1. Server >
  2. Unix Server

ArabicEnglishFrenchGermanGreekItalianJapaneseKoreanPersianPolishPortugueseRussianSpanishTurkishVietnamese
Anzeige

Unix Server


Suchen

USN-3456-1: X.Org X server vulnerabilities

Unix Server vom 17.10.2017 um 17:03 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3456-1

17th October, 2017

xorg-server, xorg-server-hwe-16.04, xorg-server-lts-xenial vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.04
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in the X.Org X server.

Software description

  • xorg-server - X.Org X11 server
  • xorg-server-hwe-16.04 - X.Org X11 server
  • xorg-server-lts-xenial - X.Org X11 server

Details

It was discovered that the X.Org X server incorrectly handled certain
lengths. An attacker able to connect to an X server, either locally or
remotely, could use these issues to crash the server, or possibly execute
arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 17.04:
xserver-xorg-core 2:1.19.3-1ubuntu1.3
Ubuntu 16.04 LTS:
xserver-xorg-core 2:1.18.4-0ubuntu0.7
xserver-xorg-core-hwe-16.04 2:1.19.3-1ubuntu1~16.04.4
Ubuntu 14.04 LTS:
xserver-xorg-core 2:1.15.1-0ubuntu2.11
xserver-xorg-core-lts-xenial 2:1.18.3-1ubuntu2.3~trusty4

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

CVE-2017-12176, CVE-2017-12177, CVE-2017-12178, CVE-2017-12179, CVE-2017-12180, CVE-2017-12181, CVE-2017-12182, CVE-2017-12183, CVE-2017-12184, CVE-2017-12185, CVE-2017-12186, CVE-2017-12187


News bewerten

Weiterlesen Artikel ansehen

USN-3455-1: wpa_supplicant and hostapd vulnerabilities

Unix Server vom 16.10.2017 um 17:21 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3455-1

16th October, 2017

wpa vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.04
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in wpa_supplicant.

Software description

  • wpa - client support for WPA and WPA2

Details

Mathy Vanhoef discovered that wpa_supplicant and hostapd incorrectly
handled WPA2. A remote attacker could use this issue with key
reinstallation attacks to obtain sensitive information. (CVE-2017-13077,
CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081,
CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088)

Imre Rad discovered that wpa_supplicant and hostapd incorrectly handled
invalid characters in passphrase parameters. A remote attacker could use
this issue to cause a denial of service. (CVE-2016-4476)

Imre Rad discovered that wpa_supplicant and hostapd incorrectly handled
invalid characters in passphrase parameters. A local attacker could use
this issue to cause a denial of service, or possibly execute arbitrary
code. (CVE-2016-4477)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 17.04:
hostapd 2.4-0ubuntu9.1
wpasupplicant 2.4-0ubuntu9.1
Ubuntu 16.04 LTS:
hostapd 2.4-0ubuntu6.2
wpasupplicant 2.4-0ubuntu6.2
Ubuntu 14.04 LTS:
hostapd 2.1-0ubuntu1.5
wpasupplicant 2.1-0ubuntu1.5

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

CVE-2016-4476, CVE-2016-4477, CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088


News bewerten

Weiterlesen Artikel ansehen

DSA-3999 wpa - security update

Unix Server vom 16.10.2017 um 00:00 Uhr | Quelle debian.org

Mathy Vanhoef of the imec-DistriNet research group of KU Leuven discovered multiple vulnerabilities in the WPA protocol, used for authentication in wireless networks. Those vulnerabilities applies to both the access point (implemented in hostapd) and the station (implemented in wpa_supplicant).


News bewerten

Weiterlesen Artikel ansehen

USN-3454-1: libffi vulnerability

Unix Server vom 12.10.2017 um 20:20 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3454-1

12th October, 2017

libffi vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 LTS

Summary

A security issue was fixed in libffi.

Software description

  • libffi - Foreign Function Interface library

Details

It was discovered that libffi incorrectly enforced an executable stack. An
attacker could possibly use this issue, in combination with another
vulnerability, to facilitate executing arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 14.04 LTS:
libffi6 3.1~rc1+r3.0.13-12ubuntu0.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2017-1000376


News bewerten

Weiterlesen Artikel ansehen

USN-3453-1: X.Org X server vulnerabilities

Unix Server vom 12.10.2017 um 15:19 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3453-1

12th October, 2017

xorg-server, xorg-server-hwe-16.04, xorg-server-lts-xenial vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.04
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in the X.Org X server.

Software description

  • xorg-server - X.Org X11 server
  • xorg-server-hwe-16.04 - X.Org X11 server
  • xorg-server-lts-xenial - X.Org X11 server

Details

Michal Srb discovered that the X.Org X server incorrectly handled shared
memory segments. An attacker able to connect to an X server, either locally
or remotely, could use this issue to crash the server, or possibly replace
shared memory segments of other X clients in the same session.
(CVE-2017-13721)

Michal Srb discovered that the X.Org X server incorrectly handled XKB
buffers. An attacker able to connect to an X server, either locally or
remotely, could use this issue to crash the server, or possibly execute
arbitrary code. (CVE-2017-13723)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 17.04:
xserver-xorg-core 2:1.19.3-1ubuntu1.2
Ubuntu 16.04 LTS:
xserver-xorg-core 2:1.18.4-0ubuntu0.6
xserver-xorg-core-hwe-16.04 2:1.19.3-1ubuntu1~16.04.3
Ubuntu 14.04 LTS:
xserver-xorg-core 2:1.15.1-0ubuntu2.10
xserver-xorg-core-lts-xenial 2:1.18.3-1ubuntu2.3~trusty3

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

CVE-2017-13721, CVE-2017-13723


News bewerten

Weiterlesen Artikel ansehen

CentOS Seven blog: Upcoming Dojo at CERN, FOSDEM

Unix Server vom 12.10.2017 um 12:51 Uhr | Quelle seven.centos.org

Next week, we're holding a Dojo at CERN, in Meyrin, Switzerland. This will feature content from various of our Special Interest Groups (SIGs), and an overview of how CERN is using CentOS in their work to unravel the secrets of the universe.

