[월:] 2016년 03월

USN-2915-2: Django regression Ubuntu Security Notice USN-2915-2 7th March, 2016 python-django regression A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.10 Ubuntu 14.04 LTS Summary USN-2915-1 introduced a regression in Django. Software description python-django – High-level Python web development framework Details USN-2915-1 fixed vulnerabilities in Django. The upstream fix forCVE-2016-2512 introduced a regression for certain applications. This updatefixes the problem. Original advisory details: Mark Striemer discovered that Django incorrectly handled user-supplied redirect URLs containing basic authentication credentials. A remote attacker could possibly use this issue to perform a cross-site scripting attack or a malicious redirect. (CVE-2016-2512) Sjoerd Job Postmus discovered that Django incorrectly handled timing when doing password hashing operations. A remote attacker could possibly use this issue to perform user enumeration. (CVE-2016-2513) Update instructions The problem can be corrected by updating your system to the [ more… ]

USN-2921-1: Squid vulnerabilities Ubuntu Security Notice USN-2921-1 7th March, 2016 squid3 vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Summary Several security issues were fixed in Squid. Software description squid3 – Web proxy cache server Details Sebastian Krahmer discovered that Squid incorrectly handled certain SNMPrequests. If SNMP is enabled, a remote attacker could use this issue tocause Squid to crash, resulting in a denial of service, or possibly executearbitrary code. (CVE-2014-6270) Alex Rousskov discovered that Squid incorrectly handled certain malformedresponses. A remote attacker could possibly use this issue to cause Squidto crash, resulting in a denial of service. (CVE-2016-2571) Update instructions The problem can be corrected by updating your system to the following package version: Ubuntu 15.10: squid3 3.3.8-1ubuntu16.2 Ubuntu 14.04 LTS: squid3 3.3.8-1ubuntu6.6 Ubuntu 12.04 LTS: squid3 [ more… ]