Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-2228-1] Linux kernel vulnerabilities (John Johansen)
----------------------------------------------------------------------
Message: 1
Date: Tue, 27 May 2014 12:13:22 +0200
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2228-1] Linux kernel vulnerabilities
Message-ID: <53846542.9050703@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2228-1
May 27, 2014
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 13.10
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux: Linux kernel
Details:
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A flaw was discovered in the vhost-net subsystem of the Linux kernel. Guest
OS users could exploit this flaw to cause a denial of service (host OS
crash). (CVE-2014-0055)
A flaw was discovered in the handling of network packets when mergeable
buffers are disabled for virtual machines in the Linux kernel. Guest OS
users may exploit this flaw to cause a denial of service (host OS crash) or
possibly gain privilege on the host OS. (CVE-2014-0077)
Nikolay Aleksandrov discovered a race condition in Linux kernel's IPv4
fragment handling code. Remote attackers could exploit this flaw to cause a
denial of service (system crash) or possibly have other unspecified impact.
(CVE-2014-0100)
A flaw was discovered in the Linux kernel's handling of the SCTP handshake.
A remote attacker could exploit this flaw to cause a denial of service
(system crash). (CVE-2014-0101)
A flaw was discovered in the handling of routing information in Linux
kernel's IPv6 stack. A remote attacker could exploit this flaw to cause a
denial of service (memory consumption) via a flood of ICMPv6 router
advertisement packets. (CVE-2014-2309)
An error was discovered in the Linux kernel's DCCP protocol support. A
remote attacked could exploit this flaw to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2014-2523)
Max Sydorenko discovered a race condition in the Atheros 9k wireless driver
in the Linux kernel. This race could be exploited by remote attackers to
cause a denial of service (system crash). (CVE-2014-2672)
Adhemerval Zanella Neto discovered a flaw the in the Transactional Memory
(TM) implementation for powerpc based machine. An unprivileged local user
could exploit this flaw to cause a denial of service (system crash).
(CVE-2014-2673)
An error was discovered in the Reliable Datagram Sockets (RDS) protocol
stack in the Linux kernel. A local user could exploit this flaw to cause a
denial of service (system crash) or possibly have unspecified other impact.
(CVE-2014-2678)
Yaara Rozenblum discovered a race condition in the Linux kernel's Generic
IEEE 802.11 Networking Stack (mac80211). Remote attackers could exploit
this flaw to cause a denial of service (system crash). (CVE-2014-2706)
A flaw was discovered in the Linux kernel's ping sockets. An unprivileged
local user could exploit this flaw to cause a denial of service (system
crash) or possibly gain privileges via a crafted application.
(CVE-2014-2851)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 13.10:
linux-image-3.11.0-22-generic 3.11.0-22.38
linux-image-3.11.0-22-generic-lpae 3.11.0-22.38
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2228-1
CVE-2014-0055, CVE-2014-0077, CVE-2014-0100, CVE-2014-0101,
CVE-2014-1737, CVE-2014-1738, CVE-2014-2309, CVE-2014-2523,
CVE-2014-2672, CVE-2014-2673, CVE-2014-2678, CVE-2014-2706,
CVE-2014-2851
Package Information:
https://launchpad.net/ubuntu/+source/linux/3.11.0-22.38
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140527/956d06ab/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 116, Issue 13
*********************************************************
Tuesday, May 27, 2014
ubuntu-security-announce Digest, Vol 116, Issue 12
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-2224-1] Linux kernel (Raring HWE) vulnerabilities
(John Johansen)
2. [USN-2225-1] Linux kernel (Saucy HWE) vulnerabilities
(John Johansen)
3. [USN-2226-1] Linux kernel vulnerabilities (John Johansen)
4. [USN-2227-1] Linux kernel (OMAP4) vulnerabilities (John Johansen)
----------------------------------------------------------------------
Message: 1
Date: Tue, 27 May 2014 08:51:32 +0200
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2224-1] Linux kernel (Raring HWE) vulnerabilities
Message-ID: <538435F4.3060706@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2224-1
May 27, 2014
linux-lts-raring vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux-lts-raring: Linux hardware enablement kernel from Raring
Details:
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A flaw was discovered in the vhost-net subsystem of the Linux kernel. Guest
OS users could exploit this flaw to cause a denial of service (host OS
crash). (CVE-2014-0055)
A flaw was discovered in the handling of network packets when mergeable
buffers are disabled for virtual machines in the Linux kernel. Guest OS
users may exploit this flaw to cause a denial of service (host OS crash) or
possibly gain privilege on the host OS. (CVE-2014-0077)
A flaw was discovered in the Linux kernel's handling of the SCTP handshake.
A remote attacker could exploit this flaw to cause a denial of service
(system crash). (CVE-2014-0101)
A flaw was discovered in the handling of routing information in Linux
kernel's IPv6 stack. A remote attacker could exploit this flaw to cause a
denial of service (memory consumption) via a flood of ICMPv6 router
advertisement packets. (CVE-2014-2309)
An error was discovered in the Linux kernel's DCCP protocol support. A
remote attacked could exploit this flaw to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2014-2523)
Max Sydorenko discovered a race condition in the Atheros 9k wireless driver
in the Linux kernel. This race could be exploited by remote attackers to
cause a denial of service (system crash). (CVE-2014-2672)
An error was discovered in the Reliable Datagram Sockets (RDS) protocol
stack in the Linux kernel. A local user could exploit this flaw to cause a
denial of service (system crash) or possibly have unspecified other impact.
(CVE-2014-2678)
Yaara Rozenblum discovered a race condition in the Linux kernel's Generic
IEEE 802.11 Networking Stack (mac80211). Remote attackers could exploit
this flaw to cause a denial of service (system crash). (CVE-2014-2706)
A flaw was discovered in the Linux kernel's ping sockets. An unprivileged
local user could exploit this flaw to cause a denial of service (system
crash) or possibly gain privileges via a crafted application.
(CVE-2014-2851)
Sasha Levin reported a bug in the Linux kernel's virtual memory management
subsystem. An unprivileged local user could exploit this flaw to cause a
denial of service (system crash). (CVE-2014-3122)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
linux-image-3.8.0-41-generic 3.8.0-41.60~precise1
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2224-1
CVE-2014-0055, CVE-2014-0077, CVE-2014-0101, CVE-2014-1737,
CVE-2014-1738, CVE-2014-2309, CVE-2014-2523, CVE-2014-2672,
CVE-2014-2678, CVE-2014-2706, CVE-2014-2851, CVE-2014-3122
Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-raring/3.8.0-41.60~precise1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140527/230f1e70/attachment-0001.pgp>
------------------------------
Message: 2
Date: Tue, 27 May 2014 08:52:01 +0200
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2225-1] Linux kernel (Saucy HWE) vulnerabilities
Message-ID: <53843611.4080802@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2225-1
May 27, 2014
linux-lts-saucy vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux-lts-saucy: Linux hardware enablement kernel from Saucy
Details:
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A flaw was discovered in the vhost-net subsystem of the Linux kernel. Guest
OS users could exploit this flaw to cause a denial of service (host OS
crash). (CVE-2014-0055)
A flaw was discovered in the handling of network packets when mergeable
buffers are disabled for virtual machines in the Linux kernel. Guest OS
users may exploit this flaw to cause a denial of service (host OS crash) or
possibly gain privilege on the host OS. (CVE-2014-0077)
Nikolay Aleksandrov discovered a race condition in Linux kernel's IPv4
fragment handling code. Remote attackers could exploit this flaw to cause a
denial of service (system crash) or possibly have other unspecified impact.
(CVE-2014-0100)
A flaw was discovered in the Linux kernel's handling of the SCTP handshake.
A remote attacker could exploit this flaw to cause a denial of service
(system crash). (CVE-2014-0101)
A flaw was discovered in the handling of routing information in Linux
kernel's IPv6 stack. A remote attacker could exploit this flaw to cause a
denial of service (memory consumption) via a flood of ICMPv6 router
advertisement packets. (CVE-2014-2309)
An error was discovered in the Linux kernel's DCCP protocol support. A
remote attacked could exploit this flaw to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2014-2523)
Max Sydorenko discovered a race condition in the Atheros 9k wireless driver
in the Linux kernel. This race could be exploited by remote attackers to
cause a denial of service (system crash). (CVE-2014-2672)
Adhemerval Zanella Neto discovered a flaw the in the Transactional Memory
(TM) implementation for powerpc based machine. An unprivileged local user
could exploit this flaw to cause a denial of service (system crash).
(CVE-2014-2673)
An error was discovered in the Reliable Datagram Sockets (RDS) protocol
stack in the Linux kernel. A local user could exploit this flaw to cause a
denial of service (system crash) or possibly have unspecified other impact.
(CVE-2014-2678)
Yaara Rozenblum discovered a race condition in the Linux kernel's Generic
IEEE 802.11 Networking Stack (mac80211). Remote attackers could exploit
this flaw to cause a denial of service (system crash). (CVE-2014-2706)
A flaw was discovered in the Linux kernel's ping sockets. An unprivileged
local user could exploit this flaw to cause a denial of service (system
crash) or possibly gain privileges via a crafted application.
(CVE-2014-2851)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
linux-image-3.11.0-22-generic 3.11.0-22.38~precise1
linux-image-3.11.0-22-generic-lpae 3.11.0-22.38~precise1
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2225-1
CVE-2014-0055, CVE-2014-0077, CVE-2014-0100, CVE-2014-0101,
CVE-2014-1737, CVE-2014-1738, CVE-2014-2309, CVE-2014-2523,
CVE-2014-2672, CVE-2014-2673, CVE-2014-2678, CVE-2014-2706,
CVE-2014-2851
Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-saucy/3.11.0-22.38~precise1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140527/57d6bb08/attachment-0001.pgp>
------------------------------
Message: 3
Date: Tue, 27 May 2014 08:52:28 +0200
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2226-1] Linux kernel vulnerabilities
Message-ID: <5384362C.3060703@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2226-1
May 27, 2014
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux: Linux kernel
Details:
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A flaw was discovered in the handling of network packets when mergeable
buffers are disabled for virtual machines in the Linux kernel. Guest OS
users may exploit this flaw to cause a denial of service (host OS crash) or
possibly gain privilege on the host OS. (CVE-2014-0077)
A flaw was discovered in the Linux kernel's ping sockets. An unprivileged
local user could exploit this flaw to cause a denial of service (system
crash) or possibly gain privileges via a crafted application.
