==========================================================================
Ubuntu Security Notice USN-3470-2
October 31, 2017
linux-lts-trusty vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-lts-trusty: Linux hardware enablement kernel from Trusty for Precise ESM
Details:
USN-3470-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu
12.04 ESM.
Qian Zhang discovered a heap-based buffer overflow in the tipc_msg_build()
function in the Linux kernel. A local attacker could use to cause a denial
of service (system crash) or possibly execute arbitrary code with
administrative privileges. (CVE-2016-8632)
Dmitry Vyukov discovered that a race condition existed in the timerfd
subsystem of the Linux kernel when handling might_cancel queuing. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2017-10661)
It was discovered that the Flash-Friendly File System (f2fs) implementation
in the Linux kernel did not properly validate superblock metadata. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2017-10662, CVE-2017-10663)
Anthony Perard discovered that the Xen virtual block driver did not
properly initialize some data structures before passing them to user space.
A local attacker in a guest VM could use this to expose sensitive
information from the host OS or other guest VMs. (CVE-2017-10911)
It was discovered that a use-after-free vulnerability existed in the POSIX
message queue implementation in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-11176)
Dave Chinner discovered that the XFS filesystem did not enforce that the
realtime inode flag was settable only on filesystems on a realtime device.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2017-14340)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
linux-image-3.13.0-135-generic 3.13.0-135.184~precise1
linux-image-3.13.0-135-generic-lpae 3.13.0-135.184~precise1
linux-image-generic-lpae-lts-trusty 3.13.0.135.125
linux-image-generic-lts-trusty 3.13.0.135.125
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://www.ubuntu.com/usn/usn-3470-2
https://www.ubuntu.com/usn/usn-3470-1
CVE-2016-8632, CVE-2017-10661, CVE-2017-10662, CVE-2017-10663,
CVE-2017-10911, CVE-2017-11176, CVE-2017-14340
Tuesday, October 31, 2017
[USN-3471-1] Quagga vulnerabilities
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCgAGBQJZ+MI4AAoJEGVp2FWnRL6TbiQP/2EYmLcNMUzL0RqQc2Efsw1T
ezNUfpnsOxxGA4QURyURKZflspj5RTGybNeAcGXAelod0BXkhVGpR+QcqaIP+72N
s88oxi1fAuzkQblG3lGR9ww1+Xer9opZ/ZSAIfyPMAT/jpL6JD6N/xgOs9UhSVUI
wl525hK5f8srPNRAOnC/N0FfLDjftFRaqOPYOgYeAvD9l7NUFairCOij59zkE1VG
kKlio/WX/2FTwS/mdX6ZRaRLEdm/14X9sZbiXuJBW0WFoD3E6xuF1wkmG3k2AIHX
hQSdkZuKlaaOsWO6Is3AWVoWrUUeEFqbTppGuoAnFCA59Va3Yd0JEq2TdLbhgDT1
UHfovXRffxj4ihJheeJGUB0D60I0pWDt2Orq+dx676k5Q9YaqL/hjf8lDgxfGeKk
kjYV4AEf/5cRo/WLr+8ly5pO7Q9fXIVfLq0wk1F/IuKen/u4mlRteSbM23RaUZlM
/uj5Ooitnnzx8leaLA9KFAvxMGfmRBn6uRpC/rYYKWIaEk0sWb3EKAZl+xVo+fgB
AM/FoQMMMBkneS5DjRHZtjR43pYTicXfPHRmjcRUOHbR3leKFame7KhM5EhXHOvQ
PQ4Vqn+g0WiuMDZFEt60RD3zx59bieWXL2bEeh9+1lFHLMDVEYh55yEDeV6gcdij
7e4b0kszeE7wK12wv+Q8
=nQ47
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3471-1
October 31, 2017
quagga vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Quagga.
Software Description:
- quagga: BGP/OSPF/RIP routing daemon
Details:
Andreas Jaggi discovered that Quagga incorrectly handled certain BGP UPDATE
messages. A remote attacker could possibly use this issue to cause Quagga
to crash, resulting in a denial of service. (CVE-2017-16227)
Quentin Young discovered that Quagga incorrectly handled memory in the
telnet vty CLI. An attacker able to connect to the telnet interface could
possibly use this issue to cause Quagga to consume memory, resulting in a
denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu
16.04 LTS. (CVE-2017-5495)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
quagga 1.1.1-3ubuntu0.1
quagga-bgpd 1.1.1-3ubuntu0.1
Ubuntu 17.04:
quagga 1.1.1-1ubuntu0.1
quagga-bgpd 1.1.1-1ubuntu0.1
Ubuntu 16.04 LTS:
quagga 0.99.24.1-2ubuntu1.3
Ubuntu 14.04 LTS:
quagga 0.99.22.4-3ubuntu1.4
After a standard system update you need to restart Quagga to make all the
necessary changes.
References:
https://www.ubuntu.com/usn/usn-3471-1
CVE-2017-16227, CVE-2017-5495
Package Information:
https://launchpad.net/ubuntu/+source/quagga/1.1.1-3ubuntu0.1
https://launchpad.net/ubuntu/+source/quagga/1.1.1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/quagga/0.99.24.1-2ubuntu1.3
https://launchpad.net/ubuntu/+source/quagga/0.99.22.4-3ubuntu1.4
Version: GnuPG v2
iQIcBAEBCgAGBQJZ+MI4AAoJEGVp2FWnRL6TbiQP/2EYmLcNMUzL0RqQc2Efsw1T
ezNUfpnsOxxGA4QURyURKZflspj5RTGybNeAcGXAelod0BXkhVGpR+QcqaIP+72N
s88oxi1fAuzkQblG3lGR9ww1+Xer9opZ/ZSAIfyPMAT/jpL6JD6N/xgOs9UhSVUI
wl525hK5f8srPNRAOnC/N0FfLDjftFRaqOPYOgYeAvD9l7NUFairCOij59zkE1VG
kKlio/WX/2FTwS/mdX6ZRaRLEdm/14X9sZbiXuJBW0WFoD3E6xuF1wkmG3k2AIHX
hQSdkZuKlaaOsWO6Is3AWVoWrUUeEFqbTppGuoAnFCA59Va3Yd0JEq2TdLbhgDT1
UHfovXRffxj4ihJheeJGUB0D60I0pWDt2Orq+dx676k5Q9YaqL/hjf8lDgxfGeKk
kjYV4AEf/5cRo/WLr+8ly5pO7Q9fXIVfLq0wk1F/IuKen/u4mlRteSbM23RaUZlM
/uj5Ooitnnzx8leaLA9KFAvxMGfmRBn6uRpC/rYYKWIaEk0sWb3EKAZl+xVo+fgB
AM/FoQMMMBkneS5DjRHZtjR43pYTicXfPHRmjcRUOHbR3leKFame7KhM5EhXHOvQ
PQ4Vqn+g0WiuMDZFEt60RD3zx59bieWXL2bEeh9+1lFHLMDVEYh55yEDeV6gcdij
7e4b0kszeE7wK12wv+Q8
=nQ47
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3471-1
October 31, 2017
quagga vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Quagga.
Software Description:
- quagga: BGP/OSPF/RIP routing daemon
Details:
Andreas Jaggi discovered that Quagga incorrectly handled certain BGP UPDATE
messages. A remote attacker could possibly use this issue to cause Quagga
to crash, resulting in a denial of service. (CVE-2017-16227)
Quentin Young discovered that Quagga incorrectly handled memory in the
telnet vty CLI. An attacker able to connect to the telnet interface could
possibly use this issue to cause Quagga to consume memory, resulting in a
denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu
16.04 LTS. (CVE-2017-5495)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
quagga 1.1.1-3ubuntu0.1
quagga-bgpd 1.1.1-3ubuntu0.1
Ubuntu 17.04:
quagga 1.1.1-1ubuntu0.1
quagga-bgpd 1.1.1-1ubuntu0.1
Ubuntu 16.04 LTS:
quagga 0.99.24.1-2ubuntu1.3
Ubuntu 14.04 LTS:
quagga 0.99.22.4-3ubuntu1.4
After a standard system update you need to restart Quagga to make all the
necessary changes.
References:
https://www.ubuntu.com/usn/usn-3471-1
CVE-2017-16227, CVE-2017-5495
Package Information:
https://launchpad.net/ubuntu/+source/quagga/1.1.1-3ubuntu0.1
https://launchpad.net/ubuntu/+source/quagga/1.1.1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/quagga/0.99.24.1-2ubuntu1.3
https://launchpad.net/ubuntu/+source/quagga/0.99.22.4-3ubuntu1.4
[USN-3469-1] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3469-1
October 31, 2017
linux, linux-aws, linux-gke, linux-kvm, linux-raspi2, linux-snapdragon
vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-gke: Linux kernel for Google Container Engine (GKE) systems
- linux-kvm: Linux kernel for cloud environments
- linux-raspi2: Linux kernel for Raspberry Pi 2
- linux-snapdragon: Linux kernel for Snapdragon processors
Details:
Anthony Perard discovered that the Xen virtual block driver did not
properly initialize some data structures before passing them to user space.
A local attacker in a guest VM could use this to expose sensitive
information from the host OS or other guest VMs. (CVE-2017-10911)
Bo Zhang discovered that the netlink wireless configuration interface in
the Linux kernel did not properly validate attributes when handling certain
requests. A local attacker with the CAP_NET_ADMIN could use this to cause a
denial of service (system crash). (CVE-2017-12153)
It was discovered that the nested KVM implementation in the Linux
kernel in some situations did not properly prevent second level guests
from reading and writing the hardware CR8 register. A local attacker
in a guest could use this to cause a denial of service (system crash).
It was discovered that the key management subsystem in the Linux kernel
did not properly restrict key reads on negatively instantiated keys. A
local attacker could use this to cause a denial of service (system crash).
(CVE-2017-12192)
It was discovered that an integer overflow existed in the sysfs interface
for the QLogic 24xx+ series SCSI driver in the Linux kernel. A local
privileged attacker could use this to cause a denial of service (system
crash). (CVE-2017-14051)
It was discovered that the ATI Radeon framebuffer driver in the Linux
kernel did not properly initialize a data structure returned to user space.
A local attacker could use this to expose sensitive information (kernel
memory). (CVE-2017-14156)
Dave Chinner discovered that the XFS filesystem did not enforce that the
realtime inode flag was settable only on filesystems on a realtime device.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2017-14340)
ChunYu Wang discovered that the iSCSI transport implementation in the Linux
kernel did not properly validate data structures. A local attacker could
use this to cause a denial of service (system crash). (CVE-2017-14489)
It was discovered that the generic SCSI driver in the Linux kernel did not
properly initialize data returned to user space in some situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2017-14991)
Dmitry Vyukov discovered that the Floating Point Unit (fpu) subsystem in
the Linux kernel did not properly handle attempts to set reserved bits in a
task's extended state (xstate) area. A local attacker could use this to
cause a denial of service (system crash). (CVE-2017-15537)
Pengfei Wang discovered that the Turtle Beach MultiSound audio device
driver in the Linux kernel contained race conditions when fetching
from the ring-buffer. A local attacker could use this to cause a
denial of service (infinite loop). (CVE-2017-9984, CVE-2017-9985)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
linux-image-4.4.0-1009-kvm 4.4.0-1009.14
linux-image-4.4.0-1033-gke 4.4.0-1033.33
linux-image-4.4.0-1039-aws 4.4.0-1039.48
linux-image-4.4.0-1076-raspi2 4.4.0-1076.84
linux-image-4.4.0-1078-snapdragon 4.4.0-1078.83
linux-image-4.4.0-98-generic 4.4.0-98.121
linux-image-4.4.0-98-generic-lpae 4.4.0-98.121
linux-image-4.4.0-98-lowlatency 4.4.0-98.121
linux-image-4.4.0-98-powerpc-e500mc 4.4.0-98.121
linux-image-4.4.0-98-powerpc-smp 4.4.0-98.121
linux-image-4.4.0-98-powerpc64-emb 4.4.0-98.121
linux-image-4.4.0-98-powerpc64-smp 4.4.0-98.121
linux-image-aws 4.4.0.1039.41
linux-image-generic 4.4.0.98.103
linux-image-generic-lpae 4.4.0.98.103
linux-image-gke 4.4.0.1033.34
linux-image-kvm 4.4.0.1009.9
linux-image-lowlatency 4.4.0.98.103
linux-image-powerpc-e500mc 4.4.0.98.103
linux-image-powerpc-smp 4.4.0.98.103
linux-image-powerpc64-emb 4.4.0.98.103
linux-image-powerpc64-smp 4.4.0.98.103
linux-image-raspi2 4.4.0.1076.76
linux-image-snapdragon 4.4.0.1078.70
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://www.ubuntu.com/usn/usn-3469-1
CVE-2017-10911, CVE-2017-12153, CVE-2017-12154, CVE-2017-12192,
CVE-2017-14051, CVE-2017-14156, CVE-2017-14340, CVE-2017-14489,
CVE-2017-14991, CVE-2017-15537, CVE-2017-9984, CVE-2017-9985
Package Information:
https://launchpad.net/ubuntu/+source/linux/4.4.0-98.121
https://launchpad.net/ubuntu/+source/linux-aws/4.4.0-1039.48
https://launchpad.net/ubuntu/+source/linux-gke/4.4.0-1033.33
https://launchpad.net/ubuntu/+source/linux-kvm/4.4.0-1009.14
https://launchpad.net/ubuntu/+source/linux-raspi2/4.4.0-1076.84
https://launchpad.net/ubuntu/+source/linux-snapdragon/4.4.0-1078.83
Ubuntu Security Notice USN-3469-1
October 31, 2017
linux, linux-aws, linux-gke, linux-kvm, linux-raspi2, linux-snapdragon
vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-gke: Linux kernel for Google Container Engine (GKE) systems
- linux-kvm: Linux kernel for cloud environments
- linux-raspi2: Linux kernel for Raspberry Pi 2
- linux-snapdragon: Linux kernel for Snapdragon processors
Details:
Anthony Perard discovered that the Xen virtual block driver did not
properly initialize some data structures before passing them to user space.
A local attacker in a guest VM could use this to expose sensitive
information from the host OS or other guest VMs. (CVE-2017-10911)
Bo Zhang discovered that the netlink wireless configuration interface in
the Linux kernel did not properly validate attributes when handling certain
requests. A local attacker with the CAP_NET_ADMIN could use this to cause a
denial of service (system crash). (CVE-2017-12153)
It was discovered that the nested KVM implementation in the Linux
kernel in some situations did not properly prevent second level guests
from reading and writing the hardware CR8 register. A local attacker
in a guest could use this to cause a denial of service (system crash).
It was discovered that the key management subsystem in the Linux kernel
did not properly restrict key reads on negatively instantiated keys. A
local attacker could use this to cause a denial of service (system crash).
(CVE-2017-12192)
It was discovered that an integer overflow existed in the sysfs interface
for the QLogic 24xx+ series SCSI driver in the Linux kernel. A local
privileged attacker could use this to cause a denial of service (system
crash). (CVE-2017-14051)
It was discovered that the ATI Radeon framebuffer driver in the Linux
kernel did not properly initialize a data structure returned to user space.
