Ubuntu Security Notice USN-2761-1

5th October, 2015

linux vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 14.04 LTS

Summary

The system could be made to crash or run programs as an administrator.

Software description

• linux
  – Linux kernel

Details

Dmitry Vyukov discovered that the Linux kernel did not properly initialize
IPC object state in certain situations. A local attacker could use this to
escalate their privileges, expose confidential information, or cause a
denial of service (system crash).

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 14.04 LTS:

linux-image-3.13.0-65-powerpc-e500

3.13.0-65.106

linux-image-3.13.0-65-powerpc64-smp

3.13.0-65.106

linux-image-3.13.0-65-powerpc-smp

3.13.0-65.106

linux-image-3.13.0-65-powerpc64-emb

3.13.0-65.106

linux-image-3.13.0-65-generic

3.13.0-65.106

linux-image-3.13.0-65-generic-lpae

3.13.0-65.106

linux-image-3.13.0-65-powerpc-e500mc

3.13.0-65.106

linux-image-3.13.0-65-lowlatency

3.13.0-65.106

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

CVE-2015-7613

Ubuntu Security Notice USN-2764-1

5th October, 2015

linux-lts-utopic vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 14.04 LTS

Summary

The system could be made to crash or run programs as an administrator.

Software description

• linux-lts-utopic
  – Linux hardware enablement kernel from Utopic

Details

Dmitry Vyukov discovered that the Linux kernel did not properly initialize
IPC object state in certain situations. A local attacker could use this to
escalate their privileges, expose confidential information, or cause a
denial of service (system crash).

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 14.04 LTS:

linux-image-3.16.0-50-powerpc64-emb

3.16.0-50.67~14.04.1

linux-image-3.16.0-50-generic

3.16.0-50.67~14.04.1

linux-image-3.16.0-50-lowlatency

3.16.0-50.67~14.04.1

linux-image-3.16.0-50-powerpc64-smp

3.16.0-50.67~14.04.1

linux-image-3.16.0-50-powerpc-smp

3.16.0-50.67~14.04.1

linux-image-3.16.0-50-powerpc-e500mc

3.16.0-50.67~14.04.1

linux-image-3.16.0-50-generic-lpae

3.16.0-50.67~14.04.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

CVE-2015-7613

Ubuntu Security Notice USN-2763-1

5th October, 2015

linux-lts-trusty vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 12.04 LTS

Summary

The system could be made to crash or run programs as an administrator.

Software description

• linux-lts-trusty
  – Linux hardware enablement kernel from Trusty

Details

Dmitry Vyukov discovered that the Linux kernel did not properly initialize
IPC object state in certain situations. A local attacker could use this to
escalate their privileges, expose confidential information, or cause a
denial of service (system crash).

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 12.04 LTS:

linux-image-3.13.0-65-generic-lpae

3.13.0-65.106~precise1

linux-image-3.13.0-65-generic

3.13.0-65.106~precise1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

CVE-2015-7613

Ubuntu Security Notice USN-2765-1

5th October, 2015

linux-lts-vivid vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 14.04 LTS

Summary

The system could be made to crash or run programs as an administrator.

Software description

• linux-lts-vivid
  – Linux hardware enablement kernel from Vivid

Details

Dmitry Vyukov discovered that the Linux kernel did not properly initialize
IPC object state in certain situations. A local attacker could use this to
escalate their privileges, expose confidential information, or cause a
denial of service (system crash).

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 14.04 LTS:

linux-image-3.19.0-30-powerpc64-smp

3.19.0-30.34~14.04.1

linux-image-3.19.0-30-generic

3.19.0-30.34~14.04.1

linux-image-3.19.0-30-powerpc64-emb

3.19.0-30.34~14.04.1

linux-image-3.19.0-30-powerpc-smp

3.19.0-30.34~14.04.1

linux-image-3.19.0-30-generic-lpae

3.19.0-30.34~14.04.1

linux-image-3.19.0-30-lowlatency

3.19.0-30.34~14.04.1

linux-image-3.19.0-30-powerpc-e500mc

3.19.0-30.34~14.04.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

CVE-2015-7613

Ubuntu Security Notice USN-2753-3

5th October, 2015

lxc regression

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 14.04 LTS

Summary

USN-2753-1 introduced a regression in LXC.

Software description

• lxc
  – Linux Containers userspace tools

Details

USN-2753-1 fixed a vulnerability in LXC. The update caused a regression
that prevented some containers from starting. This regression only
affected containers that had a path that contained a ‘/./’ directory
specified as a bind mount target in their configuration file. This
update fixes the problem. We apologize for the inconvenience.