We still have a little space, if you are interested in coming. You can find out more details about the event, and register, at http://cern.ch/centos

In the weeks following the event, video of the presentations, will be appearing here. Follow us on Twitter (@CentOSProject) to find out when they're posted.

Meanwhile, we're also planning a Dojo in Brussels, on the Friday before FOSDEM, as we've been doing this for a number of years now. The CFP is now open, if you're interested in presenting. We're looking for any talks about work that you're doing on CentOS, or anything that you're doing using CentOS. The CFP closes October 30th.


News bewerten

Weiterlesen Artikel ansehen

USN-3449-1: OpenStack Nova vulnerabilities

Unix Server vom 11.10.2017 um 13:51 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3449-1

11th October, 2017

nova vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in OpenStack Nova.

Software description

  • nova - OpenStack Compute cloud infrastructure

Details

George Shuklin discovered that OpenStack Nova incorrectly handled the
migration process. A remote authenticated user could use this issue to
consume resources, resulting in a denial of service. (CVE-2015-3241)

George Shuklin and Tushar Patil discovered that OpenStack Nova incorrectly
handled deleting instances. A remote authenticated user could use this
issue to consume disk resources, resulting in a denial of service.
(CVE-2015-3280)

It was discovered that OpenStack Nova incorrectly limited qemu-img calls. A
remote authenticated user could use this issue to consume resources,
resulting in a denial of service. (CVE-2015-5162)

Matthew Booth discovered that OpenStack Nova incorrectly handled snapshots.
A remote authenticated user could use this issue to read arbitrary files.
(CVE-2015-7548)

Sreekumar S. and Suntao discovered that OpenStack Nova incorrectly applied
security group changes. A remote attacker could possibly use this issue to
bypass intended restriction changes by leveraging an instance that was
running when the change was made. (CVE-2015-7713)

Matt Riedemann discovered that OpenStack Nova incorrectly handled logging.
A local attacker could possibly use this issue to obtain sensitive
information from log files. (CVE-2015-8749)

Matthew Booth discovered that OpenStack Nova incorrectly handled certain
qcow2 headers. A remote authenticated user could possibly use this issue to
read arbitrary files. (CVE-2016-2140)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 14.04 LTS:
python-nova 1:2014.1.5-0ubuntu1.7

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2015-3241, CVE-2015-3280, CVE-2015-5162, CVE-2015-7548, CVE-2015-7713, CVE-2015-8749, CVE-2016-2140


News bewerten

Weiterlesen Artikel ansehen

USN-3448-1: OpenStack Keystone vulnerability

Unix Server vom 11.10.2017 um 13:51 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3448-1

11th October, 2017

keystone vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 16.04 LTS

Summary

OpenStack Keystone would allow unintended access over the network.

Software description

  • keystone - OpenStack identity service

Details

Boris Bobrov discovered that OpenStack Keystone incorrectly handled
federation mapping when there are rules in which group-based assignments
are not used. A remote authenticated user may receive all the roles
assigned to a project regardless of the federation mapping, contrary to
expectations.

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 16.04 LTS:
keystone 2:9.3.0-0ubuntu3.1
python-keystone 2:9.3.0-0ubuntu3.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2017-2673


News bewerten

Weiterlesen Artikel ansehen

USN-3451-1: OpenStack Swift vulnerabilities

Unix Server vom 11.10.2017 um 13:51 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3451-1

11th October, 2017

swift vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in OpenStack Swift.

Software description

  • swift - OpenStack distributed virtual object store

Details

It was discovered that OpenStack Swift incorrectly handled tempurls. A
remote authenticated user in possession of a tempurl key authorized for PUT
could retrieve other objects in the same Swift account. (CVE-2015-5223)

Romain Le Disez and Örjan Persson discovered that OpenStack Swift
incorrectly closed client connections. A remote attacker could possibly use
this issue to consume resources, resulting in a denial of service.
(CVE-2016-0737, CVE-2016-0738)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 14.04 LTS:
swift 1.13.1-0ubuntu1.5
python-swift 1.13.1-0ubuntu1.5

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2015-5223, CVE-2016-0737, CVE-2016-0738


News bewerten

Weiterlesen Artikel ansehen

USN-3447-1: OpenStack Horizon vulnerability

Unix Server vom 11.10.2017 um 13:51 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3447-1

11th October, 2017

horizon vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 LTS

Summary

OpenStack Horizon could be made to expose sensitive information over the network.

Software description

  • horizon - Web interface for OpenStack cloud infrastructure

Details

Beth Lancaster and Brandon Sawyers discovered that OpenStack Horizon was
incorrect protected against cross-site scripting (XSS) attacks. A remote
authenticated user could use this issue to inject web script or HTML in
a dashboard form.

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 14.04 LTS:
openstack-dashboard 1:2014.1.5-0ubuntu2.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2016-4428


News bewerten

Weiterlesen Artikel ansehen

USN-3452-1: Ceph vulnerabilities

Unix Server vom 11.10.2017 um 13:51 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3452-1

11th October, 2017

ceph vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in Ceph.