A local attacker could use this to expose sensitive information (kernel
memory). (CVE-2017-14156)
Dave Chinner discovered that the XFS filesystem did not enforce that the
realtime inode flag was settable only on filesystems on a realtime device.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2017-14340)
ChunYu Wang discovered that the iSCSI transport implementation in the Linux
kernel did not properly validate data structures. A local attacker could
use this to cause a denial of service (system crash). (CVE-2017-14489)
It was discovered that the generic SCSI driver in the Linux kernel did not
properly initialize data returned to user space in some situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2017-14991)
Dmitry Vyukov discovered that the Floating Point Unit (fpu) subsystem in
the Linux kernel did not properly handle attempts to set reserved bits in a
task's extended state (xstate) area. A local attacker could use this to
cause a denial of service (system crash). (CVE-2017-15537)
Pengfei Wang discovered that the Turtle Beach MultiSound audio device
driver in the Linux kernel contained race conditions when fetching
from the ring-buffer. A local attacker could use this to cause a
denial of service (infinite loop). (CVE-2017-9984, CVE-2017-9985)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
linux-image-4.4.0-1009-kvm 4.4.0-1009.14
linux-image-4.4.0-1033-gke 4.4.0-1033.33
linux-image-4.4.0-1039-aws 4.4.0-1039.48
linux-image-4.4.0-1076-raspi2 4.4.0-1076.84
linux-image-4.4.0-1078-snapdragon 4.4.0-1078.83
linux-image-4.4.0-98-generic 4.4.0-98.121
linux-image-4.4.0-98-generic-lpae 4.4.0-98.121
linux-image-4.4.0-98-lowlatency 4.4.0-98.121
linux-image-4.4.0-98-powerpc-e500mc 4.4.0-98.121
linux-image-4.4.0-98-powerpc-smp 4.4.0-98.121
linux-image-4.4.0-98-powerpc64-emb 4.4.0-98.121
linux-image-4.4.0-98-powerpc64-smp 4.4.0-98.121
linux-image-aws 4.4.0.1039.41
linux-image-generic 4.4.0.98.103
linux-image-generic-lpae 4.4.0.98.103
linux-image-gke 4.4.0.1033.34
linux-image-kvm 4.4.0.1009.9
linux-image-lowlatency 4.4.0.98.103
linux-image-powerpc-e500mc 4.4.0.98.103
linux-image-powerpc-smp 4.4.0.98.103
linux-image-powerpc64-emb 4.4.0.98.103
linux-image-powerpc64-smp 4.4.0.98.103
linux-image-raspi2 4.4.0.1076.76
linux-image-snapdragon 4.4.0.1078.70
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://www.ubuntu.com/usn/usn-3469-1
CVE-2017-10911, CVE-2017-12153, CVE-2017-12154, CVE-2017-12192,
CVE-2017-14051, CVE-2017-14156, CVE-2017-14340, CVE-2017-14489,
CVE-2017-14991, CVE-2017-15537, CVE-2017-9984, CVE-2017-9985
Package Information:
https://launchpad.net/ubuntu/+source/linux/4.4.0-98.121
https://launchpad.net/ubuntu/+source/linux-aws/4.4.0-1039.48
https://launchpad.net/ubuntu/+source/linux-gke/4.4.0-1033.33
https://launchpad.net/ubuntu/+source/linux-kvm/4.4.0-1009.14
https://launchpad.net/ubuntu/+source/linux-raspi2/4.4.0-1076.84
https://launchpad.net/ubuntu/+source/linux-snapdragon/4.4.0-1078.83
[USN-3470-1] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3470-1
October 31, 2017
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
Details:
Qian Zhang discovered a heap-based buffer overflow in the tipc_msg_build()
function in the Linux kernel. A local attacker could use to cause a denial
of service (system crash) or possibly execute arbitrary code with
administrative privileges. (CVE-2016-8632)
Dmitry Vyukov discovered that a race condition existed in the timerfd
subsystem of the Linux kernel when handling might_cancel queuing. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2017-10661)
It was discovered that the Flash-Friendly File System (f2fs) implementation
in the Linux kernel did not properly validate superblock metadata. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2017-10662, CVE-2017-10663)
Anthony Perard discovered that the Xen virtual block driver did not
properly initialize some data structures before passing them to user space.
A local attacker in a guest VM could use this to expose sensitive
information from the host OS or other guest VMs. (CVE-2017-10911)
It was discovered that a use-after-free vulnerability existed in the POSIX
message queue implementation in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-11176)
Dave Chinner discovered that the XFS filesystem did not enforce that the
realtime inode flag was settable only on filesystems on a realtime device.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2017-14340)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
linux-image-3.13.0-135-generic 3.13.0-135.184
linux-image-3.13.0-135-generic-lpae 3.13.0-135.184
linux-image-3.13.0-135-lowlatency 3.13.0-135.184
linux-image-3.13.0-135-powerpc-e500 3.13.0-135.184
linux-image-3.13.0-135-powerpc-e500mc 3.13.0-135.184
linux-image-3.13.0-135-powerpc-smp 3.13.0-135.184
linux-image-3.13.0-135-powerpc64-emb 3.13.0-135.184
linux-image-3.13.0-135-powerpc64-smp 3.13.0-135.184
linux-image-generic 3.13.0.135.144
linux-image-generic-lpae 3.13.0.135.144
linux-image-lowlatency 3.13.0.135.144
linux-image-powerpc-e500 3.13.0.135.144
linux-image-powerpc-e500mc 3.13.0.135.144
linux-image-powerpc-smp 3.13.0.135.144
linux-image-powerpc64-emb 3.13.0.135.144
linux-image-powerpc64-smp 3.13.0.135.144
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://www.ubuntu.com/usn/usn-3470-1
CVE-2016-8632, CVE-2017-10661, CVE-2017-10662, CVE-2017-10663,
CVE-2017-10911, CVE-2017-11176, CVE-2017-14340
Package Information:
https://launchpad.net/ubuntu/+source/linux/3.13.0-135.184
Ubuntu Security Notice USN-3470-1
October 31, 2017
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
Details:
Qian Zhang discovered a heap-based buffer overflow in the tipc_msg_build()
function in the Linux kernel. A local attacker could use to cause a denial
of service (system crash) or possibly execute arbitrary code with
administrative privileges. (CVE-2016-8632)
Dmitry Vyukov discovered that a race condition existed in the timerfd
subsystem of the Linux kernel when handling might_cancel queuing. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2017-10661)
It was discovered that the Flash-Friendly File System (f2fs) implementation
in the Linux kernel did not properly validate superblock metadata. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2017-10662, CVE-2017-10663)
Anthony Perard discovered that the Xen virtual block driver did not
properly initialize some data structures before passing them to user space.
A local attacker in a guest VM could use this to expose sensitive
information from the host OS or other guest VMs. (CVE-2017-10911)
It was discovered that a use-after-free vulnerability existed in the POSIX
message queue implementation in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-11176)
Dave Chinner discovered that the XFS filesystem did not enforce that the
realtime inode flag was settable only on filesystems on a realtime device.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2017-14340)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
linux-image-3.13.0-135-generic 3.13.0-135.184
linux-image-3.13.0-135-generic-lpae 3.13.0-135.184
linux-image-3.13.0-135-lowlatency 3.13.0-135.184
linux-image-3.13.0-135-powerpc-e500 3.13.0-135.184
linux-image-3.13.0-135-powerpc-e500mc 3.13.0-135.184
linux-image-3.13.0-135-powerpc-smp 3.13.0-135.184
linux-image-3.13.0-135-powerpc64-emb 3.13.0-135.184
linux-image-3.13.0-135-powerpc64-smp 3.13.0-135.184
linux-image-generic 3.13.0.135.144
linux-image-generic-lpae 3.13.0.135.144
linux-image-lowlatency 3.13.0.135.144
linux-image-powerpc-e500 3.13.0.135.144
linux-image-powerpc-e500mc 3.13.0.135.144
linux-image-powerpc-smp 3.13.0.135.144
linux-image-powerpc64-emb 3.13.0.135.144
linux-image-powerpc64-smp 3.13.0.135.144
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://www.ubuntu.com/usn/usn-3470-1
CVE-2016-8632, CVE-2017-10661, CVE-2017-10662, CVE-2017-10663,
CVE-2017-10911, CVE-2017-11176, CVE-2017-14340
Package Information:
https://launchpad.net/ubuntu/+source/linux/3.13.0-135.184
[USN-3469-2] Linux kernel (Xenial HWE) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3469-2
October 31, 2017
linux-lts-xenial vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty
Details:
USN-3469-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
Anthony Perard discovered that the Xen virtual block driver did not
properly initialize some data structures before passing them to user space.
A local attacker in a guest VM could use this to expose sensitive
information from the host OS or other guest VMs. (CVE-2017-10911)
Bo Zhang discovered that the netlink wireless configuration interface in
the Linux kernel did not properly validate attributes when handling certain
requests. A local attacker with the CAP_NET_ADMIN could use this to cause a
denial of service (system crash). (CVE-2017-12153)
It was discovered that the nested KVM implementation in the Linux
kernel in some situations did not properly prevent second level guests
from reading and writing the hardware CR8 register. A local attacker
in a guest could use this to cause a denial of service (system crash).
It was discovered that the key management subsystem in the Linux kernel
did not properly restrict key reads on negatively instantiated keys. A
local attacker could use this to cause a denial of service (system crash).
(CVE-2017-12192)
It was discovered that an integer overflow existed in the sysfs interface
for the QLogic 24xx+ series SCSI driver in the Linux kernel. A local
privileged attacker could use this to cause a denial of service (system
crash). (CVE-2017-14051)
It was discovered that the ATI Radeon framebuffer driver in the Linux
kernel did not properly initialize a data structure returned to user space.
A local attacker could use this to expose sensitive information (kernel
memory). (CVE-2017-14156)
Dave Chinner discovered that the XFS filesystem did not enforce that the
realtime inode flag was settable only on filesystems on a realtime device.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2017-14340)
ChunYu Wang discovered that the iSCSI transport implementation in the Linux
kernel did not properly validate data structures. A local attacker could
use this to cause a denial of service (system crash). (CVE-2017-14489)
It was discovered that the generic SCSI driver in the Linux kernel did not
properly initialize data returned to user space in some situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2017-14991)
Dmitry Vyukov discovered that the Floating Point Unit (fpu) subsystem in
the Linux kernel did not properly handle attempts to set reserved bits in a
task's extended state (xstate) area. A local attacker could use this to
cause a denial of service (system crash). (CVE-2017-15537)
Pengfei Wang discovered that the Turtle Beach MultiSound audio device
driver in the Linux kernel contained race conditions when fetching
from the ring-buffer. A local attacker could use this to cause a
denial of service (infinite loop). (CVE-2017-9984, CVE-2017-9985)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
linux-image-4.4.0-98-generic 4.4.0-98.121~14.04.1
linux-image-4.4.0-98-generic-lpae 4.4.0-98.121~14.04.1
linux-image-4.4.0-98-lowlatency 4.4.0-98.121~14.04.1
linux-image-4.4.0-98-powerpc-e500mc 4.4.0-98.121~14.04.1
linux-image-4.4.0-98-powerpc-smp 4.4.0-98.121~14.04.1
linux-image-4.4.0-98-powerpc64-emb 4.4.0-98.121~14.04.1
linux-image-4.4.0-98-powerpc64-smp 4.4.0-98.121~14.04.1
linux-image-generic-lpae-lts-xenial 4.4.0.98.82
linux-image-generic-lts-xenial 4.4.0.98.82
linux-image-lowlatency-lts-xenial 4.4.0.98.82
linux-image-powerpc-e500mc-lts-xenial 4.4.0.98.82
linux-image-powerpc-smp-lts-xenial 4.4.0.98.82
linux-image-powerpc64-emb-lts-xenial 4.4.0.98.82
linux-image-powerpc64-smp-lts-xenial 4.4.0.98.82
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://www.ubuntu.com/usn/usn-3469-2
https://www.ubuntu.com/usn/usn-3469-1
CVE-2017-10911, CVE-2017-12153, CVE-2017-12154, CVE-2017-12192,
CVE-2017-14051, CVE-2017-14156, CVE-2017-14340, CVE-2017-14489,
CVE-2017-14991, CVE-2017-15537, CVE-2017-9984, CVE-2017-9985
Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-xenial/4.4.0-98.121~14.04.1
Ubuntu Security Notice USN-3469-2
October 31, 2017
linux-lts-xenial vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty
Details:
USN-3469-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
Anthony Perard discovered that the Xen virtual block driver did not
properly initialize some data structures before passing them to user space.
A local attacker in a guest VM could use this to expose sensitive
information from the host OS or other guest VMs. (CVE-2017-10911)
Bo Zhang discovered that the netlink wireless configuration interface in
the Linux kernel did not properly validate attributes when handling certain
requests. A local attacker with the CAP_NET_ADMIN could use this to cause a
denial of service (system crash). (CVE-2017-12153)
It was discovered that the nested KVM implementation in the Linux
kernel in some situations did not properly prevent second level guests
from reading and writing the hardware CR8 register. A local attacker
in a guest could use this to cause a denial of service (system crash).
It was discovered that the key management subsystem in the Linux kernel
did not properly restrict key reads on negatively instantiated keys. A
local attacker could use this to cause a denial of service (system crash).
(CVE-2017-12192)
It was discovered that an integer overflow existed in the sysfs interface
for the QLogic 24xx+ series SCSI driver in the Linux kernel. A local
privileged attacker could use this to cause a denial of service (system
crash). (CVE-2017-14051)
It was discovered that the ATI Radeon framebuffer driver in the Linux
kernel did not properly initialize a data structure returned to user space.
A local attacker could use this to expose sensitive information (kernel
memory). (CVE-2017-14156)
Dave Chinner discovered that the XFS filesystem did not enforce that the
realtime inode flag was settable only on filesystems on a realtime device.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2017-14340)
ChunYu Wang discovered that the iSCSI transport implementation in the Linux
kernel did not properly validate data structures. A local attacker could
use this to cause a denial of service (system crash). (CVE-2017-14489)
It was discovered that the generic SCSI driver in the Linux kernel did not
properly initialize data returned to user space in some situations. A local
attacker could use this to expose sensitive information (kernel memory).
(CVE-2017-14991)
Dmitry Vyukov discovered that the Floating Point Unit (fpu) subsystem in
the Linux kernel did not properly handle attempts to set reserved bits in a
task's extended state (xstate) area. A local attacker could use this to
cause a denial of service (system crash). (CVE-2017-15537)
Pengfei Wang discovered that the Turtle Beach MultiSound audio device
driver in the Linux kernel contained race conditions when fetching
from the ring-buffer. A local attacker could use this to cause a
denial of service (infinite loop). (CVE-2017-9984, CVE-2017-9985)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
linux-image-4.4.0-98-generic 4.4.0-98.121~14.04.1
linux-image-4.4.0-98-generic-lpae 4.4.0-98.121~14.04.1
linux-image-4.4.0-98-lowlatency 4.4.0-98.121~14.04.1
linux-image-4.4.0-98-powerpc-e500mc 4.4.0-98.121~14.04.1
linux-image-4.4.0-98-powerpc-smp 4.4.0-98.121~14.04.1
linux-image-4.4.0-98-powerpc64-emb 4.4.0-98.121~14.04.1
linux-image-4.4.0-98-powerpc64-smp 4.4.0-98.121~14.04.1
linux-image-generic-lpae-lts-xenial 4.4.0.98.82
linux-image-generic-lts-xenial 4.4.0.98.82
linux-image-lowlatency-lts-xenial 4.4.0.98.82
linux-image-powerpc-e500mc-lts-xenial 4.4.0.98.82
linux-image-powerpc-smp-lts-xenial 4.4.0.98.82
linux-image-powerpc64-emb-lts-xenial 4.4.0.98.82
linux-image-powerpc64-smp-lts-xenial 4.4.0.98.82
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://www.ubuntu.com/usn/usn-3469-2
https://www.ubuntu.com/usn/usn-3469-1
CVE-2017-10911, CVE-2017-12153, CVE-2017-12154, CVE-2017-12192,
CVE-2017-14051, CVE-2017-14156, CVE-2017-14340, CVE-2017-14489,
CVE-2017-14991, CVE-2017-15537, CVE-2017-9984, CVE-2017-9985
Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-xenial/4.4.0-98.121~14.04.1
[USN-3468-3] Linux kernel (GCP) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3468-3
October 31, 2017
linux-gcp vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
Details:
It was discovered that the KVM subsystem in the Linux kernel did not
properly bound guest IRQs. A local attacker in a guest VM could use this to
cause a denial of service (host system crash). (CVE-2017-1000252)
It was discovered that the Flash-Friendly File System (f2fs) implementation
in the Linux kernel did not properly validate superblock metadata. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2017-10663)
Anthony Perard discovered that the Xen virtual block driver did not
properly initialize some data structures before passing them to user space.
