WINDOWS CENTER: December 2013

Saturday, December 21, 2013

ubuntu-security-announce Digest, Vol 111, Issue 14

Friday, December 20, 2013

ubuntu-security-announce Digest, Vol 111, Issue 13

Thursday, December 19, 2013

ubuntu-security-announce Digest, Vol 111, Issue 12

Wednesday, December 18, 2013

ubuntu-security-announce Digest, Vol 111, Issue 11

Tuesday, December 17, 2013

ubuntu-security-announce Digest, Vol 111, Issue 10

Friday, December 13, 2013

ubuntu-security-announce Digest, Vol 111, Issue 9

Thursday, December 12, 2013

ubuntu-security-announce Digest, Vol 111, Issue 8

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."

Today's Topics:

1. [USN-2052-1] Firefox vulnerabilities (Chris Coulson)
2. [USN-2054-1] Samba vulnerabilities (Marc Deslauriers)
3. [USN-2053-1] Thunderbird vulnerabilities (Chris Coulson)

----------------------------------------------------------------------

Message: 1
Date: Wed, 11 Dec 2013 14:32:22 +0000
From: Chris Coulson <chris.coulson@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2052-1] Firefox vulnerabilities
Message-ID: <52A87776.5010506@canonical.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

==========================================================================
Ubuntu Security Notice USN-2052-1
December 11, 2013

firefox vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.10
- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS

Summary:

Firefox could be made to crash or run programs as your login if it
opened a malicious website.

Software Description:
- firefox: Mozilla Open Source web browser

Details:

Ben Turner, Bobby Holley, Jesse Ruderman, Christian Holler and Christoph
Diehl discovered multiple memory safety issues in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service via application
crash, or execute arbitrary code with the privileges of the user invoking
Firefox. (CVE-2013-5609, CVE-2013-5610)

Myk Melez discovered that the doorhanger notification for web app
installation could persist between page navigations. An attacker could
potentially exploit this to conduct clickjacking attacks. (CVE-2013-5611)

Masato Kinugawa discovered that pages with missing character set encoding
information can inherit character encodings across navigations from
another domain. An attacker could potentially exploit this to conduct
cross-site scripting attacks. (CVE-2013-5612)

Daniel Veditz discovered that a sandboxed iframe could use an object
element to bypass its own restrictions. (CVE-2013-5614)

Tyson Smith and Jesse Schwartzentruber discovered a use-after-free in
event listeners. An attacker could potentially exploit this to cause a
denial of service via application crash, or execute arbitrary code with
the privileges of the user invoking Firefox. (CVE-2013-5616)

A use-after-free was discovered in the table editing interface. An
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2013-5618)

Dan Gohman discovered that binary search algorithms in Spidermonkey
used arithmetic prone to overflow in several places. However, this
is issue not believed to be exploitable. (CVE-2013-5619)

Tyson Smith and Jesse Schwartzentruber discovered a crash when inserting
an ordered list in to a document using script. An attacker could
potentially exploit this to execute arbitrary code with the privileges
of the user invoking Firefox. (CVE-2013-6671)

Vincent Lefevre discovered that web content could access clipboard data
under certain circumstances, resulting in information disclosure.
(CVE-2013-6672)

Sijie Xia discovered that trust settings for built-in EV root certificates
were ignored under certain circumstances, removing the ability for a user
to manually untrust certificates from specific authorities.
(CVE-2013-6673)

Tyson Smith, Jesse Schwartzentruber and Atte Kettunen discovered a
use-after-free in functions for synthetic mouse movement handling. An
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2013-5613)

Eric Faust discovered that GetElementIC typed array stubs can be generated
outside observed typesets. An attacker could possibly exploit this to
cause undefined behaviour with a potential security impact.
(CVE-2013-5615)

Michal Zalewski discovered several issues with JPEG image handling. An
attacker could potentially exploit these to obtain sensitive information.
(CVE-2013-6629, CVE-2013-6630)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
firefox 26.0+build2-0ubuntu0.13.10.2