Software description

  • ceph - distributed storage and file system

Details

It was discovered that Ceph incorrectly handled the handle_command
function. A remote authenticated user could use this issue to cause Ceph to
crash, resulting in a denial of service. (CVE-2016-5009)

Rahul Aggarwal discovered that Ceph incorrectly handled the
authenticated-read ACL. A remote attacker could possibly use this issue to
list bucket contents via a URL. (CVE-2016-7031)

Diluga Salome discovered that Ceph incorrectly handled certain POST objects
with null conditions. A remote attacker could possibly use this issue to
cuase Ceph to crash, resulting in a denial of service. (CVE-2016-8626)

Yang Liu discovered that Ceph incorrectly handled invalid HTTP Origin
headers. A remote attacker could possibly use this issue to cuase Ceph to
crash, resulting in a denial of service. (CVE-2016-9579)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 14.04 LTS:
ceph 0.80.11-0ubuntu1.14.04.3
ceph-common 0.80.11-0ubuntu1.14.04.3

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2016-5009, CVE-2016-7031, CVE-2016-8626, CVE-2016-9579


News bewerten

Weiterlesen Artikel ansehen

USN-3450-1: Open vSwitch vulnerabilities

Unix Server vom 11.10.2017 um 13:51 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3450-1

11th October, 2017

openvswitch vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.04
  • Ubuntu 16.04 LTS

Summary

Several security issues were fixed in Open vSwitch.

Software description

  • openvswitch - Ethernet virtual switch

Details

Bhargava Shastry discovered that Open vSwitch incorrectly handled certain
OFP messages. A remote attacker could possibly use this issue to cause
Open vSwitch to crash, resulting in a denial of service. (CVE-2017-9214)

It was discovered that Open vSwitch incorrectly handled certain OpenFlow
role messages. A remote attacker could possibly use this issue to cause
Open vSwitch to crash, resulting in a denial of service. (CVE-2017-9263)

It was discovered that Open vSwitch incorrectly handled certain malformed
packets. A remote attacker could possibly use this issue to cause Open
vSwitch to crash, resulting in a denial of service. This issue only
affected Ubuntu 17.04. (CVE-2017-9264)

It was discovered that Open vSwitch incorrectly handled group mod OpenFlow
messages. A remote attacker could possibly use this issue to cause Open
vSwitch to crash, resulting in a denial of service. (CVE-2017-9265)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 17.04:
openvswitch-common 2.6.1-0ubuntu5.1
Ubuntu 16.04 LTS:
openvswitch-common 2.5.2-0ubuntu0.16.04.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2017-9214, CVE-2017-9263, CVE-2017-9264, CVE-2017-9265


News bewerten

Weiterlesen Artikel ansehen

USN-3446-1: OpenStack Glance vulnerabilities

Unix Server vom 11.10.2017 um 13:51 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3446-1

11th October, 2017

glance vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in OpenStack Glance.

Software description

  • glance - OpenStack Image Registry and Delivery Service

Details

Hemanth Makkapati discovered that OpenStack Glance incorrectly handled
access restrictions. A remote authenticated user could use this issue to
change the status of images, contrary to access restrictions.
(CVE-2015-5251)

Mike Fedosin and Alexei Galkin discovered that OpenStack Glance incorrectly
handled the storage quota. A remote authenticated user could use this issue
to consume disk resources, leading to a denial of service. (CVE-2015-5286)

Erno Kuvaja discovered that OpenStack Glance incorrectly handled the
show_multiple_locations option. When show_multiple_locations is enabled,
a remote authenticated user could change an image status and upload new
image data. (CVE-2016-0757)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 14.04 LTS:
glance-common 1:2014.1.5-0ubuntu1.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2015-5251, CVE-2015-5286, CVE-2016-0757


News bewerten

Weiterlesen Artikel ansehen

USN-3436-1: Thunderbird vulnerabilities

Unix Server vom 11.10.2017 um 11:21 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3436-1

11th October, 2017

thunderbird vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.04
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in Thunderbird.

Software description

  • thunderbird - Mozilla Open Source mail and newsgroup client

Details

Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing-like
context, an attacker could potentially exploit these to read uninitialized
memory, bypass phishing and malware protection, conduct cross-site
scripting (XSS) attacks, cause a denial of service via application crash,
or execute arbitrary code. (CVE-2017-7793, CVE-2017-7810, CVE-2017-7814,
CVE-2017-7818, CVE-2017-7819, CVE-2017-7823, CVE-2017-7824)

Martin Thomson discovered that NSS incorrectly generated handshake hashes.
A remote attacker could potentially exploit this to cause a denial of
service via application crash, or execute arbitrary code. (CVE-2017-7805)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 17.04:
thunderbird 1:52.4.0+build1-0ubuntu0.17.04.2
Ubuntu 16.04 LTS:
thunderbird 1:52.4.0+build1-0ubuntu0.16.04.2
Ubuntu 14.04 LTS:
thunderbird 1:52.4.0+build1-0ubuntu0.14.04.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Thunderbird to make
all the necessary changes.

References

CVE-2017-7793, CVE-2017-7805, CVE-2017-7810, CVE-2017-7814, CVE-2017-7818, CVE-2017-7819, CVE-2017-7823, CVE-2017-7824


News bewerten

Weiterlesen Artikel ansehen

Jim Perrin: Four years later with CentOS and Red Hat

Unix Server vom 11.10.2017 um 07:00 Uhr | Quelle jperrin.org

After 4 years of being at Red Hat, I still occasionally get questions that show not everyone understands what Red Hat means to CentOS, or what CentOS provides to Red Hat. They tend to think in terms of competition, like there’s an either or choice. Reality just doesn’t bear that out.

First and foremost, CentOS is about integration, and its important to know who the community is. We’re your sysadmins and operations teams. We’re your SREs, the OPS in your devops. We’re a force multiplier to developers, the angry voice that says “stop disabling SELinux” and “show me your unit tests”. We’re the community voice encouraging you to do things the right way, rather than taking an easy shortcut we know from experience will come back to bite you.

What we’re not is developers. We may pull in kernel patches, but we’re not kernel developers. We can help you do the root cause analysis to figure out why your app is suddenly not performing, but we aren’t the ones to write the code to fix it. We don’t determine priority for what does or doesn’t get fixed, that’s what Red Hat does.

