Red Hat Enterprise Linux: Updated gdbm packages that fix one bug are now available for Red Hat Enterprise
Linux 6.
Monthly Archives: January 2015
RHBA-2015:0003-1: dovecot bug fix and enhancement update
Red Hat Enterprise Linux: Updated dovecot packages that fix one bug and add one enhancement are now
available for Red Hat Enterprise Linux 6.
RHBA-2015:0002-1: autofs bug fix update
Red Hat Enterprise Linux: Updated autofs packages that fix one bug are now available for Red Hat
Enterprise Linux 6.
USN-2450-1: strongSwan vulnerability
Ubuntu Security Notice USN-2450-1
5th January, 2015
strongswan vulnerability
A security issue affects these releases of Ubuntu and its
derivatives:
- Ubuntu 14.10
- Ubuntu 14.04 LTS
Summary
strongSwan could be made to crash if it received specially
crafted network traffic.
Software description
- strongswan
– IPsec VPN solution
Details
Mike Daskalakis discovered that strongSwan incorrectly handled IKEv2
payloads that contained the Diffie-Hellman group 1025. A remote attacker
could use this issue to cause the IKE daemon to crash, resulting in a
denial of service.
Update instructions
The problem can be corrected by updating your system to the following
package version:
- Ubuntu 14.10:
-
strongswan-ike
5.1.2-0ubuntu3.2
- Ubuntu 14.04 LTS:
-
strongswan-ike
5.1.2-0ubuntu2.2
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
References
USN-2451-1: cgmanager vulnerability
Ubuntu Security Notice USN-2451-1
5th January, 2015
cgmanager vulnerability
A security issue affects these releases of Ubuntu and its
derivatives:
- Ubuntu 14.10
- Ubuntu 14.04 LTS
Summary
cgmanager could be made to expose sensitive information or devices to
containers running on the system.
Software description
- cgmanager
– Central cgroup manager daemon
Details
Serge Hallyn discovered that cgmanager did not consistently enforce
proper nesting when modifying cgroup properties. A local attacker in a
privileged container could use this to set cgroup values for all cgroups.
Update instructions
The problem can be corrected by updating your system to the following
package version:
- Ubuntu 14.10:
-
cgmanager
0.32-4ubuntu1.1
- Ubuntu 14.04 LTS:
-
cgmanager
0.24-0ubuntu7.1
To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to reboot your computer to make
all the necessary changes.
References
Fedora EPEL 5 Security Update: nail-12.4-1.el5
DSA-3120 mantis – security update
Multiple security issues have been found in the Mantis bug tracking
system, which may result in phishing, information disclosure, CAPTCHA
bypass, SQL injection, cross-site scripting or the execution of arbitrary
PHP code.
DSA-3119 libevent – security update
Andrew Bartlett of Catalyst reported a defect affecting certain
applications using the Libevent evbuffer API. This defect leaves
applications which pass insanely large inputs to evbuffers open to a
possible heap overflow or infinite loop. In order to exploit this flaw,
an attacker needs to be able to find a way to provoke the program into
trying to make a buffer chunk larger than what will fit into a single
size_t or off_t.