Ubuntu security

USN-3367-1: gdb vulnerabilities Ubuntu Security Notice USN-3367-1 26th July, 2017 gdb vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.04 Ubuntu 16.04 LTS Ubuntu 14.04 LTS Summary Several security issues were fixed in gdb. Software description gdb – GNU Debugger Details Hanno Böck discovered that gdb incorrectly handled certain malformed AOUTheaders in PE executables. If a user or automated system were tricked intoprocessing a specially crafted binary, a remote attacker could use thisissue to cause gdb to crash, resulting in a denial of service, or possiblyexecute arbitrary code. This issue only applied to Ubuntu 14.04 LTS.(CVE-2014-8501) It was discovered that gdb incorrectly handled printing bad bytes in IntelHex objects. If a user or automated system were tricked into processing aspecially crafted binary, a remote attacker could use this issue to causegdb to crash, resulting in [ more… ]

USN-3364-3: Linux kernel (AWS, GKE) vulnerabilities Ubuntu Security Notice USN-3364-3 25th July, 2017 linux-aws, linux-gke vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.04 LTS Summary Several security issues were fixed in the Linux kernel. Software description linux-aws – Linux kernel for Amazon Web Services (AWS) systems linux-gke – Linux kernel for Google Container Engine (GKE) systems Details It was discovered that the Linux kernel did not properly initialize a Wake-on-Lan data structure. A local attacker could use this to expose sensitiveinformation (kernel memory). (CVE-2014-9900) It was discovered that the Linux kernel did not properly restrict access to/proc/iomem. A local attacker could use this to expose sensitiveinformation. (CVE-2015-8944) Alexander Potapenko discovered a race condition in the Advanced Linux SoundArchitecture (ALSA) subsystem in the Linux kernel. A local attacker coulduse this to expose sensitive information (kernel [ more… ]

USN-3365-1: Ruby vulnerabilities Ubuntu Security Notice USN-3365-1 25th July, 2017 ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.04 Ubuntu 16.04 LTS Ubuntu 14.04 LTS Summary Several security issues were fixed in Ruby. Software description ruby1.9.1 – Object-oriented scripting language ruby2.0 – Object-oriented scripting language ruby2.3 – Object-oriented scripting language Details It was discovered that Ruby DL::dlopen incorrectly handled openinglibraries. An attacker could possibly use this issue to open libraries withtainted names. This issue only applied to Ubuntu 14.04 LTS. (CVE-2009-5147) Tony Arcieri, Jeffrey Walton, and Steffan Ullrich discovered that the RubyOpenSSL extension incorrectly handled hostname wildcard matching. Thisissue only applied to Ubuntu 14.04 LTS. (CVE-2015-1855) Christian Hofstaedtler discovered that Ruby Fiddle::Handle incorrectlyhandled certain crafted strings. An attacker could use this issue to causea denial of service, or possibly execute arbitrary code. [ more… ]

USN-3364-1: Linux kernel vulnerabilities Ubuntu Security Notice USN-3364-1 24th July, 2017 linux, linux-raspi2, linux-snapdragon vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.04 LTS Summary Several security issues were fixed in the Linux kernel. Software description linux – Linux kernel linux-raspi2 – Linux kernel for Raspberry Pi 2 linux-snapdragon – Linux kernel for Snapdragon processors Details It was discovered that the Linux kernel did not properly initialize a Wake-on-Lan data structure. A local attacker could use this to expose sensitiveinformation (kernel memory). (CVE-2014-9900) It was discovered that the Linux kernel did not properly restrict access to/proc/iomem. A local attacker could use this to expose sensitiveinformation. (CVE-2015-8944) Alexander Potapenko discovered a race condition in the Advanced Linux SoundArchitecture (ALSA) subsystem in the Linux kernel. A local attacker coulduse this to expose sensitive information (kernel memory).(CVE-2017-1000380) Li [ more… ]

USN-3364-2: Linux kernel (Xenial HWE) vulnerabilities Ubuntu Security Notice USN-3364-2 24th July, 2017 linux-lts-xenial vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.04 LTS Summary Several security issues were fixed in the Linux kernel. Software description linux-lts-xenial – Linux hardware enablement kernel from Xenial for Trusty Details USN-3364-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04LTS. This update provides the corresponding updates for the LinuxHardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu14.04 LTS. It was discovered that the Linux kernel did not properly initialize a Wake-on-Lan data structure. A local attacker could use this to expose sensitiveinformation (kernel memory). (CVE-2014-9900) It was discovered that the Linux kernel did not properly restrict access to/proc/iomem. A local attacker could use this to expose sensitiveinformation. (CVE-2015-8944) Alexander Potapenko discovered a race condition in the Advanced [ more… ]