Red Hat Enterprise Linux: Updated jasper-devel packages are now available for Red Hat OpenShift Enterprise
release 2.0. These packages are required to avoid dependency issues with the
base channel for Red Hat Enterprise Linux 6.6.
Monthly Archives: January 2015
RHBA-2015:0019-1: Red Hat OpenShift Enterprise 2.2.3 bug fix and enhancement update
Red Hat Enterprise Linux: Red Hat OpenShift Enterprise release 2.2.3 is now available with updates to
packages that fix several bugs and introduce a feature enhancement.
RHBA-2015:0018-1: sblim-sfcb bug fix update
Red Hat Enterprise Linux: Updated sblim-sfcb packages that fix one bug are now available for Red Hat
Enterprise Linux 6.
RHBA-2015:0017-1: libibverbs and libmlx4 bug fix update
Red Hat Enterprise Linux: Updated libibverbs and libmlx4 packages that fix one bug are now available for
Red Hat Enterprise Linux 7.
USN-2456-1: GNU cpio vulnerabilities
Ubuntu Security Notice USN-2456-1
8th January, 2015
cpio vulnerabilities
A security issue affects these releases of Ubuntu and its
derivatives:
- Ubuntu 14.10
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Summary
The GNU cpio program could be made to crash or run programs if it
opened a specially crafted file or received specially crafted input.
Software description
- cpio
– a program to manage archives of files
Details
Michal Zalewski discovered an out of bounds write issue in the
process_copy_in function of GNU cpio. An attacker could specially
craft a cpio archive that could create a denial of service or possibly
execute arbitrary code. (CVE-2014-9112)
Jakob Lell discovered a heap-based buffer overflow in the rmt_read__
function of GNU cpio’s rmt client functionality. An attacker
controlling a remote rmt server could use this to cause a denial of
service or possibly execute arbitrary code. This issue only affected
Ubuntu 10.04 LTS. (CVE-2010-0624)
Update instructions
The problem can be corrected by updating your system to the following
package version:
- Ubuntu 14.10:
-
cpio
2.11+dfsg-2ubuntu1.1
- Ubuntu 14.04 LTS:
-
cpio
2.11+dfsg-1ubuntu1.1
- Ubuntu 12.04 LTS:
-
cpio
2.11-7ubuntu3.1
- Ubuntu 10.04 LTS:
-
cpio
2.10-1ubuntu2.1
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
References
CVE-2014-3570
The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c.
CVE-2014-3571
OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1_get_record function in d1_pkt.c and the ssl3_read_n function in s3_pkt.c.
CVE-2014-3572
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message.
CVE-2014-8027
The RBAC component in Cisco Secure Access Control System (ACS) allows remote authenticated users to obtain Network Device Administrator privileges for Create, Delete, Read, and Update operations via crafted HTTP requests, aka Bug ID CSCuq79034.
CVE-2014-8028
Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco Secure Access Control System (ACS) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq79019.