USN-2577-1: wpa_supplicant vulnerability

Ubuntu Security Notice USN-2577-1

23rd April, 2015

wpa vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 15.04
  • Ubuntu 14.10
  • Ubuntu 14.04 LTS

Summary

wpa_supplicant could be made to crash, expose memory, or run programs if it
received specially crafted network traffic.

Software description

  • wpa
    – client support for WPA and WPA2

Details

It was discovered that wpa_supplicant incorrectly handled SSID information
when creating or updating P2P peer entries. A remote attacker could use
this issue to cause wpa_supplicant to crash, resulting in a denial of
service, expose memory contents, or possibly execute arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 15.04:
wpasupplicant

2.1-0ubuntu7.1
Ubuntu 14.10:
wpasupplicant

2.1-0ubuntu4.1
Ubuntu 14.04 LTS:
wpasupplicant

2.1-0ubuntu1.2

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

CVE-2015-1863

Ubuntu Security Notice USN-2576-2

Ubuntu Security Notice 2576-2 – USN-2576-1 fixed a vulnerability in usb-creator. This update provides the corresponding fix for Ubuntu 15.04. Tavis Ormandy discovered that usb-creator was missing an authentication check. A local attacker could use this issue to gain elevated privileges.

Fedora EPEL 6 Security Update: wordpress-4.2.1-1.el6

Resolved Bugs
1214650 – wordpress: several vulnerabilities fixed in WordPress 4.1.2
1214652 – wordpress: several vulnerabilities fixed in WordPress 4.1.2 [epel-all]
1216069 – wordpress: stored XSS via long comments
1216071 – wordpress: stored XSS via long comments [epel-all]<br
**WordPress 4.2 “Powell” **
* Upstream announcement https://wordpress.org/news/2015/04/powell/
**WordPress 4.2.1 Security Release**
* Upstream announcement https://wordpress.org/news/2015/04/wordpress-4-2-1/

Fedora EPEL 7 Security Update: wordpress-4.2.1-1.el7

Resolved Bugs
1214650 – wordpress: several vulnerabilities fixed in WordPress 4.1.2
1216069 – wordpress: stored XSS via long comments
1214652 – wordpress: several vulnerabilities fixed in WordPress 4.1.2 [epel-all]
1216071 – wordpress: stored XSS via long comments [epel-all]<br
**WordPress 4.2 “Powell” **
* Upstream announcement https://wordpress.org/news/2015/04/powell/
**WordPress 4.2.1 Security Release**
* Upstream announcement https://wordpress.org/news/2015/04/wordpress-4-2-1/

Fedora EPEL 5 Security Update: wordpress-4.2.1-1.el5

Resolved Bugs
1214650 – wordpress: several vulnerabilities fixed in WordPress 4.1.2
1214652 – wordpress: several vulnerabilities fixed in WordPress 4.1.2 [epel-all]
1216069 – wordpress: stored XSS via long comments
1216071 – wordpress: stored XSS via long comments [epel-all]<br
**WordPress 4.2 “Powell” **
* Upstream announcement https://wordpress.org/news/2015/04/powell/
**WordPress 4.2.1 Security Release**
* Upstream announcement https://wordpress.org/news/2015/04/wordpress-4-2-1/