You are here

Hírolvasó

USN-3597-2: Linux kernel (HWE) vulnerabilities

Ubuntu security notices - 2018.03.15, cs - 08:43
linux-hwe vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 16.04 LTS
Summary

Several security issues were fixed in the Linux kernel.

Software Description
  • linux-hwe - Linux hardware enablement (HWE) kernel
Details

USN-3597-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 17.10 for Ubuntu 16.04 LTS.

USNS 3541-2 and 3523-2 provided mitigations for Spectre and Meltdown (CVE-2017-5715, CVE-2017-5753, CVE-2017-5754) for the i386, amd64, and ppc64el architectures for Ubuntu 16.04 LTS. This update provides the corresponding mitigations for the arm64 architecture. Original advisory details:

Jann Horn discovered that microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Meltdown. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2017-5754)

Jann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2017-5715, CVE-2017-5753)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 16.04 LTS
linux-image-4.13.0-37-generic - 4.13.0-37.42~16.04.1
linux-image-4.13.0-37-generic-lpae - 4.13.0-37.42~16.04.1
linux-image-4.13.0-37-lowlatency - 4.13.0-37.42~16.04.1
linux-image-generic-hwe-16.04 - 4.13.0.37.56
linux-image-generic-lpae-hwe-16.04 - 4.13.0.37.56
linux-image-lowlatency-hwe-16.04 - 4.13.0.37.56

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well.

References
Kategóriák: Securiy

USN-3597-1: Linux kernel vulnerabilities

Ubuntu security notices - 2018.03.15, cs - 08:38
linux, linux-raspi2 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
Summary

Several security issues were fixed in the Linux kernel.

Software Description
  • linux - Linux kernel
  • linux-raspi2 - Linux kernel for Raspberry Pi 2
Details

USNS 3541-1 and 3523-1 provided mitigations for Spectre and Meltdown (CVE-2017-5715, CVE-2017-5753, CVE-2017-5754) for the i386, amd64, and ppc64el architectures in Ubuntu 17.10. This update provides the corresponding mitigations for the arm64 architecture. Original advisory details:

Jann Horn discovered that microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Meltdown. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2017-5754)

Jann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2017-5715, CVE-2017-5753)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.10
linux-image-4.13.0-1015-raspi2 - 4.13.0-1015.16
linux-image-4.13.0-37-generic - 4.13.0-37.42
linux-image-4.13.0-37-generic-lpae - 4.13.0-37.42
linux-image-4.13.0-37-lowlatency - 4.13.0-37.42
linux-image-generic - 4.13.0.37.40
linux-image-generic-lpae - 4.13.0.37.40
linux-image-lowlatency - 4.13.0.37.40
linux-image-raspi2 - 4.13.0.1015.13

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well.

References
Kategóriák: Securiy

USN-3596-1: Firefox vulnerabilities

Ubuntu security notices - 2018.03.14, sze - 23:56
firefox vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS
Summary

Firefox could be made to crash or run programs as your login if it opened a malicious website.

Software Description
  • firefox - Mozilla Open Source web browser
Details

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash or opening new tabs, escape the sandbox, bypass same-origin restrictions, obtain sensitive information, confuse the user with misleading permission requests, or execute arbitrary code. (CVE-2018-5125, CVE-2018-5126, CVE-2018-5127, CVE-2018-5128, CVE-2018-5129, CVE-2018-5130, CVE-2018-5136, CVE-2018-5137, CVE-2018-5140, CVE-2018-5141, CVE-2018-5142)

It was discovered that the fetch() API could incorrectly return cached copies of no-store/no-cache resources in some circumstances. A local attacker could potentially exploit this to obtain sensitive information in environments where multiple users share a common profile. (CVE-2018-5131)

Multiple security issues were discovered with WebExtensions. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to obtain sensitive information or bypass security restrictions. (CVE-2018-5132, CVE-2018-5134, CVE-2018-5135)

It was discovered that the value of app.support.baseURL is not sanitized properly. If a malicious local application were to set this to a specially crafted value, an attacker could potentially exploit this to execute arbitrary code. (CVE-2018-5133)

It was discovered that javascript: URLs with embedded tab characters could be pasted in to the addressbar. If a user were tricked in to copying a specially crafted URL in to the addressbar, an attacker could exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2018-5143)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.10
firefox - 59.0+build5-0ubuntu0.17.10.1
Ubuntu 16.04 LTS
firefox - 59.0+build5-0ubuntu0.16.04.1
Ubuntu 14.04 LTS
firefox - 59.0+build5-0ubuntu0.14.04.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Firefox to make all the necessary changes.

