Monthly Archives: December 2014

Redhat

RHSA-2014:1983-1: Important: xorg-x11-server security update

Red Hat Enterprise Linux: Updated xorg-x11-server packages that fix multiple security issues are now
available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
CVE-2014-8091, CVE-2014-8092, CVE-2014-8093, CVE-2014-8094, CVE-2014-8095, CVE-2014-8096, CVE-2014-8097, CVE-2014-8098, CVE-2014-8099, CVE-2014-8100, CVE-2014-8101, CVE-2014-8102, CVE-2014-8103

Redhat

RHSA-2014:1982-1: Important: xorg-x11-server security update

Red Hat Enterprise Linux: Updated xorg-x11-server packages that fix multiple security issues are now
available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
CVE-2014-8091, CVE-2014-8092, CVE-2014-8093, CVE-2014-8095, CVE-2014-8096, CVE-2014-8097, CVE-2014-8098, CVE-2014-8099, CVE-2014-8100, CVE-2014-8101, CVE-2014-8102

Ubuntu

USN-2439-1: QEMU vulnerabilities

Ubuntu Security Notice USN-2439-1

11th December, 2014

qemu, qemu-kvm vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 14.10
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS
  • Ubuntu 10.04 LTS

Summary

Several security issues were fixed in QEMU.

Software description

  • qemu
    – Machine emulator and virtualizer

  • qemu-kvm
    – Machine emulator and virtualizer

Details

Michael S. Tsirkin discovered that QEMU incorrectly handled certain
parameters during ram load while performing a migration. An attacker able
to manipulate savevm data could use this issue to possibly execute
arbitrary code on the host. This issue only affected Ubuntu 12.04 LTS,
Ubuntu 14.04 LTS, and Ubuntu 14.10. (CVE-2014-7840)

Paolo Bonzini discovered that QEMU incorrectly handled memory in the Cirrus
VGA device. A malicious guest could possibly use this issue to write into
memory of the host, leading to privilege escalation. (CVE-2014-8106)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 14.10:
qemu-system-misc

2.1+dfsg-4ubuntu6.3
qemu-system

2.1+dfsg-4ubuntu6.3
qemu-system-aarch64

2.1+dfsg-4ubuntu6.3
qemu-system-x86

2.1+dfsg-4ubuntu6.3
qemu-system-sparc

2.1+dfsg-4ubuntu6.3
qemu-system-arm

2.1+dfsg-4ubuntu6.3
qemu-system-ppc

2.1+dfsg-4ubuntu6.3
qemu-system-mips

2.1+dfsg-4ubuntu6.3
Ubuntu 14.04 LTS:
qemu-system-misc

2.0.0+dfsg-2ubuntu1.9
qemu-system

2.0.0+dfsg-2ubuntu1.9
qemu-system-aarch64

2.0.0+dfsg-2ubuntu1.9
qemu-system-x86

2.0.0+dfsg-2ubuntu1.9
qemu-system-sparc

2.0.0+dfsg-2ubuntu1.9
qemu-system-arm

2.0.0+dfsg-2ubuntu1.9
qemu-system-ppc

2.0.0+dfsg-2ubuntu1.9
qemu-system-mips

2.0.0+dfsg-2ubuntu1.9
Ubuntu 12.04 LTS:
qemu-kvm

1.0+noroms-0ubuntu14.21
Ubuntu 10.04 LTS:
qemu-kvm

0.12.3+noroms-0ubuntu9.26

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

CVE-2014-7840,

CVE-2014-8106

Ubuntu

USN-2440-1: Mutt vulnerability

Ubuntu Security Notice USN-2440-1

11th December, 2014

mutt vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 14.10
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS
  • Ubuntu 10.04 LTS

Summary

The mutt mail client could be made to crash if it opened a specially
crafted email.

Software description

  • mutt
    – text-based mailreader supporting MIME, GPG, PGP and threading

Details

Jakub Wilk discovered that the write_one_header function in mutt
did not properly handle newline characters at the beginning of a
header. An attacker could specially craft an email to cause mutt to
crash, resulting in a denial of service.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 14.10:
mutt-patched

1.5.23-1.1ubuntu0.2
mutt

1.5.23-1.1ubuntu0.2
Ubuntu 14.04 LTS:
mutt-patched

1.5.21-6.4ubuntu2.1
mutt

1.5.21-6.4ubuntu2.1
Ubuntu 12.04 LTS:
mutt-patched

1.5.21-5ubuntu2.2
mutt

1.5.21-5ubuntu2.2
Ubuntu 10.04 LTS:
mutt-patched

1.5.20-7ubuntu1.3
mutt

1.5.20-7ubuntu1.3

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart any running
instances of mutt to make all the necessary changes.

References

CVE-2014-9116