Ubuntu Security Notice USN-3258-2

11th April, 2017

dovecot regression

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 16.10
• Ubuntu 16.04 LTS

Summary

USN-3258-1 introduced a regression in Dovecot.

Software description

• dovecot
  – IMAP and POP3 email server

Details

USN-3258-1 intended to fix a vulnerability in Dovecot. Further investigation
revealed that only Dovecot versions 2.2.26 and newer were affected by the
vulnerability. Additionally, the change introduced a regression when Dovecot
was configured to use the “dict” authentication database. This update reverts
the change. We apologize for the inconvenience.

Original advisory details:

It was discovered that Dovecot incorrectly handled some usernames. An attacker
could possibly use this issue to cause Dovecot to hang or crash, resulting in a
denial of service.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.10:

dovecot-core

1:2.2.24-1ubuntu1.3

Ubuntu 16.04 LTS:

dovecot-core

1:2.2.22-1ubuntu2.4

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2017-2669

Ubuntu Security Notice USN-3257-1

10th April, 2017

webkit2gtk vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 16.10
• Ubuntu 16.04 LTS

Summary

Several security issues were fixed in WebKitGTK+.

Software description

• webkit2gtk
  – Web content engine library for GTK+

Details

A large number of security issues were discovered in the WebKitGTK+ Web and
JavaScript engines. If a user were tricked into viewing a malicious
website, a remote attacker could exploit a variety of issues related to web
browser security, including cross-site scripting attacks, denial of service
attacks, and arbitrary code execution.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.10:

libwebkit2gtk-4.0-37

2.16.1-0ubuntu0.16.10.1

libjavascriptcoregtk-4.0-18

2.16.1-0ubuntu0.16.10.1

Ubuntu 16.04 LTS:

libwebkit2gtk-4.0-37

2.16.1-0ubuntu0.16.04.1

libjavascriptcoregtk-4.0-18

2.16.1-0ubuntu0.16.04.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use WebKitGTK+, such as Epiphany, to make all the necessary changes.

References

CVE-2016-9642,

CVE-2016-9643,

CVE-2017-2364,

CVE-2017-2367,

CVE-2017-2376,

CVE-2017-2377,

CVE-2017-2386,

CVE-2017-2392,

CVE-2017-2394,

CVE-2017-2395,

CVE-2017-2396,

CVE-2017-2405,

CVE-2017-2415,

CVE-2017-2419,

CVE-2017-2433,

CVE-2017-2442,

CVE-2017-2445,

CVE-2017-2446,

CVE-2017-2447,

CVE-2017-2454,

CVE-2017-2455,

CVE-2017-2457,

CVE-2017-2459,

CVE-2017-2460,

CVE-2017-2464,

CVE-2017-2465,

CVE-2017-2466,

CVE-2017-2468,

CVE-2017-2469,

CVE-2017-2470,

CVE-2017-2471,

CVE-2017-2475,

CVE-2017-2476,

CVE-2017-2481

Ubuntu Security Notice USN-3258-1

10th April, 2017

dovecot vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 16.10
• Ubuntu 16.04 LTS

Summary

Dovecot could be made to crash if it received specially crafted input.

Software description

• dovecot
  – IMAP and POP3 email server

Details

It was discovered that Dovecot incorrectly handled some usernames. An attacker
could possibly use this issue to cause Dovecot to hang or crash, resulting in a
denial of service.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.10:

dovecot-core

1:2.2.24-1ubuntu1.2

Ubuntu 16.04 LTS:

dovecot-core

1:2.2.22-1ubuntu2.3

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2017-2669

Ubuntu Security Notice USN-3256-1

4th April, 2017

linux, linux-aws, linux-gke, linux-raspi2, linux-snapdragon, linux-ti-omap4 vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 16.10
• Ubuntu 16.04 LTS
• Ubuntu 14.04 LTS
• Ubuntu 12.04 LTS

Summary

The system could be made to crash under certain conditions.

Software description

• linux
  – Linux kernel

• linux-aws
  – Linux kernel for Amazon Web Services (AWS) systems

• linux-gke
  – Linux kernel for Google Container Engine (GKE) systems

• linux-raspi2
  – Linux kernel for Raspberry Pi 2

• linux-snapdragon
  – Linux kernel for Snapdragon Processors

• linux-ti-omap4
  – Linux kernel for OMAP4

Details

Andrey Konovalov discovered that the AF_PACKET implementation in the Linux
kernel did not properly validate certain block-size data. A local attacker
could use this to cause a denial of service (system crash).