References
Kategóriák: Securiy

USN-3595-1: Samba vulnerabilities

Ubuntu security notices - 2018.03.13, k - 16:28
samba vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS
Summary

Several security issues were fixed in Samba.

Software Description
  • samba - SMB/CIFS file, print, and login server for Unix
Details

Björn Baumbach discovered that Samba incorrectly validated permissions when changing account passwords via LDAP. An authenticated attacker could use this issue to change the password of other users, including administrators, and perform actions as those users. (CVE-2018-1057)

It was discovered that Samba incorrectly validated inputs to the RPC spoolss service. An authenticated attacker could use this issue to cause the service to crash, resulting in a denial of service. (CVE-2018-1050)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.10
samba - 2:4.6.7+dfsg-1ubuntu3.2
samba-dsdb-modules - 2:4.6.7+dfsg-1ubuntu3.2
Ubuntu 16.04 LTS
samba - 2:4.3.11+dfsg-0ubuntu0.16.04.13
samba-dsdb-modules - 2:4.3.11+dfsg-0ubuntu0.16.04.13
Ubuntu 14.04 LTS
samba - 2:4.3.11+dfsg-0ubuntu0.14.04.14
samba-dsdb-modules - 2:4.3.11+dfsg-0ubuntu0.14.04.14

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References
Kategóriák: Securiy

USN-3594-1: Linux kernel vulnerability

Ubuntu security notices - 2018.03.09, p - 11:02
linux vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 LTS
Summary

The system could be made to expose sensitive information.

Software Description
  • linux - Linux kernel
Details

USN-3542-1 mitigated CVE-2017-5715 (Spectre Variant 2) for the amd64 architecture in Ubuntu 14.04 LTS. This update provides the compiler-based retpoline kernel mitigation for the amd64 and i386 architectures. Original advisory details:

Jann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2017-5715)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.04 LTS
linux-image-3.13.0-143-generic - 3.13.0-143.192
linux-image-3.13.0-143-generic-lpae - 3.13.0-143.192
linux-image-3.13.0-143-lowlatency - 3.13.0-143.192
linux-image-generic - 3.13.0.143.153
linux-image-generic-lpae - 3.13.0.143.153
linux-image-lowlatency - 3.13.0.143.153

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well.

References
Kategóriák: Securiy

USN-3592-2: ClamAV vulnerabilities

Ubuntu security notices - 2018.03.08, cs - 17:26
clamav vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 12.04 ESM
Summary

Several security issues were fixed in ClamAV.

Software Description
  • clamav - Anti-virus utility for Unix
Details

USN-3592-1 fixed several vulnerabilities in ClamAV. This update provides the corresponding update for Ubuntu 12.04 ESM.

Original advisory details:

It was discovered that ClamAV incorrectly handled parsing certain PDF files. A remote attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-0202)

Hanno Böck discovered that ClamAV incorrectly handled parsing certain XAR files. A remote attacker could use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2018-1000085)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 12.04 ESM
clamav - 0.99.4+addedllvm-0ubuntu0.12.04.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

This update uses a new upstream release, which includes additional bug fixes. In general, a standard system update will make all the necessary changes.

References
Kategóriák: Securiy

USN-3593-1: Zsh vulnerabilities

Ubuntu security notices - 2018.03.08, cs - 16:27
zsh vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS
Summary

Several security issues were fixed in Zsh.

