SECURITY

USN-3321-1: Thunderbird vulnerabilities Ubuntu Security Notice USN-3321-1 5th July, 2017 thunderbird vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.04 Ubuntu 16.10 Ubuntu 16.04 LTS Ubuntu 14.04 LTS Summary Several security issues were fixed in Thunderbird. Software description thunderbird – Mozilla Open Source mail and newsgroup client Details Multiple security issues were discovered in Thunderbird. If a user weretricked in to opening a specially crafted website in a browsing context,an attacker could potentially exploit these to cause a denial of service,read uninitialized memory, obtain sensitive information or executearbitrary code. (CVE-2017-5470, CVE-2017-5472,CVE-2017-7749, CVE-2017-7750, CVE-2017-7751, CVE-2017-7752, CVE-2017-7754,CVE-2017-7756, CVE-2017-7757, CVE-2017-7758, CVE-2017-7764) Multiple security issues were discovered in the Graphite 2 library usedby Thunderbird. If a user were tricked in to opening a specially craftedmessage, an attacker could potentially exploit these to cause a denial ofservice, read uninitialized memory, [ more… ]

USN-3349-1: NTP vulnerabilities Ubuntu Security Notice USN-3349-1 5th July, 2017 ntp vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.04 Ubuntu 16.10 Ubuntu 16.04 LTS Ubuntu 14.04 LTS Summary Several security issues were fixed in NTP. Software description ntp – Network Time Protocol daemon and utility programs Details Yihan Lian discovered that NTP incorrectly handled certain large requestdata values. A remote attacker could possibly use this issue to cause NTPto crash, resulting in a denial of service. This issue only affectedUbuntu 16.04 LTS. (CVE-2016-2519) Miroslav Lichvar discovered that NTP incorrectly handled certain spoofedaddresses when performing rate limiting. A remote attacker could possiblyuse this issue to perform a denial of service. This issue only affectedUbuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-7426) Matthew Van Gundy discovered that NTP incorrectly handled certain craftedbroadcast mode packets. [ more… ]

USN-3348-1: Samba vulnerability Ubuntu Security Notice USN-3348-1 5th July, 2017 samba vulnerability A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.04 Ubuntu 16.10 Ubuntu 16.04 LTS Ubuntu 14.04 LTS Summary Samba could be made to hang if it received specially crafted network traffic. Software description samba – SMB/CIFS file, print, and login server for Unix Details It was discovered that Samba incorrectly handled dangling symlinks. Aremote attacker could possibly use this issue to cause Samba to hang,resulting in a denial of service. This issue only applied to Ubuntu 14.04LTS and Ubuntu 16.04 LTS. (CVE-2017-9461) In addition, this update fixes a regression introduced by USN-3267-1that caused Samba to incorrectly handle non-wide symlinks to directories. Update instructions The problem can be corrected by updating your system to the following package version: Ubuntu 17.04: samba 2:4.5.8+dfsg-0ubuntu0.17.04.3 Ubuntu 16.10: samba [ more… ]