Original advisory details:

Roman Fiedler discovered a directory traversal flaw in lxc-start. A local
attacker with access to an LXC container could exploit this flaw to run
programs inside the container that are not confined by AppArmor or expose
unintended files in the host to the container.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 14.04 LTS:

lxc-dev

1.0.7-0ubuntu0.7

liblxc1

1.0.7-0ubuntu0.7

lxc-templates

1.0.7-0ubuntu0.7

python3-lxc

1.0.7-0ubuntu0.7

lxc

1.0.7-0ubuntu0.7

lxc-tests

1.0.7-0ubuntu0.7

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

LP: 1501491

Ubuntu Security Notice USN-2759-1

1st October, 2015

linux vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 12.04 LTS

Summary

Several security issues were fixed in the kernel.

Software description

• linux
  – Linux kernel

Details

It was discovered that an integer overflow error existed in the SCSI
generic (sg) driver in the Linux kernel. A local attacker with write
permission to a SCSI generic device could use this to cause a denial of
service (system crash) or potentially escalate their privileges.
(CVE-2015-5707)

Marc-André Lureau discovered that the vhost driver did not properly
release the userspace provided log file descriptor. A privileged attacker
could use this to cause a denial of service (resource exhaustion).
(CVE-2015-6252)

It was discovered that the Linux kernel’s perf subsystem did not bound
callchain backtraces on PowerPC 64. A local attacker could use this to
cause a denial of service. (CVE-2015-6526)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 12.04 LTS:

linux-image-3.2.0-91-generic-pae

3.2.0-91.129

linux-image-3.2.0-91-powerpc64-smp

3.2.0-91.129

linux-image-3.2.0-91-generic

3.2.0-91.129

linux-image-3.2.0-91-virtual

3.2.0-91.129

linux-image-3.2.0-91-omap

3.2.0-91.129

linux-image-3.2.0-91-powerpc-smp

3.2.0-91.129

linux-image-3.2.0-91-highbank

3.2.0-91.129

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

CVE-2015-5707,

CVE-2015-6252,

CVE-2015-6526

Ubuntu Security Notice USN-2760-1

1st October, 2015

linux-ti-omap4 vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 12.04 LTS

Summary

Several security issues were fixed in the kernel.

Software description

• linux-ti-omap4
  – Linux kernel for OMAP4

Details

It was discovered that an integer overflow error existed in the SCSI
generic (sg) driver in the Linux kernel. A local attacker with write
permission to a SCSI generic device could use this to cause a denial of
service (system crash) or potentially escalate their privileges.
(CVE-2015-5707)

Marc-André Lureau discovered that the vhost driver did not properly
release the userspace provided log file descriptor. A privileged attacker
could use this to cause a denial of service (resource exhaustion).
(CVE-2015-6252)

It was discovered that the Linux kernel’s perf subsystem did not bound
callchain backtraces on PowerPC 64. A local attacker could use this to
cause a denial of service. (CVE-2015-6526)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 12.04 LTS:

linux-image-3.2.0-1471-omap4

3.2.0-1471.92

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

CVE-2015-5707,

CVE-2015-6252,

CVE-2015-6526

Ubuntu Security Notice USN-2755-1

30th September, 2015

cyrus-sasl2 vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 15.04

Summary

Cyrus SASL could be made to crash if it processed specially crafted input.

Software description

• cyrus-sasl2
  – Cyrus Simple Authentication and Security Layer

Details

It was discovered that Cyrus SASL incorrectly handled certain invalid
password salts. An attacker could use this issue to cause Cyrus SASL to
crash, resulting in a denial of service.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 15.04:

libsasl2-2

2.1.26.dfsg1-13ubuntu0.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

CVE-2013-4122

Ubuntu Security Notice USN-2753-2

30th September, 2015

lxc regression

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 14.04 LTS

Summary

USN-2753-1 introduced a regression in LXC.

Software description

• lxc
  – Linux Containers userspace tools

Details

USN-2753-1 fixed a vulnerability in LXC. The update caused a regression that
prevented some containers from starting. This regression only affected
containers that had an absolute path specified as a bind mount target in their
configuration file. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Roman Fiedler discovered a directory traversal flaw in lxc-start. A local
attacker with access to an LXC container could exploit this flaw to run
programs inside the container that are not confined by AppArmor or expose
unintended files in the host to the container.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 14.04 LTS:

lxc

1.0.7-0ubuntu0.6

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

LP: 1501310

Ubuntu Security Notice USN-2756-1

30th September, 2015

rpcbind vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 15.04
• Ubuntu 14.04 LTS
• Ubuntu 12.04 LTS

Summary

rpcbind could be made to crash or run programs if it received specially
crafted network traffic.

Software description

• rpcbind
  – converts RPC program numbers into universal addresses

Details

It was discovered that rpcbind incorrectly handled certain memory
structures. A remote attacker could use this issue to cause rpcbind to
crash, resulting in a denial of service, or possibly execute arbitrary
code.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 15.04:

rpcbind

0.2.1-6ubuntu3.1

Ubuntu 14.04 LTS:

rpcbind

0.2.1-2ubuntu2.2

Ubuntu 12.04 LTS:

rpcbind

0.2.0-7ubuntu1.3

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

CVE-2015-7236