Software Description
  • zsh - shell with lots of features
Details

It was discovered that Zsh incorrectly handled certain enviroment variables. An attacker could possibly use this issue to gain privileged access to the system. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-10070)

It was discovered that Zsh incorrectly handled certain inputs. An attacker could possibly use this to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-10071)

It was discovered that Zsh incorrectly handled some symbolic links. An attacker could possibly use this to execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-10072)

It was discovered that Zsh incorrectly handled certain errors. An attacker could possibly use this issue to cause a denial of service. (CVE-2016-10714)

It was discovered that Zsh incorrectly handled certain commands. An attacker could possibly use this to execute arbitrary code. (CVE-2017-18205)

It was discovered that Zsh incorrectly handled certain symlinks. An attacker could possibly use this to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2017-18206)

It was discovered that Zsh incorrectly handled certain inputs. An attacker could possible use to execute arbitrary code. This issue only affected Ubuntu 17.10. (CVE-2018-7548)

It was discovered that Zsh incorrectly handled certain inputs. An attacker could possibly use this to cause a denial of service. (CVE-2018-7549)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.10
zsh - 5.2-5ubuntu1.1
Ubuntu 16.04 LTS
zsh - 5.1.1-1ubuntu2.1
Ubuntu 14.04 LTS
zsh - 5.0.2-3ubuntu6.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Zsh to make all the necessary changes.

References
Kategóriák: Securiy

USN-3592-1: ClamAV vulnerabilities

Ubuntu security notices - 2018.03.08, cs - 14:16
clamav vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS
Summary

Several security issues were fixed in ClamAV.

Software Description
  • clamav - Anti-virus utility for Unix
Details

It was discovered that ClamAV incorrectly handled parsing certain PDF files. A remote attacker could use this issue to cause ClamAV to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-0202)

Hanno Böck discovered that ClamAV incorrectly handled parsing certain XAR files. A remote attacker could use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2018-1000085)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.10
clamav - 0.99.4+addedllvm-0ubuntu0.17.10.1
Ubuntu 16.04 LTS
clamav - 0.99.4+addedllvm-0ubuntu0.16.04.1
Ubuntu 14.04 LTS
clamav - 0.99.4+addedllvm-0ubuntu0.14.04.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

This update uses a new upstream release, which includes additional bug fixes. In general, a standard system update will make all the necessary changes.

References
Kategóriák: Securiy

Inkscape sorozat 5. rész – 29-35. részek

Full Circle Magazin - 2018.03.07, sze - 21:35

Nehogy unatkozzanak a kedves rajzolni vágyó olvasók, az „Inkscape” sorozat 5. kötetét is közreadjuk. Ebben a kiadásban a 29 – 35. részt lehet megtalálni, semmi extra, csak a tények.

 

Kérlek, ne feledkezz meg az eredeti kiadási dátumról. A hardver és szoftver jelenlegi verziói eltérhetnek az akkor közöltektől, így ellenőrizd a hardvered és szoftvered verzióit, mielőtt megpróbálod emulálni/utánozni a különkiadásokban lévő ismertetőket. Előfordulhat, hogy a szoftver későbbi verziói vannak meg neked, vagy érhetők el a kiadásod tárolóiban.

Inkscape sorozat 5. rész (0)

Inkscape sorozat (ötödik különkiadás): 29–35. rész

Ubuntu magyar közösség - 2018.03.07, sze - 20:58

Folytatjuk az Inkscape cikksorozat különkiadását. A cikksorozat 29–35. részeivel, semmi extra, csak a tények.

Ne feledkezzetek meg az eredeti kiadási dátumokról. A hardver és szoftver jelenlegi verziói eltérhetnek az akkor közöltektől, ellenőrizzétek a verziószámokat, mielőtt kipróbáljátok a cikkekben leírtakat. Nem feltétlenül fog működni az akkori megoldás a mostani rendszereken.

Ez a kiadás letölthető a szokásos PDF változatban.

Letöltés: Inkscape 29–35. rész

Jó olvasgatást!

USN-3579-3: LibreOffice regression

Ubuntu security notices - 2018.03.07, sze - 17:55
libreoffice regression

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
Summary

USN-3579-1 caused a regression in LibreOffice.