A local attacker in a guest VM could use this to expose sensitive
information from the host OS or other guest VMs. (CVE-2017-10911)
It was discovered that a use-after-free vulnerability existed in the POSIX
message queue implementation in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-11176)
Dave Chinner discovered that the XFS filesystem did not enforce that the
realtime inode flag was settable only on filesystems on a realtime device.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2017-14340)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
linux-image-4.10.0-1008-gcp 4.10.0-1008.8
linux-image-gcp 4.10.0.1008.10
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://www.ubuntu.com/usn/usn-3468-3
https://www.ubuntu.com/usn/usn-3468-1
CVE-2017-1000252, CVE-2017-10663, CVE-2017-10911, CVE-2017-11176,
CVE-2017-14340
Package Information:
https://launchpad.net/ubuntu/+source/linux-gcp/4.10.0-1008.8
Ubuntu Security Notice USN-3468-3
October 31, 2017
linux-gcp vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
Details:
It was discovered that the KVM subsystem in the Linux kernel did not
properly bound guest IRQs. A local attacker in a guest VM could use this to
cause a denial of service (host system crash). (CVE-2017-1000252)
It was discovered that the Flash-Friendly File System (f2fs) implementation
in the Linux kernel did not properly validate superblock metadata. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2017-10663)
Anthony Perard discovered that the Xen virtual block driver did not
properly initialize some data structures before passing them to user space.
A local attacker in a guest VM could use this to expose sensitive
information from the host OS or other guest VMs. (CVE-2017-10911)
It was discovered that a use-after-free vulnerability existed in the POSIX
message queue implementation in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-11176)
Dave Chinner discovered that the XFS filesystem did not enforce that the
realtime inode flag was settable only on filesystems on a realtime device.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2017-14340)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
linux-image-4.10.0-1008-gcp 4.10.0-1008.8
linux-image-gcp 4.10.0.1008.10
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://www.ubuntu.com/usn/usn-3468-3
https://www.ubuntu.com/usn/usn-3468-1
CVE-2017-1000252, CVE-2017-10663, CVE-2017-10911, CVE-2017-11176,
CVE-2017-14340
Package Information:
https://launchpad.net/ubuntu/+source/linux-gcp/4.10.0-1008.8
[USN-3468-2] Linux kernel (HWE) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3468-2
October 31, 2017
linux-hwe vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-hwe: Linux hardware enablement (HWE) kernel
Details:
USN-3468-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04.
This update provides the corresponding updates for the Linux Hardware
Enablement (HWE) kernel from Ubuntu 17.04 for Ubuntu 16.04 LTS.
It was discovered that the KVM subsystem in the Linux kernel did not
properly bound guest IRQs. A local attacker in a guest VM could use this to
cause a denial of service (host system crash). (CVE-2017-1000252)
It was discovered that the Flash-Friendly File System (f2fs) implementation
in the Linux kernel did not properly validate superblock metadata. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2017-10663)
Anthony Perard discovered that the Xen virtual block driver did not
properly initialize some data structures before passing them to user space.
A local attacker in a guest VM could use this to expose sensitive
information from the host OS or other guest VMs. (CVE-2017-10911)
It was discovered that a use-after-free vulnerability existed in the POSIX
message queue implementation in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-11176)
Dave Chinner discovered that the XFS filesystem did not enforce that the
realtime inode flag was settable only on filesystems on a realtime device.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2017-14340)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
linux-image-4.10.0-38-generic 4.10.0-38.42~16.04.1
linux-image-4.10.0-38-generic-lpae 4.10.0-38.42~16.04.1
linux-image-4.10.0-38-lowlatency 4.10.0-38.42~16.04.1
linux-image-generic-hwe-16.04 4.10.0.38.40
linux-image-generic-lpae-hwe-16.04 4.10.0.38.40
linux-image-lowlatency-hwe-16.04 4.10.0.38.40
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://www.ubuntu.com/usn/usn-3468-2
https://www.ubuntu.com/usn/usn-3468-1
CVE-2017-1000252, CVE-2017-10663, CVE-2017-10911, CVE-2017-11176,
CVE-2017-14340
Package Information:
https://launchpad.net/ubuntu/+source/linux-hwe/4.10.0-38.42~16.04.1
Ubuntu Security Notice USN-3468-2
October 31, 2017
linux-hwe vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-hwe: Linux hardware enablement (HWE) kernel
Details:
USN-3468-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04.
This update provides the corresponding updates for the Linux Hardware
Enablement (HWE) kernel from Ubuntu 17.04 for Ubuntu 16.04 LTS.
It was discovered that the KVM subsystem in the Linux kernel did not
properly bound guest IRQs. A local attacker in a guest VM could use this to
cause a denial of service (host system crash). (CVE-2017-1000252)
It was discovered that the Flash-Friendly File System (f2fs) implementation
in the Linux kernel did not properly validate superblock metadata. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2017-10663)
Anthony Perard discovered that the Xen virtual block driver did not
properly initialize some data structures before passing them to user space.
A local attacker in a guest VM could use this to expose sensitive
information from the host OS or other guest VMs. (CVE-2017-10911)
It was discovered that a use-after-free vulnerability existed in the POSIX
message queue implementation in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-11176)
Dave Chinner discovered that the XFS filesystem did not enforce that the
realtime inode flag was settable only on filesystems on a realtime device.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2017-14340)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
linux-image-4.10.0-38-generic 4.10.0-38.42~16.04.1
linux-image-4.10.0-38-generic-lpae 4.10.0-38.42~16.04.1
linux-image-4.10.0-38-lowlatency 4.10.0-38.42~16.04.1
linux-image-generic-hwe-16.04 4.10.0.38.40
linux-image-generic-lpae-hwe-16.04 4.10.0.38.40
linux-image-lowlatency-hwe-16.04 4.10.0.38.40
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://www.ubuntu.com/usn/usn-3468-2
https://www.ubuntu.com/usn/usn-3468-1
CVE-2017-1000252, CVE-2017-10663, CVE-2017-10911, CVE-2017-11176,
CVE-2017-14340
Package Information:
https://launchpad.net/ubuntu/+source/linux-hwe/4.10.0-38.42~16.04.1
[USN-3468-1] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3468-1
October 31, 2017
linux, linux-raspi2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.04
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-raspi2: Linux kernel for Raspberry Pi 2
Details:
It was discovered that the KVM subsystem in the Linux kernel did not
properly bound guest IRQs. A local attacker in a guest VM could use this to
cause a denial of service (host system crash). (CVE-2017-1000252)
It was discovered that the Flash-Friendly File System (f2fs) implementation
in the Linux kernel did not properly validate superblock metadata. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2017-10663)
Anthony Perard discovered that the Xen virtual block driver did not
properly initialize some data structures before passing them to user space.
A local attacker in a guest VM could use this to expose sensitive
information from the host OS or other guest VMs. (CVE-2017-10911)
It was discovered that a use-after-free vulnerability existed in the POSIX
message queue implementation in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-11176)
Dave Chinner discovered that the XFS filesystem did not enforce that the
realtime inode flag was settable only on filesystems on a realtime device.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2017-14340)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.04:
linux-image-4.10.0-1020-raspi2 4.10.0-1020.23
linux-image-4.10.0-38-generic 4.10.0-38.42
linux-image-4.10.0-38-generic-lpae 4.10.0-38.42
linux-image-4.10.0-38-lowlatency 4.10.0-38.42
linux-image-generic 4.10.0.38.38
linux-image-generic-lpae 4.10.0.38.38
linux-image-lowlatency 4.10.0.38.38
linux-image-raspi2 4.10.0.1020.21
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://www.ubuntu.com/usn/usn-3468-1
CVE-2017-1000252, CVE-2017-10663, CVE-2017-10911, CVE-2017-11176,
CVE-2017-14340
Package Information:
https://launchpad.net/ubuntu/+source/linux/4.10.0-38.42
https://launchpad.net/ubuntu/+source/linux-raspi2/4.10.0-1020.23
Ubuntu Security Notice USN-3468-1
October 31, 2017
linux, linux-raspi2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.04
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-raspi2: Linux kernel for Raspberry Pi 2
Details:
It was discovered that the KVM subsystem in the Linux kernel did not
properly bound guest IRQs. A local attacker in a guest VM could use this to
cause a denial of service (host system crash). (CVE-2017-1000252)
It was discovered that the Flash-Friendly File System (f2fs) implementation
in the Linux kernel did not properly validate superblock metadata. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2017-10663)
Anthony Perard discovered that the Xen virtual block driver did not
properly initialize some data structures before passing them to user space.
A local attacker in a guest VM could use this to expose sensitive
information from the host OS or other guest VMs. (CVE-2017-10911)
It was discovered that a use-after-free vulnerability existed in the POSIX
message queue implementation in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2017-11176)
Dave Chinner discovered that the XFS filesystem did not enforce that the
realtime inode flag was settable only on filesystems on a realtime device.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2017-14340)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.04:
linux-image-4.10.0-1020-raspi2 4.10.0-1020.23
linux-image-4.10.0-38-generic 4.10.0-38.42
linux-image-4.10.0-38-generic-lpae 4.10.0-38.42
linux-image-4.10.0-38-lowlatency 4.10.0-38.42
linux-image-generic 4.10.0.38.38
linux-image-generic-lpae 4.10.0.38.38
linux-image-lowlatency 4.10.0.38.38
linux-image-raspi2 4.10.0.1020.21
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://www.ubuntu.com/usn/usn-3468-1
CVE-2017-1000252, CVE-2017-10663, CVE-2017-10911, CVE-2017-11176,
CVE-2017-14340
Package Information:
https://launchpad.net/ubuntu/+source/linux/4.10.0-38.42
https://launchpad.net/ubuntu/+source/linux-raspi2/4.10.0-1020.23
Monday, October 30, 2017
[announce] NYC*BUG Upcoming
The next planned meeting is January 3, and we'll be back monthly for the
new year with a bunch of great meeting topics. Details coming soon.
This Wednesday some people are informally getting together at Suspenders
at 108 Greenwich Street at 630 PM to chat.
The BSDCan 2018 web site is now up at https://www.bsdcan.org/2018/ and
the call for papers opens on December 1.
_______________________________________________
announce mailing list
announce@lists.nycbug.org
http://lists.nycbug.org/mailman/listinfo/announce
new year with a bunch of great meeting topics. Details coming soon.
This Wednesday some people are informally getting together at Suspenders
at 108 Greenwich Street at 630 PM to chat.
The BSDCan 2018 web site is now up at https://www.bsdcan.org/2018/ and
the call for papers opens on December 1.
_______________________________________________
announce mailing list
announce@lists.nycbug.org
http://lists.nycbug.org/mailman/listinfo/announce
OpenNTPD 6.2p3 Released
OpenNTPD 6.2p3 has just been released, which is based on the OpenBSD 6.2 release.
It will be available from the mirrors listed at http://www.openntpd.org/ shortly.
OpenNTPD is a FREE, secure, and easy to use implementation of the Network Time
Protocol. It provides the ability to sync the local clock to remote NTP servers
and can act as NTP server itself, redistributing the local clock.
Changes since OpenNTPD 6.2p1
============================
* Fixed support for the 'query from <ip>' directive and clarified its usage.
Changes since OpenNTPD 6.2p2
============================
* Fixed support for macOS
The libtls library, as shipped with LibreSSL 2.6.0 or later, is
required to use the HTTPS constraint feature, though it is not
required to use OpenNTPD.
For detailed changes, see the changes either in the OpenBSD CVS repository or
the GitHub mirror.
Reporting Bugs:
===============
General bugs may be reported to tech@openbsd.org
Portable bugs may be filed at https://github.com/openntpd-portable/openntpd-portable/
It will be available from the mirrors listed at http://www.openntpd.org/ shortly.
OpenNTPD is a FREE, secure, and easy to use implementation of the Network Time
Protocol. It provides the ability to sync the local clock to remote NTP servers
and can act as NTP server itself, redistributing the local clock.
Changes since OpenNTPD 6.2p1
============================
* Fixed support for the 'query from <ip>' directive and clarified its usage.
Changes since OpenNTPD 6.2p2
============================
* Fixed support for macOS
The libtls library, as shipped with LibreSSL 2.6.0 or later, is
required to use the HTTPS constraint feature, though it is not
required to use OpenNTPD.
For detailed changes, see the changes either in the OpenBSD CVS repository or
the GitHub mirror.
Reporting Bugs:
===============
General bugs may be reported to tech@openbsd.org
Portable bugs may be filed at https://github.com/openntpd-portable/openntpd-portable/
[USN-3459-2] MySQL vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3459-2
October 30, 2017
mysql-5.5 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in MySQL.
Software Description:
- mysql-5.5: MySQL database
Details:
USN-3459-1 fixed several vulnerabilities in MySQL. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Multiple security issues were discovered in MySQL and this update
includes new upstream MySQL versions to fix these issues.
MySQL has been updated to 5.5.58 in Ubuntu 12.04 ESM.
In addition to security fixes, the updated packages contain bug fixes,
new features, and possibly incompatible changes.
Please see the following for more information:
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-58.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
mysql-server-5.5 5.5.58-0ubuntu0.12.04.1
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3459-2
https://www.ubuntu.com/usn/usn-3459-1
CVE-2017-10268, CVE-2017-10378, CVE-2017-10379, CVE-2017-10384
Ubuntu Security Notice USN-3459-2
October 30, 2017
mysql-5.5 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in MySQL.
Software Description:
- mysql-5.5: MySQL database
Details:
USN-3459-1 fixed several vulnerabilities in MySQL. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Multiple security issues were discovered in MySQL and this update
includes new upstream MySQL versions to fix these issues.
MySQL has been updated to 5.5.58 in Ubuntu 12.04 ESM.
In addition to security fixes, the updated packages contain bug fixes,
new features, and possibly incompatible changes.
Please see the following for more information:
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-58.html
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
mysql-server-5.5 5.5.58-0ubuntu0.12.04.1
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3459-2
https://www.ubuntu.com/usn/usn-3459-1
CVE-2017-10268, CVE-2017-10378, CVE-2017-10379, CVE-2017-10384
[USN-3464-2] Wget vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3464-2
October 30, 2017
wget vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in Wget.
Software Description:
- wget: retrieves files from the web
Details:
USN-3464-1 fixed several vulnerabilities in Wget. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Antti Levomäki, Christian Jalio, and Joonas Pihlaja discovered that
Wget incorrectly handled certain HTTP responses. A remote attacker
could use this issue to cause Wget to crash, resulting in a denial of
service, or possibly execute arbitrary code.
(CVE-2017-13089, CVE 2017-13090)
Dawid Golunski discovered that Wget incorrectly handled recursive or
mirroring mode. A remote attacker could possibly use this issue to
bypass intended access list restrictions. (CVE-2016-7098)
Orange Tsai discovered that Wget incorrectly handled CRLF sequences in
HTTP headers. A remote attacker could possibly use this issue to
inject arbitrary HTTP headers. (CVE-2017-6508)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
wget 1.13.4-2ubuntu1.5
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3464-2
https://www.ubuntu.com/usn/usn-3464-1
CVE-2016-7098, CVE-2017-13089, CVE-2017-13090, CVE-2017-6508
Ubuntu Security Notice USN-3464-2
October 30, 2017
wget vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in Wget.