Ubuntu 13.04:
firefox 26.0+build2-0ubuntu0.13.04.2

Ubuntu 12.10:
firefox 26.0+build2-0ubuntu0.12.10.2

Ubuntu 12.04 LTS:
firefox 26.0+build2-0ubuntu0.12.04.2

After a standard system update you need to restart Firefox to make
all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2052-1
CVE-2013-5609, CVE-2013-5610, CVE-2013-5611, CVE-2013-5612,
CVE-2013-5613, CVE-2013-5614, CVE-2013-5615, CVE-2013-5616,
CVE-2013-5618, CVE-2013-5619, CVE-2013-6629, CVE-2013-6630,
CVE-2013-6671, CVE-2013-6672, CVE-2013-6673,https://launchpad.net/bugs/1258513

Package Information:
https://launchpad.net/ubuntu/+source/firefox/26.0+build2-0ubuntu0.13.10.2
https://launchpad.net/ubuntu/+source/firefox/26.0+build2-0ubuntu0.13.04.2
https://launchpad.net/ubuntu/+source/firefox/26.0+build2-0ubuntu0.12.10.2
https://launchpad.net/ubuntu/+source/firefox/26.0+build2-0ubuntu0.12.04.2

------------------------------

Message: 2
Date: Wed, 11 Dec 2013 09:33:51 -0500
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2054-1] Samba vulnerabilities
Message-ID: <52A877CF.5090008@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2054-1
December 11, 2013

samba vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.10
- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS

Summary:

Several security issues were fixed in Samba.

Software Description:
- samba: SMB/CIFS file, print, and login server for Unix

Details:

It was discovered that Winbind incorrectly handled invalid group names with
the require_membership_of parameter. If an administrator used an invalid
group name by mistake, access was granted instead of having the login fail.
(CVE-2012-6150)

Stefan Metzmacher and Michael Adam discovered that Samba incorrectly
handled DCE-RPC fragment length fields. A remote attacker could use this
issue to cause Samba to crash, resulting in a denial of service, or
possibly execute arbitrary code as the root user. (CVE-2013-4408)

Hemanth Thummala discovered that Samba incorrectly handled file
permissions when vfs_streams_depot or vfs_streams_xattr were enabled. A
remote attacker could use this issue to bypass intended restrictions.
(CVE-2013-4475)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
libpam-winbind 2:3.6.18-1ubuntu3.1
samba 2:3.6.18-1ubuntu3.1

Ubuntu 13.04:
libpam-winbind 2:3.6.9-1ubuntu1.2
samba 2:3.6.9-1ubuntu1.2

Ubuntu 12.10:
libpam-winbind 2:3.6.6-3ubuntu5.3
samba 2:3.6.6-3ubuntu5.3

Ubuntu 12.04 LTS:
libpam-winbind 2:3.6.3-2ubuntu2.9
samba 2:3.6.3-2ubuntu2.9

Ubuntu 10.04 LTS:
samba 2:3.4.7~dfsg-1ubuntu3.13
winbind 2:3.4.7~dfsg-1ubuntu3.13

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2054-1
CVE-2012-6150, CVE-2013-4408, CVE-2013-4475

Package Information:
https://launchpad.net/ubuntu/+source/samba/2:3.6.18-1ubuntu3.1
https://launchpad.net/ubuntu/+source/samba/2:3.6.9-1ubuntu1.2
https://launchpad.net/ubuntu/+source/samba/2:3.6.6-3ubuntu5.3
https://launchpad.net/ubuntu/+source/samba/2:3.6.3-2ubuntu2.9
https://launchpad.net/ubuntu/+source/samba/2:3.4.7~dfsg-1ubuntu3.13

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 901 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20131211/c3479535/attachment-0001.pgp>

------------------------------

Message: 3
Date: Wed, 11 Dec 2013 15:17:26 +0000
From: Chris Coulson <chris.coulson@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2053-1] Thunderbird vulnerabilities
Message-ID: <52A88206.9080206@canonical.com>
Content-Type: text/plain; charset="iso-8859-1"

==========================================================================
Ubuntu Security Notice USN-2053-1
December 11, 2013

thunderbird vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.10
- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS

Summary:

Several security issues were fixed in Thunderbird.