Software Description
  • libreoffice - Office productivity suite
Details

USN-3579-1 fixed a vulnerability in LibreOffice. After upgrading, it was no longer possible for LibreOffice to open documents from certain locations outside of the user’s home directory. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that =WEBSERVICE calls in a document could be used to read arbitrary files. If a user were tricked in to opening a specially crafted document, a remote attacker could exploit this to obtain sensitive information. (CVE-2018-6871)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.10
libreoffice-common - 1:5.4.5-0ubuntu0.17.10.5

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart LibreOffice to make all the necessary changes.

References
Kategóriák: Securiy

Ubuntu Hour március

Ubuntu magyar közösség - 2018.03.07, sze - 06:05

Időpont: 2018. március 9. (péntek)

BUDAPEST
Kezdés: 18.00 óra
Helyszín: A Grund Bazsesz terem (Budapest, VIII. Nagytemplom utca 30.)
Téma: Titkosított előadás II.
Megközelítés: Corvin negyedtől 8 perc, Klinikák megállótól 5 perc séta.
Kapcsolatfelvétel a szervezővel.
MISKOLC
Kezdés: 18.00 óra
Helyszín: Avasi Sörház (Hangoló Söröző) (Miskolc, Meggyesalja u. 1.)
Téma: Ubuntu felhasználói élmények
Kapcsolatfelvétel a szervezőkkel: itt és itt.

A rendezvények mindenki számára ingyenesek.

USN-3591-1: Django vulnerabilities

Ubuntu security notices - 2018.03.06, k - 17:17
python-django vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS
Summary

Several security issues were fixed in Django.

Software Description
  • python-django - High-level Python web development framework
Details

James Davis discovered that Django incorrectly handled certain template filters. A remote attacker could possibly use this issue to cause Django to consume resources, resulting in a denial of service.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.10
python-django - 1:1.11.4-1ubuntu1.2
python3-django - 1:1.11.4-1ubuntu1.2
Ubuntu 16.04 LTS
python-django - 1.8.7-1ubuntu5.6
python3-django - 1.8.7-1ubuntu5.6
Ubuntu 14.04 LTS
python-django - 1.6.11-0ubuntu1.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References
Kategóriák: Securiy

USN-3590-1: Irssi vulnerabilities

Ubuntu security notices - 2018.03.06, k - 15:34
irssi vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS
Summary

Several security issues were fixed in Irssi.

Software Description
  • irssi - terminal based IRC client
Details

It was discovered that Irssi incorrectly handled certain empty nick names. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-7050)

It was discovered that Irssi incorrectly handled certain nick names. An attacker could possibly use this to access sensitive information. (CVE-2018-7051)

It was discovered that Irssi incorrectly handled an increase in the number of windows. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-7052)

It was discovered that Irssi incorrectly handled certain messages. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2018-7053)

It was discovered that Irssi incorrectly handled certain disconnections. An attacker could possibly use this to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 17.10. (CVE-2018-7054)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.10
irssi - 1.0.4-1ubuntu2.3
Ubuntu 16.04 LTS
irssi - 0.8.19-1ubuntu1.7
Ubuntu 14.04 LTS
irssi - 0.8.15-5ubuntu3.5

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Irssi to make all the necessary changes.

References
Kategóriák: Securiy

USN-3589-1: PostgreSQL vulnerability

Ubuntu security notices - 2018.03.06, k - 10:36
postgresql-9.3, postgresql-9.5, postgresql-9.6 vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS
Summary

PostgreSQL could be made to execute arbitrary code.

Software Description
  • postgresql-9.6 - Object-relational SQL database
  • postgresql-9.5 - Object-relational SQL database
  • postgresql-9.3 - Object-relational SQL database
Details

It was discovered that PostgreSQL incorrectly handled certain settings. An attacker could possibly use this issue to execute arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.10
postgresql-9.6 - 9.6.8-0ubuntu0.17.10
Ubuntu 16.04 LTS
postgresql-9.5 - 9.5.12-0ubuntu0.16.04
Ubuntu 14.04 LTS
postgresql-9.3 - 9.3.22-0ubuntu0.14.04

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart PostgreSQL to make all the necessary changes.