(CVE-2014-2851)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
linux-image-3.13.0-27-generic 3.13.0-27.50
linux-image-3.13.0-27-generic-lpae 3.13.0-27.50
linux-image-3.13.0-27-lowlatency 3.13.0-27.50
linux-image-3.13.0-27-powerpc-e500 3.13.0-27.50
linux-image-3.13.0-27-powerpc-e500mc 3.13.0-27.50
linux-image-3.13.0-27-powerpc-smp 3.13.0-27.50
linux-image-3.13.0-27-powerpc64-emb 3.13.0-27.50
linux-image-3.13.0-27-powerpc64-smp 3.13.0-27.50
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2226-1
CVE-2014-0077, CVE-2014-1737, CVE-2014-1738, CVE-2014-2851
Package Information:
https://launchpad.net/ubuntu/+source/linux/3.13.0-27.50
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140527/e496f836/attachment-0001.pgp>
------------------------------
Message: 4
Date: Tue, 27 May 2014 12:02:53 +0200
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2227-1] Linux kernel (OMAP4) vulnerabilities
Message-ID: <538462CD.4050401@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2227-1
May 27, 2014
linux-ti-omap4 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux-ti-omap4: Linux kernel for OMAP4
Details:
A flaw was discovered in the Linux kernel's pseudo tty (pty) device. An
unprivileged user could exploit this flaw to cause a denial of service
(system crash) or potentially gain administrator privileges.
(CVE-2014-0196)
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A flaw was discovered in the Linux kernel's IPC reference counting. An
unprivileged local user could exploit this flaw to cause a denial of
service (OOM system crash). (CVE-2013-4483)
Al Viro discovered an error in how CIFS in the Linux kernel handles
uncached write operations. An unprivileged local user could exploit this
flaw to cause a denial of service (system crash), obtain sensitive
information from kernel memory, or possibly gain privileges.
(CVE-2014-0069)
A flaw was discovered in the handling of network packets when mergeable
buffers are disabled for virtual machines in the Linux kernel. Guest OS
users may exploit this flaw to cause a denial of service (host OS crash) or
possibly gain privilege on the host OS. (CVE-2014-0077)
A flaw was discovered in the Linux kernel's handling of the SCTP handshake.
A remote attacker could exploit this flaw to cause a denial of service
(system crash). (CVE-2014-0101)
A flaw was discovered in the handling of routing information in Linux
kernel's IPv6 stack. A remote attacker could exploit this flaw to cause a
denial of service (memory consumption) via a flood of ICMPv6 router
advertisement packets. (CVE-2014-2309)
An error was discovered in the Linux kernel's DCCP protocol support. A
remote attacked could exploit this flaw to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2014-2523)
Max Sydorenko discovered a race condition in the Atheros 9k wireless driver
in the Linux kernel. This race could be exploited by remote attackers to
cause a denial of service (system crash). (CVE-2014-2672)
An error was discovered in the Reliable Datagram Sockets (RDS) protocol
stack in the Linux kernel. A local user could exploit this flaw to cause a
denial of service (system crash) or possibly have unspecified other impact.
(CVE-2014-2678)
Yaara Rozenblum discovered a race condition in the Linux kernel's Generic
IEEE 802.11 Networking Stack (mac80211). Remote attackers could exploit
this flaw to cause a denial of service (system crash). (CVE-2014-2706)
A flaw was discovered in the Linux kernel's ping sockets. An unprivileged
local user could exploit this flaw to cause a denial of service (system
crash) or possibly gain privileges via a crafted application.
(CVE-2014-2851)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
linux-image-3.2.0-1446-omap4 3.2.0-1446.65
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2227-1
CVE-2013-4483, CVE-2014-0069, CVE-2014-0077, CVE-2014-0101,
CVE-2014-0196, CVE-2014-1737, CVE-2014-1738, CVE-2014-2309,
CVE-2014-2523, CVE-2014-2672, CVE-2014-2678, CVE-2014-2706,
CVE-2014-2851
Package Information:
https://launchpad.net/ubuntu/+source/linux-ti-omap4/3.2.0-1446.65
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140527/b5f6d7ed/attachment.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 116, Issue 12
*********************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-2224-1] Linux kernel (Raring HWE) vulnerabilities
(John Johansen)
2. [USN-2225-1] Linux kernel (Saucy HWE) vulnerabilities
(John Johansen)
3. [USN-2226-1] Linux kernel vulnerabilities (John Johansen)
4. [USN-2227-1] Linux kernel (OMAP4) vulnerabilities (John Johansen)
----------------------------------------------------------------------
Message: 1
Date: Tue, 27 May 2014 08:51:32 +0200
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2224-1] Linux kernel (Raring HWE) vulnerabilities
Message-ID: <538435F4.3060706@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2224-1
May 27, 2014
linux-lts-raring vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux-lts-raring: Linux hardware enablement kernel from Raring
Details:
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A flaw was discovered in the vhost-net subsystem of the Linux kernel. Guest
OS users could exploit this flaw to cause a denial of service (host OS
crash). (CVE-2014-0055)
A flaw was discovered in the handling of network packets when mergeable
buffers are disabled for virtual machines in the Linux kernel. Guest OS
users may exploit this flaw to cause a denial of service (host OS crash) or
possibly gain privilege on the host OS. (CVE-2014-0077)
A flaw was discovered in the Linux kernel's handling of the SCTP handshake.
A remote attacker could exploit this flaw to cause a denial of service
(system crash). (CVE-2014-0101)
A flaw was discovered in the handling of routing information in Linux
kernel's IPv6 stack. A remote attacker could exploit this flaw to cause a
denial of service (memory consumption) via a flood of ICMPv6 router
advertisement packets. (CVE-2014-2309)
An error was discovered in the Linux kernel's DCCP protocol support. A
remote attacked could exploit this flaw to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2014-2523)
Max Sydorenko discovered a race condition in the Atheros 9k wireless driver
in the Linux kernel. This race could be exploited by remote attackers to
cause a denial of service (system crash). (CVE-2014-2672)
An error was discovered in the Reliable Datagram Sockets (RDS) protocol
stack in the Linux kernel. A local user could exploit this flaw to cause a
denial of service (system crash) or possibly have unspecified other impact.
(CVE-2014-2678)
Yaara Rozenblum discovered a race condition in the Linux kernel's Generic
IEEE 802.11 Networking Stack (mac80211). Remote attackers could exploit
this flaw to cause a denial of service (system crash). (CVE-2014-2706)
A flaw was discovered in the Linux kernel's ping sockets. An unprivileged
local user could exploit this flaw to cause a denial of service (system
crash) or possibly gain privileges via a crafted application.
(CVE-2014-2851)
Sasha Levin reported a bug in the Linux kernel's virtual memory management
subsystem. An unprivileged local user could exploit this flaw to cause a
denial of service (system crash). (CVE-2014-3122)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
linux-image-3.8.0-41-generic 3.8.0-41.60~precise1
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2224-1
CVE-2014-0055, CVE-2014-0077, CVE-2014-0101, CVE-2014-1737,
CVE-2014-1738, CVE-2014-2309, CVE-2014-2523, CVE-2014-2672,
CVE-2014-2678, CVE-2014-2706, CVE-2014-2851, CVE-2014-3122
Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-raring/3.8.0-41.60~precise1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140527/230f1e70/attachment-0001.pgp>
------------------------------
Message: 2
Date: Tue, 27 May 2014 08:52:01 +0200
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2225-1] Linux kernel (Saucy HWE) vulnerabilities
Message-ID: <53843611.4080802@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2225-1
May 27, 2014
linux-lts-saucy vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux-lts-saucy: Linux hardware enablement kernel from Saucy
Details:
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A flaw was discovered in the vhost-net subsystem of the Linux kernel. Guest
OS users could exploit this flaw to cause a denial of service (host OS
crash). (CVE-2014-0055)
A flaw was discovered in the handling of network packets when mergeable
buffers are disabled for virtual machines in the Linux kernel. Guest OS
users may exploit this flaw to cause a denial of service (host OS crash) or
possibly gain privilege on the host OS. (CVE-2014-0077)
Nikolay Aleksandrov discovered a race condition in Linux kernel's IPv4
fragment handling code. Remote attackers could exploit this flaw to cause a
denial of service (system crash) or possibly have other unspecified impact.
(CVE-2014-0100)
A flaw was discovered in the Linux kernel's handling of the SCTP handshake.
A remote attacker could exploit this flaw to cause a denial of service
(system crash). (CVE-2014-0101)
A flaw was discovered in the handling of routing information in Linux
kernel's IPv6 stack. A remote attacker could exploit this flaw to cause a
denial of service (memory consumption) via a flood of ICMPv6 router
advertisement packets. (CVE-2014-2309)
An error was discovered in the Linux kernel's DCCP protocol support. A
remote attacked could exploit this flaw to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2014-2523)
Max Sydorenko discovered a race condition in the Atheros 9k wireless driver
in the Linux kernel. This race could be exploited by remote attackers to
cause a denial of service (system crash). (CVE-2014-2672)
Adhemerval Zanella Neto discovered a flaw the in the Transactional Memory
(TM) implementation for powerpc based machine. An unprivileged local user
could exploit this flaw to cause a denial of service (system crash).
(CVE-2014-2673)
An error was discovered in the Reliable Datagram Sockets (RDS) protocol
stack in the Linux kernel. A local user could exploit this flaw to cause a
denial of service (system crash) or possibly have unspecified other impact.
(CVE-2014-2678)
Yaara Rozenblum discovered a race condition in the Linux kernel's Generic
IEEE 802.11 Networking Stack (mac80211). Remote attackers could exploit
this flaw to cause a denial of service (system crash). (CVE-2014-2706)
A flaw was discovered in the Linux kernel's ping sockets. An unprivileged
local user could exploit this flaw to cause a denial of service (system
crash) or possibly gain privileges via a crafted application.
(CVE-2014-2851)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
linux-image-3.11.0-22-generic 3.11.0-22.38~precise1
linux-image-3.11.0-22-generic-lpae 3.11.0-22.38~precise1
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2225-1
CVE-2014-0055, CVE-2014-0077, CVE-2014-0100, CVE-2014-0101,
CVE-2014-1737, CVE-2014-1738, CVE-2014-2309, CVE-2014-2523,
CVE-2014-2672, CVE-2014-2673, CVE-2014-2678, CVE-2014-2706,
CVE-2014-2851
Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-saucy/3.11.0-22.38~precise1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140527/57d6bb08/attachment-0001.pgp>
------------------------------
Message: 3
Date: Tue, 27 May 2014 08:52:28 +0200
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2226-1] Linux kernel vulnerabilities
Message-ID: <5384362C.3060703@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2226-1
May 27, 2014
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux: Linux kernel
Details:
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A flaw was discovered in the handling of network packets when mergeable
buffers are disabled for virtual machines in the Linux kernel. Guest OS
users may exploit this flaw to cause a denial of service (host OS crash) or
possibly gain privilege on the host OS. (CVE-2014-0077)
A flaw was discovered in the Linux kernel's ping sockets. An unprivileged
local user could exploit this flaw to cause a denial of service (system
crash) or possibly gain privileges via a crafted application.
