntu/+source/evolution-data-server/3.6.2-0ubuntu0.2
https://launchpad.net/ubuntu/+source/evolution-data-server/3.2.3-0ubuntu7.1




-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130731/dd5c79a2/attachment.pgp>

------------------------------

Message: 3
Date: Wed, 31 Jul 2013 18:48:37 -0700
From: Seth Arnold <seth.arnold@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1923-1] GnuPG, Libgcrypt vulnerability
Message-ID: <20130801014837.GA21160@hunt>
Content-Type: text/plain; charset="us-ascii"

==========================================================================
Ubuntu Security Notice USN-1923-1
August 01, 2013

gnupg, libgcrypt11 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS

Summary:

GnuPG and Libgcrypt could be made to expose sensitive information.

Software Description:
- gnupg: GNU privacy guard - a free PGP replacement
- libgcrypt11: LGPL Crypto library - runtime library

Details:

Yuval Yarom and Katrina Falkner discovered a timing-based information leak,
known as Flush+Reload, that could be used to trace execution in programs.
GnuPG and Libgcrypt followed different execution paths based on key-related
data, which could be used to expose the contents of private keys.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
gnupg 1.4.12-7ubuntu1.1
libgcrypt11 1.5.0-3ubuntu2.2

Ubuntu 12.10:
gnupg 1.4.11-3ubuntu4.2
libgcrypt11 1.5.0-3ubuntu1.1

Ubuntu 12.04 LTS:
gnupg 1.4.11-3ubuntu2.3
libgcrypt11 1.5.0-3ubuntu0.2

Ubuntu 10.04 LTS:
gnupg 1.4.10-2ubuntu1.3
libgcrypt11 1.4.4-5ubuntu2.2

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1923-1
CVE-2013-4242

Package Information:
https://launchpad.net/ubuntu/+source/gnupg/1.4.12-7ubuntu1.1
https://launchpad.net/ubuntu/+source/libgcrypt11/1.5.0-3ubuntu2.2
https://launchpad.net/ubuntu/+source/gnupg/1.4.11-3ubuntu4.2
https://launchpad.net/ubuntu/+source/libgcrypt11/1.5.0-3ubuntu1.1
https://launchpad.net/ubuntu/+source/gnupg/1.4.11-3ubuntu2.3
https://launchpad.net/ubuntu/+source/libgcrypt11/1.5.0-3ubuntu0.2
https://launchpad.net/ubuntu/+source/gnupg/1.4.10-2ubuntu1.3
https://launchpad.net/ubuntu/+source/libgcrypt11/1.4.4-5ubuntu2.2

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130731/250e7a80/attachment.pgp>

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce


End of ubuntu-security-announce Digest, Vol 107, Issue 1
********************************************************