Software Description:
- thunderbird: Mozilla Open Source mail and newsgroup client

Details:

Ben Turner, Bobby Holley, Jesse Ruderman and Christian Holler discovered
multiple memory safety issues in Thunderbird. If a user were tricked in to
opening a specially crafted message with scripting enabled, an attacker
could potentially exploit these to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Thunderbird. (CVE-2013-5609)

Tyson Smith and Jesse Schwartzentruber discovered a use-after-free in
event listeners. If a user had enabled scripting, an attacker could
potentially exploit this to cause a denial of service via application
crash, or execute arbitrary code with the privileges of the user invoking
Thunderbird. (CVE-2013-5616)

A use-after-free was discovered in the table editing interface. An
attacker could potentially exploit this to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Thunderbird. (CVE-2013-5618)

Tyson Smith and Jesse Schwartzentruber discovered a crash when inserting
an ordered list in to a document using script. If a user had enabled
scripting, an attacker could potentially exploit this to execute
arbitrary code with the privileges of the user invoking Thunderbird.
(CVE-2013-6671)

Sijie Xia discovered that trust settings for built-in EV root certificates
were ignored under certain circumstances, removing the ability for a user
to manually untrust certificates from specific authorities.
(CVE-2013-6673)

Tyson Smith, Jesse Schwartzentruber and Atte Kettunen discovered a
use-after-free in functions for synthetic mouse movement handling. If a
user had enabled scripting, an attacker could potentially exploit this
to cause a denial of service via application crash, or execute arbitrary
code with the privileges of the user invoking Thunderbird. (CVE-2013-5613)

Eric Faust discovered that GetElementIC typed array stubs can be generated
outside observed typesets. If a user had enabled scripting, an attacker
could possibly exploit this to cause undefined behaviour with a potential
security impact. (CVE-2013-5615)

Michal Zalewski discovered several issues with JPEG image handling. An
attacker could potentially exploit these to obtain sensitive information.
(CVE-2013-6629, CVE-2013-6630)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
thunderbird 1:24.2.0+build1-0ubuntu0.13.10.1

Ubuntu 13.04:
thunderbird 1:24.2.0+build1-0ubuntu0.13.04.1

Ubuntu 12.10:
thunderbird 1:24.2.0+build1-0ubuntu0.12.10.1

Ubuntu 12.04 LTS:
thunderbird 1:24.2.0+build1-0ubuntu0.12.04.1

After a standard system update you need to restart Thunderbird to make
all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2053-1
CVE-2013-5609, CVE-2013-5613, CVE-2013-5615, CVE-2013-5616,
CVE-2013-5618, CVE-2013-6629, CVE-2013-6630, CVE-2013-6671,
CVE-2013-6673, https://launchpad.net/bugs/1258653

Package Information:
https://launchpad.net/ubuntu/+source/thunderbird/1:24.2.0+build1-0ubuntu0.13.10.1
https://launchpad.net/ubuntu/+source/thunderbird/1:24.2.0+build1-0ubuntu0.13.04.1
https://launchpad.net/ubuntu/+source/thunderbird/1:24.2.0+build1-0ubuntu0.12.10.1
https://launchpad.net/ubuntu/+source/thunderbird/1:24.2.0+build1-0ubuntu0.12.04.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 555 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20131211/512de5d3/attachment-0001.pgp>

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

End of ubuntu-security-announce Digest, Vol 111, Issue 8
********************************************************

Tuesday, December 10, 2013

ubuntu-security-announce Digest, Vol 111, Issue 7

Sunday, December 08, 2013

ubuntu-security-announce Digest, Vol 111, Issue 6

Saturday, December 07, 2013

ubuntu-security-announce Digest, Vol 111, Issue 5

Friday, December 06, 2013

ubuntu-security-announce Digest, Vol 111, Issue 4

Wednesday, December 04, 2013

ubuntu-security-announce Digest, Vol 111, Issue 3

Tuesday, December 03, 2013

ubuntu-security-announce Digest, Vol 111, Issue 2

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."