(CVE-2014-2851)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
linux-image-3.13.0-27-generic 3.13.0-27.50
linux-image-3.13.0-27-generic-lpae 3.13.0-27.50
linux-image-3.13.0-27-lowlatency 3.13.0-27.50
linux-image-3.13.0-27-powerpc-e500 3.13.0-27.50
linux-image-3.13.0-27-powerpc-e500mc 3.13.0-27.50
linux-image-3.13.0-27-powerpc-smp 3.13.0-27.50
linux-image-3.13.0-27-powerpc64-emb 3.13.0-27.50
linux-image-3.13.0-27-powerpc64-smp 3.13.0-27.50
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2226-1
CVE-2014-0077, CVE-2014-1737, CVE-2014-1738, CVE-2014-2851
Package Information:
https://launchpad.net/ubuntu/+source/linux/3.13.0-27.50
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140527/e496f836/attachment-0001.pgp>
------------------------------
Message: 4
Date: Tue, 27 May 2014 12:02:53 +0200
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2227-1] Linux kernel (OMAP4) vulnerabilities
Message-ID: <538462CD.4050401@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2227-1
May 27, 2014
linux-ti-omap4 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux-ti-omap4: Linux kernel for OMAP4
Details:
A flaw was discovered in the Linux kernel's pseudo tty (pty) device. An
unprivileged user could exploit this flaw to cause a denial of service
(system crash) or potentially gain administrator privileges.
(CVE-2014-0196)
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A flaw was discovered in the Linux kernel's IPC reference counting. An
unprivileged local user could exploit this flaw to cause a denial of
service (OOM system crash). (CVE-2013-4483)
Al Viro discovered an error in how CIFS in the Linux kernel handles
uncached write operations. An unprivileged local user could exploit this
flaw to cause a denial of service (system crash), obtain sensitive
information from kernel memory, or possibly gain privileges.
(CVE-2014-0069)
A flaw was discovered in the handling of network packets when mergeable
buffers are disabled for virtual machines in the Linux kernel. Guest OS
users may exploit this flaw to cause a denial of service (host OS crash) or
possibly gain privilege on the host OS. (CVE-2014-0077)
A flaw was discovered in the Linux kernel's handling of the SCTP handshake.
A remote attacker could exploit this flaw to cause a denial of service
(system crash). (CVE-2014-0101)
A flaw was discovered in the handling of routing information in Linux
kernel's IPv6 stack. A remote attacker could exploit this flaw to cause a
denial of service (memory consumption) via a flood of ICMPv6 router
advertisement packets. (CVE-2014-2309)
An error was discovered in the Linux kernel's DCCP protocol support. A
remote attacked could exploit this flaw to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2014-2523)
Max Sydorenko discovered a race condition in the Atheros 9k wireless driver
in the Linux kernel. This race could be exploited by remote attackers to
cause a denial of service (system crash). (CVE-2014-2672)
An error was discovered in the Reliable Datagram Sockets (RDS) protocol
stack in the Linux kernel. A local user could exploit this flaw to cause a
denial of service (system crash) or possibly have unspecified other impact.
(CVE-2014-2678)
Yaara Rozenblum discovered a race condition in the Linux kernel's Generic
IEEE 802.11 Networking Stack (mac80211). Remote attackers could exploit
this flaw to cause a denial of service (system crash). (CVE-2014-2706)
A flaw was discovered in the Linux kernel's ping sockets. An unprivileged
local user could exploit this flaw to cause a denial of service (system
crash) or possibly gain privileges via a crafted application.
(CVE-2014-2851)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
linux-image-3.2.0-1446-omap4 3.2.0-1446.65
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2227-1
CVE-2013-4483, CVE-2014-0069, CVE-2014-0077, CVE-2014-0101,
CVE-2014-0196, CVE-2014-1737, CVE-2014-1738, CVE-2014-2309,
CVE-2014-2523, CVE-2014-2672, CVE-2014-2678, CVE-2014-2706,
CVE-2014-2851
Package Information:
https://launchpad.net/ubuntu/+source/linux-ti-omap4/3.2.0-1446.65
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140527/b5f6d7ed/attachment.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 116, Issue 12
*********************************************************
Monday, May 26, 2014
ubuntu-security-announce Digest, Vol 116, Issue 11
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-2219-1] Linux kernel vulnerabilities (John Johansen)
2. [USN-2220-1] Linux kernel (EC2) vulnerabilities (John Johansen)
3. [USN-2221-1] Linux kernel vulnerabilities (John Johansen)
4. [USN-2222-1] mod_wsgi vulnerabilities (Seth Arnold)
5. [USN-2223-1] Linux kernel (Quantal HWE) vulnerabilities
(John Johansen)
----------------------------------------------------------------------
Message: 1
Date: Mon, 26 May 2014 14:16:35 +0200
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2219-1] Linux kernel vulnerabilities
Message-ID: <538330A3.5050304@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2219-1
May 26, 2014
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux: Linux kernel
Details:
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A flaw was discovered in the Reliable Datagram Sockets (RDS) protocol
implementation in the Linux kernel for systems that lack RDS transports. An
unprivileged local user could exploit this flaw to cause a denial of
service (system crash). (CVE-2013-7339)
An error was discovered in the Reliable Datagram Sockets (RDS) protocol
stack in the Linux kernel. A local user could exploit this flaw to cause a
denial of service (system crash) or possibly have unspecified other impact.
(CVE-2014-2678)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 10.04 LTS:
linux-image-2.6.32-60-386 2.6.32-60.122
linux-image-2.6.32-60-generic 2.6.32-60.122
linux-image-2.6.32-60-generic-pae 2.6.32-60.122
linux-image-2.6.32-60-ia64 2.6.32-60.122
linux-image-2.6.32-60-lpia 2.6.32-60.122
linux-image-2.6.32-60-powerpc 2.6.32-60.122
linux-image-2.6.32-60-powerpc-smp 2.6.32-60.122
linux-image-2.6.32-60-powerpc64-smp 2.6.32-60.122
linux-image-2.6.32-60-preempt 2.6.32-60.122
linux-image-2.6.32-60-server 2.6.32-60.122
linux-image-2.6.32-60-sparc64 2.6.32-60.122
linux-image-2.6.32-60-sparc64-smp 2.6.32-60.122
linux-image-2.6.32-60-versatile 2.6.32-60.122
linux-image-2.6.32-60-virtual 2.6.32-60.122
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2219-1
CVE-2013-7339, CVE-2014-1737, CVE-2014-1738, CVE-2014-2678
Package Information:
https://launchpad.net/ubuntu/+source/linux/2.6.32-60.122
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140526/7a55c7bd/attachment-0001.pgp>
------------------------------
Message: 2
Date: Mon, 26 May 2014 14:17:03 +0200
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2220-1] Linux kernel (EC2) vulnerabilities
Message-ID: <538330BF.70009@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2220-1
May 26, 2014
linux-ec2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux-ec2: Linux kernel for EC2
Details:
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A flaw was discovered in the Reliable Datagram Sockets (RDS) protocol
implementation in the Linux kernel for systems that lack RDS transports. An
unprivileged local user could exploit this flaw to cause a denial of
service (system crash). (CVE-2013-7339)
An error was discovered in the Reliable Datagram Sockets (RDS) protocol
stack in the Linux kernel. A local user could exploit this flaw to cause a
denial of service (system crash) or possibly have unspecified other impact.
(CVE-2014-2678)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 10.04 LTS:
linux-image-2.6.32-364-ec2 2.6.32-364.77
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2220-1
CVE-2013-7339, CVE-2014-1737, CVE-2014-1738, CVE-2014-2678
Package Information:
https://launchpad.net/ubuntu/+source/linux-ec2/2.6.32-364.77
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140526/ff514d45/attachment-0001.pgp>
------------------------------
Message: 3
Date: Mon, 26 May 2014 14:17:33 +0200
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2221-1] Linux kernel vulnerabilities
Message-ID: <538330DD.2080702@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2221-1
May 26, 2014
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux: Linux kernel
Details:
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A flaw was discovered in the Linux kernel's IPC reference counting. An
unprivileged local user could exploit this flaw to cause a denial of
service (OOM system crash). (CVE-2013-4483)
Al Viro discovered an error in how CIFS in the Linux kernel handles
uncached write operations. An unprivileged local user could exploit this
flaw to cause a denial of service (system crash), obtain sensitive
information from kernel memory, or possibly gain privileges.
(CVE-2014-0069)
A flaw was discovered in the handling of network packets when mergeable
buffers are disabled for virtual machines in the Linux kernel. Guest OS
users may exploit this flaw to cause a denial of service (host OS crash) or
possibly gain privilege on the host OS. (CVE-2014-0077)
A flaw was discovered in the Linux kernel's handling of the SCTP handshake.
A remote attacker could exploit this flaw to cause a denial of service
(system crash). (CVE-2014-0101)
A flaw was discovered in the handling of routing information in Linux
kernel's IPv6 stack. A remote attacker could exploit this flaw to cause a
denial of service (memory consumption) via a flood of ICMPv6 router
advertisement packets. (CVE-2014-2309)
An error was discovered in the Linux kernel's DCCP protocol support. A
remote attacked could exploit this flaw to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2014-2523)
Max Sydorenko discovered a race condition in the Atheros 9k wireless driver
in the Linux kernel. This race could be exploited by remote attackers to
cause a denial of service (system crash). (CVE-2014-2672)
An error was discovered in the Reliable Datagram Sockets (RDS) protocol
stack in the Linux kernel. A local user could exploit this flaw to cause a
denial of service (system crash) or possibly have unspecified other impact.
(CVE-2014-2678)
Yaara Rozenblum discovered a race condition in the Linux kernel's Generic
IEEE 802.11 Networking Stack (mac80211). Remote attackers could exploit
this flaw to cause a denial of service (system crash). (CVE-2014-2706)
A flaw was discovered in the Linux kernel's ping sockets. An unprivileged
local user could exploit this flaw to cause a denial of service (system
crash) or possibly gain privileges via a crafted application.
(CVE-2014-2851)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
linux-image-3.2.0-63-generic 3.2.0-63.95
linux-image-3.2.0-63-generic-pae 3.2.0-63.95
linux-image-3.2.0-63-highbank 3.2.0-63.95
linux-image-3.2.0-63-omap 3.2.0-63.95
linux-image-3.2.0-63-powerpc-smp 3.2.0-63.95
linux-image-3.2.0-63-powerpc64-smp 3.2.0-63.95
linux-image-3.2.0-63-virtual 3.2.0-63.95
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2221-1
CVE-2013-4483, CVE-2014-0069, CVE-2014-0077, CVE-2014-0101,
CVE-2014-1737, CVE-2014-1738, CVE-2014-2309, CVE-2014-2523,
CVE-2014-2672, CVE-2014-2678, CVE-2014-2706, CVE-2014-2851
Package Information:
https://launchpad.net/ubuntu/+source/linux/3.2.0-63.95
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140526/edbf114d/attachment-0001.pgp>
------------------------------
Message: 4
Date: Mon, 26 May 2014 15:15:55 +0200
From: Seth Arnold <seth.arnold@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2222-1] mod_wsgi vulnerabilities
Message-ID: <20140526131555.GA6745@hunt>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-2222-1
May 26, 2014
mod-wsgi vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.04 LTS
Summary:
mod_wsgi could be made to run programs as an administrator if it executes
a specially crafted file.
mod_wsgi could be made to expose sensitive information over the network.
Software Description:
- mod-wsgi: Python WSGI adapter module for Apache
Details:
R?bert Kisteleki discovered mod_wsgi incorrectly checked setuid return
values. A malicious application could use this issue to cause a local
privilege escalation when using daemon mode. (CVE-2014-0240)
Buck Golemon discovered that mod_wsgi used memory that had been freed.
