Ubuntu security

USN-3444-2: Linux kernel (Xenial HWE) vulnerabilities Ubuntu Security Notice USN-3444-2 10th October, 2017 linux-lts-xenial vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.04 LTS Summary Several security issues were fixed in the Linux kernel. Software description linux-lts-xenial – Linux hardware enablement kernel from Xenial for Trusty Details USN-3444-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04LTS. This update provides the corresponding updates for the LinuxHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu14.04 LTS. Jan H. Schönherr discovered that the Xen subsystem did not properly handleblock IO merges correctly in some situations. An attacker in a guest vmcould use this to cause a denial of service (host crash) or possibly gainadministrative privileges in the host. (CVE-2017-12134) Andrey Konovalov discovered that a divide-by-zero error existed in the TCPstack implementation in the Linux kernel. A [ more… ]

USN-3445-1: Linux kernel vulnerabilities Ubuntu Security Notice USN-3445-1 10th October, 2017 linux vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.04 LTS Summary Several security issues were fixed in the Linux kernel. Software description linux – Linux kernel Details Eyal Itkin discovered that the IP over IEEE 1394 (FireWire) implementationin the Linux kernel contained a buffer overflow when handling fragmentedpackets. A remote attacker could use this to possibly execute arbitrarycode with administrative privileges. (CVE-2016-8633) Andrey Konovalov discovered that a divide-by-zero error existed in the TCPstack implementation in the Linux kernel. A local attacker could use thisto cause a denial of service (system crash). (CVE-2017-14106) Update instructions The problem can be corrected by updating your system to the following package version: Ubuntu 14.04 LTS: linux-image-3.13.0-133-powerpc64-smp 3.13.0-133.182 linux-image-powerpc-smp 3.13.0.133.142 linux-image-powerpc-e500mc 3.13.0.133.142 linux-image-3.13.0-133-powerpc-e500mc 3.13.0-133.182 linux-image-3.13.0-133-powerpc-e500 3.13.0-133.182 linux-image-generic 3.13.0.133.142 [ more… ]

USN-3424-2: libxml2 vulnerabilities Ubuntu Security Notice USN-3424-2 10th October, 2017 libxml2 vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.04 LTS Summary Several security issues were fixed in libxml2. Software description libxml2 – GNOME XML library Details USN-3424-1 fixed several vulnerabilities in libxml2. This updateprovides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: It was discovered that a type confusion error existed in libxml2. An attacker could use this to specially construct XML data that could cause a denial of service or possibly execute arbitrary code. (CVE-2017-0663) It was discovered that libxml2 did not properly validate parsed entity references. An attacker could use this to specially construct XML data that could expose sensitive information. (CVE-2017-7375) It was discovered that a buffer overflow existed in libxml2 when handling HTTP redirects. An attacker could use [ more… ]

USN-3443-2: Linux kernel (HWE) vulnerabilities Ubuntu Security Notice USN-3443-2 10th October, 2017 linux-hwe vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.04 LTS Summary Several security issues were fixed in the Linux kernel. Software description linux-hwe – Linux hardware enablement (HWE) kernel Details USN-3443-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04.This update provides the corresponding updates for the Linux HardwareEnablement (HWE) kernel from Ubuntu 17.04 for Ubuntu 16.04 LTS. It was discovered that on the PowerPC architecture, the kernel did notproperly sanitize the signal stack when handling sigreturn(). A localattacker could use this to cause a denial of service (system crash) orpossibly execute arbitrary code. (CVE-2017-1000255) Andrey Konovalov discovered that a divide-by-zero error existed in the TCPstack implementation in the Linux kernel. A local attacker could use thisto cause a denial of service [ more… ]

USN-3443-1: Linux kernel vulnerabilities Ubuntu Security Notice USN-3443-1 10th October, 2017 linux, linux-raspi2 vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.04 Summary Several security issues were fixed in the Linux kernel. Software description linux – Linux kernel linux-raspi2 – Linux kernel for Raspberry Pi 2 Details It was discovered that on the PowerPC architecture, the kernel did notproperly sanitize the signal stack when handling sigreturn(). A localattacker could use this to cause a denial of service (system crash) orpossibly execute arbitrary code. (CVE-2017-1000255) Andrey Konovalov discovered that a divide-by-zero error existed in the TCPstack implementation in the Linux kernel. A local attacker could use thisto cause a denial of service (system crash). (CVE-2017-14106) Update instructions The problem can be corrected by updating your system to the following package version: Ubuntu 17.04: linux-image-powerpc-smp 4.10.0.37.37 linux-image-powerpc-e500mc [ more… ]