ubuntu-security-announce Digest, Vol 114, Issue 11

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."


Today's Topics:

1. [USN-2148-1] FreeType vulnerabilities (Marc Deslauriers)
2. [USN-2149-1] librsvg vulnerability (Marc Deslauriers)
3. [USN-2149-2] GTK+ update (Marc Deslauriers)


----------------------------------------------------------------------

Message: 1
Date: Mon, 17 Mar 2014 08:08:55 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2148-1] FreeType vulnerabilities
Message-ID: <5326E5D7.5010409@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2148-1
March 17, 2014

freetype vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.10

Summary:

FreeType could be made to crash or run programs as your login if it opened
a specially crafted font file.

Software Description:
- freetype: FreeType 2 is a font engine library

Details:

Mateusz Jurczyk discovered that FreeType did not correctly handle certain
malformed font files. If a user were tricked into using a specially crafted
font file, a remote attacker could cause FreeType to crash or possibly
execute arbitrary code with user privileges. (CVE-2014-2240, CVE-2014-2241)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
libfreetype6 2.4.12-0ubuntu1.1

After a standard system update you need to restart your session to make all
the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2148-1
CVE-2014-2240, CVE-2014-2241

Package Information:
https://launchpad.net/ubuntu/+source/freetype/2.4.12-0ubuntu1.1


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140317/c63de4c2/attachment-0001.pgp>

------------------------------

Message: 2
Date: Mon, 17 Mar 2014 08:09:24 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2149-1] librsvg vulnerability
Message-ID: <5326E5F4.2080700@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2149-1
March 17, 2014

librsvg vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.10
- Ubuntu 12.10
- Ubuntu 12.04 LTS

Summary:

Librsvg could be made to expose sensitive information.

Software Description:
- librsvg: renderer library for SVG files

Details:

It was discovered that librsvg would load XML external entities by default.
If a user were tricked into viewing a specially crafted SVG file, an
attacker could possibly obtain access to arbitrary files.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
librsvg2-2 2.36.4-2ubuntu0.1

Ubuntu 12.10:
librsvg2-2 2.36.3-0ubuntu1.1

Ubuntu 12.04 LTS:
librsvg2-2 2.36.1-0ubuntu1.1

After a standard system update you need to restart your session to make all
the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2149-1
CVE-2013-1881

Package Information:
https://launchpad.net/ubuntu/+source/librsvg/2.36.4-2ubuntu0.1
https://launchpad.net/ubuntu/+source/librsvg/2.36.3-0ubuntu1.1
https://launchpad.net/ubuntu/+source/librsvg/2.36.1-0ubuntu1.1


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140317/0d5ae725/attachment-0001.pgp>

------------------------------

Message: 3
Date: Mon, 17 Mar 2014 08:09:44 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2149-2] GTK+ update
Message-ID: <5326E608.6090906@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2149-2
March 17, 2014

gtk+3.0 update
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.10
- Ubuntu 12.04 LTS

Summary:

This update provides a compatibility fix for GTK+.

Software Description:
- gtk+3.0: GTK+ graphical user interface library

Details:

USN-2149-1 fixed a vulnerability in librsvg. This update provides a
compatibility fix for GTK+ to work with the librsvg security update.

Original advisory details:

It was discovered that librsvg would load XML external entities by default.
If a user were tricked into viewing a specially crafted SVG file, an
attacker could possibly obtain access to arbitrary files.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
libgtk-3-0 3.6.0-0ubuntu3.3

Ubuntu 12.04 LTS:
libgtk-3-0 3.4.2-0ubuntu0.7

After a standard system update you need to restart your session to make all
the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2149-2
http://www.ubuntu.com/usn/usn-2149-1
CVE-2013-1881

Package Information:
https://launchpad.net/ubuntu/+source/gtk+3.0/3.6.0-0ubuntu3.3
https://launchpad.net/ubuntu/+source/gtk+3.0/3.4.2-0ubuntu0.7


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140317/254c886c/attachment-0001.pgp>

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce


End of ubuntu-security-announce Digest, Vol 114, Issue 11
*********************************************************