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.10:

linux-image-powerpc-smp 4.8.0.46.58

linux-image-powerpc-e500mc 4.8.0.46.58

linux-image-generic 4.8.0.46.58

linux-image-4.8.0-46-lowlatency

4.8.0-46.49

linux-image-4.8.0-46-generic-lpae

4.8.0-46.49

linux-image-4.8.0-46-powerpc-smp

4.8.0-46.49

linux-image-4.8.0-1033-raspi2

4.8.0-1033.36

linux-image-4.8.0-46-powerpc-e500mc

4.8.0-46.49

linux-image-generic-lpae 4.8.0.46.58

linux-image-4.8.0-46-powerpc64-emb

4.8.0-46.49

linux-image-4.8.0-46-generic

4.8.0-46.49

linux-image-lowlatency 4.8.0.46.58

linux-image-raspi2 4.8.0.1033.37

linux-image-powerpc64-smp 4.8.0.46.58

Ubuntu 16.04 LTS:

linux-image-powerpc-e500mc 4.4.0.72.78

linux-image-4.4.0-72-lowlatency

4.4.0-72.93

linux-image-4.4.0-72-powerpc-smp

4.4.0-72.93

linux-image-4.4.0-72-powerpc-e500mc

4.4.0-72.93

linux-image-4.4.0-1055-snapdragon

4.4.0-1055.59

linux-image-powerpc64-smp-lts-utopic 4.4.0.72.78

linux-image-4.4.0-72-generic

4.4.0-72.93

linux-image-4.4.0-72-generic-lpae

4.4.0-72.93

linux-image-powerpc64-smp-lts-xenial 4.4.0.72.78

linux-image-4.4.0-72-powerpc64-smp

4.4.0-72.93

linux-image-gke 4.4.0.1010.12

linux-image-powerpc64-smp-lts-vivid 4.4.0.72.78

linux-image-generic 4.4.0.72.78

linux-image-snapdragon 4.4.0.1055.48

linux-image-aws 4.4.0.1013.16

linux-image-raspi2 4.4.0.1052.53

linux-image-powerpc-smp 4.4.0.72.78

linux-image-4.4.0-1052-raspi2

4.4.0-1052.59

linux-image-generic-lpae 4.4.0.72.78

linux-image-powerpc64-smp-lts-wily 4.4.0.72.78

linux-image-4.4.0-1013-aws

4.4.0-1013.22

linux-image-4.4.0-1010-gke

4.4.0-1010.10

linux-image-powerpc64-smp 4.4.0.72.78

linux-image-lowlatency 4.4.0.72.78

Ubuntu 14.04 LTS:

linux-image-powerpc-smp

3.13.0.116.126

linux-image-powerpc-e500mc

3.13.0.116.126

linux-image-generic

3.13.0.116.126

linux-image-generic-lpae

3.13.0.116.126

linux-image-3.13.0-116-powerpc64-smp

3.13.0-116.163

linux-image-3.13.0-116-powerpc-e500mc

3.13.0-116.163

linux-image-3.13.0-116-lowlatency

3.13.0-116.163

linux-image-powerpc-e500

3.13.0.116.126

linux-image-3.13.0-116-generic

3.13.0-116.163

linux-image-3.13.0-116-powerpc-e500

3.13.0-116.163

linux-image-3.13.0-116-powerpc-smp

3.13.0-116.163

linux-image-powerpc64-smp

3.13.0.116.126

linux-image-lowlatency

3.13.0.116.126

linux-image-3.13.0-116-generic-lpae

3.13.0-116.163

Ubuntu 12.04 LTS:

linux-image-3.2.0-126-virtual

3.2.0-126.169

linux-image-3.2.0-126-highbank

3.2.0-126.169

linux-image-3.2.0-1504-omap4

3.2.0-1504.131

linux-image-3.2.0-126-generic-pae

3.2.0-126.169

linux-image-powerpc-smp 3.2.0.126.141

linux-image-generic 3.2.0.126.141

linux-image-3.2.0-126-omap

3.2.0-126.169

linux-image-3.2.0-126-generic

3.2.0-126.169

linux-image-generic-pae 3.2.0.126.141

linux-image-highbank 3.2.0.126.141

linux-image-3.2.0-126-powerpc64-smp

3.2.0-126.169

linux-image-powerpc64-smp 3.2.0.126.141

linux-image-omap4 3.2.0.1504.99

linux-image-3.2.0-126-powerpc-smp

3.2.0-126.169

linux-image-omap 3.2.0.126.141

linux-image-virtual 3.2.0.126.141

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References

CVE-2017-7308

Ubuntu Security Notice USN-3255-1

4th April, 2017

lightdm vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 16.10
• Ubuntu 16.04 LTS

Summary

LightDM could be made to run programs as an administrator.