A remote attacker could use this issue to read process memory via the
Content-Type response header. This issue only affected Ubuntu 12.04 LTS.
(CVE-2014-0242)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
libapache2-mod-wsgi 3.4-4ubuntu2.1.14.04.1
libapache2-mod-wsgi-py3 3.4-4ubuntu2.1.14.04.1
Ubuntu 13.10:
libapache2-mod-wsgi 3.4-4ubuntu2.1.13.10.1
libapache2-mod-wsgi-py3 3.4-4ubuntu2.1.13.10.1
Ubuntu 12.04 LTS:
libapache2-mod-wsgi 3.3-4ubuntu0.1
libapache2-mod-wsgi-py3 3.3-4ubuntu0.1
After a standard system update you need to restart apache2 to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2222-1
CVE-2014-0240, CVE-2014-0242
Package Information:
https://launchpad.net/ubuntu/+source/mod-wsgi/3.4-4ubuntu2.1.14.04.1
https://launchpad.net/ubuntu/+source/mod-wsgi/3.4-4ubuntu2.1.13.10.1
https://launchpad.net/ubuntu/+source/mod-wsgi/3.3-4ubuntu0.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140526/539c55f2/attachment-0001.pgp>
------------------------------
Message: 5
Date: Tue, 27 May 2014 08:51:02 +0200
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2223-1] Linux kernel (Quantal HWE) vulnerabilities
Message-ID: <538435D6.7000303@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2223-1
May 27, 2014
linux-lts-quantal vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux-lts-quantal: Linux hardware enablement kernel from Quantal
Details:
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A flaw was discovered in the Linux kernel's IPC reference counting. An
unprivileged local user could exploit this flaw to cause a denial of
service (OOM system crash). (CVE-2013-4483)
A flaw was discovered in the vhost-net subsystem of the Linux kernel. Guest
OS users could exploit this flaw to cause a denial of service (host OS
crash). (CVE-2014-0055)
A flaw was discovered in the handling of network packets when mergeable
buffers are disabled for virtual machines in the Linux kernel. Guest OS
users may exploit this flaw to cause a denial of service (host OS crash) or
possibly gain privilege on the host OS. (CVE-2014-0077)
A flaw was discovered in the Linux kernel's handling of the SCTP handshake.
A remote attacker could exploit this flaw to cause a denial of service
(system crash). (CVE-2014-0101)
A flaw was discovered in the handling of routing information in Linux
kernel's IPv6 stack. A remote attacker could exploit this flaw to cause a
denial of service (memory consumption) via a flood of ICMPv6 router
advertisement packets. (CVE-2014-2309)
An error was discovered in the Linux kernel's DCCP protocol support. A
remote attacked could exploit this flaw to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2014-2523)
Max Sydorenko discovered a race condition in the Atheros 9k wireless driver
in the Linux kernel. This race could be exploited by remote attackers to
cause a denial of service (system crash). (CVE-2014-2672)
An error was discovered in the Reliable Datagram Sockets (RDS) protocol
stack in the Linux kernel. A local user could exploit this flaw to cause a
denial of service (system crash) or possibly have unspecified other impact.
(CVE-2014-2678)
Yaara Rozenblum discovered a race condition in the Linux kernel's Generic
IEEE 802.11 Networking Stack (mac80211). Remote attackers could exploit
this flaw to cause a denial of service (system crash). (CVE-2014-2706)
A flaw was discovered in the Linux kernel's ping sockets. An unprivileged
local user could exploit this flaw to cause a denial of service (system
crash) or possibly gain privileges via a crafted application.
(CVE-2014-2851)
Sasha Levin reported a bug in the Linux kernel's virtual memory management
subsystem. An unprivileged local user could exploit this flaw to cause a
denial of service (system crash). (CVE-2014-3122)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
linux-image-3.5.0-51-generic 3.5.0-51.76~precise1
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2223-1
CVE-2013-4483, CVE-2014-0055, CVE-2014-0077, CVE-2014-0101,
CVE-2014-1737, CVE-2014-1738, CVE-2014-2309, CVE-2014-2523,
CVE-2014-2672, CVE-2014-2678, CVE-2014-2706, CVE-2014-2851,
CVE-2014-3122
Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-quantal/3.5.0-51.76~precise1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140527/45a1af7b/attachment.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 116, Issue 11
*********************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-2219-1] Linux kernel vulnerabilities (John Johansen)
2. [USN-2220-1] Linux kernel (EC2) vulnerabilities (John Johansen)
3. [USN-2221-1] Linux kernel vulnerabilities (John Johansen)
4. [USN-2222-1] mod_wsgi vulnerabilities (Seth Arnold)
5. [USN-2223-1] Linux kernel (Quantal HWE) vulnerabilities
(John Johansen)
----------------------------------------------------------------------
Message: 1
Date: Mon, 26 May 2014 14:16:35 +0200
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2219-1] Linux kernel vulnerabilities
Message-ID: <538330A3.5050304@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2219-1
May 26, 2014
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux: Linux kernel
Details:
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A flaw was discovered in the Reliable Datagram Sockets (RDS) protocol
implementation in the Linux kernel for systems that lack RDS transports. An
unprivileged local user could exploit this flaw to cause a denial of
service (system crash). (CVE-2013-7339)
An error was discovered in the Reliable Datagram Sockets (RDS) protocol
stack in the Linux kernel. A local user could exploit this flaw to cause a
denial of service (system crash) or possibly have unspecified other impact.
(CVE-2014-2678)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 10.04 LTS:
linux-image-2.6.32-60-386 2.6.32-60.122
linux-image-2.6.32-60-generic 2.6.32-60.122
linux-image-2.6.32-60-generic-pae 2.6.32-60.122
linux-image-2.6.32-60-ia64 2.6.32-60.122
linux-image-2.6.32-60-lpia 2.6.32-60.122
linux-image-2.6.32-60-powerpc 2.6.32-60.122
linux-image-2.6.32-60-powerpc-smp 2.6.32-60.122
linux-image-2.6.32-60-powerpc64-smp 2.6.32-60.122
linux-image-2.6.32-60-preempt 2.6.32-60.122
linux-image-2.6.32-60-server 2.6.32-60.122
linux-image-2.6.32-60-sparc64 2.6.32-60.122
linux-image-2.6.32-60-sparc64-smp 2.6.32-60.122
linux-image-2.6.32-60-versatile 2.6.32-60.122
linux-image-2.6.32-60-virtual 2.6.32-60.122
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2219-1
CVE-2013-7339, CVE-2014-1737, CVE-2014-1738, CVE-2014-2678
Package Information:
https://launchpad.net/ubuntu/+source/linux/2.6.32-60.122
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140526/7a55c7bd/attachment-0001.pgp>
------------------------------
Message: 2
Date: Mon, 26 May 2014 14:17:03 +0200
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2220-1] Linux kernel (EC2) vulnerabilities
Message-ID: <538330BF.70009@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2220-1
May 26, 2014
linux-ec2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux-ec2: Linux kernel for EC2
Details:
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A flaw was discovered in the Reliable Datagram Sockets (RDS) protocol
implementation in the Linux kernel for systems that lack RDS transports. An
unprivileged local user could exploit this flaw to cause a denial of
service (system crash). (CVE-2013-7339)
An error was discovered in the Reliable Datagram Sockets (RDS) protocol
stack in the Linux kernel. A local user could exploit this flaw to cause a
denial of service (system crash) or possibly have unspecified other impact.
(CVE-2014-2678)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 10.04 LTS:
linux-image-2.6.32-364-ec2 2.6.32-364.77
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2220-1
CVE-2013-7339, CVE-2014-1737, CVE-2014-1738, CVE-2014-2678
Package Information:
https://launchpad.net/ubuntu/+source/linux-ec2/2.6.32-364.77
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140526/ff514d45/attachment-0001.pgp>
------------------------------
Message: 3
Date: Mon, 26 May 2014 14:17:33 +0200
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2221-1] Linux kernel vulnerabilities
Message-ID: <538330DD.2080702@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2221-1
May 26, 2014
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux: Linux kernel
Details:
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A flaw was discovered in the Linux kernel's IPC reference counting. An
unprivileged local user could exploit this flaw to cause a denial of
service (OOM system crash). (CVE-2013-4483)
Al Viro discovered an error in how CIFS in the Linux kernel handles
uncached write operations. An unprivileged local user could exploit this
flaw to cause a denial of service (system crash), obtain sensitive
information from kernel memory, or possibly gain privileges.
(CVE-2014-0069)
A flaw was discovered in the handling of network packets when mergeable
buffers are disabled for virtual machines in the Linux kernel. Guest OS
users may exploit this flaw to cause a denial of service (host OS crash) or
possibly gain privilege on the host OS. (CVE-2014-0077)
A flaw was discovered in the Linux kernel's handling of the SCTP handshake.
A remote attacker could exploit this flaw to cause a denial of service
(system crash). (CVE-2014-0101)
A flaw was discovered in the handling of routing information in Linux
kernel's IPv6 stack. A remote attacker could exploit this flaw to cause a
denial of service (memory consumption) via a flood of ICMPv6 router
advertisement packets. (CVE-2014-2309)
An error was discovered in the Linux kernel's DCCP protocol support. A
remote attacked could exploit this flaw to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2014-2523)
Max Sydorenko discovered a race condition in the Atheros 9k wireless driver
in the Linux kernel. This race could be exploited by remote attackers to
cause a denial of service (system crash). (CVE-2014-2672)
An error was discovered in the Reliable Datagram Sockets (RDS) protocol
stack in the Linux kernel. A local user could exploit this flaw to cause a
denial of service (system crash) or possibly have unspecified other impact.
(CVE-2014-2678)
Yaara Rozenblum discovered a race condition in the Linux kernel's Generic
IEEE 802.11 Networking Stack (mac80211). Remote attackers could exploit
this flaw to cause a denial of service (system crash). (CVE-2014-2706)
A flaw was discovered in the Linux kernel's ping sockets. An unprivileged
local user could exploit this flaw to cause a denial of service (system
crash) or possibly gain privileges via a crafted application.
(CVE-2014-2851)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
linux-image-3.2.0-63-generic 3.2.0-63.95
linux-image-3.2.0-63-generic-pae 3.2.0-63.95
linux-image-3.2.0-63-highbank 3.2.0-63.95
linux-image-3.2.0-63-omap 3.2.0-63.95
linux-image-3.2.0-63-powerpc-smp 3.2.0-63.95
linux-image-3.2.0-63-powerpc64-smp 3.2.0-63.95
linux-image-3.2.0-63-virtual 3.2.0-63.95
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2221-1
CVE-2013-4483, CVE-2014-0069, CVE-2014-0077, CVE-2014-0101,
CVE-2014-1737, CVE-2014-1738, CVE-2014-2309, CVE-2014-2523,
CVE-2014-2672, CVE-2014-2678, CVE-2014-2706, CVE-2014-2851
Package Information:
https://launchpad.net/ubuntu/+source/linux/3.2.0-63.95
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140526/edbf114d/attachment-0001.pgp>
------------------------------
Message: 4
Date: Mon, 26 May 2014 15:15:55 +0200
From: Seth Arnold <seth.arnold@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2222-1] mod_wsgi vulnerabilities
Message-ID: <20140526131555.GA6745@hunt>
Content-Type: text/plain; charset="iso-8859-1"
==========================================================================
Ubuntu Security Notice USN-2222-1
May 26, 2014
mod-wsgi vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.04 LTS
Summary:
mod_wsgi could be made to run programs as an administrator if it executes
a specially crafted file.
mod_wsgi could be made to expose sensitive information over the network.