Software Description:
- wget: retrieves files from the web
Details:
USN-3464-1 fixed several vulnerabilities in Wget. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Antti Levomäki, Christian Jalio, and Joonas Pihlaja discovered that
Wget incorrectly handled certain HTTP responses. A remote attacker
could use this issue to cause Wget to crash, resulting in a denial of
service, or possibly execute arbitrary code.
(CVE-2017-13089, CVE 2017-13090)
Dawid Golunski discovered that Wget incorrectly handled recursive or
mirroring mode. A remote attacker could possibly use this issue to
bypass intended access list restrictions. (CVE-2016-7098)
Orange Tsai discovered that Wget incorrectly handled CRLF sequences in
HTTP headers. A remote attacker could possibly use this issue to
inject arbitrary HTTP headers. (CVE-2017-6508)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
wget 1.13.4-2ubuntu1.5
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3464-2
https://www.ubuntu.com/usn/usn-3464-1
CVE-2016-7098, CVE-2017-13089, CVE-2017-13090, CVE-2017-6508
[USN-3467-1] poppler vulnerability
==========================================================================
Ubuntu Security Notice USN-3467-1
October 30, 2017
Ubuntu Security Notice USN-3467-1
October 30, 2017
poppler vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
poppler could be made to crash if it opened a specially crafted file.
Software Description:
- poppler: PDF rendering library
Details:
It was discovered that Poppler incorrectly handled certain files.
If a user or automated system were tricked into opening a
crafted PDF file, an attacker could cause a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
libpoppler68 0.57.0-2ubuntu4.1
poppler-utils 0.57.0-2ubuntu4.1
Ubuntu 17.04:
libpoppler64 0.48.0-2ubuntu2.4
poppler-utils 0.48.0-2ubuntu2.4
Ubuntu 16.04 LTS:
libpoppler58 0.41.0-0ubuntu1.5
poppler-utils 0.41.0-0ubuntu1.5
Ubuntu 14.04 LTS:
libpoppler44 0.24.5-2ubuntu4.8
poppler-utils 0.24.5-2ubuntu4.8
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3467-1
CVE-2017-15565
Package Information:
https://launchpad.net/ubuntu/+source/poppler/0.57.0-2ubuntu4.1
https://launchpad.net/ubuntu/+source/poppler/0.48.0-2ubuntu2.4
https://launchpad.net/ubuntu/+source/poppler/0.41.0-0ubuntu1.5
https://launchpad.net/ubuntu/+source/poppler/0.24.5-2ubuntu4.8
[CentOS-announce] CESA-2017:3081 Important CentOS 7 tomcat Security Update
CentOS Errata and Security Advisory 2017:3081 Important
Upstream details at : https://access.redhat.com/errata/RHSA-2017:3081
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
1d033d848fb070ce731bfc768129169c2cd611bc11dc8653f5c58cb1bdfd05b9 tomcat-7.0.76-3.el7_4.noarch.rpm
3fef90d9cd773b7c399ed6ad442d6bc6380c0c314e99d92d583c8aae5b369c70 tomcat-admin-webapps-7.0.76-3.el7_4.noarch.rpm
cc9dd653559a23925e450bfb446d94d2bda2a98f22bf4109e030240fa2ad20a3 tomcat-docs-webapp-7.0.76-3.el7_4.noarch.rpm
156136608e5705defebcd04383800714ac64368b390e1992099db8fe147046eb tomcat-el-2.2-api-7.0.76-3.el7_4.noarch.rpm
aaa1246b0c12bd623bba6542c6cedaad6a97d3e38fad4966e1f7fbbadb6908ed tomcat-javadoc-7.0.76-3.el7_4.noarch.rpm
3286080d1506c088e8e68c9c41ed8fd5724465ab5b7e322ef9c8ff6d6d60df16 tomcat-jsp-2.2-api-7.0.76-3.el7_4.noarch.rpm
f6c79a4f7d436f6f619be26db6eef983ab97add568110ad8aa23ee0ea50e7eb3 tomcat-jsvc-7.0.76-3.el7_4.noarch.rpm
5c867e9a48a014d635134a35b7cfa16433bf58119cca39a0194e4163dff5ed54 tomcat-lib-7.0.76-3.el7_4.noarch.rpm
961dc90fbf11540be166f76a98224ca6ec920060a48bfdab9d2ef525026991f2 tomcat-servlet-3.0-api-7.0.76-3.el7_4.noarch.rpm
6415299ddddb2dd85e5fd14ac1b183dc1a297f94db23ad0be08ea8e7d0ae53dc tomcat-webapps-7.0.76-3.el7_4.noarch.rpm
Source:
3b05b59c5528f3efa27c0d843a6801a0c9ba8804aff08ffb0b6103379b84cd2a tomcat-7.0.76-3.el7_4.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHSA-2017:3081
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
1d033d848fb070ce731bfc768129169c2cd611bc11dc8653f5c58cb1bdfd05b9 tomcat-7.0.76-3.el7_4.noarch.rpm
3fef90d9cd773b7c399ed6ad442d6bc6380c0c314e99d92d583c8aae5b369c70 tomcat-admin-webapps-7.0.76-3.el7_4.noarch.rpm
cc9dd653559a23925e450bfb446d94d2bda2a98f22bf4109e030240fa2ad20a3 tomcat-docs-webapp-7.0.76-3.el7_4.noarch.rpm
156136608e5705defebcd04383800714ac64368b390e1992099db8fe147046eb tomcat-el-2.2-api-7.0.76-3.el7_4.noarch.rpm
aaa1246b0c12bd623bba6542c6cedaad6a97d3e38fad4966e1f7fbbadb6908ed tomcat-javadoc-7.0.76-3.el7_4.noarch.rpm
3286080d1506c088e8e68c9c41ed8fd5724465ab5b7e322ef9c8ff6d6d60df16 tomcat-jsp-2.2-api-7.0.76-3.el7_4.noarch.rpm
f6c79a4f7d436f6f619be26db6eef983ab97add568110ad8aa23ee0ea50e7eb3 tomcat-jsvc-7.0.76-3.el7_4.noarch.rpm
5c867e9a48a014d635134a35b7cfa16433bf58119cca39a0194e4163dff5ed54 tomcat-lib-7.0.76-3.el7_4.noarch.rpm
961dc90fbf11540be166f76a98224ca6ec920060a48bfdab9d2ef525026991f2 tomcat-servlet-3.0-api-7.0.76-3.el7_4.noarch.rpm
6415299ddddb2dd85e5fd14ac1b183dc1a297f94db23ad0be08ea8e7d0ae53dc tomcat-webapps-7.0.76-3.el7_4.noarch.rpm
Source:
3b05b59c5528f3efa27c0d843a6801a0c9ba8804aff08ffb0b6103379b84cd2a tomcat-7.0.76-3.el7_4.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CESA-2017:3080 Important CentOS 6 tomcat6 Security Update
CentOS Errata and Security Advisory 2017:3080 Important
Upstream details at : https://access.redhat.com/errata/RHSA-2017:3080
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
f54b6d93d6877aa8d15e0b1910dab0560b9f439ac53cc6171c7da57d5287e3be tomcat6-6.0.24-111.el6_9.noarch.rpm
0249d6b4061656e106a48680caa74706e6a856640bf304d1d7534c59a6eacb7b tomcat6-admin-webapps-6.0.24-111.el6_9.noarch.rpm
d67864afbf9585832bfbc2711b89a628d1cc1be4bea3d075b93318115a50fd84 tomcat6-docs-webapp-6.0.24-111.el6_9.noarch.rpm
3653f1d30cdb47d423b28ecf217bcba8346ec2849ca00c329a692d872088173b tomcat6-el-2.1-api-6.0.24-111.el6_9.noarch.rpm
0f597cddfa8240ccc4606542f52f664783d55162ea2a2b5f48f3efdb0d953982 tomcat6-javadoc-6.0.24-111.el6_9.noarch.rpm
709845ffeb526027fba6f819236edeb50f21fe59e67eb55eb76fbbee31635708 tomcat6-jsp-2.1-api-6.0.24-111.el6_9.noarch.rpm
6cb703774287209f9c8c591007798309089446a76c621a91b2200c1a2504b924 tomcat6-lib-6.0.24-111.el6_9.noarch.rpm
d48b5d92a79b9b98f74fd007dd16c96314e6f51c58563487f16a74146d9f64ea tomcat6-servlet-2.5-api-6.0.24-111.el6_9.noarch.rpm
88ec61de388e1dd353e87636442ee7fb835ab5212645652bab3f2a5464b2f317 tomcat6-webapps-6.0.24-111.el6_9.noarch.rpm
x86_64:
f54b6d93d6877aa8d15e0b1910dab0560b9f439ac53cc6171c7da57d5287e3be tomcat6-6.0.24-111.el6_9.noarch.rpm
0249d6b4061656e106a48680caa74706e6a856640bf304d1d7534c59a6eacb7b tomcat6-admin-webapps-6.0.24-111.el6_9.noarch.rpm
d67864afbf9585832bfbc2711b89a628d1cc1be4bea3d075b93318115a50fd84 tomcat6-docs-webapp-6.0.24-111.el6_9.noarch.rpm
3653f1d30cdb47d423b28ecf217bcba8346ec2849ca00c329a692d872088173b tomcat6-el-2.1-api-6.0.24-111.el6_9.noarch.rpm
0f597cddfa8240ccc4606542f52f664783d55162ea2a2b5f48f3efdb0d953982 tomcat6-javadoc-6.0.24-111.el6_9.noarch.rpm
709845ffeb526027fba6f819236edeb50f21fe59e67eb55eb76fbbee31635708 tomcat6-jsp-2.1-api-6.0.24-111.el6_9.noarch.rpm
6cb703774287209f9c8c591007798309089446a76c621a91b2200c1a2504b924 tomcat6-lib-6.0.24-111.el6_9.noarch.rpm
d48b5d92a79b9b98f74fd007dd16c96314e6f51c58563487f16a74146d9f64ea tomcat6-servlet-2.5-api-6.0.24-111.el6_9.noarch.rpm
88ec61de388e1dd353e87636442ee7fb835ab5212645652bab3f2a5464b2f317 tomcat6-webapps-6.0.24-111.el6_9.noarch.rpm
Source:
ba857eb2777da91f86634ead63fa60f762cd4035919bef69966d7d95ee708c79 tomcat6-6.0.24-111.el6_9.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHSA-2017:3080
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
f54b6d93d6877aa8d15e0b1910dab0560b9f439ac53cc6171c7da57d5287e3be tomcat6-6.0.24-111.el6_9.noarch.rpm
0249d6b4061656e106a48680caa74706e6a856640bf304d1d7534c59a6eacb7b tomcat6-admin-webapps-6.0.24-111.el6_9.noarch.rpm
d67864afbf9585832bfbc2711b89a628d1cc1be4bea3d075b93318115a50fd84 tomcat6-docs-webapp-6.0.24-111.el6_9.noarch.rpm
3653f1d30cdb47d423b28ecf217bcba8346ec2849ca00c329a692d872088173b tomcat6-el-2.1-api-6.0.24-111.el6_9.noarch.rpm
0f597cddfa8240ccc4606542f52f664783d55162ea2a2b5f48f3efdb0d953982 tomcat6-javadoc-6.0.24-111.el6_9.noarch.rpm
709845ffeb526027fba6f819236edeb50f21fe59e67eb55eb76fbbee31635708 tomcat6-jsp-2.1-api-6.0.24-111.el6_9.noarch.rpm
6cb703774287209f9c8c591007798309089446a76c621a91b2200c1a2504b924 tomcat6-lib-6.0.24-111.el6_9.noarch.rpm
d48b5d92a79b9b98f74fd007dd16c96314e6f51c58563487f16a74146d9f64ea tomcat6-servlet-2.5-api-6.0.24-111.el6_9.noarch.rpm
88ec61de388e1dd353e87636442ee7fb835ab5212645652bab3f2a5464b2f317 tomcat6-webapps-6.0.24-111.el6_9.noarch.rpm
x86_64:
f54b6d93d6877aa8d15e0b1910dab0560b9f439ac53cc6171c7da57d5287e3be tomcat6-6.0.24-111.el6_9.noarch.rpm
0249d6b4061656e106a48680caa74706e6a856640bf304d1d7534c59a6eacb7b tomcat6-admin-webapps-6.0.24-111.el6_9.noarch.rpm
d67864afbf9585832bfbc2711b89a628d1cc1be4bea3d075b93318115a50fd84 tomcat6-docs-webapp-6.0.24-111.el6_9.noarch.rpm
3653f1d30cdb47d423b28ecf217bcba8346ec2849ca00c329a692d872088173b tomcat6-el-2.1-api-6.0.24-111.el6_9.noarch.rpm
0f597cddfa8240ccc4606542f52f664783d55162ea2a2b5f48f3efdb0d953982 tomcat6-javadoc-6.0.24-111.el6_9.noarch.rpm
709845ffeb526027fba6f819236edeb50f21fe59e67eb55eb76fbbee31635708 tomcat6-jsp-2.1-api-6.0.24-111.el6_9.noarch.rpm
6cb703774287209f9c8c591007798309089446a76c621a91b2200c1a2504b924 tomcat6-lib-6.0.24-111.el6_9.noarch.rpm
d48b5d92a79b9b98f74fd007dd16c96314e6f51c58563487f16a74146d9f64ea tomcat6-servlet-2.5-api-6.0.24-111.el6_9.noarch.rpm
88ec61de388e1dd353e87636442ee7fb835ab5212645652bab3f2a5464b2f317 tomcat6-webapps-6.0.24-111.el6_9.noarch.rpm
Source:
ba857eb2777da91f86634ead63fa60f762cd4035919bef69966d7d95ee708c79 tomcat6-6.0.24-111.el6_9.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Friday, October 27, 2017
[Guidelines change] Changes to the packaging guidelines
Here are the recent changes to the packaging guidelines.
-----
Following releng approval, the restrictions on the use of rich/Boolean
dependencies have been lifted.
* https://fedoraproject.org/wiki/Packaging:Guidelines#Rich.2FBoolean_dependencies
* https://pagure.io/packaging-committee/issue/559
-----
Packaging guidelines for Rust have been added.
* https://fedoraproject.org/wiki/Packaging:Rust
* https://pagure.io/packaging-committee/issue/705
-----
A new section was added to the packaging guidelines regarding shebang
lines. It forbids the use of 'env' and codifies the longstanding rpmlint
rule that non-executable files should not have shebang lines.
* https://fedoraproject.org/wiki/Packaging:Guidelines#Shebang_lines
* https://pagure.io/packaging-committee/issue/700
-----
Appstream metadata guidelines were updated to reflect the new location
into which appdata files should be placed.
* https://fedoraproject.org/wiki/Packaging:AppData
* https://pagure.io/packaging-committee/issue/704
-----
The python guidelines were modified to forbid the use of /usr/bin/python
in shebang lines or as a dependency of a package.
* https://fedoraproject.org/wiki/Packaging:Python#Multiple_Python_Runtimes
* https://pagure.io/packaging-committee/issue/698
-----
The SourceURL guideliens were altered to Use a simplified form for
github URLs.
* https://fedoraproject.org/wiki/Packaging:SourceURL#Git_Hosting_Services
* https://pagure.io/packaging-committee/issue/697
-----
The section on bundled libraries was expanded with more explicit
instructions on constructing the Provides: line which indicates the
bundling.
* https://fedoraproject.org/wiki/Packaging:Guidelines#Bundling_and_Duplication_of_system_libraries
* https://pagure.io/packaging-committee/issue/696
-----
The section on statically linking executables has been completely
revamped to remove the need for committee intervention and to make it
more obvious that there is no prohibition on statically linking to build
artifacts within a single package.
* https://fedoraproject.org/wiki/Packaging:Guidelines#Statically_Linking_Executables
* https://pagure.io/packaging-committee/issue/692
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
-----
Following releng approval, the restrictions on the use of rich/Boolean
dependencies have been lifted.