References
Kategóriák: Securiy

USN-3588-1: Memcached vulnerabilities

Ubuntu security notices - 2018.03.05, h - 20:35
Ubuntu Security Notice USN-3588-1

5th March, 2018

memcached vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS
Summary

Several security issues were fixed in Memcached.

Software description
  • memcached - high-performance memory object caching system
Details

Daniel Shapira discovered an integer overflow issue in Memcached. A remote
attacker could use this to cause a denial of service (daemon crash).
(CVE-2017-9951)

It was discovered that Memcached listened to UDP by default. A remote
attacker could use this as part of a distributed denial of service attack.
(CVE-2018-1000115)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 17.10:
memcached 1.4.33-1ubuntu3.2
Ubuntu 16.04 LTS:
memcached 1.4.25-2ubuntu1.3
Ubuntu 14.04 LTS:
memcached 1.4.14-0ubuntu9.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

Please note that after applying this update, Memcached will no longer
listen to UDP by default. If UDP service is desired, please add
'-U 11211' to /etc/memcached.conf and restart the memcached service.

References

CVE-2017-9951, CVE-2018-1000115

Kategóriák: Securiy

USN-3585-1: Twisted vulnerability

Ubuntu security notices - 2018.03.05, h - 18:08
twisted vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS
Summary

Twisted could be made to run programs if it received specially crafted network traffic.

Software Description
  • twisted - Event-based framework for internet applications
Details

It was discovered that Twisted incorrectly handled certain HTTP requests. An attacker could possibly use this issue to execute arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 16.04 LTS
python-twisted - 16.0.0-1ubuntu0.2
python-twisted-bin - 16.0.0-1ubuntu0.2
python-twisted-web - 16.0.0-1ubuntu0.2
python3-twisted - 16.0.0-1ubuntu0.2
Ubuntu 14.04 LTS
python-twisted - 13.2.0-1ubuntu1.2
python-twisted-bin - 13.2.0-1ubuntu1.2
python-twisted-web - 13.2.0-1ubuntu1.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References
Kategóriák: Securiy

USN-3587-1: Dovecot vulnerabilities

Ubuntu security notices - 2018.03.05, h - 17:29
Ubuntu Security Notice USN-3587-1

5th March, 2018

dovecot vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS
Summary

Several security issues were fixed in Dovecot.

Software description
  • dovecot - IMAP and POP3 email server
Details

It was discovered that Dovecot incorrectly handled parsing certain email
addresses. A remote attacker could use this issue to cause Dovecot to
crash, resulting in a denial of service, or possibly obtain sensitive
information. (CVE-2017-14461)

It was discovered that Dovecot incorrectly handled TLS SNI config lookups.
A remote attacker could possibly use this issue to cause Dovecot to crash,
resulting in a denial of service. (CVE-2017-15130)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 17.10:
dovecot-core 1:2.2.27-3ubuntu1.3
Ubuntu 16.04 LTS:
dovecot-core 1:2.2.22-1ubuntu2.7
Ubuntu 14.04 LTS:
dovecot-core 1:2.2.9-1ubuntu2.4

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2017-14461, CVE-2017-15130

Kategóriák: Securiy

USN-3588-1: Memcached vulnerabilities

Ubuntu security notices - 2018.03.05, h - 17:02
memcached vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS
Summary

Several security issues were fixed in Memcached.

Software Description
  • memcached - high-performance memory object caching system
Details

Daniel Shapira discovered an integer overflow issue in Memcached. A remote attacker could use this to cause a denial of service (daemon crash). (CVE-2017-9951)

It was discovered that Memcached listened to UDP by default. A remote attacker could use this as part of a distributed denial of service attack. (CVE-2018-1000115)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.10
memcached - 1.4.33-1ubuntu3.2
Ubuntu 16.04 LTS
memcached - 1.4.25-2ubuntu1.3
Ubuntu 14.04 LTS
memcached - 1.4.14-0ubuntu9.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

Please note that after applying this update, Memcached will no longer listen to UDP by default. If UDP service is desired, please add ‘-U 11211’ to /etc/memcached.conf and restart the memcached service.