Software Description:
- mod-wsgi: Python WSGI adapter module for Apache
Details:
R?bert Kisteleki discovered mod_wsgi incorrectly checked setuid return
values. A malicious application could use this issue to cause a local
privilege escalation when using daemon mode. (CVE-2014-0240)
Buck Golemon discovered that mod_wsgi used memory that had been freed.
A remote attacker could use this issue to read process memory via the
Content-Type response header. This issue only affected Ubuntu 12.04 LTS.
(CVE-2014-0242)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
libapache2-mod-wsgi 3.4-4ubuntu2.1.14.04.1
libapache2-mod-wsgi-py3 3.4-4ubuntu2.1.14.04.1
Ubuntu 13.10:
libapache2-mod-wsgi 3.4-4ubuntu2.1.13.10.1
libapache2-mod-wsgi-py3 3.4-4ubuntu2.1.13.10.1
Ubuntu 12.04 LTS:
libapache2-mod-wsgi 3.3-4ubuntu0.1
libapache2-mod-wsgi-py3 3.3-4ubuntu0.1
After a standard system update you need to restart apache2 to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2222-1
CVE-2014-0240, CVE-2014-0242
Package Information:
https://launchpad.net/ubuntu/+source/mod-wsgi/3.4-4ubuntu2.1.14.04.1
https://launchpad.net/ubuntu/+source/mod-wsgi/3.4-4ubuntu2.1.13.10.1
https://launchpad.net/ubuntu/+source/mod-wsgi/3.3-4ubuntu0.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140526/539c55f2/attachment-0001.pgp>
------------------------------
Message: 5
Date: Tue, 27 May 2014 08:51:02 +0200
From: John Johansen <john.johansen@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2223-1] Linux kernel (Quantal HWE) vulnerabilities
Message-ID: <538435D6.7000303@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2223-1
May 27, 2014
linux-lts-quantal vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux-lts-quantal: Linux hardware enablement kernel from Quantal
Details:
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A flaw was discovered in the Linux kernel's IPC reference counting. An
unprivileged local user could exploit this flaw to cause a denial of
service (OOM system crash). (CVE-2013-4483)
A flaw was discovered in the vhost-net subsystem of the Linux kernel. Guest
OS users could exploit this flaw to cause a denial of service (host OS
crash). (CVE-2014-0055)
A flaw was discovered in the handling of network packets when mergeable
buffers are disabled for virtual machines in the Linux kernel. Guest OS
users may exploit this flaw to cause a denial of service (host OS crash) or
possibly gain privilege on the host OS. (CVE-2014-0077)
A flaw was discovered in the Linux kernel's handling of the SCTP handshake.
A remote attacker could exploit this flaw to cause a denial of service
(system crash). (CVE-2014-0101)
A flaw was discovered in the handling of routing information in Linux
kernel's IPv6 stack. A remote attacker could exploit this flaw to cause a
denial of service (memory consumption) via a flood of ICMPv6 router
advertisement packets. (CVE-2014-2309)
An error was discovered in the Linux kernel's DCCP protocol support. A
remote attacked could exploit this flaw to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2014-2523)
Max Sydorenko discovered a race condition in the Atheros 9k wireless driver
in the Linux kernel. This race could be exploited by remote attackers to
cause a denial of service (system crash). (CVE-2014-2672)
An error was discovered in the Reliable Datagram Sockets (RDS) protocol
stack in the Linux kernel. A local user could exploit this flaw to cause a
denial of service (system crash) or possibly have unspecified other impact.
(CVE-2014-2678)
Yaara Rozenblum discovered a race condition in the Linux kernel's Generic
IEEE 802.11 Networking Stack (mac80211). Remote attackers could exploit
this flaw to cause a denial of service (system crash). (CVE-2014-2706)
A flaw was discovered in the Linux kernel's ping sockets. An unprivileged
local user could exploit this flaw to cause a denial of service (system
crash) or possibly gain privileges via a crafted application.
(CVE-2014-2851)
Sasha Levin reported a bug in the Linux kernel's virtual memory management
subsystem. An unprivileged local user could exploit this flaw to cause a
denial of service (system crash). (CVE-2014-3122)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
linux-image-3.5.0-51-generic 3.5.0-51.76~precise1
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2223-1
CVE-2013-4483, CVE-2014-0055, CVE-2014-0077, CVE-2014-0101,
CVE-2014-1737, CVE-2014-1738, CVE-2014-2309, CVE-2014-2523,
CVE-2014-2672, CVE-2014-2678, CVE-2014-2706, CVE-2014-2851,
CVE-2014-3122
Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-quantal/3.5.0-51.76~precise1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140527/45a1af7b/attachment.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 116, Issue 11
*********************************************************
Thursday, May 22, 2014
ubuntu-security-announce Digest, Vol 116, Issue 10
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-2216-1] Pidgin vulnerability (Marc Deslauriers)
2. [USN-2215-1] libgadu vulnerability (Marc Deslauriers)
3. [USN-2217-1] lxml vulnerability (Marc Deslauriers)
4. [USN-2218-1] Xalan-Java vulnerability (Marc Deslauriers)
----------------------------------------------------------------------
Message: 1
Date: Wed, 21 May 2014 08:43:28 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2216-1] Pidgin vulnerability
Message-ID: <537C9F70.8090105@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2216-1
May 21, 2014
pidgin vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.04 LTS
Summary:
Pidgin could be made to crash or run programs if it received specially
crafted network traffic.
Software Description:
- pidgin: graphical multi-protocol instant messaging client for X
Details:
It was discovered that Pidgin incorrectly handled certain messages from
Gadu-Gadu file relay servers. A malicious remote server or a man in the
middle could use this issue to cause Pidgin to crash, resulting in a denial
of service, or possibly execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
libpurple0 1:2.10.9-0ubuntu3.1
pidgin 1:2.10.9-0ubuntu3.1
Ubuntu 13.10:
libpurple0 1:2.10.7-0ubuntu4.1.13.10.2
pidgin 1:2.10.7-0ubuntu4.1.13.10.2
Ubuntu 12.04 LTS:
libpurple0 1:2.10.3-0ubuntu1.5
pidgin 1:2.10.3-0ubuntu1.5
After a standard system update you need to restart Pidgin to make all the
necessary changes.
References:
http://www.ubuntu.com/usn/usn-2216-1
CVE-2014-3775
Package Information:
https://launchpad.net/ubuntu/+source/pidgin/1:2.10.9-0ubuntu3.1
https://launchpad.net/ubuntu/+source/pidgin/1:2.10.7-0ubuntu4.1.13.10.2
https://launchpad.net/ubuntu/+source/pidgin/1:2.10.3-0ubuntu1.5
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140521/45334c90/attachment-0001.pgp>
------------------------------
Message: 2
Date: Wed, 21 May 2014 08:43:04 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2215-1] libgadu vulnerability
Message-ID: <537C9F58.2060101@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2215-1
May 21, 2014
libgadu vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 13.10
- Ubuntu 12.04 LTS
Summary:
libgadu could be made to crash or run programs if it received specially
crafted network traffic.
Software Description:
- libgadu: Gadu-Gadu protocol library
Details:
It was discovered that libgadu incorrectly handled certain messages from
file relay servers. A malicious remote server or a man in the middle could
use this issue to cause applications using libgadu to crash, resulting in a
denial of service, or possibly execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 13.10:
libgadu3 1:1.11.2-1ubuntu1.2
Ubuntu 12.04 LTS:
libgadu3 1:1.11.1-1ubuntu0.2
After a standard system update you need to restart your session to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2215-1
CVE-2014-3775
Package Information:
https://launchpad.net/ubuntu/+source/libgadu/1:1.11.2-1ubuntu1.2
https://launchpad.net/ubuntu/+source/libgadu/1:1.11.1-1ubuntu0.2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140521/785c80c7/attachment-0001.pgp>
------------------------------
Message: 3
Date: Wed, 21 May 2014 12:03:17 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2217-1] lxml vulnerability
Message-ID: <537CCE45.9080109@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2217-1
May 21, 2014
lxml vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.04 LTS
Summary:
lxml could allow cross-site scripting (XSS) attacks.
Software Description:
- lxml: pythonic binding for the libxml2 and libxslt libraries
Details:
It was discovered that the lxml.html.clean module incorrectly stripped
control characters. An attacked could potentially exploit this to conduct
cross-site scripting (XSS) attacks.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
python-lxml 3.3.3-1ubuntu0.1
python3-lxml 3.3.3-1ubuntu0.1
Ubuntu 13.10:
python-lxml 3.2.0-1ubuntu0.1
python3-lxml 3.2.0-1ubuntu0.1
Ubuntu 12.04 LTS:
python-lxml 2.3.2-1ubuntu0.2
python3-lxml 2.3.2-1ubuntu0.2
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2217-1
CVE-2014-3146
Package Information:
https://launchpad.net/ubuntu/+source/lxml/3.3.3-1ubuntu0.1
https://launchpad.net/ubuntu/+source/lxml/3.2.0-1ubuntu0.1
https://launchpad.net/ubuntu/+source/lxml/2.3.2-1ubuntu0.2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140521/fff1eaea/attachment-0001.pgp>
------------------------------
Message: 4
Date: Wed, 21 May 2014 15:26:27 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2218-1] Xalan-Java vulnerability
Message-ID: <537CFDE3.70804@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2218-1
May 21, 2014
libxalan2-java vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 13.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
Xalan-Java could be made to load arbitrary classes or access external
resources.
Software Description:
- libxalan2-java: XSL Transformations (XSLT) processor in Java
Details:
Nicolas Gregoire discovered that Xalan-Java incorrectly handled certain
properties when the secure processing feature was enabled. An attacker
could possibly use this issue to load arbitrary classes or access external
resources.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 13.10:
libxalan2-java 2.7.1-8ubuntu0.1
libxsltc-java 2.7.1-8ubuntu0.1
Ubuntu 12.04 LTS:
libxalan2-java 2.7.1-7ubuntu0.1
libxsltc-java 2.7.1-7ubuntu0.1
Ubuntu 10.04 LTS:
libxalan2-java 2.7.1-5ubuntu1.1
libxalan2-java-gcj 2.7.1-5ubuntu1.1
libxsltc-java 2.7.1-5ubuntu1.1
libxsltc-java-gcj 2.7.1-5ubuntu1.1
After a standard system update you need to reboot your computer to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2218-1
CVE-2014-0107
Package Information:
https://launchpad.net/ubuntu/+source/libxalan2-java/2.7.1-8ubuntu0.1
https://launchpad.net/ubuntu/+source/libxalan2-java/2.7.1-7ubuntu0.1
https://launchpad.net/ubuntu/+source/libxalan2-java/2.7.1-5ubuntu1.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140521/0c4fd6ed/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 116, Issue 10
*********************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-2216-1] Pidgin vulnerability (Marc Deslauriers)
2. [USN-2215-1] libgadu vulnerability (Marc Deslauriers)
3. [USN-2217-1] lxml vulnerability (Marc Deslauriers)
4. [USN-2218-1] Xalan-Java vulnerability (Marc Deslauriers)
----------------------------------------------------------------------
Message: 1
Date: Wed, 21 May 2014 08:43:28 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2216-1] Pidgin vulnerability
Message-ID: <537C9F70.8090105@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2216-1
May 21, 2014
pidgin vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.04 LTS
Summary:
Pidgin could be made to crash or run programs if it received specially
crafted network traffic.