* https://fedoraproject.org/wiki/Packaging:Guidelines#Rich.2FBoolean_dependencies
* https://pagure.io/packaging-committee/issue/559
-----
Packaging guidelines for Rust have been added.
* https://fedoraproject.org/wiki/Packaging:Rust
* https://pagure.io/packaging-committee/issue/705
-----
A new section was added to the packaging guidelines regarding shebang
lines. It forbids the use of 'env' and codifies the longstanding rpmlint
rule that non-executable files should not have shebang lines.
* https://fedoraproject.org/wiki/Packaging:Guidelines#Shebang_lines
* https://pagure.io/packaging-committee/issue/700
-----
Appstream metadata guidelines were updated to reflect the new location
into which appdata files should be placed.
* https://fedoraproject.org/wiki/Packaging:AppData
* https://pagure.io/packaging-committee/issue/704
-----
The python guidelines were modified to forbid the use of /usr/bin/python
in shebang lines or as a dependency of a package.
* https://fedoraproject.org/wiki/Packaging:Python#Multiple_Python_Runtimes
* https://pagure.io/packaging-committee/issue/698
-----
The SourceURL guideliens were altered to Use a simplified form for
github URLs.
* https://fedoraproject.org/wiki/Packaging:SourceURL#Git_Hosting_Services
* https://pagure.io/packaging-committee/issue/697
-----
The section on bundled libraries was expanded with more explicit
instructions on constructing the Provides: line which indicates the
bundling.
* https://fedoraproject.org/wiki/Packaging:Guidelines#Bundling_and_Duplication_of_system_libraries
* https://pagure.io/packaging-committee/issue/696
-----
The section on statically linking executables has been completely
revamped to remove the need for committee intervention and to make it
more obvious that there is no prohibition on statically linking to build
artifacts within a single package.
* https://fedoraproject.org/wiki/Packaging:Guidelines#Statically_Linking_Executables
* https://pagure.io/packaging-committee/issue/692
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
[CentOS-announce] CESA-2017:3075 Important CentOS 7 wget Security Update
CentOS Errata and Security Advisory 2017:3075 Important
Upstream details at : https://access.redhat.com/errata/RHSA-2017:3075
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
d74e0e13c9f03a464eb508b06ff96dd93a58297e0515f1a29015fec5334f1b80 wget-1.14-15.el7_4.1.x86_64.rpm
Source:
0dec11e33a32973c79bcd6a690907a2f8e99507d1ff3f38be7f5f34996f5fe87 wget-1.14-15.el7_4.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHSA-2017:3075
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
d74e0e13c9f03a464eb508b06ff96dd93a58297e0515f1a29015fec5334f1b80 wget-1.14-15.el7_4.1.x86_64.rpm
Source:
0dec11e33a32973c79bcd6a690907a2f8e99507d1ff3f38be7f5f34996f5fe87 wget-1.14-15.el7_4.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Autumn Elections 2017: Mindshare elections
Hi everybody,
as approved by Fedora Council [1] we are replacing the FAmSCo
elections with elections to a brand new body "Mindshare". You can fine
more information about the Mindshare on its wiki page [2]. For this
election cycle we have opened 2 seats into this body.
At the moment we are collecting questions for candidates in election's
Questionnaire [3]. Please have a look at it and contribute with your
questions you would like to see answered by candidates to these seats.
The Questionnaire [3] is open for new questions till November 6th.
[1] https://pagure.io/Fedora-Council/tickets/issue/142
[2] https://fedoraproject.org/wiki/Mindshare
[3] https://fedoraproject.org/wiki/Elections/Questionnaire
Thanks for your support and Regards,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
as approved by Fedora Council [1] we are replacing the FAmSCo
elections with elections to a brand new body "Mindshare". You can fine
more information about the Mindshare on its wiki page [2]. For this
election cycle we have opened 2 seats into this body.
At the moment we are collecting questions for candidates in election's
Questionnaire [3]. Please have a look at it and contribute with your
questions you would like to see answered by candidates to these seats.
The Questionnaire [3] is open for new questions till November 6th.
[1] https://pagure.io/Fedora-Council/tickets/issue/142
[2] https://fedoraproject.org/wiki/Mindshare
[3] https://fedoraproject.org/wiki/Elections/Questionnaire
Thanks for your support and Regards,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Thursday, October 26, 2017
Fedora 27 Final status is NO-GO
Release status of the Fedora 27 Final is NO-GO.
The next Go/No-Go meeting is planned on Thursday, November 2nd. The GA
date for the F27 Final release moves from Target date to Rain date,
which is 2017-Nov-07.
For more details please check the Go/No-Go meeting minutes[1].
[1] https://meetbot.fedoraproject.org/fedora-meeting-1/2017-10-26/f27-final-and-server-beta-go-no-go-meeting.2017-10-26-17.00.html
Regards,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
The next Go/No-Go meeting is planned on Thursday, November 2nd. The GA
date for the F27 Final release moves from Target date to Rain date,
which is 2017-Nov-07.
For more details please check the Go/No-Go meeting minutes[1].
[1] https://meetbot.fedoraproject.org/fedora-meeting-1/2017-10-26/f27-final-and-server-beta-go-no-go-meeting.2017-10-26-17.00.html
Regards,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora 27 Server Beta status (3rd round) is NO-GO
Release status of the Fedora 27 Server Beta is NO-GO.
The next Go/No-Go meeting is planned on Thursday, November 2nd
together with second round of F27 Final Go/No-Go meeting. The F27
Server Beta release slips for one week. The slip also affects the F27
Server GA, it moves to 2017-Dec-19 having Go/No-Go meeting on
2017-Dec-14.
For more information please check the F27 Server Beta Go/No-Go meeting
minutes [1].
[1] https://meetbot.fedoraproject.org/fedora-meeting-1/2017-10-26/f27-final-and-server-beta-go-no-go-meeting.2017-10-26-17.00.html
Regards,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
The next Go/No-Go meeting is planned on Thursday, November 2nd
together with second round of F27 Final Go/No-Go meeting. The F27
Server Beta release slips for one week. The slip also affects the F27
Server GA, it moves to 2017-Dec-19 having Go/No-Go meeting on
2017-Dec-14.
For more information please check the F27 Server Beta Go/No-Go meeting
minutes [1].
[1] https://meetbot.fedoraproject.org/fedora-meeting-1/2017-10-26/f27-final-and-server-beta-go-no-go-meeting.2017-10-26-17.00.html
Regards,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
[USN-3466-1] systemd vulnerability
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCgAGBQJZ8jHnAAoJEGVp2FWnRL6TsoMQAI5AOY46M9CqJAmsvxcUswEm
9reA6xv4JQdTB/HnyG7m3Ugbox1+/kfXItQVVNcdjPt9XIMUmNPpMuIw7k62q0wX
9aO+J4OvR+uWqjuWXddvhN/j2cpI8xiiV40GPoVUUG6YMczz94TobTm02EylYMNw
fP/CoAXET5y1bmGSKMljzo0lzn0lSs70UoLgy9KaUXcBYZb9EvyNW9/SRq9Bf+hn
uC2T4TsBhFlb+IFaDPdcKMuXy1bzsL6Idx1i4NlQVSQ/4mc2z731T6LAvwnAxB8I
zgeUToWMY3rWQ93NroqjhLWazAR0H7ulpnQNeM/bHYykKE1zG4mlcZvzWctV86Bi
GZBOmWbaRd0/dzlUdaaem99HkdZOEl0hJcKu7k8f7pxHvElEIYzUOINV5t3jmGnJ
GEg9kVb73sNWqCp8VnrHebOkC9Q7Z45akMy9MwYQoe6f3aNGDjdJqyyT6wxhgOd8
U6s8E6n4WuZ9EtVb1Dey0hIHwcHv7g9EgcpCSmqwewVr1rZmohIIoUz5zU7UV0CA
uZbFin7D2xup7rMwd2tVFqy/k5E6cc60+KtvwSMa4mWNux3A4toGjH0P6cvZC19E
dBTp2Q+IK4wn0LCfC/M3NIcFsOSBZIceWUNdP/uUkqbuurXuYhxPRuhetoEFDuWq
tI83H9ovdjagsRfDde5y
=cLR9
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3466-1
October 26, 2017
systemd vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 17.04
Summary:
systemd could be made to temporarily stop responding if it received
specially crafted network traffic.
Software Description:
- systemd: system and service manager
Details:
Karim Hossen & Thomas Imbert discovered that systemd-resolved incorrectly
handled certain DNS responses. A remote attacker could possibly use this
issue to cause systemd to temporarily stop responding, resulting in a
denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
systemd 234-2ubuntu12.1
Ubuntu 17.04:
systemd 232-21ubuntu7.1
In general, a standard system update will make all the necessary changes.
References:
https://www.ubuntu.com/usn/usn-3466-1
CVE-2017-15908
Package Information:
https://launchpad.net/ubuntu/+source/systemd/234-2ubuntu12.1
https://launchpad.net/ubuntu/+source/systemd/232-21ubuntu7.1
Version: GnuPG v2
iQIcBAEBCgAGBQJZ8jHnAAoJEGVp2FWnRL6TsoMQAI5AOY46M9CqJAmsvxcUswEm
9reA6xv4JQdTB/HnyG7m3Ugbox1+/kfXItQVVNcdjPt9XIMUmNPpMuIw7k62q0wX
9aO+J4OvR+uWqjuWXddvhN/j2cpI8xiiV40GPoVUUG6YMczz94TobTm02EylYMNw
fP/CoAXET5y1bmGSKMljzo0lzn0lSs70UoLgy9KaUXcBYZb9EvyNW9/SRq9Bf+hn
uC2T4TsBhFlb+IFaDPdcKMuXy1bzsL6Idx1i4NlQVSQ/4mc2z731T6LAvwnAxB8I
zgeUToWMY3rWQ93NroqjhLWazAR0H7ulpnQNeM/bHYykKE1zG4mlcZvzWctV86Bi
GZBOmWbaRd0/dzlUdaaem99HkdZOEl0hJcKu7k8f7pxHvElEIYzUOINV5t3jmGnJ
GEg9kVb73sNWqCp8VnrHebOkC9Q7Z45akMy9MwYQoe6f3aNGDjdJqyyT6wxhgOd8
U6s8E6n4WuZ9EtVb1Dey0hIHwcHv7g9EgcpCSmqwewVr1rZmohIIoUz5zU7UV0CA
uZbFin7D2xup7rMwd2tVFqy/k5E6cc60+KtvwSMa4mWNux3A4toGjH0P6cvZC19E
dBTp2Q+IK4wn0LCfC/M3NIcFsOSBZIceWUNdP/uUkqbuurXuYhxPRuhetoEFDuWq
tI83H9ovdjagsRfDde5y
=cLR9
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3466-1
October 26, 2017
systemd vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 17.04
Summary:
systemd could be made to temporarily stop responding if it received
specially crafted network traffic.
Software Description:
- systemd: system and service manager
Details:
Karim Hossen & Thomas Imbert discovered that systemd-resolved incorrectly
handled certain DNS responses. A remote attacker could possibly use this
issue to cause systemd to temporarily stop responding, resulting in a
denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
systemd 234-2ubuntu12.1
Ubuntu 17.04:
systemd 232-21ubuntu7.1
In general, a standard system update will make all the necessary changes.
References:
https://www.ubuntu.com/usn/usn-3466-1
CVE-2017-15908
Package Information:
https://launchpad.net/ubuntu/+source/systemd/234-2ubuntu12.1
https://launchpad.net/ubuntu/+source/systemd/232-21ubuntu7.1
[USN-3465-1] Irssi vulnerabilities
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCgAGBQJZ8jHMAAoJEGVp2FWnRL6T+hQQAI5x4RYRZvF/e+3w1H6MA2lz
jRUnVPWq8fL1NcBrD7NGt8ECgrVGhXrzm42I7zaSDRApu5OGS4DnfVoNdbWvG5eQ
NcKUvdFJyguQKCEbEzHUUqnD7fodBYicuK0RvnOgAJFlMWHy7jl77fNZnWSbZXkM
xqRw/mgytg2yGR6GZUKRYfLdmVfR6D+5t6HZl1sAO/eQxIXC6SCklIWh3HrCPl5G
zqHQm4kq00DNMimPi6WrMEavXOpXG8lfyt/cd1fo5+f7QBFQ4tSnS/bcwNAJa8UV
RWtzd5Sp8CuBuvhMMbVE+YuXAC8YECkekn135XDqofYMUxnZpTu3HSNYj1TJtcWd
OA6Kw/rj6tqnm5oFHuao+VXvexyJN/K+1oPFI8Lz3etUlSa9/VdP75vL6xGUD+rR
m8bOJ6pkgAL1RHlCfJ6PMNCSX+U0E0Q349yxpESPM7yVszsfFLxlqolFP8LR2LyH
izlgl2Q6KqRfovn0CYXaDn1fuGD7TAHgTPXg1V9Xaciqr74lX7MXx7+Q94Zv4zd1
WqJw2TCxvFiWC1WKldgunlqdg5me7Iqe1Ye+sW6BS4nE1tSpZEHJSXINDaRwGw+e
Ql7cZGca533Gngr0l+GXBkLsal1B7yiGH3OwwtMJmN0JsN78RbGh4Ry/8R4Ew5LM
ihncHR2OjtC7poRTDlmz
=Dxmd
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3465-1
October 26, 2017
irssi vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Irssi.
Software Description:
- irssi: terminal based IRC client
Details:
Brian Carpenter discovered that Irssi incorrectly handled messages with
invalid time stamps. A malicious IRC server could use this issue to cause
Irssi to crash, resulting in a denial of service. (CVE-2017-10965)
Brian Carpenter discovered that Irssi incorrectly handled the internal nick
list. A malicious IRC server could use this issue to cause Irssi to crash,
resulting in a denial of service. (CVE-2017-10966)
Joseph Bisch discovered that Irssi incorrectly removed destroyed channels
from the query list. A malicious IRC server could use this issue to cause
Irssi to crash, resulting in a denial of service. (CVE-2017-15227)
Hanno Böck discovered that Irssi incorrectly handled themes. If a user were
tricked into using a malicious theme, a attacker could use this issue to
cause Irssi to crash, resulting in a denial of service. (CVE-2017-15228)
Joseph Bisch discovered that Irssi incorrectly handled certain DCC CTCP
messages. A malicious IRC server could use this issue to cause Irssi to
crash, resulting in a denial of service. (CVE-2017-15721)
Joseph Bisch discovered that Irssi incorrectly handled certain channel IDs.
A malicious IRC server could use this issue to cause Irssi to crash,
resulting in a denial of service. (CVE-2017-15722)
Joseph Bisch discovered that Irssi incorrectly handled certain long nicks
or targets. A malicious IRC server could use this issue to cause Irssi to
crash, resulting in a denial of service. (CVE-2017-15723)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
irssi 1.0.4-1ubuntu2.1
Ubuntu 17.04:
irssi 0.8.20-2ubuntu2.2
Ubuntu 16.04 LTS:
irssi 0.8.19-1ubuntu1.5
Ubuntu 14.04 LTS:
irssi 0.8.15-5ubuntu3.3
After a standard system update you need to restart Irssi to make all the
necessary changes.
