ubuntu-security-announce Digest, Vol 120, Issue 11

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."


Today's Topics:

1. [USN-2347-1] Django vulnerabilities (Marc Deslauriers)
2. [USN-2348-1] APT vulnerabilities (Marc Deslauriers)
3. [USN-2319-3] OpenJDK 7 update (Jamie Strandboge)


----------------------------------------------------------------------

Message: 1
Date: Tue, 16 Sep 2014 08:16:00 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2347-1] Django vulnerabilities
Message-ID: <54182A00.2020004@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2347-1
September 16, 2014

python-django vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS

Summary:

Several security issues were fixed in Django.

Software Description:
- python-django: High-level Python web development framework

Details:

Florian Apolloner discovered that Django incorrectly validated URLs. A
remote attacker could use this issue to conduct phishing attacks.
(CVE-2014-0480)

David Wilson discovered that Django incorrectly handled file name
generation. A remote attacker could use this issue to cause Django to
consume resources, resulting in a denial of service. (CVE-2014-0481)

David Greisen discovered that Django incorrectly handled certain headers in
contrib.auth.middleware.RemoteUserMiddleware. A remote authenticated user
could use this issue to hijack web sessions. (CVE-2014-0482)

Collin Anderson discovered that Django incorrectly checked if a field
represented a relationship between models in the administrative interface.
A remote authenticated user could use this issue to possibly obtain
sensitive information. (CVE-2014-0483)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
python-django 1.6.1-2ubuntu0.4

Ubuntu 12.04 LTS:
python-django 1.3.1-4ubuntu1.12

Ubuntu 10.04 LTS:
python-django 1.1.1-2ubuntu1.13

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2347-1
CVE-2014-0480, CVE-2014-0481, CVE-2014-0482, CVE-2014-0483

Package Information:
https://launchpad.net/ubuntu/+source/python-django/1.6.1-2ubuntu0.4
https://launchpad.net/ubuntu/+source/python-django/1.3.1-4ubuntu1.12
https://launchpad.net/ubuntu/+source/python-django/1.1.1-2ubuntu1.13


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140916/44c7b980/attachment-0001.pgp>

------------------------------

Message: 2
Date: Tue, 16 Sep 2014 12:35:42 -0400
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2348-1] APT vulnerabilities
Message-ID: <541866DE.7060000@canonical.com>
Content-Type: text/plain; charset="utf-8"

==========================================================================
Ubuntu Security Notice USN-2348-1
September 16, 2014

apt vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS

Summary:

Several security issues were fixed in APT.

Software Description:
- apt: Advanced front-end for dpkg

Details:

It was discovered that APT did not re-verify downloaded files when the
If-Modified-Since wasn't met. (CVE-2014-0487)

It was discovered that APT did not invalidate repository data when it
switched from an unauthenticated to an authenticated state. (CVE-2014-0488)

It was discovered that the APT Acquire::GzipIndexes option caused APT to
skip checksum validation. This issue only applied to Ubuntu 12.04 LTS and
Ubuntu 14.04 LTS, and was not enabled by default. (CVE-2014-0489)

It was discovered that APT did not correctly validate signatures when
downloading source packages using the download command. This issue only
applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-0490)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
apt 1.0.1ubuntu2.3

Ubuntu 12.04 LTS:
apt 0.8.16~exp12ubuntu10.19

Ubuntu 10.04 LTS:
apt 0.7.25.3ubuntu9.16

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2348-1
CVE-2014-0487, CVE-2014-0488, CVE-2014-0489, CVE-2014-0490

Package Information:
https://launchpad.net/ubuntu/+source/apt/1.0.1ubuntu2.3
https://launchpad.net/ubuntu/+source/apt/0.8.16~exp12ubuntu10.19
https://launchpad.net/ubuntu/+source/apt/0.7.25.3ubuntu9.16


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140916/2d8c1ef7/attachment-0001.pgp>

------------------------------

Message: 3
Date: Tue, 16 Sep 2014 21:17:37 -0500
From: Jamie Strandboge <jamie@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-2319-3] OpenJDK 7 update
Message-ID: <5418EF41.7000108@canonical.com>
Content-Type: text/plain; charset="utf-8"


==========================================================================
Ubuntu Security Notice USN-2319-3
September 17, 2014

openjdk-7 update
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

This update provides stability updates for OpenJDK 7.

Software Description:
- openjdk-7: Open Source Java implementation

Details:

USN-2319-1 fixed vulnerabilities in OpenJDK 7. This update provides
stability fixes for the arm64 and ppc64el architectures.

Original advisory details:

Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure, data integrity and availability. An attacker could
exploit these to cause a denial of service or expose sensitive data over
the network. (CVE-2014-2483, CVE-2014-2490, CVE-2014-4216, CVE-2014-4219,
CVE-2014-4223, CVE-2014-4262)

Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure and data integrity. An attacker could exploit these
to expose sensitive data over the network. (CVE-2014-4209, CVE-2014-4244,
CVE-2014-4263)

Two vulnerabilities were discovered in the OpenJDK JRE related to data
integrity. (CVE-2014-4218, CVE-2014-4266)

A vulnerability was discovered in the OpenJDK JRE related to availability.
An attacker could exploit this to cause a denial of service.
(CVE-2014-4264)

Several vulnerabilities were discovered in the OpenJDK JRE related to
information disclosure. An attacker could exploit these to expose sensitive
data over the network. (CVE-2014-4221, CVE-2014-4252, CVE-2014-4268)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
icedtea-7-jre-jamvm 7u65-2.5.2-3~14.04
openjdk-7-jre 7u65-2.5.2-3~14.04
openjdk-7-jre-headless 7u65-2.5.2-3~14.04
openjdk-7-jre-lib 7u65-2.5.2-3~14.04
openjdk-7-jre-zero 7u65-2.5.2-3~14.04

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications or applets to make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2319-3
http://www.ubuntu.com/usn/usn-2319-1
https://launchpad.net/bugs/1370307

Package Information:
https://launchpad.net/ubuntu/+source/openjdk-7/7u65-2.5.2-3~14.04




-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20140916/b91bb2e9/attachment-0001.pgp>

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce


End of ubuntu-security-announce Digest, Vol 120, Issue 11
*********************************************************