Software Description:
- pidgin: graphical multi-protocol instant messaging client for X
Details:
It was discovered that Pidgin incorrectly handled certain messages from
Gadu-Gadu file relay servers. A malicious remote server or a man in the
middle could use this issue to cause Pidgin to crash, resulting in a denial
of service, or possibly execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
libpurple0 1:2.10.9-0ubuntu3.1
pidgin 1:2.10.9-0ubuntu3.1
Ubuntu 13.10:
libpurple0 1:2.10.7-0ubuntu4.1.13.10.2
pidgin 1:2.10.7-0ubuntu4.1.13.10.2
Ubuntu 12.04 LTS:
libpurple0 1:2.10.3-0ubuntu1.5
pidgin 1:2.10.3-0ubuntu1.5
After a standard system update you need to restart Pidgin to make all the
necessary changes.
References:
http://www.ubuntu.com/usn/usn-2216-1
CVE-2014-3775
Package Information:
https://launchpad.net/ubuntu/+source/pidgin/1:2.10.9-0ubuntu3.1
https://launchpad.net/ubuntu/+source/pidgin/1:2.10.7-0ubuntu4.1.13.10.2
https://launchpad.net/ubuntu/+source/pidgin/1:2.10.3-0ubuntu1.5
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140521/45334c90/attachment-0001.pgp>
------------------------------
Message: 2
Date: Wed, 21 May 2014 08:43:04 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2215-1] libgadu vulnerability
Message-ID: <537C9F58.2060101@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2215-1
May 21, 2014
libgadu vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 13.10
- Ubuntu 12.04 LTS
Summary:
libgadu could be made to crash or run programs if it received specially
crafted network traffic.
Software Description:
- libgadu: Gadu-Gadu protocol library
Details:
It was discovered that libgadu incorrectly handled certain messages from
file relay servers. A malicious remote server or a man in the middle could
use this issue to cause applications using libgadu to crash, resulting in a
denial of service, or possibly execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 13.10:
libgadu3 1:1.11.2-1ubuntu1.2
Ubuntu 12.04 LTS:
libgadu3 1:1.11.1-1ubuntu0.2
After a standard system update you need to restart your session to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2215-1
CVE-2014-3775
Package Information:
https://launchpad.net/ubuntu/+source/libgadu/1:1.11.2-1ubuntu1.2
https://launchpad.net/ubuntu/+source/libgadu/1:1.11.1-1ubuntu0.2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140521/785c80c7/attachment-0001.pgp>
------------------------------
Message: 3
Date: Wed, 21 May 2014 12:03:17 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2217-1] lxml vulnerability
Message-ID: <537CCE45.9080109@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2217-1
May 21, 2014
lxml vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.04 LTS
Summary:
lxml could allow cross-site scripting (XSS) attacks.
Software Description:
- lxml: pythonic binding for the libxml2 and libxslt libraries
Details:
It was discovered that the lxml.html.clean module incorrectly stripped
control characters. An attacked could potentially exploit this to conduct
cross-site scripting (XSS) attacks.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
python-lxml 3.3.3-1ubuntu0.1
python3-lxml 3.3.3-1ubuntu0.1
Ubuntu 13.10:
python-lxml 3.2.0-1ubuntu0.1
python3-lxml 3.2.0-1ubuntu0.1
Ubuntu 12.04 LTS:
python-lxml 2.3.2-1ubuntu0.2
python3-lxml 2.3.2-1ubuntu0.2
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2217-1
CVE-2014-3146
Package Information:
https://launchpad.net/ubuntu/+source/lxml/3.3.3-1ubuntu0.1
https://launchpad.net/ubuntu/+source/lxml/3.2.0-1ubuntu0.1
https://launchpad.net/ubuntu/+source/lxml/2.3.2-1ubuntu0.2
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140521/fff1eaea/attachment-0001.pgp>
------------------------------
Message: 4
Date: Wed, 21 May 2014 15:26:27 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2218-1] Xalan-Java vulnerability
Message-ID: <537CFDE3.70804@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2218-1
May 21, 2014
libxalan2-java vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 13.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
Xalan-Java could be made to load arbitrary classes or access external
resources.
Software Description:
- libxalan2-java: XSL Transformations (XSLT) processor in Java
Details:
Nicolas Gregoire discovered that Xalan-Java incorrectly handled certain
properties when the secure processing feature was enabled. An attacker
could possibly use this issue to load arbitrary classes or access external
resources.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 13.10:
libxalan2-java 2.7.1-8ubuntu0.1
libxsltc-java 2.7.1-8ubuntu0.1
Ubuntu 12.04 LTS:
libxalan2-java 2.7.1-7ubuntu0.1
libxsltc-java 2.7.1-7ubuntu0.1
Ubuntu 10.04 LTS:
libxalan2-java 2.7.1-5ubuntu1.1
libxalan2-java-gcj 2.7.1-5ubuntu1.1
libxsltc-java 2.7.1-5ubuntu1.1
libxsltc-java-gcj 2.7.1-5ubuntu1.1
After a standard system update you need to reboot your computer to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2218-1
CVE-2014-0107
Package Information:
https://launchpad.net/ubuntu/+source/libxalan2-java/2.7.1-8ubuntu0.1
https://launchpad.net/ubuntu/+source/libxalan2-java/2.7.1-7ubuntu0.1
https://launchpad.net/ubuntu/+source/libxalan2-java/2.7.1-5ubuntu1.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140521/0c4fd6ed/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 116, Issue 10
*********************************************************
Saturday, May 17, 2014
ubuntu-security-announce Digest, Vol 116, Issue 9
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. Ubuntu 12.10 (Quantal Quetzal) End of Life reached on May 16
2014 (Adam Conrad)
----------------------------------------------------------------------
Message: 1
Date: Fri, 16 May 2014 19:37:07 -0600
From: Adam Conrad <adconrad@ubuntu.com>
To: ubuntu-announce@lists.ubuntu.com
Cc: ubuntu-security-announce@lists.ubuntu.com
Subject: Ubuntu 12.10 (Quantal Quetzal) End of Life reached on May 16
2014
Message-ID: <20140517013706.GY28005@0c3.net>
Content-Type: text/plain; charset=us-ascii
This is a follow-up to the End of Life warning sent last month to
confirm that as of today (May 16, 2014), Ubuntu 12.10 is no longer
supported. No more package updates will be accepted to 12.10, and
it will be archived to old-releases.ubuntu.com in the coming weeks.
The original End of Life warning follows, with upgrade instructions:
Ubuntu announced its 12.10 (Quantal Quetzal) release more than 18 months
ago, on October 18, 2012. Since changes to the Ubuntu support cycle
mean that Ubuntu 13.04 has reached end of life before Ubuntu 12.10, the
support cycle for Ubuntu 12.10 has been extended slightly to overlap
with the release of Ubuntu 14.04 LTS. This will allow users to move
directly from Ubuntu 12.10 to Ubuntu 14.04 LTS (via Ubuntu 13.10).
This period of overlap is now coming to a close, and we will be retiring
Ubuntu 12.10 on Friday, May 16, 2014. At that time, Ubuntu Security
Notices will no longer include information or updated packages for
Ubuntu 12.10.
The supported upgrade path from Ubuntu 12.10 is via Ubuntu 13.10, though
we highly recommend that once you've upgraded to 13.10, you continue to
upgrade through to 14.04, as 13.10's support will end in July.
Instructions and caveats for the upgrade may be found at:
https://help.ubuntu.com/community/SaucyUpgrades
https://help.ubuntu.com/community/TrustyUpgrades
Ubuntu 13.10 and 14.04 continue to be actively supported with security
updates and select high-impact bug fixes. Announcements of security
updates for Ubuntu releases are sent to the ubuntu-security-announce
mailing list, information about which may be found at:
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
Since its launch in October 2004 Ubuntu has become one of the most
highly regarded Linux distributions with millions of users in homes,
schools, businesses and governments around the world. Ubuntu is Open
Source software, costs nothing to download, and users are free to
customize or alter their software in order to meet their needs.
On behalf of the Ubuntu Release Team,
Adam Conrad
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 116, Issue 9
********************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. Ubuntu 12.10 (Quantal Quetzal) End of Life reached on May 16
2014 (Adam Conrad)
----------------------------------------------------------------------
Message: 1
Date: Fri, 16 May 2014 19:37:07 -0600
From: Adam Conrad <adconrad@ubuntu.com>
To: ubuntu-announce@lists.ubuntu.com
Cc: ubuntu-security-announce@lists.ubuntu.com
Subject: Ubuntu 12.10 (Quantal Quetzal) End of Life reached on May 16
2014
Message-ID: <20140517013706.GY28005@0c3.net>
Content-Type: text/plain; charset=us-ascii
This is a follow-up to the End of Life warning sent last month to
confirm that as of today (May 16, 2014), Ubuntu 12.10 is no longer
supported. No more package updates will be accepted to 12.10, and
it will be archived to old-releases.ubuntu.com in the coming weeks.
The original End of Life warning follows, with upgrade instructions:
Ubuntu announced its 12.10 (Quantal Quetzal) release more than 18 months
ago, on October 18, 2012. Since changes to the Ubuntu support cycle
mean that Ubuntu 13.04 has reached end of life before Ubuntu 12.10, the
support cycle for Ubuntu 12.10 has been extended slightly to overlap
with the release of Ubuntu 14.04 LTS. This will allow users to move
directly from Ubuntu 12.10 to Ubuntu 14.04 LTS (via Ubuntu 13.10).
This period of overlap is now coming to a close, and we will be retiring
Ubuntu 12.10 on Friday, May 16, 2014. At that time, Ubuntu Security
Notices will no longer include information or updated packages for
Ubuntu 12.10.
The supported upgrade path from Ubuntu 12.10 is via Ubuntu 13.10, though
we highly recommend that once you've upgraded to 13.10, you continue to
upgrade through to 14.04, as 13.10's support will end in July.
Instructions and caveats for the upgrade may be found at:
https://help.ubuntu.com/community/SaucyUpgrades
https://help.ubuntu.com/community/TrustyUpgrades
Ubuntu 13.10 and 14.04 continue to be actively supported with security
updates and select high-impact bug fixes. Announcements of security
updates for Ubuntu releases are sent to the ubuntu-security-announce
mailing list, information about which may be found at:
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
Since its launch in October 2004 Ubuntu has become one of the most
highly regarded Linux distributions with millions of users in homes,
schools, businesses and governments around the world. Ubuntu is Open
Source software, costs nothing to download, and users are free to
customize or alter their software in order to meet their needs.
