ubuntu-security-announce Digest, Vol 108, Issue 8

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."


Today's Topics:

1. [USN-1958-1] language-selector vulnerability (Marc Deslauriers)
2. [USN-1959-1] RealtimeKit vulnerability (Marc Deslauriers)
3. [USN-1955-1] apt-xapian-index vulnerability (Marc Deslauriers)
4. [USN-1962-1] ubuntu-system-service vulnerability
(Marc Deslauriers)
5. [USN-1956-1] HPLIP vulnerability (Marc Deslauriers)
6. [USN-1953-1] polkit vulnerability (Marc Deslauriers)
7. [USN-1954-1] libvirt vulnerabilities (Marc Deslauriers)


----------------------------------------------------------------------

Message: 1
Date: Wed, 18 Sep 2013 11:07:24 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1958-1] language-selector vulnerability
Message-ID: <5239C1AC.3030802@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-1958-1
September 18, 2013

language-selector vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS

Summary:

language-selector could be tricked into bypassing polkit authorizations.

Software Description:
- language-selector: Language selector for Ubuntu

Details:

It was discovered that language-selector was using polkit in an unsafe
manner. A local attacker could possibly use this issue to bypass intended
polkit authorizations.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
language-selector-common 0.110.1

Ubuntu 12.10:
language-selector-common 0.90.1

Ubuntu 12.04 LTS:
language-selector-common 0.79.4

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1958-1
CVE-2013-1066

Package Information:
https://launchpad.net/ubuntu/+source/language-selector/0.110.1
https://launchpad.net/ubuntu/+source/language-selector/0.90.1
https://launchpad.net/ubuntu/+source/language-selector/0.79.4


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130918/5c0e9875/attachment-0001.pgp>

------------------------------

Message: 2
Date: Wed, 18 Sep 2013 11:07:42 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1959-1] RealtimeKit vulnerability
Message-ID: <5239C1BE.3090105@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-1959-1
September 18, 2013

rtkit vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS

Summary:

RealtimeKit could be tricked into bypassing polkit authorizations.

Software Description:
- rtkit: Realtime Policy and Watchdog Daemon

Details:

It was discovered that RealtimeKit was using polkit in an unsafe manner. A
local attacker could possibly use this issue to bypass intended polkit
authorizations.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
rtkit 0.10-2ubuntu0.13.04.1

Ubuntu 12.10:
rtkit 0.10-2ubuntu0.12.10.1

Ubuntu 12.04 LTS:
rtkit 0.10-2ubuntu0.12.04.1

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1959-1
CVE-2013-4326

Package Information:
https://launchpad.net/ubuntu/+source/rtkit/0.10-2ubuntu0.13.04.1
https://launchpad.net/ubuntu/+source/rtkit/0.10-2ubuntu0.12.10.1
https://launchpad.net/ubuntu/+source/rtkit/0.10-2ubuntu0.12.04.1


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130918/b2457bfa/attachment-0001.pgp>

------------------------------

Message: 3
Date: Wed, 18 Sep 2013 11:06:27 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1955-1] apt-xapian-index vulnerability
Message-ID: <5239C173.8020801@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-1955-1
September 18, 2013

apt-xapian-index vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS

Summary:

apt-xapian-index could be tricked into bypassing polkit authorizations.

Software Description:
- apt-xapian-index: maintenance and search tools for a Xapian index of Debian
package

Details:

It was discovered that apt-xapian-index was using polkit in an unsafe
manner. A local attacker could possibly use this issue to bypass intended
polkit authorizations.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
apt-xapian-index 0.45ubuntu2.1

Ubuntu 12.10:
apt-xapian-index 0.44ubuntu7.1

Ubuntu 12.04 LTS:
apt-xapian-index 0.44ubuntu5.1

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1955-1
CVE-2013-1064

Package Information:
https://launchpad.net/ubuntu/+source/apt-xapian-index/0.45ubuntu2.1
https://launchpad.net/ubuntu/+source/apt-xapian-index/0.44ubuntu7.1
https://launchpad.net/ubuntu/+source/apt-xapian-index/0.44ubuntu5.1


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130918/4ce1ac2c/attachment-0001.pgp>

------------------------------

Message: 4
Date: Wed, 18 Sep 2013 11:08:47 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1962-1] ubuntu-system-service vulnerability
Message-ID: <5239C1FF.4050709@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-1962-1
September 18, 2013

ubuntu-system-service vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS

Summary:

ubuntu-system-service could be tricked into bypassing polkit
authorizations.

Software Description:
- ubuntu-system-service: Dbus service to set various system-wide configurations

Details:

It was discovered that ubuntu-system-service was using polkit in an unsafe
manner. A local attacker could possibly use this issue to bypass intended
polkit authorizations.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
ubuntu-system-service 0.2.4.1

Ubuntu 12.10:
ubuntu-system-service 0.2.3.1

Ubuntu 12.04 LTS:
ubuntu-system-service 0.2.2.1

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1962-1
CVE-2013-1062

Package Information:
https://launchpad.net/ubuntu/+source/ubuntu-system-service/0.2.4.1
https://launchpad.net/ubuntu/+source/ubuntu-system-service/0.2.3.1
https://launchpad.net/ubuntu/+source/ubuntu-system-service/0.2.2.1


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130918/8fdb3979/attachment-0001.pgp>

------------------------------

Message: 5
Date: Wed, 18 Sep 2013 11:06:47 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1956-1] HPLIP vulnerability
Message-ID: <5239C187.8000903@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-1956-1
September 18, 2013

hplip vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS

Summary:

HPLIP could be tricked into bypassing polkit authorizations.