The core distribution of CentOS is and has always been based on code written by Red Hat. This doesn’t mean it’s a choice of “either CentOS or RHEL,” because we’re in this together. CentOS provides Red Hat a community platform for building and testing things like OpenStack with RDO. We build new ecosystems around ARM servers. We provide a base layer for others to innovate around emerging technologies like NFV. But none of this would be possible without the work of RH’s engineering teams.

The community can build, organize and deliver tools in any number of creative ways, but ultimately the code behind them is being developed by engineers paid to address the needs of Red Hat’s customers. You can bet that RH is keeping an eye on what the CentOS community is using and building, but that doesn’t necessarily translate to business need.

We’re here to empower operators who want to experiment on top of the enterprise base lifespan. We’re here to bring tools and technology to those for whom it may be otherwise be out of reach. We’re here to take use cases and lessons learned from the community back to Red Hat as advocates. We’re happy to serve both audiences in this capacity, but let’s not forget how we buy the ‘free as in beer’.

After 4 years of being at Red Hat, I still occasionally get questions that show not everyone understands what Red Hat means to CentOS, or what CentOS provides to Red Hat. They tend to think in terms of competition, like there’s an either or choice. Reality just doesn’t bear that out.
News bewerten

Weiterlesen Artikel ansehen

USN-3445-2: Linux kernel vulnerabilities

Unix Server vom 11.10.2017 um 06:20 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3445-2

11th October, 2017

linux vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 12.04 LTS

Summary

Several security issues were fixed in the Linux kernel.

Software description

  • linux - Linux kernel

Details

USN-3445-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu
12.04 ESM.

Eyal Itkin discovered that the IP over IEEE 1394 (FireWire) implementation
in the Linux kernel contained a buffer overflow when handling fragmented
packets. A remote attacker could use this to possibly execute arbitrary
code with administrative privileges. (CVE-2016-8633)

Andrey Konovalov discovered that a divide-by-zero error existed in the TCP
stack implementation in the Linux kernel. A local attacker could use this
to cause a denial of service (system crash). (CVE-2017-14106)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 12.04 LTS:
linux-image-powerpc-smp 3.2.0.131.145
linux-image-3.2.0-131-omap 3.2.0-131.177
linux-image-3.2.0-131-powerpc-smp 3.2.0-131.177
linux-image-generic 3.2.0.131.145
linux-image-3.2.0-131-generic-pae 3.2.0-131.177
linux-image-3.2.0-131-highbank 3.2.0-131.177
linux-image-generic-pae 3.2.0.131.145
linux-image-3.2.0-131-virtual 3.2.0-131.177
linux-image-highbank 3.2.0.131.145
linux-image-powerpc64-smp 3.2.0.131.145
linux-image-3.2.0-131-generic 3.2.0-131.177
linux-image-omap 3.2.0.131.145
linux-image-3.2.0-131-powerpc64-smp 3.2.0-131.177

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References

CVE-2016-8633, CVE-2017-14106


News bewerten

Weiterlesen Artikel ansehen

USN-3443-3: Linux kernel (GCP) vulnerability

Unix Server vom 11.10.2017 um 06:20 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3443-3

11th October, 2017

linux-gcp vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 16.04 LTS

Summary

The system could be made to crash under certain conditions.

Software description

  • linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems

Details

Andrey Konovalov discovered that a divide-by-zero error existed in the TCP
stack implementation in the Linux kernel. A local attacker could use this
to cause a denial of service (system crash). (CVE-2017-14106)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 16.04 LTS:
linux-image-gcp 4.10.0.1007.9
linux-image-4.10.0-1007-gcp 4.10.0-1007.7

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References

CVE-2017-14106


News bewerten

Weiterlesen Artikel ansehen

USN-3444-1: Linux kernel vulnerabilities

Unix Server vom 11.10.2017 um 01:20 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3444-1

10th October, 2017

linux, linux-aws, linux-gke, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 16.04 LTS

Summary

Several security issues were fixed in the Linux kernel.

Software description

  • linux - Linux kernel
  • linux-aws - Linux kernel for Amazon Web Services (AWS) systems
  • linux-gke - Linux kernel for Google Container Engine (GKE) systems
  • linux-kvm - Linux kernel for cloud environments
  • linux-raspi2 - Linux kernel for Raspberry Pi 2
  • linux-snapdragon - Linux kernel for Snapdragon processors

Details

Jan H. Schönherr discovered that the Xen subsystem did not properly handle
block IO merges correctly in some situations. An attacker in a guest vm
could use this to cause a denial of service (host crash) or possibly gain
administrative privileges in the host. (CVE-2017-12134)

Andrey Konovalov discovered that a divide-by-zero error existed in the TCP
stack implementation in the Linux kernel. A local attacker could use this
to cause a denial of service (system crash). (CVE-2017-14106)

Otto Ebeling discovered that the memory manager in the Linux kernel did not
properly check the effective UID in some situations. A local attacker could
use this to expose sensitive information. (CVE-2017-14140)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 16.04 LTS:
linux-image-powerpc-e500mc 4.4.0.97.102
linux-image-4.4.0-97-lowlatency 4.4.0-97.120
linux-image-4.4.0-1032-gke 4.4.0-1032.32
linux-image-kvm 4.4.0.1008.8
linux-image-4.4.0-97-generic 4.4.0-97.120
linux-image-4.4.0-1075-raspi2 4.4.0-1075.83
linux-image-4.4.0-1008-kvm 4.4.0-1008.13
linux-image-4.4.0-97-powerpc-smp 4.4.0-97.120
linux-image-snapdragon 4.4.0.1077.69
linux-image-4.4.0-97-powerpc64-smp 4.4.0-97.120
linux-image-powerpc64-emb 4.4.0.97.102
linux-image-4.4.0-97-powerpc-e500mc 4.4.0-97.120
linux-image-gke 4.4.0.1032.33
linux-image-4.4.0-97-generic-lpae 4.4.0-97.120
linux-image-generic 4.4.0.97.102
linux-image-4.4.0-1077-snapdragon 4.4.0-1077.82
linux-image-aws 4.4.0.1038.40
linux-image-4.4.0-97-powerpc64-emb 4.4.0-97.120
linux-image-raspi2 4.4.0.1075.75
linux-image-powerpc-smp 4.4.0.97.102
linux-image-generic-lpae 4.4.0.97.102
linux-image-4.4.0-1038-aws 4.4.0-1038.47
linux-image-powerpc64-smp 4.4.0.97.102
linux-image-lowlatency 4.4.0.97.102

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References

CVE-2017-12134, CVE-2017-14106, CVE-2017-14140


News bewerten

Weiterlesen Artikel ansehen

USN-3445-1: Linux kernel vulnerabilities

Unix Server vom 11.10.2017 um 01:20 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3445-1

10th October, 2017

linux vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in the Linux kernel.