On behalf of the Ubuntu Release Team,
Adam Conrad
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 116, Issue 9
********************************************************
Friday, May 16, 2014
ubuntu-security-announce Digest, Vol 116, Issue 8
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-2213-1] Dovecot vulnerability (Marc Deslauriers)
2. [USN-2214-1] libxml2 vulnerability (Marc Deslauriers)
----------------------------------------------------------------------
Message: 1
Date: Thu, 15 May 2014 11:02:00 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2213-1] Dovecot vulnerability
Message-ID: <5374D6E8.3000607@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2213-1
May 15, 2014
dovecot vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
Dovecot could be made to stop responding if it received specially crafted
network traffic.
Software Description:
- dovecot: IMAP and POP3 email server
Details:
It was discovered that Dovecot incorrectly handled closing inactive SSL/TLS
connections. A remote attacker could use this issue to cause Dovecot to
stop responding to new connections, resulting in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
dovecot-core 1:2.2.9-1ubuntu2.1
dovecot-imapd 1:2.2.9-1ubuntu2.1
dovecot-pop3d 1:2.2.9-1ubuntu2.1
Ubuntu 13.10:
dovecot-core 1:2.1.7-7ubuntu3.1
dovecot-imapd 1:2.1.7-7ubuntu3.1
dovecot-pop3d 1:2.1.7-7ubuntu3.1
Ubuntu 12.10:
dovecot-core 1:2.1.7-1ubuntu2.1
dovecot-imapd 1:2.1.7-1ubuntu2.1
dovecot-pop3d 1:2.1.7-1ubuntu2.1
Ubuntu 12.04 LTS:
dovecot-core 1:2.0.19-0ubuntu2.1
dovecot-imapd 1:2.0.19-0ubuntu2.1
dovecot-pop3d 1:2.0.19-0ubuntu2.1
Ubuntu 10.04 LTS:
dovecot-imapd 1:1.2.9-1ubuntu6.6
dovecot-pop3d 1:1.2.9-1ubuntu6.6
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2213-1
CVE-2014-3430
Package Information:
https://launchpad.net/ubuntu/+source/dovecot/1:2.2.9-1ubuntu2.1
https://launchpad.net/ubuntu/+source/dovecot/1:2.1.7-7ubuntu3.1
https://launchpad.net/ubuntu/+source/dovecot/1:2.1.7-1ubuntu2.1
https://launchpad.net/ubuntu/+source/dovecot/1:2.0.19-0ubuntu2.1
https://launchpad.net/ubuntu/+source/dovecot/1:1.2.9-1ubuntu6.6
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140515/fa59b925/attachment-0001.pgp>
------------------------------
Message: 2
Date: Thu, 15 May 2014 14:01:22 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2214-1] libxml2 vulnerability
Message-ID: <537500F2.2050509@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2214-1
May 15, 2014
libxml2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
libxml2 could be made to consume resources if it processed a specially
crafted file.
Software Description:
- libxml2: GNOME XML library
Details:
Daniel Berrange discovered that libxml2 would incorrectly perform entity
substitution even when requested not to. If a user or automated system were
tricked into opening a specially crafted document, an attacker could
possibly cause resource consumption, resulting in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
libxml2 2.9.1+dfsg1-3ubuntu4.1
Ubuntu 13.10:
libxml2 2.9.1+dfsg1-3ubuntu2.1
Ubuntu 12.10:
libxml2 2.8.0+dfsg1-5ubuntu2.5
Ubuntu 12.04 LTS:
libxml2 2.7.8.dfsg-5.1ubuntu4.7
Ubuntu 10.04 LTS:
libxml2 2.7.6.dfsg-1ubuntu1.11
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2214-1
CVE-2014-0191
Package Information:
https://launchpad.net/ubuntu/+source/libxml2/2.9.1+dfsg1-3ubuntu4.1
https://launchpad.net/ubuntu/+source/libxml2/2.9.1+dfsg1-3ubuntu2.1
https://launchpad.net/ubuntu/+source/libxml2/2.8.0+dfsg1-5ubuntu2.5
https://launchpad.net/ubuntu/+source/libxml2/2.7.8.dfsg-5.1ubuntu4.7
https://launchpad.net/ubuntu/+source/libxml2/2.7.6.dfsg-1ubuntu1.11
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140515/32fbcd99/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 116, Issue 8
********************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-2213-1] Dovecot vulnerability (Marc Deslauriers)
2. [USN-2214-1] libxml2 vulnerability (Marc Deslauriers)
----------------------------------------------------------------------
Message: 1
Date: Thu, 15 May 2014 11:02:00 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2213-1] Dovecot vulnerability
Message-ID: <5374D6E8.3000607@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2213-1
May 15, 2014
dovecot vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
Dovecot could be made to stop responding if it received specially crafted
network traffic.
Software Description:
- dovecot: IMAP and POP3 email server
Details:
It was discovered that Dovecot incorrectly handled closing inactive SSL/TLS
connections. A remote attacker could use this issue to cause Dovecot to
stop responding to new connections, resulting in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
dovecot-core 1:2.2.9-1ubuntu2.1
dovecot-imapd 1:2.2.9-1ubuntu2.1
dovecot-pop3d 1:2.2.9-1ubuntu2.1
Ubuntu 13.10:
dovecot-core 1:2.1.7-7ubuntu3.1
dovecot-imapd 1:2.1.7-7ubuntu3.1
dovecot-pop3d 1:2.1.7-7ubuntu3.1
Ubuntu 12.10:
dovecot-core 1:2.1.7-1ubuntu2.1
dovecot-imapd 1:2.1.7-1ubuntu2.1
dovecot-pop3d 1:2.1.7-1ubuntu2.1
Ubuntu 12.04 LTS:
dovecot-core 1:2.0.19-0ubuntu2.1
dovecot-imapd 1:2.0.19-0ubuntu2.1
dovecot-pop3d 1:2.0.19-0ubuntu2.1
Ubuntu 10.04 LTS:
dovecot-imapd 1:1.2.9-1ubuntu6.6
dovecot-pop3d 1:1.2.9-1ubuntu6.6
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2213-1
CVE-2014-3430
Package Information:
https://launchpad.net/ubuntu/+source/dovecot/1:2.2.9-1ubuntu2.1
https://launchpad.net/ubuntu/+source/dovecot/1:2.1.7-7ubuntu3.1
https://launchpad.net/ubuntu/+source/dovecot/1:2.1.7-1ubuntu2.1
https://launchpad.net/ubuntu/+source/dovecot/1:2.0.19-0ubuntu2.1
https://launchpad.net/ubuntu/+source/dovecot/1:1.2.9-1ubuntu6.6
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140515/fa59b925/attachment-0001.pgp>
------------------------------
Message: 2
Date: Thu, 15 May 2014 14:01:22 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2214-1] libxml2 vulnerability
Message-ID: <537500F2.2050509@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2214-1
May 15, 2014
libxml2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
libxml2 could be made to consume resources if it processed a specially
crafted file.
Software Description:
- libxml2: GNOME XML library
Details:
Daniel Berrange discovered that libxml2 would incorrectly perform entity
substitution even when requested not to. If a user or automated system were
tricked into opening a specially crafted document, an attacker could
possibly cause resource consumption, resulting in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
libxml2 2.9.1+dfsg1-3ubuntu4.1
Ubuntu 13.10:
libxml2 2.9.1+dfsg1-3ubuntu2.1
Ubuntu 12.10:
libxml2 2.8.0+dfsg1-5ubuntu2.5
Ubuntu 12.04 LTS:
libxml2 2.7.8.dfsg-5.1ubuntu4.7
Ubuntu 10.04 LTS:
libxml2 2.7.6.dfsg-1ubuntu1.11
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2214-1
CVE-2014-0191
Package Information:
https://launchpad.net/ubuntu/+source/libxml2/2.9.1+dfsg1-3ubuntu4.1
https://launchpad.net/ubuntu/+source/libxml2/2.9.1+dfsg1-3ubuntu2.1
https://launchpad.net/ubuntu/+source/libxml2/2.8.0+dfsg1-5ubuntu2.5
https://launchpad.net/ubuntu/+source/libxml2/2.7.8.dfsg-5.1ubuntu4.7
https://launchpad.net/ubuntu/+source/libxml2/2.7.6.dfsg-1ubuntu1.11
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140515/32fbcd99/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 116, Issue 8
********************************************************
Thursday, May 15, 2014
ubuntu-security-announce Digest, Vol 116, Issue 7
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-2211-1] libXfont vulnerabilities (Marc Deslauriers)
2. [USN-2212-1] Django vulnerabilities (Seth Arnold)
----------------------------------------------------------------------
Message: 1
Date: Wed, 14 May 2014 10:44:35 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2211-1] libXfont vulnerabilities
Message-ID: <53738153.8030007@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2211-1
May 14, 2014
libxfont vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in libXfont.
Software Description:
- libxfont: X11 font rasterisation library
Details:
Ilja van Sprundel discovered that libXfont incorrectly handled font
metadata file parsing. A local attacker could use this issue to cause
libXfont to crash, or possibly execute arbitrary code in order to gain
privileges. (CVE-2014-0209)
Ilja van Sprundel discovered that libXfont incorrectly handled X Font
Server replies. A malicious font server could return specially-crafted data
that could cause libXfont to crash, or possibly execute arbitrary code.
This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS, Ubuntu 12.10
and Ubuntu 13.10. (CVE-2014-0210, CVE-2014-0211)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
libxfont1 1:1.4.7-1ubuntu0.1
Ubuntu 13.10:
libxfont1 1:1.4.6-1ubuntu0.2
Ubuntu 12.10:
libxfont1 1:1.4.5-2ubuntu0.12.10.2
Ubuntu 12.04 LTS:
libxfont1 1:1.4.4-1ubuntu0.2
Ubuntu 10.04 LTS:
libxfont1 1:1.4.1-1ubuntu0.3
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2211-1
CVE-2014-0209, CVE-2014-0210, CVE-2014-0211
Package Information:
https://launchpad.net/ubuntu/+source/libxfont/1:1.4.7-1ubuntu0.1
https://launchpad.net/ubuntu/+source/libxfont/1:1.4.6-1ubuntu0.2
https://launchpad.net/ubuntu/+source/libxfont/1:1.4.5-2ubuntu0.12.10.2
https://launchpad.net/ubuntu/+source/libxfont/1:1.4.4-1ubuntu0.2
https://launchpad.net/ubuntu/+source/libxfont/1:1.4.1-1ubuntu0.3
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140514/361085e1/attachment-0001.pgp>
------------------------------
Message: 2
Date: Wed, 14 May 2014 18:29:54 -0700
From: Seth Arnold <seth.arnold@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2212-1] Django vulnerabilities
Message-ID: <20140515012954.GA22505@hunt>
Content-Type: text/plain; charset="us-ascii"
==========================================================================
Ubuntu Security Notice USN-2212-1
May 15, 2014
python-django vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
Django applications could be made to expose sensitive information over
the network.
