Ubuntu Security Notice USN-3102-1

13th October, 2016

quagga vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 16.04 LTS
• Ubuntu 14.04 LTS
• Ubuntu 12.04 LTS

Summary

Several security issues were fixed in Quagga.

Software description

• quagga
  – BGP/OSPF/RIP routing daemon

Details

It was discovered that Quagga incorrectly handled dumping data. A remote
attacker could possibly use a large BGP packet to cause Quagga to crash,
resulting in a denial of service. (CVE-2016-4049)

It was discovered that the Quagga package incorrectly set permissions on
the configuration directory. A local user could use this issue to possibly
obtain sensitive information. (CVE-2016-4036)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.04 LTS:

quagga

0.99.24.1-2ubuntu1.1

Ubuntu 14.04 LTS:

quagga

0.99.22.4-3ubuntu1.2

Ubuntu 12.04 LTS:

quagga

0.99.20.1-0ubuntu0.12.04.5

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Quagga to make all the
necessary changes.

References

CVE-2016-4036,

CVE-2016-4049

Ubuntu Security Notice USN-3103-1

13th October, 2016

libdbd-mysql-perl vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 14.04 LTS
• Ubuntu 12.04 LTS

Summary

DBD::mysql could be made to crash or run programs if it received specially
crafted input.

Software description

• libdbd-mysql-perl
  – Perl5 database interface to the MySQL database

Details

It was discovered that DBD::mysql incorrectly handled certain memory
operations. A remote attacker could use this issue to cause DBD::mysql to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2014-9906)

Hanno Böck discovered that DBD::mysql incorrectly handled certain memory
operations. A remote attacker could use this issue to cause DBD::mysql to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2015-8949)

Pali Rohár discovered that DBD::mysql incorrectly handled certain user
supplied data. A remote attacker could use this issue to cause DBD::mysql
to crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-1246)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 14.04 LTS:

libdbd-mysql-perl

4.025-1ubuntu0.1

Ubuntu 12.04 LTS:

libdbd-mysql-perl

4.020-1ubuntu0.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2014-9906,

CVE-2015-8949,

CVE-2016-1246

Ubuntu Security Notice USN-3097-2

13th October, 2016

linux-ti-omap4 vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 12.04 LTS

Summary

Several security issues were fixed in the kernel.

Software description

• linux-ti-omap4
  – Linux kernel for OMAP4

Details

Marco Grassi discovered a use-after-free condition could occur in the TCP
retransmit queue handling code in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2016-6828)

Pengfei Wang discovered a race condition in the audit subsystem in the
Linux kernel. A local attacker could use this to corrupt audit logs or
disrupt system-call auditing. (CVE-2016-6136)

Pengfei Wang discovered a race condition in the Adaptec AAC RAID controller
driver in the Linux kernel when handling ioctl()s. A local attacker could
use this to cause a denial of service (system crash). (CVE-2016-6480)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 12.04 LTS:

linux-image-3.2.0-1489-omap4

3.2.0-1489.116

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References

CVE-2016-6136,

CVE-2016-6480,

CVE-2016-6828