Software description

• lightdm
  – Display Manager

Details

It was discovered that LightDM incorrectly handled home directory creation for
guest users. A local attacker could use this issue to gain ownership of
arbitrary directory paths and possibly gain administrative privileges.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.10:

lightdm

1.19.5-0ubuntu1.1

Ubuntu 16.04 LTS:

lightdm

1.18.3-0ubuntu1.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2017-7358

Ubuntu Security Notice USN-3254-1

4th April, 2017

python-django vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 16.10
• Ubuntu 16.04 LTS
• Ubuntu 14.04 LTS
• Ubuntu 12.04 LTS

Summary

Several security issues were fixed in Django.

Software description

• python-django
  – High-level Python web development framework

Details

It was discovered that Django incorrectly handled numeric redirect URLs. A
remote attacker could possibly use this issue to perform XSS attacks, and
to use a Django server as an open redirect. (CVE-2017-7233)

Phithon Gong discovered that Django incorrectly handled certain URLs when
the jango.views.static.serve() view is being used. A remote attacker could
possibly use a Django server as an open redirect. (CVE-2017-7234)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.10:

python3-django

1.8.7-1ubuntu8.2

python-django

1.8.7-1ubuntu8.2

Ubuntu 16.04 LTS:

python3-django

1.8.7-1ubuntu5.5

python-django

1.8.7-1ubuntu5.5

Ubuntu 14.04 LTS:

python-django

1.6.11-0ubuntu1.1

Ubuntu 12.04 LTS:

python-django

1.3.1-4ubuntu1.23

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2017-7233,

CVE-2017-7234

Ubuntu Security Notice USN-3256-2

4th April, 2017

linux-hwe, linux-lts-trusty, linux-lts-xenial vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 16.04 LTS
• Ubuntu 14.04 LTS
• Ubuntu 12.04 LTS

Summary

The system could be made to crash under certain conditions.

Software description

• linux-hwe
  – Linux hardware enablement (HWE) kernel

• linux-lts-trusty
  – Linux hardware enablement kernel from Trusty for Precise

• linux-lts-xenial
  – Linux hardware enablement kernel from Xenial for Trusty

Details

USN-3256-1 fixed vulnerabilities in the Linux kernel for Ubuntu
14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. This update provides
the corresponding updates for the Linux Hardware Enablement (HWE)
kernel for each of the respective prior Ubuntu LTS releases.

Andrey Konovalov discovered that the AF_PACKET implementation in the Linux
kernel did not properly validate certain block-size data. A local attacker
could use this to cause a denial of service (system crash).

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.04 LTS:

linux-image-4.8.0-46-lowlatency

4.8.0-46.49~16.04.1

linux-image-lowlatency-hwe-16.04

4.8.0.46.18

linux-image-4.8.0-46-generic-lpae

4.8.0-46.49~16.04.1

linux-image-generic-hwe-16.04

4.8.0.46.18

linux-image-4.8.0-46-generic

4.8.0-46.49~16.04.1

linux-image-generic-lpae-hwe-16.04

4.8.0.46.18

Ubuntu 14.04 LTS:

linux-image-powerpc-smp-lts-xenial

4.4.0.72.59

linux-image-4.4.0-72-generic

4.4.0-72.93~14.04.1

linux-image-4.4.0-72-powerpc-smp

4.4.0-72.93~14.04.1

linux-image-4.4.0-72-powerpc-e500mc

4.4.0-72.93~14.04.1

linux-image-generic-lpae-lts-xenial

4.4.0.72.59

linux-image-4.4.0-72-generic-lpae

4.4.0-72.93~14.04.1

linux-image-4.4.0-72-lowlatency

4.4.0-72.93~14.04.1

linux-image-lowlatency-lts-xenial

4.4.0.72.59

linux-image-generic-lts-xenial

4.4.0.72.59

linux-image-powerpc64-smp-lts-xenial

4.4.0.72.59

linux-image-4.4.0-72-powerpc64-smp

4.4.0-72.93~14.04.1

linux-image-powerpc-e500mc-lts-xenial

4.4.0.72.59

Ubuntu 12.04 LTS:

linux-image-generic-lpae-lts-trusty

3.13.0.116.107

linux-image-3.13.0-116-generic

3.13.0-116.163~precise1

linux-image-generic-lts-trusty

3.13.0.116.107

linux-image-3.13.0-116-generic-lpae

3.13.0-116.163~precise1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References

CVE-2017-7308

Ubuntu Security Notice USN-3253-1

3rd April, 2017

nagios3 vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 16.10
• Ubuntu 16.04 LTS
• Ubuntu 14.04 LTS

Summary

Several security issues were fixed in Nagios.