Software description

  • linux - Linux kernel

Details

Eyal Itkin discovered that the IP over IEEE 1394 (FireWire) implementation
in the Linux kernel contained a buffer overflow when handling fragmented
packets. A remote attacker could use this to possibly execute arbitrary
code with administrative privileges. (CVE-2016-8633)

Andrey Konovalov discovered that a divide-by-zero error existed in the TCP
stack implementation in the Linux kernel. A local attacker could use this
to cause a denial of service (system crash). (CVE-2017-14106)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 14.04 LTS:
linux-image-3.13.0-133-powerpc64-smp 3.13.0-133.182
linux-image-powerpc-smp 3.13.0.133.142
linux-image-powerpc-e500mc 3.13.0.133.142
linux-image-3.13.0-133-powerpc-e500mc 3.13.0-133.182
linux-image-3.13.0-133-powerpc-e500 3.13.0-133.182
linux-image-generic 3.13.0.133.142
linux-image-3.13.0-133-generic-lpae 3.13.0-133.182
linux-image-3.13.0-133-powerpc-smp 3.13.0-133.182
linux-image-powerpc64-emb 3.13.0.133.142
linux-image-3.13.0-133-lowlatency 3.13.0-133.182
linux-image-powerpc-e500 3.13.0.133.142
linux-image-powerpc64-smp 3.13.0.133.142
linux-image-generic-lpae 3.13.0.133.142
linux-image-3.13.0-133-powerpc64-emb 3.13.0-133.182
linux-image-3.13.0-133-generic 3.13.0-133.182
linux-image-lowlatency 3.13.0.133.142

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References

CVE-2016-8633, CVE-2017-14106


News bewerten

Weiterlesen Artikel ansehen

USN-3444-2: Linux kernel (Xenial HWE) vulnerabilities

Unix Server vom 11.10.2017 um 01:20 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3444-2

10th October, 2017

linux-lts-xenial vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in the Linux kernel.

Software description

  • linux-lts-xenial - Linux hardware enablement kernel from Xenial for Trusty

Details

USN-3444-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.

Jan H. Schönherr discovered that the Xen subsystem did not properly handle
block IO merges correctly in some situations. An attacker in a guest vm
could use this to cause a denial of service (host crash) or possibly gain
administrative privileges in the host. (CVE-2017-12134)

Andrey Konovalov discovered that a divide-by-zero error existed in the TCP
stack implementation in the Linux kernel. A local attacker could use this
to cause a denial of service (system crash). (CVE-2017-14106)

Otto Ebeling discovered that the memory manager in the Linux kernel did not
properly check the effective UID in some situations. A local attacker could
use this to expose sensitive information. (CVE-2017-14140)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 14.04 LTS:
linux-image-powerpc-smp-lts-xenial 4.4.0.97.81
linux-image-lowlatency-lts-xenial 4.4.0.97.81
linux-image-4.4.0-97-generic 4.4.0-97.120~14.04.1
linux-image-4.4.0-97-generic-lpae 4.4.0-97.120~14.04.1
linux-image-4.4.0-97-powerpc64-emb 4.4.0-97.120~14.04.1
linux-image-generic-lpae-lts-xenial 4.4.0.97.81
linux-image-generic-lts-xenial 4.4.0.97.81
linux-image-4.4.0-97-powerpc-smp 4.4.0-97.120~14.04.1
linux-image-powerpc64-smp-lts-xenial 4.4.0.97.81
linux-image-powerpc64-emb-lts-xenial 4.4.0.97.81
linux-image-4.4.0-97-powerpc64-smp 4.4.0-97.120~14.04.1
linux-image-powerpc-e500mc-lts-xenial 4.4.0.97.81
linux-image-4.4.0-97-lowlatency 4.4.0-97.120~14.04.1
linux-image-4.4.0-97-powerpc-e500mc 4.4.0-97.120~14.04.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References

CVE-2017-12134, CVE-2017-14106, CVE-2017-14140


News bewerten

Weiterlesen Artikel ansehen

DSA-3998 nss - security update

Unix Server vom 11.10.2017 um 00:00 Uhr | Quelle debian.org

Martin Thomson discovered that nss, the Mozilla Network Security Service library, is prone to a use-after-free vulnerability in the TLS 1.2 implementation when handshake hashes are generated. A remote attacker can take advantage of this flaw to cause an application using the nss library to crash, resulting in a denial of service, or potentially to execute arbitrary code.


News bewerten

Weiterlesen Artikel ansehen

Fabian Arrotin: Using Ansible Openstack modules on CentOS 7

Unix Server vom 10.10.2017 um 22:00 Uhr | Quelle arrfab.net

Suppose that you have a RDO/Openstack cloud already in place, but that you'd want to automate some operations : what can you do ? On my side, I already mentioned that I used puppet to deploy initial clouds, but I still prefer Ansible myself when having to launch ad-hoc tasks, or even change configuration[s]. It's particulary true for our CI environment where we run "agentless" so all configuration changes happen through Ansible.

The good news is that Ansible has already some modules for Openstack but it has some requirements and a little bit of understanding before being able to use those.