References:
https://www.ubuntu.com/usn/usn-3465-1
CVE-2017-10965, CVE-2017-10966, CVE-2017-15227, CVE-2017-15228,
CVE-2017-15721, CVE-2017-15722, CVE-2017-15723
Package Information:
https://launchpad.net/ubuntu/+source/irssi/1.0.4-1ubuntu2.1
https://launchpad.net/ubuntu/+source/irssi/0.8.20-2ubuntu2.2
https://launchpad.net/ubuntu/+source/irssi/0.8.19-1ubuntu1.5
https://launchpad.net/ubuntu/+source/irssi/0.8.15-5ubuntu3.3
Version: GnuPG v2
iQIcBAEBCgAGBQJZ8jHMAAoJEGVp2FWnRL6T+hQQAI5x4RYRZvF/e+3w1H6MA2lz
jRUnVPWq8fL1NcBrD7NGt8ECgrVGhXrzm42I7zaSDRApu5OGS4DnfVoNdbWvG5eQ
NcKUvdFJyguQKCEbEzHUUqnD7fodBYicuK0RvnOgAJFlMWHy7jl77fNZnWSbZXkM
xqRw/mgytg2yGR6GZUKRYfLdmVfR6D+5t6HZl1sAO/eQxIXC6SCklIWh3HrCPl5G
zqHQm4kq00DNMimPi6WrMEavXOpXG8lfyt/cd1fo5+f7QBFQ4tSnS/bcwNAJa8UV
RWtzd5Sp8CuBuvhMMbVE+YuXAC8YECkekn135XDqofYMUxnZpTu3HSNYj1TJtcWd
OA6Kw/rj6tqnm5oFHuao+VXvexyJN/K+1oPFI8Lz3etUlSa9/VdP75vL6xGUD+rR
m8bOJ6pkgAL1RHlCfJ6PMNCSX+U0E0Q349yxpESPM7yVszsfFLxlqolFP8LR2LyH
izlgl2Q6KqRfovn0CYXaDn1fuGD7TAHgTPXg1V9Xaciqr74lX7MXx7+Q94Zv4zd1
WqJw2TCxvFiWC1WKldgunlqdg5me7Iqe1Ye+sW6BS4nE1tSpZEHJSXINDaRwGw+e
Ql7cZGca533Gngr0l+GXBkLsal1B7yiGH3OwwtMJmN0JsN78RbGh4Ry/8R4Ew5LM
ihncHR2OjtC7poRTDlmz
=Dxmd
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3465-1
October 26, 2017
irssi vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Irssi.
Software Description:
- irssi: terminal based IRC client
Details:
Brian Carpenter discovered that Irssi incorrectly handled messages with
invalid time stamps. A malicious IRC server could use this issue to cause
Irssi to crash, resulting in a denial of service. (CVE-2017-10965)
Brian Carpenter discovered that Irssi incorrectly handled the internal nick
list. A malicious IRC server could use this issue to cause Irssi to crash,
resulting in a denial of service. (CVE-2017-10966)
Joseph Bisch discovered that Irssi incorrectly removed destroyed channels
from the query list. A malicious IRC server could use this issue to cause
Irssi to crash, resulting in a denial of service. (CVE-2017-15227)
Hanno Böck discovered that Irssi incorrectly handled themes. If a user were
tricked into using a malicious theme, a attacker could use this issue to
cause Irssi to crash, resulting in a denial of service. (CVE-2017-15228)
Joseph Bisch discovered that Irssi incorrectly handled certain DCC CTCP
messages. A malicious IRC server could use this issue to cause Irssi to
crash, resulting in a denial of service. (CVE-2017-15721)
Joseph Bisch discovered that Irssi incorrectly handled certain channel IDs.
A malicious IRC server could use this issue to cause Irssi to crash,
resulting in a denial of service. (CVE-2017-15722)
Joseph Bisch discovered that Irssi incorrectly handled certain long nicks
or targets. A malicious IRC server could use this issue to cause Irssi to
crash, resulting in a denial of service. (CVE-2017-15723)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
irssi 1.0.4-1ubuntu2.1
Ubuntu 17.04:
irssi 0.8.20-2ubuntu2.2
Ubuntu 16.04 LTS:
irssi 0.8.19-1ubuntu1.5
Ubuntu 14.04 LTS:
irssi 0.8.15-5ubuntu3.3
After a standard system update you need to restart Irssi to make all the
necessary changes.
References:
https://www.ubuntu.com/usn/usn-3465-1
CVE-2017-10965, CVE-2017-10966, CVE-2017-15227, CVE-2017-15228,
CVE-2017-15721, CVE-2017-15722, CVE-2017-15723
Package Information:
https://launchpad.net/ubuntu/+source/irssi/1.0.4-1ubuntu2.1
https://launchpad.net/ubuntu/+source/irssi/0.8.20-2ubuntu2.2
https://launchpad.net/ubuntu/+source/irssi/0.8.19-1ubuntu1.5
https://launchpad.net/ubuntu/+source/irssi/0.8.15-5ubuntu3.3
[USN-3464-1] Wget vulnerabilities
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCgAGBQJZ8jG2AAoJEGVp2FWnRL6T3bQQALy+RfKyapjfJw4rqPpPa2OS
Unq5rSYDcTQDisGIeZ9//yqUtssVvGsEV3i0LZQmAi+SL+vawfxhQRjuRWtp9Wwc
UZ8zDrJbFVtblB9NiZQ1byn3RPINM8FWT0z7awcp4lPfvNlxx4InbeK4Xwakn/WS
dWngtZ2v0hGBK3GAqb5HSifPi2M8ioWi6+ANruSzMl4qBEF/dZ7qpkLiu3JC9vqm
H9rHef9cG7igkFB7WLOkVLeTGSMR38O4APuCvH8LEeif4RgxTKcotPo4GkNROE24
nD3XM73b8mr8yz140VRHZf1aQ2EsE6NNIlC/pRIWMqE77OUKIirZ7M1evaEWdRNe
ma2ZGZ6wp4u2july+Ci2pcMePh+pu4U634vw1ExQglZnespJA9J9V0igBOJXPKRI
dMDFdaVV6g+lnKmXO17AnWJGyf7piLQWUFsYBQ5rH5RL7/Vt5S1t8gOhdEcIWZED
S6Ve3EFWBR1fy/9Z2yZju4iYOWMAczxqDdAQwkyj1m/F5qGxh7kYFa9M/FPTpGPw
NS7VOq5xgHlccMst/13sDlGZQPozTXmTHfpgNvry8/KvZyyhbvD2O5f7zIVwcFfU
BOpfvzVXacp1GP7xGQtgWqAA1yi0RiXFS1B5Ny+3QxW/vt7NocAqZvw+/Q4IdayP
odwwsB50WMZMs41OOUFg
=PnJD
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3464-1
October 26, 2017
wget vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Wget.
Software Description:
- wget: retrieves files from the web
Details:
Antti Levomäki, Christian Jalio, and Joonas Pihlaja discovered that Wget
incorrectly handled certain HTTP responses. A remote attacker could use
this issue to cause Wget to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2017-13089, CVE-2017-13090)
Dawid Golunski discovered that Wget incorrectly handled recursive or
mirroring mode. A remote attacker could possibly use this issue to bypass
intended access list restrictions. (CVE-2016-7098)
Orange Tsai discovered that Wget incorrectly handled CRLF sequences in
HTTP headers. A remote attacker could possibly use this issue to inject
arbitrary HTTP headers. (CVE-2017-6508)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
wget 1.19.1-3ubuntu1.1
Ubuntu 17.04:
wget 1.18-2ubuntu1.1
Ubuntu 16.04 LTS:
wget 1.17.1-1ubuntu1.3
Ubuntu 14.04 LTS:
wget 1.15-1ubuntu1.14.04.3
In general, a standard system update will make all the necessary changes.
References:
https://www.ubuntu.com/usn/usn-3464-1
CVE-2016-7098, CVE-2017-13089, CVE-2017-13090, CVE-2017-6508
Package Information:
https://launchpad.net/ubuntu/+source/wget/1.19.1-3ubuntu1.1
https://launchpad.net/ubuntu/+source/wget/1.18-2ubuntu1.1
https://launchpad.net/ubuntu/+source/wget/1.17.1-1ubuntu1.3
https://launchpad.net/ubuntu/+source/wget/1.15-1ubuntu1.14.04.3
Version: GnuPG v2
iQIcBAEBCgAGBQJZ8jG2AAoJEGVp2FWnRL6T3bQQALy+RfKyapjfJw4rqPpPa2OS
Unq5rSYDcTQDisGIeZ9//yqUtssVvGsEV3i0LZQmAi+SL+vawfxhQRjuRWtp9Wwc
UZ8zDrJbFVtblB9NiZQ1byn3RPINM8FWT0z7awcp4lPfvNlxx4InbeK4Xwakn/WS
dWngtZ2v0hGBK3GAqb5HSifPi2M8ioWi6+ANruSzMl4qBEF/dZ7qpkLiu3JC9vqm
H9rHef9cG7igkFB7WLOkVLeTGSMR38O4APuCvH8LEeif4RgxTKcotPo4GkNROE24
nD3XM73b8mr8yz140VRHZf1aQ2EsE6NNIlC/pRIWMqE77OUKIirZ7M1evaEWdRNe
ma2ZGZ6wp4u2july+Ci2pcMePh+pu4U634vw1ExQglZnespJA9J9V0igBOJXPKRI
dMDFdaVV6g+lnKmXO17AnWJGyf7piLQWUFsYBQ5rH5RL7/Vt5S1t8gOhdEcIWZED
S6Ve3EFWBR1fy/9Z2yZju4iYOWMAczxqDdAQwkyj1m/F5qGxh7kYFa9M/FPTpGPw
NS7VOq5xgHlccMst/13sDlGZQPozTXmTHfpgNvry8/KvZyyhbvD2O5f7zIVwcFfU
BOpfvzVXacp1GP7xGQtgWqAA1yi0RiXFS1B5Ny+3QxW/vt7NocAqZvw+/Q4IdayP
odwwsB50WMZMs41OOUFg
=PnJD
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3464-1
October 26, 2017
wget vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Wget.
Software Description:
- wget: retrieves files from the web
Details:
Antti Levomäki, Christian Jalio, and Joonas Pihlaja discovered that Wget
incorrectly handled certain HTTP responses. A remote attacker could use
this issue to cause Wget to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2017-13089, CVE-2017-13090)
Dawid Golunski discovered that Wget incorrectly handled recursive or
mirroring mode. A remote attacker could possibly use this issue to bypass
intended access list restrictions. (CVE-2016-7098)
Orange Tsai discovered that Wget incorrectly handled CRLF sequences in
HTTP headers. A remote attacker could possibly use this issue to inject
arbitrary HTTP headers. (CVE-2017-6508)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
wget 1.19.1-3ubuntu1.1
Ubuntu 17.04:
wget 1.18-2ubuntu1.1
Ubuntu 16.04 LTS:
wget 1.17.1-1ubuntu1.3
Ubuntu 14.04 LTS:
wget 1.15-1ubuntu1.14.04.3
In general, a standard system update will make all the necessary changes.
References:
https://www.ubuntu.com/usn/usn-3464-1
CVE-2016-7098, CVE-2017-13089, CVE-2017-13090, CVE-2017-6508
Package Information:
https://launchpad.net/ubuntu/+source/wget/1.19.1-3ubuntu1.1
https://launchpad.net/ubuntu/+source/wget/1.18-2ubuntu1.1
https://launchpad.net/ubuntu/+source/wget/1.17.1-1ubuntu1.3
https://launchpad.net/ubuntu/+source/wget/1.15-1ubuntu1.14.04.3
F28 System Wide Change: NSS Default File Format SQL
= System Wide Change: NSS Default File Format SQL =
https://fedoraproject.org/wiki/Changes/NSSDefaultFileFormatSql
Change owner(s):
* Kai Engert <kaie@redhat.com>
Change the NSS library default to use the sqlite based data storage,
when applications don't specify their preferred storage file format.
== Detailed Description ==
Applications that use the NSS library often use a database for storage
of keys, certificates and trust. NSS supports two different file
formats, one called DBM (based on berkeley DB files) and another one
called SQL (based on sqlite DB files).
Today's default file format used by NSS, used when applications omit
the type parameter, is the older DBM file format, which forbids
parallel access to the storage. The suggestion is to change the
default file format to SQL, which allows parallel access to the
storage.
Applications, or users using the NSS command line utilities, often
provide the database storage location using a simple directory path
parameter. Some might not be aware, or forget, that the parameter can
be prefixed with a type modifier, either "dbm:" or "sql:".
As a result, when not providing this parameter, the file format used
will be the fragile DBM file format. This is particuarly problematic,
if a user attempts to modify the NSS storage using command line tools,
while another process, such as a daemon, is running concurrently,
which also accesses the same database in the DBM file format. This
often results in corrupted database storage, which cannot be
recovered.
By changing the default, all applications that currently use the DBM
file format, will automatically be migrated to the SQL file format.
NSS has the ability to discover if a storage location (a directory)
contains the DBM file format. If configured to use the modern SQL
format, NSS will automatically perform a one-time conversion from the
DBM to the SQL format.
The same applies to the NSS command line utilities. If the NSS library
default is changed to SQL, the NSS tools will also trigger the
one-time conversion, or access the already converted files.
== Scope ==
* Proposal owners:
A small downstream patch needs to be applied to the NSS library
package, which changes the library default.
* Other developers:
It's up to developers of NSS applications, if they accept the new
default and an automatic conversion, or if they prefer to continue to
use the classic DBM storage format. Although not recommended,
developers can easily do so, by adding a "dbm:" prefix to the storage
parameter they provide to NSS at NSS library initialization time.
* Release engineering: [1]
No help should be necessary. No mass rebuild necessary.
* Policies and guidelines: N/A
* Trademark approval: N/A
[1] https://pagure.io/releng/issue/6883
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
https://fedoraproject.org/wiki/Changes/NSSDefaultFileFormatSql
Change owner(s):
* Kai Engert <kaie@redhat.com>
Change the NSS library default to use the sqlite based data storage,
when applications don't specify their preferred storage file format.
== Detailed Description ==
Applications that use the NSS library often use a database for storage
of keys, certificates and trust. NSS supports two different file
formats, one called DBM (based on berkeley DB files) and another one
called SQL (based on sqlite DB files).
Today's default file format used by NSS, used when applications omit
the type parameter, is the older DBM file format, which forbids
parallel access to the storage. The suggestion is to change the
default file format to SQL, which allows parallel access to the
storage.
Applications, or users using the NSS command line utilities, often
provide the database storage location using a simple directory path
parameter. Some might not be aware, or forget, that the parameter can
be prefixed with a type modifier, either "dbm:" or "sql:".
As a result, when not providing this parameter, the file format used
will be the fragile DBM file format. This is particuarly problematic,
if a user attempts to modify the NSS storage using command line tools,
while another process, such as a daemon, is running concurrently,
which also accesses the same database in the DBM file format. This
often results in corrupted database storage, which cannot be
recovered.
By changing the default, all applications that currently use the DBM
file format, will automatically be migrated to the SQL file format.
NSS has the ability to discover if a storage location (a directory)
contains the DBM file format. If configured to use the modern SQL
format, NSS will automatically perform a one-time conversion from the
DBM to the SQL format.
The same applies to the NSS command line utilities. If the NSS library
default is changed to SQL, the NSS tools will also trigger the
one-time conversion, or access the already converted files.
== Scope ==
* Proposal owners:
A small downstream patch needs to be applied to the NSS library
package, which changes the library default.
* Other developers:
It's up to developers of NSS applications, if they accept the new
default and an automatic conversion, or if they prefer to continue to
use the classic DBM storage format. Although not recommended,
developers can easily do so, by adding a "dbm:" prefix to the storage
parameter they provide to NSS at NSS library initialization time.
* Release engineering: [1]
No help should be necessary. No mass rebuild necessary.