Software Description:
- hplip: HP Linux Printing and Imaging System (HPLIP)

Details:

It was discovered that HPLIP was using polkit in an unsafe manner. A local
attacker could possibly use this issue to bypass intended polkit
authorizations.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
hplip 3.13.3-1ubuntu0.1

Ubuntu 12.10:
hplip 3.12.6-3ubuntu4.1

Ubuntu 12.04 LTS:
hplip 3.12.2-1ubuntu3.2

Ubuntu 10.04 LTS:
hplip 3.10.2-2ubuntu2.3

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1956-1
CVE-2013-4325

Package Information:
https://launchpad.net/ubuntu/+source/hplip/3.13.3-1ubuntu0.1
https://launchpad.net/ubuntu/+source/hplip/3.12.6-3ubuntu4.1
https://launchpad.net/ubuntu/+source/hplip/3.12.2-1ubuntu3.2
https://launchpad.net/ubuntu/+source/hplip/3.10.2-2ubuntu2.3


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130918/3a746669/attachment-0001.pgp>

------------------------------

Message: 6
Date: Wed, 18 Sep 2013 11:05:41 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1953-1] polkit vulnerability
Message-ID: <5239C145.3030601@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-1953-1
September 18, 2013

policykit-1 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS

Summary:

polkit could be tricked into giving out improper authorization.

Software Description:
- policykit-1: framework for managing administrative policies and privileges

Details:

It was discovered that polkit didn't allow applications to use the pkcheck
tool in a way which prevented a race condition in the UID lookup. A local
attacker could use this flaw to possibly escalate privileges.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
policykit-1 0.105-1ubuntu1.1

Ubuntu 12.10:
policykit-1 0.104-2ubuntu1.1

Ubuntu 12.04 LTS:
policykit-1 0.104-1ubuntu1.1

Ubuntu 10.04 LTS:
policykit-1 0.96-2ubuntu0.2

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1953-1
CVE-2013-4288

Package Information:
https://launchpad.net/ubuntu/+source/policykit-1/0.105-1ubuntu1.1
https://launchpad.net/ubuntu/+source/policykit-1/0.104-2ubuntu1.1
https://launchpad.net/ubuntu/+source/policykit-1/0.104-1ubuntu1.1
https://launchpad.net/ubuntu/+source/policykit-1/0.96-2ubuntu0.2


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130918/613bf811/attachment.pgp>

------------------------------

Message: 7
Date: Wed, 18 Sep 2013 11:06:08 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1954-1] libvirt vulnerabilities
Message-ID: <5239C160.4050707@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-1954-1
September 18, 2013

libvirt vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS

Summary:

Several security issues were fixed in libvirt.

Software Description:
- libvirt: Libvirt virtualization toolkit

Details:

It was discovered that libvirt used the pkcheck tool in an unsafe manner. A
local attacker could possibly use this flaw to bypass polkit
authentication. In Ubuntu, libvirt polkit authentication is not enabled by
default. (CVE-2013-4311)

It was discovered that libvirt incorrectly handled certain memory stats
requests. A remote attacker could use this issue to cause libvirt to
crash, resulting in a denial of service. This issue only affected Ubuntu
12.04 LTS, Ubuntu 12.10, and Ubuntu 13.04. (CVE-2013-4296)

It was discovered that libvirt incorrectly handled certain bitmap
operations. A remote attacker could use this issue to cause libvirt to
crash, resulting in a denial of service. This issue only affected Ubuntu
13.04. (CVE-2013-5651)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
libvirt-bin 1.0.2-0ubuntu11.13.04.4
libvirt0 1.0.2-0ubuntu11.13.04.4

Ubuntu 12.10:
libvirt-bin 0.9.13-0ubuntu12.5
libvirt0 0.9.13-0ubuntu12.5

Ubuntu 12.04 LTS:
libvirt-bin 0.9.8-2ubuntu17.13
libvirt0 0.9.8-2ubuntu17.13

Ubuntu 10.04 LTS:
libvirt-bin 0.7.5-5ubuntu27.24
libvirt0 0.7.5-5ubuntu27.24

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1954-1
CVE-2013-4296, CVE-2013-4311, CVE-2013-5651

Package Information:
https://launchpad.net/ubuntu/+source/libvirt/1.0.2-0ubuntu11.13.04.4
https://launchpad.net/ubuntu/+source/libvirt/0.9.13-0ubuntu12.5
https://launchpad.net/ubuntu/+source/libvirt/0.9.8-2ubuntu17.13
https://launchpad.net/ubuntu/+source/libvirt/0.7.5-5ubuntu27.24


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130918/75ef19d5/attachment.pgp>

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce


End of ubuntu-security-announce Digest, Vol 108, Issue 8
********************************************************