First of all, all the ansible os_ modules need "shade" on the host included in the play, and that will be responsible of all os_ modules launch. At the time of writing this post, it's not yet available on mirror.centos.org, (a review is open so that will be soon available directly) but you can find the pkg on our CBS builders

Once installed, a simple os_image task was directly failing, despite the fact that auth: was present, and that's due to a simple reason : Ansible os_ modules still want to use v2 API, while it's now defaulting to v3 in Pike release. There is no way to force ansible itself to use v3, but as it uses shade behind the scene, there is a way to force this through os-client-config

That means that you just have to use a .yaml file (does that sound familiar for ansible ?) that will contain everything you need to know about specific cloud, and then just in ansible declare which cloud you're configuring.

That clouds.yaml file can be under $current_directory, ~/.config/openstack or /etc/openstack so it's up to you to decide where you want to temporary host it, but I selected /etc/openstack/ :

- name: Ensuring we have required pkgs for ansible/openstack
  yum:
    name: python2-shade
    state: installed

- name: Ensuring local directory to hold the os-client-config file
  file:
    path: /etc/openstack
    state: directory
    owner: root
    group: root

- name: Adding clouds.yaml for os-client-config for further actions
  template:
    src: clouds.yaml.j2
    dest: /etc/openstack/clouds.yaml
    owner: root
    group: root
    mode: 0700

Of course such clouds.yaml file is itself a jinja2 template distributed by ansible on the host in the play before using the os_* modules :

clouds:
  {{ cloud_name }}:
    auth:
      username: admin
      project_name: admin
      password: {{ openstack_admin_pass }}
      auth_url: http://{{ openstack_controller }}:5000/v3/
      user_domain_name: default
      project_domain_name: default
    identity_api_version: 3

You just have to adapt to your needs (see doc for this) but the interesting part is the identity_api_version to force v3.

Then, you can use all that in a simple way through ansible tasks, in this case adding users to a project :

- name: Configuring OpenStack user[s]
  os_user:
    cloud: "{{ cloud_name }}"
    default_project: "{{ item.0.name }}"
    domain: "{{ item.0.domain_id }}"
    name: "{{ item.1.login }}"
    email: "{{ item.1.email }}"
    password: "{{ item.1.password }}"           
  with_subelements:
    - "{{ cloud_projects }}"
    - users  
  no_log: True

From a variables point of view, I decided to just have a simple structure to host project/users/roles/quotas like this :

cloud_projects:
  - name: demo
    description: demo project
    domain_id: default
    quota_cores: 20
    quota_instances: 10
    quota_ram: 40960
    users:
      - login: demo_user
        email: demo@centos.org
        password: Ch@ngeM3
        role: admin # can be _member_ or admin
      - login: demo_user2
        email: demo2@centos.org
        password: Ch@ngeMe2

Now that it works, you can explore all the other os_* modules and I'm already using those to :

  • Import cloud images in glance
  • Create networks and subnets in neutron
  • Create projects/users/roles in keystone
  • Change quotas for those projects

I'm just discovering how powerful those tools are, so I'll probably discover much more interesting things to do with those later.


News bewerten

Weiterlesen Artikel ansehen

USN-3424-2: libxml2 vulnerabilities

Unix Server vom 10.10.2017 um 21:41 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3424-2

10th October, 2017

libxml2 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 12.04 LTS

Summary

Several security issues were fixed in libxml2.

Software description

  • libxml2 - GNOME XML library

Details

USN-3424-1 fixed several vulnerabilities in libxml2. This update
provides the corresponding update for Ubuntu 12.04 ESM.

Original advisory details:

It was discovered that a type confusion error existed in libxml2. An
attacker could use this to specially construct XML data that
could cause a denial of service or possibly execute arbitrary
code. (CVE-2017-0663)

It was discovered that libxml2 did not properly validate parsed entity
references. An attacker could use this to specially construct XML
data that could expose sensitive information. (CVE-2017-7375)

It was discovered that a buffer overflow existed in libxml2 when
handling HTTP redirects. An attacker could use this to specially
construct XML data that could cause a denial of service or possibly
execute arbitrary code. (CVE-2017-7376)

Marcel Böhme and Van-Thuan Pham discovered a buffer overflow in
libxml2 when handling elements. An attacker could use this to specially
construct XML data that could cause a denial of service or possibly
execute arbitrary code. (CVE-2017-9047)

Marcel Böhme and Van-Thuan Pham discovered a buffer overread
in libxml2 when handling elements. An attacker could use this
to specially construct XML data that could cause a denial of
service. (CVE-2017-9048)

Marcel Böhme and Van-Thuan Pham discovered multiple buffer overreads
in libxml2 when handling parameter-entity references. An attacker
could use these to specially construct XML data that could cause a
denial of service. (CVE-2017-9049, CVE-2017-9050)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 12.04 LTS:
libxml2 2.7.8.dfsg-5.1ubuntu4.18

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2017-0663, CVE-2017-7375, CVE-2017-7376, CVE-2017-9047, CVE-2017-9048, CVE-2017-9049, CVE-2017-9050


News bewerten

Weiterlesen Artikel ansehen

USN-3443-1: Linux kernel vulnerabilities

Unix Server vom 10.10.2017 um 20:04 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3443-1

10th October, 2017

linux, linux-raspi2 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.04

Summary

Several security issues were fixed in the Linux kernel.