* Policies and guidelines: N/A
* Trademark approval: N/A
[1] https://pagure.io/releng/issue/6883
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
[CentOS-announce] CESA-2017:3071 Moderate CentOS 6 ntp Security Update
CentOS Errata and Security Advisory 2017:3071 Moderate
Upstream details at : https://access.redhat.com/errata/RHSA-2017:3071
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
e2dc7d323fdff02674abf27c51cba5cd3bf2b9c9185851bc003ca2cb61234d0a ntp-4.2.6p5-12.el6.centos.1.i686.rpm
158ab373f5d0392f4e3168fc548d889218036ca71e3612c22fd655343a834dac ntpdate-4.2.6p5-12.el6.centos.1.i686.rpm
98157086964064a8175b71c4b70121a4109802cf5678b17b70c10e650d0b043d ntp-doc-4.2.6p5-12.el6.centos.1.noarch.rpm
bb7742afa687e7d0d0d2031d8dbfc938e1a239a65cc1d51da35d5321113688dc ntp-perl-4.2.6p5-12.el6.centos.1.i686.rpm
x86_64:
b90705825a7665764895b2b0f5f0fa253f3cd8053f7ba4e4bf22ea0eb60ad119 ntp-4.2.6p5-12.el6.centos.1.x86_64.rpm
5383d9b247aa508f0d02fa89e11e2e8a3760537f680d0323abd9af544d16d3e5 ntpdate-4.2.6p5-12.el6.centos.1.x86_64.rpm
98157086964064a8175b71c4b70121a4109802cf5678b17b70c10e650d0b043d ntp-doc-4.2.6p5-12.el6.centos.1.noarch.rpm
43f5fbf0dc6b734fca4848fc47bae07ff975b24929c8ad160383ed68dedcadce ntp-perl-4.2.6p5-12.el6.centos.1.x86_64.rpm
Source:
ad6efac5d8fa6c0476a3c2e19ef9e4660ba834bf7a411b668f05346167a5f483 ntp-4.2.6p5-12.el6.centos.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHSA-2017:3071
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
e2dc7d323fdff02674abf27c51cba5cd3bf2b9c9185851bc003ca2cb61234d0a ntp-4.2.6p5-12.el6.centos.1.i686.rpm
158ab373f5d0392f4e3168fc548d889218036ca71e3612c22fd655343a834dac ntpdate-4.2.6p5-12.el6.centos.1.i686.rpm
98157086964064a8175b71c4b70121a4109802cf5678b17b70c10e650d0b043d ntp-doc-4.2.6p5-12.el6.centos.1.noarch.rpm
bb7742afa687e7d0d0d2031d8dbfc938e1a239a65cc1d51da35d5321113688dc ntp-perl-4.2.6p5-12.el6.centos.1.i686.rpm
x86_64:
b90705825a7665764895b2b0f5f0fa253f3cd8053f7ba4e4bf22ea0eb60ad119 ntp-4.2.6p5-12.el6.centos.1.x86_64.rpm
5383d9b247aa508f0d02fa89e11e2e8a3760537f680d0323abd9af544d16d3e5 ntpdate-4.2.6p5-12.el6.centos.1.x86_64.rpm
98157086964064a8175b71c4b70121a4109802cf5678b17b70c10e650d0b043d ntp-doc-4.2.6p5-12.el6.centos.1.noarch.rpm
43f5fbf0dc6b734fca4848fc47bae07ff975b24929c8ad160383ed68dedcadce ntp-perl-4.2.6p5-12.el6.centos.1.x86_64.rpm
Source:
ad6efac5d8fa6c0476a3c2e19ef9e4660ba834bf7a411b668f05346167a5f483 ntp-4.2.6p5-12.el6.centos.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Wednesday, October 25, 2017
[USN-3463-1] Werkzeug vulnerability
==========================================================================
Ubuntu Security Notice USN-3463-1
October 25, 2017
python-werkzeug vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Werkzeug could be made to run arbitrary code if it opened a
specially crafted file.
Software Description:
- python-werkzeug: collection of utilities for WSGI applications
Details:
It was discovered that Werkzeug did not properly handle certain
web scripts. A remote attacker could use this to inject arbitrary
code via a field that contains an exception message.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
python-werkzeug 0.10.4+dfsg1-1ubuntu1.1
python3-werkzeug 0.10.4+dfsg1-1ubuntu1.1
Ubuntu 14.04 LTS:
python-werkzeug 0.9.4+dfsg-1.1ubuntu2.1
python3-werkzeug 0.9.4+dfsg-1.1ubuntu2.1
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3463-1
CVE-2016-10516
Package Information:
https://launchpad.net/ubuntu/+source/python-werkzeug/0.10.4+dfsg1-1ub
untu1.1
https://launchpad.net/ubuntu/+source/python-werkzeug/0.9.4+dfsg-1.1ub
untu2.1
Ubuntu Security Notice USN-3463-1
October 25, 2017
python-werkzeug vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Werkzeug could be made to run arbitrary code if it opened a
specially crafted file.
Software Description:
- python-werkzeug: collection of utilities for WSGI applications
Details:
It was discovered that Werkzeug did not properly handle certain
web scripts. A remote attacker could use this to inject arbitrary
code via a field that contains an exception message.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
python-werkzeug 0.10.4+dfsg1-1ubuntu1.1
python3-werkzeug 0.10.4+dfsg1-1ubuntu1.1
Ubuntu 14.04 LTS:
python-werkzeug 0.9.4+dfsg-1.1ubuntu2.1
python3-werkzeug 0.9.4+dfsg-1.1ubuntu2.1
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3463-1
CVE-2016-10516
Package Information:
https://launchpad.net/ubuntu/+source/python-werkzeug/0.10.4+dfsg1-1ub
untu1.1
https://launchpad.net/ubuntu/+source/python-werkzeug/0.9.4+dfsg-1.1ub
untu2.1
[CentOS-announce] CEEA-2017:3052 CentOS 7 tzdata Enhancement Update
CentOS Errata and Enhancement Advisory 2017:3052
Upstream details at : https://access.redhat.com/errata/RHEA-2017:3052
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
c9f0d7fde7ab3952e0ba0343757b60f1477cf62074063cd9f35afeffc3d18032 tzdata-2017c-1.el7.noarch.rpm
f3dd206595a2476b7e11197263ef695d8844aaae58cbb4b39dc2a89a35ce8d7a tzdata-java-2017c-1.el7.noarch.rpm
Source:
501c2b5e270663d3803ef40654ae931e254e9fac61ef6a27a7d55faffe75cbfc tzdata-2017c-1.el7.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHEA-2017:3052
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
c9f0d7fde7ab3952e0ba0343757b60f1477cf62074063cd9f35afeffc3d18032 tzdata-2017c-1.el7.noarch.rpm
f3dd206595a2476b7e11197263ef695d8844aaae58cbb4b39dc2a89a35ce8d7a tzdata-java-2017c-1.el7.noarch.rpm
Source:
501c2b5e270663d3803ef40654ae931e254e9fac61ef6a27a7d55faffe75cbfc tzdata-2017c-1.el7.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CEEA-2017:3052 CentOS 6 tzdata Enhancement Update
CentOS Errata and Enhancement Advisory 2017:3052
Upstream details at : https://access.redhat.com/errata/RHEA-2017:3052
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
7a35a774683c1ddda053e063c7d74ad70f7da0d98b958930699f09f175e31f21 tzdata-2017c-1.el6.noarch.rpm
a5ee76588834b62c84bbd990ed5af2d69e342c161c6a08a1be0352c987068c90 tzdata-java-2017c-1.el6.noarch.rpm
x86_64:
7a35a774683c1ddda053e063c7d74ad70f7da0d98b958930699f09f175e31f21 tzdata-2017c-1.el6.noarch.rpm
a5ee76588834b62c84bbd990ed5af2d69e342c161c6a08a1be0352c987068c90 tzdata-java-2017c-1.el6.noarch.rpm
Source:
f3d624d4b5340378fb0eee2f99d9269c6847ff4487c4997afcb6e28c6a7b82be tzdata-2017c-1.el6.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHEA-2017:3052
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
7a35a774683c1ddda053e063c7d74ad70f7da0d98b958930699f09f175e31f21 tzdata-2017c-1.el6.noarch.rpm
a5ee76588834b62c84bbd990ed5af2d69e342c161c6a08a1be0352c987068c90 tzdata-java-2017c-1.el6.noarch.rpm
x86_64:
7a35a774683c1ddda053e063c7d74ad70f7da0d98b958930699f09f175e31f21 tzdata-2017c-1.el6.noarch.rpm
a5ee76588834b62c84bbd990ed5af2d69e342c161c6a08a1be0352c987068c90 tzdata-java-2017c-1.el6.noarch.rpm
Source:
f3d624d4b5340378fb0eee2f99d9269c6847ff4487c4997afcb6e28c6a7b82be tzdata-2017c-1.el6.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Tuesday, October 24, 2017
[USN-3425-2] Apache HTTP Server vulnerability
==========================================================================
Ubuntu Security Notice USN-3425-2
October 24, 2017
apache2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Apache HTTP Server could be made to expose sensitive information over
the network.
Software Description:
- apache2: Apache HTTP server
Details:
USN-3425-1 fixed a vulnerability in Apache HTTP Server. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Hanno Böck discovered that the Apache HTTP Server incorrectly handled
Limit directives in .htaccess files. In certain configurations, a
remote attacker could possibly use this issue to read arbitrary server
memory, including sensitive information. This issue is known as
Optionsbleed.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
apache2.2-bin 2.2.22-1ubuntu1.14
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3425-2
https://www.ubuntu.com/usn/usn-3425-1
CVE-2017-9798
Ubuntu Security Notice USN-3425-2
October 24, 2017
apache2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Apache HTTP Server could be made to expose sensitive information over
the network.
Software Description:
- apache2: Apache HTTP server
Details:
USN-3425-1 fixed a vulnerability in Apache HTTP Server. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Hanno Böck discovered that the Apache HTTP Server incorrectly handled
Limit directives in .htaccess files. In certain configurations, a
remote attacker could possibly use this issue to read arbitrary server
memory, including sensitive information. This issue is known as
Optionsbleed.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
apache2.2-bin 2.2.22-1ubuntu1.14
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3425-2
https://www.ubuntu.com/usn/usn-3425-1
CVE-2017-9798
[USN-3388-2] Subversion vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3388-2
October 24, 2017
subversion vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in Subversion.
Software Description:
- subversion: Advanced version control system
Details:
USN-3388-1 fixed several vulnerabilities in Subversion. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Ivan Zhakov discovered that Subversion did not properly handle
some requests. A remote attacker could use this to cause a
denial of service. (CVE-2016-2168)
Original advisory details:
Joern Schneeweisz discovered that Subversion did not properly handle
host names in 'svn+ssh://' URLs. A remote attacker could use this
to construct a subversion repository that when accessed could run
arbitrary code with the privileges of the user. (CVE-2017-9800)
Daniel Shahaf and James McCoy discovered that Subversion did not
properly verify realms when using Cyrus SASL authentication. A
remote attacker could use this to possibly bypass intended access
restrictions. (CVE-2016-2167)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
libapache2-svn 1.6.17dfsg-3ubuntu3.7
libsvn1 1.6.17dfsg-3ubuntu3.7
subversion 1.6.17dfsg-3ubuntu3.7
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3388-2
https://www.ubuntu.com/usn/usn-3388-1
CVE-2016-2167, CVE-2016-2168, CVE-2017-9800
Ubuntu Security Notice USN-3388-2
October 24, 2017
subversion vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in Subversion.
Software Description:
- subversion: Advanced version control system
Details:
USN-3388-1 fixed several vulnerabilities in Subversion. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Ivan Zhakov discovered that Subversion did not properly handle
some requests. A remote attacker could use this to cause a
denial of service. (CVE-2016-2168)
Original advisory details:
Joern Schneeweisz discovered that Subversion did not properly handle
host names in 'svn+ssh://' URLs. A remote attacker could use this
to construct a subversion repository that when accessed could run
arbitrary code with the privileges of the user. (CVE-2017-9800)
Daniel Shahaf and James McCoy discovered that Subversion did not
properly verify realms when using Cyrus SASL authentication. A
remote attacker could use this to possibly bypass intended access
restrictions. (CVE-2016-2167)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
libapache2-svn 1.6.17dfsg-3ubuntu3.7
libsvn1 1.6.17dfsg-3ubuntu3.7
subversion 1.6.17dfsg-3ubuntu3.7
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3388-2
https://www.ubuntu.com/usn/usn-3388-1
CVE-2016-2167, CVE-2016-2168, CVE-2017-9800
[USN-3411-2] Bazaar vulnerability
==========================================================================
Ubuntu Security Notice USN-3411-2
October 24, 2017
bzr vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Bazaar could be made run programs as your login if it opened a
specially crafted URL.
Software Description:
- bzr: easy to use distributed version control system
Details:
USN-3411-1 fixed a vulnerability in Bazaar. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Adam Collard discovered that Bazaar did not properly handle host names
in 'bzr+ssh://' URLs. A remote attacker could use this to construct
a bazaar repository URL that when accessed could run arbitrary code
with the privileges of the user.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
bzr 2.5.1-0ubuntu2.1
python-bzrlib 2.5.1-0ubuntu2.1
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3411-2
https://www.ubuntu.com/usn/usn-3411-1
CVE-2017-14176
Ubuntu Security Notice USN-3411-2
October 24, 2017
bzr vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Bazaar could be made run programs as your login if it opened a
specially crafted URL.
Software Description:
- bzr: easy to use distributed version control system
Details:
USN-3411-1 fixed a vulnerability in Bazaar. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Adam Collard discovered that Bazaar did not properly handle host names
in 'bzr+ssh://' URLs. A remote attacker could use this to construct
a bazaar repository URL that when accessed could run arbitrary code
with the privileges of the user.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
bzr 2.5.1-0ubuntu2.1
python-bzrlib 2.5.1-0ubuntu2.1
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3411-2
https://www.ubuntu.com/usn/usn-3411-1
CVE-2017-14176
Heads Up - openssl makefile and scripts for creating self signed certificates
I was asked here to merge pull request that moves the openssl makefile
and scripts for creating self signed certificates to /usr/share/doc.
I am not sure this is the right thing to do as these are definitely
still used currently.
Although it is much easier now to set up proper certificates for your
servers with Let's Encrypt, it is still not fully automatable process
(it needs at least some set up at the beginning for the first issued
certificate). Thus it cannot be included for example in rpm packages
%post scripts, etc.
At least I would like to know from maintainers of packages that depend
on openssl whether they currently use the makefile or the scripts to
create self signed certificate for the service.
Tomas Mraz
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
and scripts for creating self signed certificates to /usr/share/doc.
I am not sure this is the right thing to do as these are definitely
still used currently.
Although it is much easier now to set up proper certificates for your
servers with Let's Encrypt, it is still not fully automatable process
(it needs at least some set up at the beginning for the first issued
certificate). Thus it cannot be included for example in rpm packages
%post scripts, etc.
At least I would like to know from maintainers of packages that depend
on openssl whether they currently use the makefile or the scripts to
create self signed certificate for the service.
Tomas Mraz
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
[USN-3454-2] libffi vulnerability
==========================================================================
Ubuntu Security Notice USN-3454-2
October 24, 2017
libffi vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
A security issue was fixed in libffi.
Software Description:
- libffi: Foreign Function Interface library (development files, 32bit)
Details:
USN-3454-1 fixed a vulnerability in libffi. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
It was discovered that libffi incorrectly enforced an executable
stack. An attacker could possibly use this issue, in combination with
another vulnerability, to facilitate executing arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
libffi6 3.0.11~rc1-5ubuntu0.1
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3454-2
https://www.ubuntu.com/usn/usn-3454-1
CVE-2017-1000376
Ubuntu Security Notice USN-3454-2
October 24, 2017
libffi vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
A security issue was fixed in libffi.