Software Description:
- python-django: High-level Python web development framework
Details:
Stephen Stewart, Michael Nelson, Natalia Bidart and James Westby
discovered that Django improperly removed Vary and Cache-Control headers
from HTTP responses when replying to a request from an Internet Explorer
or Chrome Frame client. An attacker may use this to retrieve private data
or poison caches. This update removes workarounds for bugs in Internet
Explorer 6 and 7. (CVE-2014-1418)
Peter Kuma and Gavin Wahl discovered that Django did not correctly
validate some malformed URLs, which are accepted by some browsers. An
attacker may use this to cause unexpected redirects. An update has been
provided for 12.04 LTS, 12.10, 13.10, and 14.04 LTS; this issue remains
unfixed for 10.04 LTS as no "is_safe_url()" functionality existed in
this version.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
python-django 1.6.1-2ubuntu0.3
Ubuntu 13.10:
python-django 1.5.4-1ubuntu1.3
Ubuntu 12.10:
python-django 1.4.1-2ubuntu0.7
Ubuntu 12.04 LTS:
python-django 1.3.1-4ubuntu1.11
Ubuntu 10.04 LTS:
python-django 1.1.1-2ubuntu1.12
After a standard system update you need to restart Django applications to
make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2212-1
CVE-2014-1418
Package Information:
https://launchpad.net/ubuntu/+source/python-django/1.6.1-2ubuntu0.3
https://launchpad.net/ubuntu/+source/python-django/1.5.4-1ubuntu1.3
https://launchpad.net/ubuntu/+source/python-django/1.4.1-2ubuntu0.7
https://launchpad.net/ubuntu/+source/python-django/1.3.1-4ubuntu1.11
https://launchpad.net/ubuntu/+source/python-django/1.1.1-2ubuntu1.12
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140514/ed2003c8/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 116, Issue 7
********************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-2211-1] libXfont vulnerabilities (Marc Deslauriers)
2. [USN-2212-1] Django vulnerabilities (Seth Arnold)
----------------------------------------------------------------------
Message: 1
Date: Wed, 14 May 2014 10:44:35 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2211-1] libXfont vulnerabilities
Message-ID: <53738153.8030007@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2211-1
May 14, 2014
libxfont vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in libXfont.
Software Description:
- libxfont: X11 font rasterisation library
Details:
Ilja van Sprundel discovered that libXfont incorrectly handled font
metadata file parsing. A local attacker could use this issue to cause
libXfont to crash, or possibly execute arbitrary code in order to gain
privileges. (CVE-2014-0209)
Ilja van Sprundel discovered that libXfont incorrectly handled X Font
Server replies. A malicious font server could return specially-crafted data
that could cause libXfont to crash, or possibly execute arbitrary code.
This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS, Ubuntu 12.10
and Ubuntu 13.10. (CVE-2014-0210, CVE-2014-0211)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
libxfont1 1:1.4.7-1ubuntu0.1
Ubuntu 13.10:
libxfont1 1:1.4.6-1ubuntu0.2
Ubuntu 12.10:
libxfont1 1:1.4.5-2ubuntu0.12.10.2
Ubuntu 12.04 LTS:
libxfont1 1:1.4.4-1ubuntu0.2
Ubuntu 10.04 LTS:
libxfont1 1:1.4.1-1ubuntu0.3
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2211-1
CVE-2014-0209, CVE-2014-0210, CVE-2014-0211
Package Information:
https://launchpad.net/ubuntu/+source/libxfont/1:1.4.7-1ubuntu0.1
https://launchpad.net/ubuntu/+source/libxfont/1:1.4.6-1ubuntu0.2
https://launchpad.net/ubuntu/+source/libxfont/1:1.4.5-2ubuntu0.12.10.2
https://launchpad.net/ubuntu/+source/libxfont/1:1.4.4-1ubuntu0.2
https://launchpad.net/ubuntu/+source/libxfont/1:1.4.1-1ubuntu0.3
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140514/361085e1/attachment-0001.pgp>
------------------------------
Message: 2
Date: Wed, 14 May 2014 18:29:54 -0700
From: Seth Arnold <seth.arnold@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2212-1] Django vulnerabilities
Message-ID: <20140515012954.GA22505@hunt>
Content-Type: text/plain; charset="us-ascii"
==========================================================================
Ubuntu Security Notice USN-2212-1
May 15, 2014
python-django vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary:
Django applications could be made to expose sensitive information over
the network.
Software Description:
- python-django: High-level Python web development framework
Details:
Stephen Stewart, Michael Nelson, Natalia Bidart and James Westby
discovered that Django improperly removed Vary and Cache-Control headers
from HTTP responses when replying to a request from an Internet Explorer
or Chrome Frame client. An attacker may use this to retrieve private data
or poison caches. This update removes workarounds for bugs in Internet
Explorer 6 and 7. (CVE-2014-1418)
Peter Kuma and Gavin Wahl discovered that Django did not correctly
validate some malformed URLs, which are accepted by some browsers. An
attacker may use this to cause unexpected redirects. An update has been
provided for 12.04 LTS, 12.10, 13.10, and 14.04 LTS; this issue remains
unfixed for 10.04 LTS as no "is_safe_url()" functionality existed in
this version.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
python-django 1.6.1-2ubuntu0.3
Ubuntu 13.10:
python-django 1.5.4-1ubuntu1.3
Ubuntu 12.10:
python-django 1.4.1-2ubuntu0.7
Ubuntu 12.04 LTS:
python-django 1.3.1-4ubuntu1.11
Ubuntu 10.04 LTS:
python-django 1.1.1-2ubuntu1.12
After a standard system update you need to restart Django applications to
make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2212-1
CVE-2014-1418
Package Information:
https://launchpad.net/ubuntu/+source/python-django/1.6.1-2ubuntu0.3
https://launchpad.net/ubuntu/+source/python-django/1.5.4-1ubuntu1.3
https://launchpad.net/ubuntu/+source/python-django/1.4.1-2ubuntu0.7
https://launchpad.net/ubuntu/+source/python-django/1.3.1-4ubuntu1.11
https://launchpad.net/ubuntu/+source/python-django/1.1.1-2ubuntu1.12
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140514/ed2003c8/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 116, Issue 7
********************************************************
Friday, May 09, 2014
ubuntu-security-announce Digest, Vol 116, Issue 6
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-2210-1] cups-filters vulnerability (Marc Deslauriers)
----------------------------------------------------------------------
Message: 1
Date: Thu, 08 May 2014 12:20:57 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2210-1] cups-filters vulnerability
Message-ID: <536BAEE9.1040805@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2210-1
May 08, 2014
cups-filters vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in cups-filters.
Software Description:
- cups-filters: OpenPrinting CUPS Filters
Details:
Sebastian Krahmer discovered that cups-browsed incorrectly filtered remote
printer names and strings. A remote attacker could use this issue to
possibly execute arbitrary commands. (CVE-2014-2707)
Johannes Meixner discovered that cups-browsed ignored invalid BrowseAllow
directives. This could cause it to accept browse packets from all hosts,
contrary to intended configuration.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
cups-browsed 1.0.52-0ubuntu1.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2210-1
CVE-2014-2707
Package Information:
https://launchpad.net/ubuntu/+source/cups-filters/1.0.52-0ubuntu1.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140508/e1b2488b/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 116, Issue 6
********************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-2210-1] cups-filters vulnerability (Marc Deslauriers)
----------------------------------------------------------------------
Message: 1
Date: Thu, 08 May 2014 12:20:57 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2210-1] cups-filters vulnerability
Message-ID: <536BAEE9.1040805@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2210-1
May 08, 2014
cups-filters vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in cups-filters.
Software Description:
- cups-filters: OpenPrinting CUPS Filters
Details:
Sebastian Krahmer discovered that cups-browsed incorrectly filtered remote
printer names and strings. A remote attacker could use this issue to
possibly execute arbitrary commands. (CVE-2014-2707)
Johannes Meixner discovered that cups-browsed ignored invalid BrowseAllow
directives. This could cause it to accept browse packets from all hosts,
contrary to intended configuration.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
cups-browsed 1.0.52-0ubuntu1.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2210-1
CVE-2014-2707
Package Information:
https://launchpad.net/ubuntu/+source/cups-filters/1.0.52-0ubuntu1.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140508/e1b2488b/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 116, Issue 6
********************************************************
Thursday, May 08, 2014
ubuntu-security-announce Digest, Vol 116, Issue 5
Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-2209-1] libvirt vulnerabilities (Marc Deslauriers)
----------------------------------------------------------------------
Message: 1
Date: Wed, 07 May 2014 14:12:53 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2209-1] libvirt vulnerabilities
Message-ID: <536A77A5.9000502@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2209-1
May 07, 2014
libvirt vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 13.10
Summary:
Several security issues were fixed in libvirt.
Software Description:
- libvirt: Libvirt virtualization toolkit
Details:
It was discovered that libvirt incorrectly handled symlinks when using the
LXC driver. An attacker could possibly use this issue to delete host
devices, create arbitrary nodes, and shutdown or power off the host.
(CVE-2013-6456)
Marian Krcmarik discovered that libvirt incorrectly handled seamless SPICE
migrations. An attacker could possibly use this issue to cause a denial of
service. (CVE-2013-7336)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 13.10:
libvirt-bin 1.1.1-0ubuntu8.11
libvirt0 1.1.1-0ubuntu8.11
After a standard system update you need to reboot your computer to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2209-1
CVE-2013-6456, CVE-2013-7336
Package Information:
https://launchpad.net/ubuntu/+source/libvirt/1.1.1-0ubuntu8.11
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140507/57f2a94e/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 116, Issue 5
********************************************************
ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-2209-1] libvirt vulnerabilities (Marc Deslauriers)
----------------------------------------------------------------------
Message: 1
Date: Wed, 07 May 2014 14:12:53 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2209-1] libvirt vulnerabilities
Message-ID: <536A77A5.9000502@canonical.com>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-2209-1
May 07, 2014
libvirt vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 13.10
Summary:
Several security issues were fixed in libvirt.
Software Description:
- libvirt: Libvirt virtualization toolkit
Details:
It was discovered that libvirt incorrectly handled symlinks when using the
LXC driver. An attacker could possibly use this issue to delete host
devices, create arbitrary nodes, and shutdown or power off the host.
(CVE-2013-6456)
Marian Krcmarik discovered that libvirt incorrectly handled seamless SPICE
migrations. An attacker could possibly use this issue to cause a denial of
service. (CVE-2013-7336)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 13.10:
libvirt-bin 1.1.1-0ubuntu8.11
libvirt0 1.1.1-0ubuntu8.11
After a standard system update you need to reboot your computer to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2209-1
CVE-2013-6456, CVE-2013-7336
Package Information:
https://launchpad.net/ubuntu/+source/libvirt/1.1.1-0ubuntu8.11
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 884 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140507/57f2a94e/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 116, Issue 5
********************************************************
Subscribe to:
Posts (Atom)