Software description

  • linux - Linux kernel
  • linux-raspi2 - Linux kernel for Raspberry Pi 2

Details

It was discovered that on the PowerPC architecture, the kernel did not
properly sanitize the signal stack when handling sigreturn(). A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2017-1000255)

Andrey Konovalov discovered that a divide-by-zero error existed in the TCP
stack implementation in the Linux kernel. A local attacker could use this
to cause a denial of service (system crash). (CVE-2017-14106)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 17.04:
linux-image-powerpc-smp 4.10.0.37.37
linux-image-powerpc-e500mc 4.10.0.37.37
linux-image-4.10.0-37-lowlatency 4.10.0-37.41
linux-image-generic-lpae 4.10.0.37.37
linux-image-lowlatency 4.10.0.37.37
linux-image-virtual 4.10.0.37.37
linux-image-4.10.0-1019-raspi2 4.10.0-1019.22
linux-image-powerpc64-smp 4.10.0.37.37
linux-image-generic 4.10.0.37.37
linux-image-4.10.0-37-generic-lpae 4.10.0-37.41
linux-image-4.10.0-37-generic 4.10.0-37.41
linux-image-powerpc64-emb 4.10.0.37.37
linux-image-raspi2 4.10.0.1019.20

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References

CVE-2017-1000255, CVE-2017-14106


News bewerten

Weiterlesen Artikel ansehen

USN-3443-2: Linux kernel (HWE) vulnerabilities

Unix Server vom 10.10.2017 um 20:04 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3443-2

10th October, 2017

linux-hwe vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 16.04 LTS

Summary

Several security issues were fixed in the Linux kernel.

Software description

  • linux-hwe - Linux hardware enablement (HWE) kernel

Details


USN-3443-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04.
This update provides the corresponding updates for the Linux Hardware
Enablement (HWE) kernel from Ubuntu 17.04 for Ubuntu 16.04 LTS.

It was discovered that on the PowerPC architecture, the kernel did not
properly sanitize the signal stack when handling sigreturn(). A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2017-1000255)

Andrey Konovalov discovered that a divide-by-zero error existed in the TCP
stack implementation in the Linux kernel. A local attacker could use this
to cause a denial of service (system crash). (CVE-2017-14106)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 16.04 LTS:
linux-image-4.10.0-37-lowlatency 4.10.0-37.41~16.04.1
linux-image-lowlatency-hwe-16.04 4.10.0.37.39
linux-image-generic-hwe-16.04 4.10.0.37.39
linux-image-4.10.0-37-generic-lpae 4.10.0-37.41~16.04.1
linux-image-4.10.0-37-generic 4.10.0-37.41~16.04.1
linux-image-generic-lpae-hwe-16.04 4.10.0.37.39

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References

CVE-2017-1000255, CVE-2017-14106


News bewerten

Weiterlesen Artikel ansehen

USN-3441-1: curl vulnerabilities

Unix Server vom 10.10.2017 um 16:05 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3441-1

10th October, 2017

curl vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.04
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in curl.

Software description

  • curl - HTTP, HTTPS, and FTP client and client libraries

Details

Daniel Stenberg discovered that curl incorrectly handled large floating
point output. A remote attacker could use this issue to cause curl to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-9586)

Even Rouault discovered that curl incorrectly handled large file names when
doing TFTP transfers. A remote attacker could use this issue to cause curl
to crash, resulting in a denial of service, or possibly obtain sensitive
memory contents. (CVE-2017-1000100)

Brian Carpenter and Yongji Ouyang discovered that curl incorrectly handled
numerical range globbing. A remote attacker could use this issue to cause
curl to crash, resulting in a denial of service, or possibly obtain
sensitive memory contents. (CVE-2017-1000101)

Max Dymond discovered that curl incorrectly handled FTP PWD responses. A
remote attacker could use this issue to cause curl to crash, resulting in a
denial of service. (CVE-2017-1000254)

Brian Carpenter discovered that curl incorrectly handled the --write-out
command line option. A local attacker could possibly use this issue to
obtain sensitive memory contents. (CVE-2017-7407)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 17.04:
libcurl3-nss 7.52.1-4ubuntu1.2
curl 7.52.1-4ubuntu1.2
libcurl3-gnutls 7.52.1-4ubuntu1.2
libcurl3 7.52.1-4ubuntu1.2
Ubuntu 16.04 LTS:
libcurl3-nss 7.47.0-1ubuntu2.3
curl 7.47.0-1ubuntu2.3
libcurl3-gnutls 7.47.0-1ubuntu2.3
libcurl3 7.47.0-1ubuntu2.3
Ubuntu 14.04 LTS:
libcurl3-nss 7.35.0-1ubuntu2.11
curl 7.35.0-1ubuntu2.11
libcurl3-gnutls 7.35.0-1ubuntu2.11
libcurl3 7.35.0-1ubuntu2.11

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2016-9586, CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-7407


News bewerten

Weiterlesen Artikel ansehen

USN-3442-1: libXfont vulnerabilities

Unix Server vom 10.10.2017 um 16:05 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3442-1

10th October, 2017

libxfont, libxfont1, libxfont2 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.04
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in libXfont.

Software description

  • libxfont - X11 font rasterisation library
  • libxfont1 - X11 font rasterisation library
  • libxfont2 - X11 font rasterisation library

Details

It was discovered that libXfont incorrectly handled certain patterns in
PatternMatch. A local attacker could use this issue to cause libXfont to
crash, resulting in a denial of service, or possibly obtain sensitive
information. (CVE-2017-13720)

It was discovered that libXfont incorrectly handled certain malformed PCF
files. A local attacker could use this issue to cause libXfont to crash,
resulting in a denial of service, or possibly obtain sensitive information.
(CVE-2017-13722)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 17.04:
libxfont1 1:1.5.2-4ubuntu0.1
libxfont2 1:2.0.1-3ubuntu0.1
Ubuntu 16.04 LTS:
libxfont1 1:1.5.1-1ubuntu0.16.04.3
libxfont2 1:2.0.1-3~ubuntu16.04.2
Ubuntu 14.04 LTS:
libxfont1 1:1.4.7-1ubuntu0.3

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

CVE-2017-13720, CVE-2017-13722


News bewerten

Weiterlesen Artikel ansehen

DSA-3995 libxfont - security update

Unix Server vom 10.10.2017 um 00:00 Uhr | Quelle debian.org

Two vulnerabilities were found in libXfont, the X11 font rasterisation library, which could result in denial of service or memory disclosure.