Software Description:
- libffi: Foreign Function Interface library (development files, 32bit)
Details:
USN-3454-1 fixed a vulnerability in libffi. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
It was discovered that libffi incorrectly enforced an executable
stack. An attacker could possibly use this issue, in combination with
another vulnerability, to facilitate executing arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
libffi6 3.0.11~rc1-5ubuntu0.1
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3454-2
https://www.ubuntu.com/usn/usn-3454-1
CVE-2017-1000376
[USN-3462-1] Pacemaker vulnerabilities
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCgAGBQJZ70GeAAoJEGVp2FWnRL6TI9EP/AmyKK9Dv4qOGmfSbZktuNWm
EMq9YVCJplABq1UDeW39SnqlXNBVibNyyR7r9pemBDmsAdk46NZy1yA8ZqRxGMC6
fRpnwNWkESbbOnXiQTeiQPm9qVXLUsUeDiAaaQIOKa+Cvjb+xuAt3BNQ5wbLvCce
fs9Hz5//95TOQhoJAZLi6BHqwfH7yogXYn1/+QYz80hScFJGOZRJU+lNQHtgwnCa
uQLYWHP230gpetldK9qbYZIUBmZ1KQnYtvC79rAqwOOlZpxMbMUc1S46hYpF0nqI
c5NRlCpZx3OAzuv/SM2CIMfSe3bQvIfOQTXt73q7onetTGM8pjaKXD18qLvKgzCs
OXuZyXPbfJ/i6ZDtxpbpGWVFuyVddN9vdjsRaWONdUVbbBAXS61XVHqe4D24jv7c
zGXfUJ57NM5q7KG01FOdI7sG2vZbZpcBu2Y5t2U28BfTlfprBxJMov7j148FFY9i
95sIxhEhclNTo3n/3DiQ2jjshOiTEt/+UyeNw+dBHY8KBMcs+uimucxtsm/dphRq
fgcmyvXXQSY6TZBViqY6aIrRHE4318G9PXJmf63bdxDZVBHH2LXZUjmzIyihqK3I
xp4je+ndteESqNk+H1m/Uj1TYmHp3+uMcgoCTO00bAWYcoQ7HMYFu8gnJECpkX7W
Hu5gF+2mDX9xCtTpxYDI
=DIWV
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3462-1
October 24, 2017
pacemaker vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Pacemaker.
Software Description:
- pacemaker: Cluster resource manager
Details:
Jan Pokorný and Alain Moulle discovered that Pacemaker incorrectly handled
the IPC interface. A local attacker could possibly use this issue to
execute arbitrary code with root privileges. (CVE-2016-7035)
Alain Moulle discovered that Pacemaker incorrectly handled authentication.
A remote attacker could possibly use this issue to shut down connections,
leading to a denial of service. This issue only affected Ubuntu 16.04 LTS.
(CVE-2016-7797)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
pacemaker 1.1.14-2ubuntu1.2
Ubuntu 14.04 LTS:
pacemaker 1.1.10+git20130802-1ubuntu2.4
In general, a standard system update will make all the necessary changes.
References:
https://www.ubuntu.com/usn/usn-3462-1
CVE-2016-7035, CVE-2016-7797
Package Information:
https://launchpad.net/ubuntu/+source/pacemaker/1.1.14-2ubuntu1.2
https://launchpad.net/ubuntu/+source/pacemaker/1.1.10+git20130802-1ubuntu2.4
Version: GnuPG v2
iQIcBAEBCgAGBQJZ70GeAAoJEGVp2FWnRL6TI9EP/AmyKK9Dv4qOGmfSbZktuNWm
EMq9YVCJplABq1UDeW39SnqlXNBVibNyyR7r9pemBDmsAdk46NZy1yA8ZqRxGMC6
fRpnwNWkESbbOnXiQTeiQPm9qVXLUsUeDiAaaQIOKa+Cvjb+xuAt3BNQ5wbLvCce
fs9Hz5//95TOQhoJAZLi6BHqwfH7yogXYn1/+QYz80hScFJGOZRJU+lNQHtgwnCa
uQLYWHP230gpetldK9qbYZIUBmZ1KQnYtvC79rAqwOOlZpxMbMUc1S46hYpF0nqI
c5NRlCpZx3OAzuv/SM2CIMfSe3bQvIfOQTXt73q7onetTGM8pjaKXD18qLvKgzCs
OXuZyXPbfJ/i6ZDtxpbpGWVFuyVddN9vdjsRaWONdUVbbBAXS61XVHqe4D24jv7c
zGXfUJ57NM5q7KG01FOdI7sG2vZbZpcBu2Y5t2U28BfTlfprBxJMov7j148FFY9i
95sIxhEhclNTo3n/3DiQ2jjshOiTEt/+UyeNw+dBHY8KBMcs+uimucxtsm/dphRq
fgcmyvXXQSY6TZBViqY6aIrRHE4318G9PXJmf63bdxDZVBHH2LXZUjmzIyihqK3I
xp4je+ndteESqNk+H1m/Uj1TYmHp3+uMcgoCTO00bAWYcoQ7HMYFu8gnJECpkX7W
Hu5gF+2mDX9xCtTpxYDI
=DIWV
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3462-1
October 24, 2017
pacemaker vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Pacemaker.
Software Description:
- pacemaker: Cluster resource manager
Details:
Jan Pokorný and Alain Moulle discovered that Pacemaker incorrectly handled
the IPC interface. A local attacker could possibly use this issue to
execute arbitrary code with root privileges. (CVE-2016-7035)
Alain Moulle discovered that Pacemaker incorrectly handled authentication.
A remote attacker could possibly use this issue to shut down connections,
leading to a denial of service. This issue only affected Ubuntu 16.04 LTS.
(CVE-2016-7797)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
pacemaker 1.1.14-2ubuntu1.2
Ubuntu 14.04 LTS:
pacemaker 1.1.10+git20130802-1ubuntu2.4
In general, a standard system update will make all the necessary changes.
References:
https://www.ubuntu.com/usn/usn-3462-1
CVE-2016-7035, CVE-2016-7797
Package Information:
https://launchpad.net/ubuntu/+source/pacemaker/1.1.14-2ubuntu1.2
https://launchpad.net/ubuntu/+source/pacemaker/1.1.10+git20130802-1ubuntu2.4
Fedora 27 Final Release Readiness Meeting on Thursday, October 26 @ 19:00 UTC
Join us on irc.freenode.net in #fedora-meeting-1 for the Fedora 27
Final Release Readiness Meeting meeting.
The meeting is going to be held on Thursday, Oct 26, 2017 at 19:00
UTC. Please check the [1] link for your time zone.
We will meet to make sure we are coordinated and ready for the Final
release of Fedora 27. Please note that this meeting is going to be
held even if the release is delayed at the Go/No-Go meeting on the
same day two hours earlier.
You may received this message several times, but it is by purpose to
open this meeting to the teams and to raise awareness, so hopefully
more team representatives will come to this meeting. This meeting
works best when we have representatives from all of the teams.
For more information please check the [2] link.
[1] https://apps.fedoraproject.org/calendar/meeting/7385/
[2] https://fedoraproject.org/wiki/Release_Readiness_Meetings
Thank you for your support,
Regards, Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Final Release Readiness Meeting meeting.
The meeting is going to be held on Thursday, Oct 26, 2017 at 19:00
UTC. Please check the [1] link for your time zone.
We will meet to make sure we are coordinated and ready for the Final
release of Fedora 27. Please note that this meeting is going to be
held even if the release is delayed at the Go/No-Go meeting on the
same day two hours earlier.
You may received this message several times, but it is by purpose to
open this meeting to the teams and to raise awareness, so hopefully
more team representatives will come to this meeting. This meeting
works best when we have representatives from all of the teams.
For more information please check the [2] link.
[1] https://apps.fedoraproject.org/calendar/meeting/7385/
[2] https://fedoraproject.org/wiki/Release_Readiness_Meetings
Thank you for your support,
Regards, Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
F27 Server Beta & F27 Final Go/No-Go Meeting on Thursday, October 26th @ 17:00 UTC
Join us on irc.freenode.net in #fedora-meeting-1 for this important
meeting, wherein we shall determine the readiness of the Fedora 27
Server Beta [1] as well as Fedora 27 Final [2] releases.
The meeting is going to be held on Thursday, October 26th, 2017 at
17:00 UTC. Please check the links [1] and [2] for your time zone.
[1] https://apps.fedoraproject.org/calendar/meeting/7520/
[2] https://apps.fedoraproject.org/calendar/meeting/7386/
[3] https://qa.fedoraproject.org/blockerbugs/milestone/27/server-beta/buglist
[4] https://qa.fedoraproject.org/blockerbugs/milestone/27/final/buglist
Thank you in advance for your support.
Regards, Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
meeting, wherein we shall determine the readiness of the Fedora 27
Server Beta [1] as well as Fedora 27 Final [2] releases.
The meeting is going to be held on Thursday, October 26th, 2017 at
17:00 UTC. Please check the links [1] and [2] for your time zone.
[1] https://apps.fedoraproject.org/calendar/meeting/7520/
[2] https://apps.fedoraproject.org/calendar/meeting/7386/
[3] https://qa.fedoraproject.org/blockerbugs/milestone/27/server-beta/buglist
[4] https://qa.fedoraproject.org/blockerbugs/milestone/27/final/buglist
Thank you in advance for your support.
Regards, Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Monday, October 23, 2017
Autumn Elections 2017: Collection of questions for Questionnaire has been started
For this Election cycle [1] we are going to follow a new way how
Elections are organized. It is an outcome of a discussion on Council
level [2] trying to improve participation of the Fedora Community in
the election process.
Today we are starting collection of questions for Election
Questionnaire [3]. The collection period ends one week after the F27
Final GA date, which means there is a time at least to November 6th to
collect these questions.
For the beginning I have copied the questions from previous Election
cycle. Feel free to add more questions or modify the current questions
of the Questionnaire [3].
The full schedule of the Autumn Elections 2017 is available on the
Elections wiki page [4] and on the detailed schedule for F27 [5].
[1] https://fedoraproject.org/wiki/Elections
[2] https://pagure.io/Fedora-Council/tickets/issue/135#comment-467523
[3] https://fedoraproject.org/wiki/Elections/Questionnaire
[4] https://fedoraproject.org/wiki/Elections
[5] https://fedorapeople.org/groups/schedule/f-27/f-27-elections.html
Regards,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Elections are organized. It is an outcome of a discussion on Council
level [2] trying to improve participation of the Fedora Community in
the election process.
Today we are starting collection of questions for Election
Questionnaire [3]. The collection period ends one week after the F27
Final GA date, which means there is a time at least to November 6th to
collect these questions.
For the beginning I have copied the questions from previous Election
cycle. Feel free to add more questions or modify the current questions
of the Questionnaire [3].
The full schedule of the Autumn Elections 2017 is available on the
Elections wiki page [4] and on the detailed schedule for F27 [5].
[1] https://fedoraproject.org/wiki/Elections
[2] https://pagure.io/Fedora-Council/tickets/issue/135#comment-467523
[3] https://fedoraproject.org/wiki/Elections/Questionnaire
[4] https://fedoraproject.org/wiki/Elections
[5] https://fedorapeople.org/groups/schedule/f-27/f-27-elections.html
Regards,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
[USN-3434-2] Libidn vulnerability
==========================================================================
Ubuntu Security Notice USN-3434-2
October 23, 2017
libidn vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Libidn could be made to crash or run programs if it processed specially
crafted input.
Software Description:
- libidn: implementation of IETF IDN specifications
Details:
USN-3434-1 fixed a vulnerability in Libidn. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
It was discovered that Libidn incorrectly handled decoding certain
digits. A remote attacker could use this issue to cause Libidn to
crash, resulting in a denial of service, or possibly execute arbitrary
code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
libidn11 1.23-2ubuntu0.2
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3434-2
https://www.ubuntu.com/usn/usn-3434-1
CVE-2017-14062
Ubuntu Security Notice USN-3434-2
October 23, 2017
libidn vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Libidn could be made to crash or run programs if it processed specially
crafted input.
Software Description:
- libidn: implementation of IETF IDN specifications
Details:
USN-3434-1 fixed a vulnerability in Libidn. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
It was discovered that Libidn incorrectly handled decoding certain
digits. A remote attacker could use this issue to cause Libidn to
crash, resulting in a denial of service, or possibly execute arbitrary
code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
libidn11 1.23-2ubuntu0.2
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3434-2
https://www.ubuntu.com/usn/usn-3434-1
CVE-2017-14062
[USN-3441-2] curl vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3441-2
October 23, 2017
curl vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in curl.
Software Description:
- curl: HTTP, HTTPS, and FTP client and client libraries
Details:
USN-3441-1 fixed several vulnerabilities in curl. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Daniel Stenberg discovered that curl incorrectly handled large
floating point output. A remote attacker could use this issue to cause
curl to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2016-9586)
Even Rouault discovered that curl incorrectly handled large file names
when doing TFTP transfers. A remote attacker could use this issue to
cause curl to crash, resulting in a denial of service, or possibly
obtain sensitive memory contents. (CVE-2017-1000100)
Brian Carpenter and Yongji Ouyang discovered that curl incorrectly
handled numerical range globbing. A remote attacker could use this
issue to cause curl to crash, resulting in a denial of service, or
possibly obtain sensitive memory contents. (CVE-2017-1000101)
Max Dymond discovered that curl incorrectly handled FTP PWD responses.
A remote attacker could use this issue to cause curl to crash,
resulting in a denial of service. (CVE-2017-1000254)
Brian Carpenter discovered that curl incorrectly handled IMAP FETCH
response lines. A remote attacker could use this issue to cause curl
to crash, resulting in a denial of service, or possibly execute
arbitrary code.(CVE-2017-1000257)
Brian Carpenter discovered that curl incorrectly handled the --write-
out command line option. A local attacker could possibly use this
issue to obtain sensitive memory contents. (CVE-2017-7407)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
curl 7.22.0-3ubuntu4.18
libcurl3 7.22.0-3ubuntu4.18
libcurl3-gnutls 7.22.0-3ubuntu4.18
libcurl3-nss 7.22.0-3ubuntu4.18
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3441-2
https://www.ubuntu.com/usn/usn-3441-1
CVE-2016-9586, CVE-2017-1000100, CVE-2017-1000254, CVE-2017-1000257,
CVE-2017-7407
Ubuntu Security Notice USN-3441-2
October 23, 2017
curl vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in curl.
Software Description:
- curl: HTTP, HTTPS, and FTP client and client libraries
Details:
USN-3441-1 fixed several vulnerabilities in curl. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Daniel Stenberg discovered that curl incorrectly handled large
floating point output. A remote attacker could use this issue to cause
curl to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2016-9586)
Even Rouault discovered that curl incorrectly handled large file names
when doing TFTP transfers. A remote attacker could use this issue to
cause curl to crash, resulting in a denial of service, or possibly
obtain sensitive memory contents. (CVE-2017-1000100)
Brian Carpenter and Yongji Ouyang discovered that curl incorrectly
handled numerical range globbing. A remote attacker could use this
issue to cause curl to crash, resulting in a denial of service, or
possibly obtain sensitive memory contents. (CVE-2017-1000101)
Max Dymond discovered that curl incorrectly handled FTP PWD responses.
A remote attacker could use this issue to cause curl to crash,
resulting in a denial of service. (CVE-2017-1000254)
Brian Carpenter discovered that curl incorrectly handled IMAP FETCH
response lines. A remote attacker could use this issue to cause curl
to crash, resulting in a denial of service, or possibly execute
arbitrary code.(CVE-2017-1000257)
Brian Carpenter discovered that curl incorrectly handled the --write-
out command line option. A local attacker could possibly use this
issue to obtain sensitive memory contents. (CVE-2017-7407)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
curl 7.22.0-3ubuntu4.18
libcurl3 7.22.0-3ubuntu4.18
libcurl3-gnutls 7.22.0-3ubuntu4.18
libcurl3-nss 7.22.0-3ubuntu4.18
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3441-2
https://www.ubuntu.com/usn/usn-3441-1
CVE-2016-9586, CVE-2017-1000100, CVE-2017-1000254, CVE-2017-1000257,
CVE-2017-7407
Subscribe to:
Posts (Atom)