SECURITY

USN-2989-1: Linux kernel vulnerabilities Ubuntu Security Notice USN-2989-1 1st June, 2016 linux vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.04 LTS Summary Several security issues were fixed in the kernel. Software description linux – Linux kernel Details Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linuxkernel incorrectly enables scatter/gather I/O. A remote attacker could usethis to obtain potentially sensitive information from kernel memory.(CVE-2016-2117) Jason A. Donenfeld discovered multiple out-of-bounds reads in the OZMO USBover wifi device drivers in the Linux kernel. A remote attacker could usethis to cause a denial of service (system crash) or obtain potentiallysensitive information from kernel memory. (CVE-2015-4004) Andy Lutomirski discovered a race condition in the Linux kernel'stranslation lookaside buffer (TLB) handling of flush events. A localattacker could use this to cause a denial of service or [ more… ]

USN-2988-1: LXD vulnerabilities Ubuntu Security Notice USN-2988-1 31st May, 2016 lxd vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.04 LTS Ubuntu 15.10 Summary Several security issues were fixed in LXD. Software description lxd – Container hypervisor based on LXC Details Robie Basak discovered that LXD incorrectly set permissions when setting upa loop based ZFS pool. A local attacker could use this issue to copy andread the data of any LXD container. (CVE-2016-1581) Robie Basak discovered that LXD incorrectly set permissions when switchingan unprivileged container into privileged mode. A local attacker could usethis issue to access any world readable path in the container directory,including setuid binaries. (CVE-2016-1582) Update instructions The problem can be corrected by updating your system to the following package version: Ubuntu 16.04 LTS: lxd 2.0.2-0ubuntu1~16.04.1 Ubuntu 15.10: lxd 0.20-0ubuntu4.2 To update your [ more… ]