News bewerten

Weiterlesen Artikel ansehen

DSA-3996 ffmpeg - security update

Unix Server vom 10.10.2017 um 00:00 Uhr | Quelle debian.org

Several vulnerabilities have been discovered in the FFmpeg multimedia framework, which could result in denial of service or potentially the execution of arbitrary code if malformed Real, MV, RL2, ASF, Apple HLS, Phantom Cine, MXF, NSV, MOV or RTP H.264 files/streams are processed.


News bewerten

Weiterlesen Artikel ansehen

DSA-3997 wordpress - security update

Unix Server vom 10.10.2017 um 00:00 Uhr | Quelle debian.org

Several vulnerabilities were discovered in Wordpress, a web blogging tool. They would allow remote attackers to exploit path-traversal issues, perform SQL injections and various cross-site scripting attacks.


News bewerten

Weiterlesen Artikel ansehen

DSA-3994 nautilus - security update

Unix Server vom 07.10.2017 um 00:00 Uhr | Quelle debian.org

Christian Boxdörfer discovered a vulnerability in the handling of FreeDesktop.org .desktop files in Nautilus, a file manager for the GNOME desktop environment. An attacker can craft a .desktop file intended to run malicious commands but displayed as a innocuous document file in Nautilus. An user would then trust it and open the file, and Nautilus would in turn execute the malicious content. Nautilus protection of only trusting .desktop files with executable permission can be bypassed by shipping the .desktop file inside a tarball.


News bewerten

Weiterlesen Artikel ansehen

USN-3440-1: poppler vulnerabilities

Unix Server vom 06.10.2017 um 16:18 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3440-1

6th October, 2017

poppler vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.04
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in poppler.

Software description

  • poppler - PDF rendering library

Details

It was discovered that Poppler incorrectly handled certain files.
If a user or automated system were tricked into opening a
crafted PDF file, an attacker could cause a denial of service.
(CVE-2017-14518, CVE-2017-14520, CVE-2017-14617, CVE-2017-14929,
CVE-2017-14975, CVE-2017-14977)

It was discovered that Poppler incorrectly handled certain files.
If a user or automated system were tricked into opening a crafted
PDF file, an attacker could cause a denial of service. This issue
only affected Ubuntu 17.04 and 16.04. (CVE-2017-14926, CVE-2017-14928)

Alberto Garcia, Francisco Oca and Suleman Ali discovered that Poppler
incorrectly handled certain files. If a user or automated system were
tricked into opening a crafted PDF file, an attacker could cause a
denial of service. (CVE-2017-9776)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 17.04:
libpoppler64 0.48.0-2ubuntu2.3
poppler-utils 0.48.0-2ubuntu2.3
Ubuntu 16.04 LTS:
libpoppler58 0.41.0-0ubuntu1.4
poppler-utils 0.41.0-0ubuntu1.4
Ubuntu 14.04 LTS:
poppler-utils 0.24.5-2ubuntu4.7
libpoppler44 0.24.5-2ubuntu4.7

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2017-14518, CVE-2017-14520, CVE-2017-14617, CVE-2017-14926, CVE-2017-14928, CVE-2017-14929, CVE-2017-14975, CVE-2017-14977, CVE-2017-9776


News bewerten

Weiterlesen Artikel ansehen

DSA-3993 tor - security update

Unix Server vom 06.10.2017 um 00:00 Uhr | Quelle debian.org

It was discovered that the Tor onion service could leak sensitive information to log files if the SafeLogging option is set to "0".


News bewerten

Weiterlesen Artikel ansehen

DSA-3992 curl - security update

Unix Server vom 06.10.2017 um 00:00 Uhr | Quelle debian.org

Several vulnerabilities have been discovered in cURL, an URL transfer library. The Common Vulnerabilities and Exposures project identifies the following problems:


News bewerten

Weiterlesen Artikel ansehen

USN-3439-1: Ruby vulnerabilities

Unix Server vom 05.10.2017 um 18:17 Uhr | Quelle ubuntu.com

Ubuntu Security Notice USN-3439-1

5th October, 2017

ruby1.9.1 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in Ruby.

Software description

  • ruby1.9.1 - Object-oriented scripting language

Details

It was discovered that Ruby incorrectly handled certain inputs.
An attacker could use this to cause a buffer overrun.
(CVE-2017-0898)

Yusuke Endoh discovered that Ruby incorrectly handled certain files.
An attacker could use this to execute terminal escape sequences.
(CVE-2017-0899)

Yusuke Endoh discovered that Ruby incorrectly handled certain inputs.
An attacker could use this to cause a denial of service.
(CVE-2017-0900)

It was discovered that Ruby incorrectly handled certain files.
An attacker could use this to overwrite any file on the filesystem.
(CVE-2017-0901)

It was discovered that Ruby incorrectly handled certain inputs.
An attacker could use this to execute arbitrary code.
(CVE-2017-10784)

It was discovered that Ruby incorrectly handled certain inputs.
An attacker could use this to cause a denial of service.
(CVE-2017-14033)

It was discovered that Ruby incorrectly handled certain files.
An attacker could use this to expose sensitive information.
(CVE-2017-14064)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 14.04 LTS:
ruby1.9.1 1.9.3.484-2ubuntu1.5
libruby1.9.1 1.9.3.484-2ubuntu1.5
ruby1.9.3 1.9.3.484-2ubuntu1.5

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2017-0898, CVE-2017-0899, CVE-2017-0900, CVE-2017-0901, CVE-2017-10748, CVE-2017-14033, CVE-2017-14064


News bewerten

Weiterlesen Artikel ansehen

Seitennavigation

Seite 1 von 45 Seiten (Bei Beitrag 1 - 35)
1.548x Beiträge in dieser Kategorie

Nächste 2 Seite | Letzte Seite