Software description

• nagios3
  – host/service/network monitoring and management system

Details

It was discovered that Nagios incorrectly handled certain long strings. A
remote authenticated attacker could use this issue to cause Nagios to
crash, resulting in a denial of service, or possibly obtain sensitive
information. (CVE-2013-7108, CVE-2013-7205)

It was discovered that Nagios incorrectly handled certain long messages to
cmd.cgi. A remote attacker could possibly use this issue to cause Nagios to
crash, resulting in a denial of service. (CVE-2014-1878)

Dawid Golunski discovered that Nagios incorrectly handled symlinks when
accessing log files. A local attacker could possibly use this issue to
elevate privileges. In the default installation of Ubuntu, this should be
prevented by the Yama link restrictions. (CVE-2016-9566)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.10:

nagios3-core

3.5.1.dfsg-2.1ubuntu3.1

nagios3-cgi

3.5.1.dfsg-2.1ubuntu3.1

Ubuntu 16.04 LTS:

nagios3-core

3.5.1.dfsg-2.1ubuntu1.1

nagios3-cgi

3.5.1.dfsg-2.1ubuntu1.1

Ubuntu 14.04 LTS:

nagios3-core

3.5.1-1ubuntu1.1

nagios3-cgi

3.5.1-1ubuntu1.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2013-7108,

CVE-2013-7205,

CVE-2014-1878,

CVE-2016-9566

Ubuntu Security Notice USN-3242-2

30th March, 2017

samba regression

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 16.10
• Ubuntu 16.04 LTS
• Ubuntu 14.04 LTS
• Ubuntu 12.04 LTS

Summary

USN-3242-1 introduced a regression in Samba.

Software description

• samba
  – SMB/CIFS file, print, and login server for Unix

Details

USN-3242-1 fixed a vulnerability in Samba. The upstream fix introduced a
regression when Samba is configured to disable following symbolic links.

This update fixes the problem.

Original advisory details:

Jann Horn discovered that Samba incorrectly handled symlinks. An
authenticated remote attacker could use this issue to access files on the
server outside of the exported directories.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.10:

samba

2:4.4.5+dfsg-2ubuntu5.5

Ubuntu 16.04 LTS:

samba

2:4.3.11+dfsg-0ubuntu0.16.04.6

Ubuntu 14.04 LTS:

samba

2:4.3.11+dfsg-0ubuntu0.14.04.7

Ubuntu 12.04 LTS:

samba

2:3.6.25-0ubuntu0.12.04.10

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

LP: 1675698

Ubuntu Security Notice USN-3216-2

30th March, 2017

firefox regression

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 16.10
• Ubuntu 16.04 LTS
• Ubuntu 14.04 LTS
• Ubuntu 12.04 LTS

Summary

USN-3216-1 introduced a regression in Firefox.

Software description

• firefox
  – Mozilla Open Source web browser

Details

USN-3216-1 fixed vulnerabilities in Firefox. The update resulted in a
startup crash when Firefox is used with XRDP. This update fixes the
problem.

We apologize for the inconvenience.

Original advisory details:

Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to bypass same origin restrictions, obtain
sensitive information, spoof the addressbar, spoof the print dialog,
cause a denial of service via application crash or hang, or execute
arbitrary code. (CVE-2017-5398, CVE-2017-5399, CVE-2017-5400,
CVE-2017-5401, CVE-2017-5402, CVE-2017-5403, CVE-2017-5404, CVE-2017-5405,
CVE-2017-5406, CVE-2017-5407, CVE-2017-5408, CVE-2017-5410, CVE-2017-5412,
CVE-2017-5413, CVE-2017-5414, CVE-2017-5415, CVE-2017-5416, CVE-2017-5417,
CVE-2017-5418, CVE-2017-5419, CVE-2017-5420, CVE-2017-5421, CVE-2017-5422,
CVE-2017-5426, CVE-2017-5427)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.10:

firefox

52.0.2+build1-0ubuntu0.16.10.1

Ubuntu 16.04 LTS:

firefox

52.0.2+build1-0ubuntu0.16.04.1

Ubuntu 14.04 LTS:

firefox

52.0.2+build1-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:

firefox

52.0.2+build1-0ubuntu0.12.04.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Firefox to make
all the necessary changes.

References

LP: 1671079