Monthly Archives: June 2016

Ubuntu

USN-3010-1: Expat vulnerabilities

Ubuntu Security Notice USN-3010-1

20th June, 2016

expat vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 16.04 LTS
  • Ubuntu 15.10
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS

Summary

Several security issues were fixed in Expat.

Software description

  • expat
    – XML parsing C library

Details

It was discovered that Expat unexpectedly called srand in certain
circumstances. This could reduce the security of calling applications.
(CVE-2012-6702)

It was discovered that Expat incorrectly handled seeding the random number
generator. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2016-5300)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.04 LTS:
libexpat1

2.1.0-7ubuntu0.16.04.2
lib64expat1

2.1.0-7ubuntu0.16.04.2
Ubuntu 15.10:
libexpat1

2.1.0-7ubuntu0.15.10.2
lib64expat1

2.1.0-7ubuntu0.15.10.2
Ubuntu 14.04 LTS:
libexpat1

2.1.0-4ubuntu1.3
lib64expat1

2.1.0-4ubuntu1.3
Ubuntu 12.04 LTS:
libexpat1

2.0.1-7.2ubuntu1.4
lib64expat1

2.0.1-7.2ubuntu1.4

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system upgrade you need to restart any applications linked
against Expat to effect the necessary changes.

References

CVE-2012-6702,

CVE-2016-5300

Ubuntu

USN-3013-1: XML-RPC for C and C++ vulnerabilities

Ubuntu Security Notice USN-3013-1

20th June, 2016

xmlrpc-c vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 12.04 LTS

Summary

Several security issues were fixed in XML-RPC for C and C++.

Software description

  • xmlrpc-c
    – Lightweight RPC library based on XML and HTTP

Details

It was discovered that the Expat code in XML-RPC for C and C++ unexpectedly
called srand in certain circumstances. This could reduce the security of
calling applications. (CVE-2012-6702)

It was discovered that the Expat code in XML-RPC for C and C++ incorrectly
handled seeding the random number generator. A remote attacker could
possibly use this issue to cause a denial of service. (CVE-2016-5300)

Gustavo Grieco discovered that the Expat code in XML-RPC for C and C++
incorrectly handled malformed XML data. If a user or application linked
against XML-RPC for C and C++ were tricked into opening a crafted XML file,
an attacker could cause a denial of service, or possibly execute arbitrary
code. (CVE-2016-0718)

It was discovered that the Expat code in XML-RPC for C and C++ incorrectly
handled malformed XML data. If a user or application linked against XML-RPC
for C and C++ were tricked into opening a crafted XML file, an attacker
could cause a denial of service, or possibly execute arbitrary code.
(CVE-2015-1283, CVE-2016-4472)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 12.04 LTS:
libxmlrpc-c++4

1.16.33-3.1ubuntu5.2
libxmlrpc-core-c3

1.16.33-3.1ubuntu5.2

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system upgrade you need to restart any applications linked
against XML-RPC for C and C++ to effect the necessary changes.

References

CVE-2012-6702,

CVE-2015-1283,

CVE-2016-0718,

CVE-2016-4472,

CVE-2016-5300

Security

Suricata IDPE 3.1

Suricata is a network intrusion detection and prevention engine developed by the Open Information Security Foundation and its supporting vendors. The engine is multi-threaded and has native IPv6 support. It’s capable of loading existing Snort rules and signatures and supports the Barnyard and Barnyard2 tools.

Security

AIEngine 1.5

AIEngine is a packet inspection engine with capabilities of learning without any human intervention. It helps network/security professionals to identify traffic and develop signatures for use them on NIDS, Firewalls, Traffic classifiers and so on.

Security

Red Hat Security Advisory 2016-1262-01

Red Hat Security Advisory 2016-1262-01 – Chromium is an open-source web browser, powered by WebKit. This update upgrades Chromium to version 51.0.2704.103. Security Fix: Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim.