Ubuntu Security Notice USN-2640-1

15th June, 2015

linux vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 12.04 LTS

Summary

The system could be made to run programs as an administrator.

Software description

• linux
  – Linux kernel

Details

Philip Pettersson discovered a privilege escalation when using overlayfs
mounts inside of user namespaces. A local user could exploit this flaw to
gain administrative privileges on the system.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 12.04 LTS:

linux-image-3.2.0-86-generic-pae

3.2.0-86.123

linux-image-3.2.0-86-powerpc64-smp

3.2.0-86.123

linux-image-3.2.0-86-generic

3.2.0-86.123

linux-image-3.2.0-86-virtual

3.2.0-86.123

linux-image-3.2.0-86-omap

3.2.0-86.123

linux-image-3.2.0-86-powerpc-smp

3.2.0-86.123

linux-image-3.2.0-86-highbank

3.2.0-86.123

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

CVE-2015-1328

Ubuntu Security Notice USN-2645-1

15th June, 2015

linux-lts-vivid vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 14.04 LTS

Summary

The system could be made to run programs as an administrator.

Software description

• linux-lts-vivid
  – Linux hardware enablement kernel from Vivid

Details

Philip Pettersson discovered a privilege escalation when using overlayfs
mounts inside of user namespaces. A local user could exploit this flaw to
gain administrative privileges on the system.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 14.04 LTS:

linux-image-3.19.0-21-powerpc-e500mc

3.19.0-21.21~14.04.1

linux-image-3.19.0-21-powerpc-smp

3.19.0-21.21~14.04.1

linux-image-3.19.0-21-powerpc64-smp

3.19.0-21.21~14.04.1

linux-image-3.19.0-21-powerpc64-emb

3.19.0-21.21~14.04.1

linux-image-3.19.0-21-lowlatency

3.19.0-21.21~14.04.1

linux-image-3.19.0-21-generic

3.19.0-21.21~14.04.1

linux-image-3.19.0-21-generic-lpae

3.19.0-21.21~14.04.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

CVE-2015-1328

Ubuntu Security Notice USN-2644-1

15th June, 2015

linux-lts-utopic vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 14.04 LTS

Summary

The system could be made to run programs as an administrator.

Software description

• linux-lts-utopic
  – Linux hardware enablement kernel from Utopic

Details

Philip Pettersson discovered a privilege escalation when using overlayfs
mounts inside of user namespaces. A local user could exploit this flaw to
gain administrative privileges on the system.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 14.04 LTS:

linux-image-3.16.0-41-powerpc-smp

3.16.0-41.55~14.04.1

linux-image-3.16.0-41-powerpc64-smp

3.16.0-41.55~14.04.1

linux-image-3.16.0-41-generic

3.16.0-41.55~14.04.1

linux-image-3.16.0-41-powerpc-e500mc

3.16.0-41.55~14.04.1

linux-image-3.16.0-41-generic-lpae

3.16.0-41.55~14.04.1

linux-image-3.16.0-41-lowlatency

3.16.0-41.55~14.04.1

linux-image-3.16.0-41-powerpc64-emb

3.16.0-41.55~14.04.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

CVE-2015-1328

Ubuntu Security Notice USN-2643-1

15th June, 2015

linux vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 14.04 LTS

Summary

The system could be made to run programs as an administrator.

Software description

• linux
  – Linux kernel

Details

Philip Pettersson discovered a privilege escalation when using overlayfs
mounts inside of user namespaces. A local user could exploit this flaw to
gain administrative privileges on the system.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 14.04 LTS:

linux-image-3.13.0-55-generic-lpae

3.13.0-55.92

linux-image-3.13.0-55-generic

3.13.0-55.92

linux-image-3.13.0-55-powerpc-e500mc

3.13.0-55.92

linux-image-3.13.0-55-powerpc-smp

3.13.0-55.92

linux-image-3.13.0-55-powerpc64-emb

3.13.0-55.92

linux-image-3.13.0-55-powerpc-e500

3.13.0-55.92

linux-image-3.13.0-55-powerpc64-smp

3.13.0-55.92

linux-image-3.13.0-55-lowlatency

3.13.0-55.92

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

CVE-2015-1328

Ubuntu Security Notice USN-2647-1

15th June, 2015

linux vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 15.04

Summary

The system could be made to run programs as an administrator.

Software description

• linux
  – Linux kernel

Details

Philip Pettersson discovered a privilege escalation when using overlayfs
mounts inside of user namespaces. A local user could exploit this flaw to
gain administrative privileges on the system.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 15.04:

linux-image-3.19.0-21-powerpc-e500mc

3.19.0-21.21

linux-image-3.19.0-21-powerpc-smp

3.19.0-21.21

linux-image-3.19.0-21-powerpc64-smp

3.19.0-21.21

linux-image-3.19.0-21-powerpc64-emb

3.19.0-21.21

linux-image-3.19.0-21-lowlatency

3.19.0-21.21

linux-image-3.19.0-21-generic

3.19.0-21.21

linux-image-3.19.0-21-generic-lpae

3.19.0-21.21

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

CVE-2015-1328

Ubuntu Security Notice USN-2646-1

15th June, 2015

linux vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 14.10

Summary

The system could be made to run programs as an administrator.

Software description

• linux
  – Linux kernel

Details

Philip Pettersson discovered a privilege escalation when using overlayfs
mounts inside of user namespaces. A local user could exploit this flaw to
gain administrative privileges on the system.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 14.10:

linux-image-3.16.0-41-powerpc-smp

3.16.0-41.55

linux-image-3.16.0-41-powerpc64-smp

3.16.0-41.55

linux-image-3.16.0-41-generic

3.16.0-41.55

linux-image-3.16.0-41-powerpc-e500mc

3.16.0-41.55

linux-image-3.16.0-41-generic-lpae

3.16.0-41.55

linux-image-3.16.0-41-lowlatency

3.16.0-41.55

linux-image-3.16.0-41-powerpc64-emb

3.16.0-41.55

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

CVE-2015-1328

Ubuntu Security Notice USN-2639-1

11th June, 2015

openssl vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 15.04
• Ubuntu 14.10
• Ubuntu 14.04 LTS
• Ubuntu 12.04 LTS

Summary

Several security issues were fixed in OpenSSL.

Software description

• openssl
  – Secure Socket Layer (SSL) cryptographic library and tools

Details

Praveen Kariyanahalli, Ivan Fratric and Felix Groebert discovered that
OpenSSL incorrectly handled memory when buffering DTLS data. A remote
attacker could use this issue to cause OpenSSL to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2014-8176)

Joseph Barr-Pixton discovered that OpenSSL incorrectly handled malformed
ECParameters structures. A remote attacker could use this issue to cause
OpenSSL to hang, resulting in a denial of service. (CVE-2015-1788)

Robert Swiecki and Hanno Böck discovered that OpenSSL incorrectly handled
certain ASN1_TIME strings. A remote attacker could use this issue to cause
OpenSSL to crash, resulting in a denial of service. (CVE-2015-1789)

Michal Zalewski discovered that OpenSSL incorrectly handled missing content
when parsing ASN.1-encoded PKCS#7 blobs. A remote attacker could use this
issue to cause OpenSSL to crash, resulting in a denial of service.
(CVE-2015-1790)

Emilia Käsper discovered that OpenSSL incorrectly handled NewSessionTicket
when being used by a multi-threaded client. A remote attacker could use
this issue to cause OpenSSL to crash, resulting in a denial of service.
(CVE-2015-1791)

Johannes Bauer discovered that OpenSSL incorrectly handled verifying
signedData messages using the CMS code. A remote attacker could use this
issue to cause OpenSSL to hang, resulting in a denial of service.
(CVE-2015-1792)

As a security improvement, this update also modifies OpenSSL behaviour to
reject DH key sizes below 768 bits, preventing a possible downgrade
attack.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 15.04:

libssl1.0.0

1.0.1f-1ubuntu11.4

Ubuntu 14.10:

libssl1.0.0

1.0.1f-1ubuntu9.8

Ubuntu 14.04 LTS:

libssl1.0.0

1.0.1f-1ubuntu2.15

Ubuntu 12.04 LTS:

libssl1.0.0

1.0.1-4ubuntu5.31

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

CVE-2014-8176,

CVE-2015-1788,

CVE-2015-1789,

CVE-2015-1790,

CVE-2015-1791,

CVE-2015-1792

Ubuntu Security Notice USN-2630-1

10th June, 2015

qemu, qemu-kvm vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 15.04
• Ubuntu 14.10
• Ubuntu 14.04 LTS
• Ubuntu 12.04 LTS

Summary

Several security issues were fixed in QEMU.

Software description

• qemu
  – Machine emulator and virtualizer

• qemu-kvm
  – Machine emulator and virtualizer

Details

Matt Tait discovered that QEMU incorrectly handled the virtual PCNET
driver. A malicious guest could use this issue to cause a denial of
service, or possibly execute arbitrary code on the host as the user running
the QEMU process. In the default installation, when QEMU is used with
libvirt, attackers would be isolated by the libvirt AppArmor profile.
(CVE-2015-3209)

Kurt Seifried discovered that QEMU incorrectly handled certain temporary
files. A local attacker could use this issue to cause a denial of service.
(CVE-2015-4037)

Jan Beulich discovered that the QEMU Xen code incorrectly restricted write
access to the host MSI message data field. A malicious guest could use this
issue to cause a denial of service. This issue only applied to Ubuntu 14.04
LTS, Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-4103)

Jan Beulich discovered that the QEMU Xen code incorrectly restricted access
to the PCI MSI mask bits. A malicious guest could use this issue to cause a
denial of service. This issue only applied to Ubuntu 14.04 LTS, Ubuntu
14.10 and Ubuntu 15.04. (CVE-2015-4104)

Jan Beulich discovered that the QEMU Xen code incorrectly handled MSI-X
error messages. A malicious guest could use this issue to cause a denial of
service. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 14.10 and
Ubuntu 15.04. (CVE-2015-4105)

Jan Beulich discovered that the QEMU Xen code incorrectly restricted write
access to the PCI config space. A malicious guest could use this issue to
cause a denial of service, obtain sensitive information, or possibly
execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS,
Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-4106)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 15.04:

qemu-system-misc

1:2.2+dfsg-5expubuntu9.2

qemu-system

1:2.2+dfsg-5expubuntu9.2

qemu-system-aarch64

1:2.2+dfsg-5expubuntu9.2

qemu-system-x86

1:2.2+dfsg-5expubuntu9.2

qemu-system-sparc

1:2.2+dfsg-5expubuntu9.2

qemu-system-arm

1:2.2+dfsg-5expubuntu9.2

qemu-system-ppc

1:2.2+dfsg-5expubuntu9.2

qemu-system-mips

1:2.2+dfsg-5expubuntu9.2

Ubuntu 14.10:

qemu-system-misc

2.1+dfsg-4ubuntu6.7

qemu-system

2.1+dfsg-4ubuntu6.7

qemu-system-aarch64

2.1+dfsg-4ubuntu6.7

qemu-system-x86

2.1+dfsg-4ubuntu6.7

qemu-system-sparc

2.1+dfsg-4ubuntu6.7

qemu-system-arm

2.1+dfsg-4ubuntu6.7

qemu-system-ppc

2.1+dfsg-4ubuntu6.7

qemu-system-mips

2.1+dfsg-4ubuntu6.7

Ubuntu 14.04 LTS:

qemu-system-misc

2.0.0+dfsg-2ubuntu1.13

qemu-system

2.0.0+dfsg-2ubuntu1.13

qemu-system-aarch64

2.0.0+dfsg-2ubuntu1.13

qemu-system-x86

2.0.0+dfsg-2ubuntu1.13

qemu-system-sparc

2.0.0+dfsg-2ubuntu1.13

qemu-system-arm

2.0.0+dfsg-2ubuntu1.13

qemu-system-ppc

2.0.0+dfsg-2ubuntu1.13

qemu-system-mips

2.0.0+dfsg-2ubuntu1.13

Ubuntu 12.04 LTS:

qemu-kvm

1.0+noroms-0ubuntu14.23

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.

References

CVE-2015-3209,

CVE-2015-4037,

CVE-2015-4103,

CVE-2015-4104,

CVE-2015-4105,

CVE-2015-4106

Ubuntu Security Notice USN-2629-1

10th June, 2015

cups vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 15.04
• Ubuntu 14.10
• Ubuntu 14.04 LTS
• Ubuntu 12.04 LTS

Summary

Several security issues were fixed in CUPS.

Software description

• cups
  – Common UNIX Printing System(tm)

Details

It was discovered that CUPS incorrectly handled reference counting when
handling localized strings. A remote attacker could use this issue to
escalate permissions, upload a replacement CUPS configuration file, and
execute arbitrary code. (CVE-2015-1158)

It was discovered that the CUPS templating engine contained a cross-site
scripting issue. A remote attacker could use this issue to bypass default
configuration settings. (CVE-2015-1159)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 15.04:

cups

2.0.2-1ubuntu3.1

Ubuntu 14.10:

cups

1.7.5-3ubuntu3.2

Ubuntu 14.04 LTS:

cups

1.7.2-0ubuntu1.6

Ubuntu 12.04 LTS:

cups

1.5.3-0ubuntu8.7

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2015-1158,

CVE-2015-1159

Ubuntu Security Notice USN-2634-1

10th June, 2015

linux vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 14.04 LTS

Summary

Several security issues were fixed in the kernel.

Software description

• linux
  – Linux kernel

Details

Wen Xu discovered a use-after-free flaw in the Linux kernel’s ipv4 ping
support. A local user could exploit this flaw to cause a denial of service
(system crash) or gain administrative privileges on the system.
(CVE-2015-3636)

A memory corruption flaw was discovered in the Linux kernel’s scsi
subsystem. A local attacker could potentially exploit this flaw to cause a
denial of service (system crash). (CVE-2015-4036)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 14.04 LTS:

linux-image-3.13.0-54-generic-lpae

3.13.0-54.91

linux-image-3.13.0-54-powerpc-e500mc

3.13.0-54.91

linux-image-3.13.0-54-lowlatency

3.13.0-54.91

linux-image-3.13.0-54-powerpc-smp

3.13.0-54.91

linux-image-3.13.0-54-powerpc64-emb

3.13.0-54.91

linux-image-3.13.0-54-generic

3.13.0-54.91

linux-image-3.13.0-54-powerpc64-smp

3.13.0-54.91

linux-image-3.13.0-54-powerpc-e500

3.13.0-54.91

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

CVE-2015-3636,

CVE-2015-4036