Today's Topics:

1. [USN-2041-1] Linux kernel (Raring HWE) vulnerabilities
(John Johansen)
2. [USN-2042-1] Linux kernel (Saucy HWE) vulnerabilities
(John Johansen)
3. [USN-2043-1] Linux kernel vulnerabilities (John Johansen)
4. [USN-2044-1] Linux kernel (OMAP4) vulnerabilities (John Johansen)
5. [USN-2045-1] Linux kernel vulnerabilities (John Johansen)
6. [USN-2046-1] Linux kernel (OMAP4) vulnerabilities (John Johansen)

----------------------------------------------------------------------

Message: 1
Date: Tue, 03 Dec 2013 11:56:49 -0800
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2041-1] Linux kernel (Raring HWE) vulnerabilities
Message-ID: <529E3781.2030809@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2041-1
December 03, 2013

linux-lts-raring vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description:
- linux-lts-raring: Linux hardware enablement kernel from Raring

Details:

A flaw was discovered in the Linux kernel's dm snapshot facility. A remote
authenticated user could exploit this flaw to obtain sensitive information
or modify/corrupt data. (CVE-2013-4299)

Alan Chester reported a flaw in the IPv6 Stream Control Transmission
Protocol (SCTP) of the Linux kernel. A remote attacker could exploit this
flaw to obtain sensitive information by sniffing network traffic.
(CVE-2013-4350)

Dmitry Vyukov reported a flaw in the Linux kernel's handling of IPv6 UDP
Fragmentation Offload (UFO) processing. A remote attacker could leverage
this flaw to cause a denial of service (system crash). (CVE-2013-4387)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
linux-image-3.8.0-34-generic 3.8.0-34.49~precise1

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References:
http://www.ubuntu.com/usn/usn-2041-1
CVE-2013-4299, CVE-2013-4350, CVE-2013-4387

Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-raring/3.8.0-34.49~precise1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 901 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20131203/38d6ceda/attachment-0001.pgp>

------------------------------

Message: 2
Date: Tue, 03 Dec 2013 11:57:25 -0800
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2042-1] Linux kernel (Saucy HWE) vulnerabilities
Message-ID: <529E37A5.2050401@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2042-1
December 03, 2013

linux-lts-saucy vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description:
- linux-lts-saucy: Linux hardware enablement kernel from Saucy

Details:

A flaw was discovered in the Linux kernel's dm snapshot facility. A remote
authenticated user could exploit this flaw to obtain sensitive information
or modify/corrupt data. (CVE-2013-4299)

Hannes Frederic Sowa discovered a flaw in the Linux kernel's UDP
Fragmenttation Offload (UFO). An unprivileged local user could exploit this
flaw to cause a denial of service (system crash) or possibly gain
administrative privileges. (CVE-2013-4470)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
linux-image-3.11.0-14-generic 3.11.0-14.21~precise1
linux-image-3.11.0-14-generic-lpae 3.11.0-14.21~precise1

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References:
http://www.ubuntu.com/usn/usn-2042-1
CVE-2013-4299, CVE-2013-4470

Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-saucy/3.11.0-14.21~precise1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 901 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20131203/20b2c9f1/attachment-0001.pgp>

------------------------------

Message: 3
Date: Tue, 03 Dec 2013 11:57:57 -0800
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2043-1] Linux kernel vulnerabilities
Message-ID: <529E37C5.10600@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2043-1
December 03, 2013

linux vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.10

Summary:

Several security issues were fixed in the kernel.

Software Description:
- linux: Linux kernel

Details:

A flaw was discovered in the Linux kernel's dm snapshot facility. A remote
authenticated user could exploit this flaw to obtain sensitive information
or modify/corrupt data. (CVE-2013-4299)

Hannes Frederic Sowa discovered a flaw in the Linux kernel's UDP
Fragmenttation Offload (UFO). An unprivileged local user could exploit this
flaw to cause a denial of service (system crash) or possibly gain
administrative privileges. (CVE-2013-4470)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
linux-image-3.5.0-44-generic 3.5.0-44.67
linux-image-3.5.0-44-highbank 3.5.0-44.67
linux-image-3.5.0-44-omap 3.5.0-44.67
linux-image-3.5.0-44-powerpc-smp 3.5.0-44.67
linux-image-3.5.0-44-powerpc64-smp 3.5.0-44.67

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References:
http://www.ubuntu.com/usn/usn-2043-1
CVE-2013-4299, CVE-2013-4470

Package Information:
https://launchpad.net/ubuntu/+source/linux/3.5.0-44.67

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 901 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20131203/edac7f5f/attachment-0001.pgp>

------------------------------

Message: 4
Date: Tue, 03 Dec 2013 11:58:26 -0800
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2044-1] Linux kernel (OMAP4) vulnerabilities
Message-ID: <529E37E2.30102@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2044-1
December 03, 2013

linux-ti-omap4 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.10

Summary:

Several security issues were fixed in the kernel.