References
Kategóriák: Securiy

USN-3575-2: QEMU regression

Ubuntu security notices - 2018.03.05, h - 14:15
Ubuntu Security Notice USN-3575-2

5th March, 2018

qemu regression

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS
Summary

USN-3575-1 introduced a regression in QEMU.

Software description
  • qemu - Machine emulator and virtualizer
Details

USN-3575-1 fixed vulnerabilities in QEMU. The fix for CVE-2017-11334 caused
a regression in Xen environments. This update removes the problematic fix
pending further investigation.

We apologize for the inconvenience.

Original advisory details:

It was discovered that QEMU incorrectly handled guest ram. A privileged
attacker inside the guest could use this issue to cause QEMU to crash,
resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS
and Ubuntu 16.04 LTS. (CVE-2017-11334)

David Buchanan discovered that QEMU incorrectly handled the VGA device. A
privileged attacker inside the guest could use this issue to cause QEMU to
crash, resulting in a denial of service. This issue was only addressed in
Ubuntu 17.10. (CVE-2017-13672)

Thomas Garnier discovered that QEMU incorrectly handled multiboot. An
attacker could use this issue to cause QEMU to crash, resulting in a denial
of service, or possibly execute arbitrary code on the host. In the default
installation, when QEMU is used with libvirt, attackers would be isolated
by the libvirt AppArmor profile. This issue only affected Ubuntu 14.04 LTS
and Ubuntu 16.04 LTS. (CVE-2017-14167)

Tuomas Tynkkynen discovered that QEMU incorrectly handled VirtFS directory
sharing. An attacker could use this issue to obtain sensitive information
from host memory. (CVE-2017-15038)

Eric Blake discovered that QEMU incorrectly handled memory in the
NBD server. An attacker could use this issue to cause the NBD server to
crash, resulting in a denial of service. This issue only affected Ubuntu
17.10. (CVE-2017-15118)

Eric Blake discovered that QEMU incorrectly handled certain options to the
NBD server. An attacker could use this issue to cause the NBD server to
crash, resulting in a denial of service. This issue only affected Ubuntu
14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-15119)

Daniel Berrange discovered that QEMU incorrectly handled the VNC server. A
remote attacker could possibly use this issue to consume memory, resulting
in a denial of service. This issue was only addressed in Ubuntu 17.10.
(CVE-2017-15124)

Carl Brassey discovered that QEMU incorrectly handled certain websockets. A
remote attacker could possibly use this issue to consume memory, resulting
in a denial of service. This issue only affected Ubuntu 17.10.
(CVE-2017-15268)

Guoxiang Niu discovered that QEMU incorrectly handled the Cirrus VGA
device. A privileged attacker inside the guest could use this issue to
cause QEMU to crash, resulting in a denial of service. (CVE-2017-15289)

Cyrille Chatras discovered that QEMU incorrectly handled certain PS2 values
during migration. An attacker could possibly use this issue to cause QEMU
to crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10.
(CVE-2017-16845)

It was discovered that QEMU incorrectly handled the Virtio Vring
implementation. An attacker could possibly use this issue to cause QEMU to
crash, resulting in a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 17.10. (CVE-2017-17381)

Eric Blake discovered that QEMU incorrectly handled certain rounding
operations. An attacker could possibly use this issue to cause QEMU to
crash, resulting in a denial of service. This issue only affected Ubuntu
14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-18043)

Jiang Xin and Lin ZheCheng discovered that QEMU incorrectly handled the
VGA device. A privileged attacker inside the guest could use this issue to
cause QEMU to crash, resulting in a denial of service. (CVE-2018-5683)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 16.04 LTS:
qemu 1:2.5+dfsg-5ubuntu10.24
Ubuntu 14.04 LTS:
qemu 2.0.0+dfsg-2ubuntu1.40

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.

References

LP: 1752761

Kategóriák: Securiy

Oldalak

Subscribe to Informatikai megoldások hírolvasó