Software Description:
- linux-ti-omap4: Linux kernel for OMAP4

Details:

A flaw was discovered in the Linux kernel's dm snapshot facility. A remote
authenticated user could exploit this flaw to obtain sensitive information
or modify/corrupt data. (CVE-2013-4299)

Hannes Frederic Sowa discovered a flaw in the Linux kernel's UDP
Fragmenttation Offload (UFO). An unprivileged local user could exploit this
flaw to cause a denial of service (system crash) or possibly gain
administrative privileges. (CVE-2013-4470)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
linux-image-3.5.0-236-omap4 3.5.0-236.52

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References:
http://www.ubuntu.com/usn/usn-2044-1
CVE-2013-4299, CVE-2013-4470

Package Information:
https://launchpad.net/ubuntu/+source/linux-ti-omap4/3.5.0-236.52

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 901 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20131203/af5a9d1e/attachment-0001.pgp>

------------------------------

Message: 5
Date: Tue, 03 Dec 2013 11:58:56 -0800
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2045-1] Linux kernel vulnerabilities
Message-ID: <529E3800.4020406@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2045-1
December 03, 2013

linux vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04

Summary:

Several security issues were fixed in the kernel.

Software Description:
- linux: Linux kernel

Details:

A flaw was discovered in the Linux kernel's dm snapshot facility. A remote
authenticated user could exploit this flaw to obtain sensitive information
or modify/corrupt data. (CVE-2013-4299)

Alan Chester reported a flaw in the IPv6 Stream Control Transmission
Protocol (SCTP) of the Linux kernel. A remote attacker could exploit this
flaw to obtain sensitive information by sniffing network traffic.
(CVE-2013-4350)

Dmitry Vyukov reported a flaw in the Linux kernel's handling of IPv6 UDP
Fragmentation Offload (UFO) processing. A remote attacker could leverage
this flaw to cause a denial of service (system crash). (CVE-2013-4387)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
linux-image-3.8.0-34-generic 3.8.0-34.49

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References:
http://www.ubuntu.com/usn/usn-2045-1
CVE-2013-4299, CVE-2013-4350, CVE-2013-4387

Package Information:
https://launchpad.net/ubuntu/+source/linux/3.8.0-34.49

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 901 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20131203/32cf4698/attachment-0001.pgp>

------------------------------

Message: 6
Date: Tue, 03 Dec 2013 11:59:23 -0800
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2046-1] Linux kernel (OMAP4) vulnerabilities
Message-ID: <529E381B.4010106@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2046-1
December 03, 2013

linux-ti-omap4 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04

Summary:

Several security issues were fixed in the kernel.

Software Description:
- linux-ti-omap4: Linux kernel for OMAP4

Details:

A flaw was discovered in the Linux kernel's dm snapshot facility. A remote
authenticated user could exploit this flaw to obtain sensitive information
or modify/corrupt data. (CVE-2013-4299)

Hannes Frederic Sowa discovered a flaw in the Linux kernel's UDP
Fragmenttation Offload (UFO). An unprivileged local user could exploit this
flaw to cause a denial of service (system crash) or possibly gain
administrative privileges. (CVE-2013-4470)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
linux-image-3.5.0-236-omap4 3.5.0-236.52

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References:
http://www.ubuntu.com/usn/usn-2046-1
CVE-2013-4299, CVE-2013-4470

Package Information:
https://launchpad.net/ubuntu/+source/linux-ti-omap4/3.5.0-236.52

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 901 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20131203/85d74735/attachment.pgp>

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

End of ubuntu-security-announce Digest, Vol 111, Issue 2
********************************************************

News