==========================================================================
Ubuntu Security Notice USN-2562-1
April 08, 2015
linux-lts-trusty vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
– linux-lts-trusty: Linux hardware enablement kernel from Trusty
Details:
Sun Baoliang discovered a use after free flaw in the Linux kernel’s SCTP
(Stream Control Transmission Protocol) subsystem during INIT collisions. A
remote attacker could exploit this flaw to cause a denial of service
(system crash) or potentially escalate their privileges on the system.
(CVE-2015-1421)
Marcelo Leitner discovered a flaw in the Linux kernel’s routing of packets
to too many different dsts/too fast. A remote attacker can exploit this
flaw to cause a denial of service (system crash). (CVE-2015-1465)
An integer overflow was discovered in the stack randomization feature of
the Linux kernel on 64 bit platforms. A local attacker could exploit this
flaw to bypass the Address Space Layout Randomization (ASLR) mitigation
mechanism. (CVE-2015-1593)
An information leak was discovered in the Linux kernel’s handling of
userspace configuration of the link layer control (LLC). A local user could
exploit this flaw to read data from other sysctl settings. (CVE-2015-2041)
An information leak was discovered in how the Linux kernel handles setting
the Reliable Datagram Sockets (RDS) settings. A local user could exploit
this flaw to read data from other sysctl settings. (CVE-2015-2042)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
linux-image-3.13.0-49-generic 3.13.0-49.81~precise1
linux-image-3.13.0-49-generic-lpae 3.13.0-49.81~precise1
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2562-1
CVE-2015-1421, CVE-2015-1465, CVE-2015-1593, CVE-2015-2041,
CVE-2015-2042
Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-trusty/3.13.0-49.81~precise1
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIcBAEBCgAGBQJVJbG2AAoJEAUvNnAY1cPYYgIP/2dCbCteMfH0dSPAu6xZmdj3
SqkFTUoBV89HrTZ6b1oafJBiC3GhAu+fIkdEpiE2MerxzsOwirVCkbZ4cQRiV0VN
x81Hz2ytFDHCNBq3W8Ipd1t5tL1I0L8A/ejONvzGBl1jY8iXdcjF/W6HcwrP6aDC
ylczkyM9+MEuRacFPZWP0TOj9UJB802QXmLcbc34jEMTUG4ppUkX4wGHjziSJoKX
vyKlsGdhjzIdyYzfp7F3JK09yAId2CNy6BArg9v3TQkjS9lhw0QkOicO+lRUf99d
2B73BbRmlSKYxFRLDMvkmudIYZqzS1ChE1YGeQszRv3eDvHoqcOT3/jy1SogpABL
GM9kydLMweOC3Amcue3JWs5L3Xos9BheeFAJAcrzpRMPz7eGNGJtnzqIgx7mXtBz
4BSKnZgCluKA43EZ9qOQ1KYsN+63jNnQEbcn74Q/MsXwHUh/EE2ZhdgjKPnudT/E
lvWlyz2D9ZmggD+b+xSC/HiOXKMRL+lzzxN8+h3PMRKk2Sm+n1ILYVx7z3jWURXN
YyViRZwcNpCmqiFlwU/pSTzcx8+l7AkhplmGV5LfiI8T3eJFTkEAfIhFVfRtyVkf
6ivvzIVVGdY8HWnGXabtiStz49RxC2QasTLiIYEx5/uUc0BMdgLsp2PykxbFq1iU
3IcgRPVtONdzK2EbkaXn
=ikLG
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
==========================================================================
Ubuntu Security Notice USN-2563-1
April 08, 2015
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
– linux: Linux kernel
Details:
Sun Baoliang discovered a use after free flaw in the Linux kernel’s SCTP
(Stream Control Transmission Protocol) subsystem during INIT collisions. A
remote attacker could exploit this flaw to cause a denial of service
(system crash) or potentially escalate their privileges on the system.
(CVE-2015-1421)
Marcelo Leitner discovered a flaw in the Linux kernel’s routing of packets
to too many different dsts/too fast. A remote attacker can exploit this
flaw to cause a denial of service (system crash). (CVE-2015-1465)
An integer overflow was discovered in the stack randomization feature of
the Linux kernel on 64 bit platforms. A local attacker could exploit this
flaw to bypass the Address Space Layout Randomization (ASLR) mitigation
mechanism. (CVE-2015-1593)
An information leak was discovered in the Linux kernel’s handling of
userspace configuration of the link layer control (LLC). A local user could
exploit this flaw to read data from other sysctl settings. (CVE-2015-2041)
An information leak was discovered in how the Linux kernel handles setting
the Reliable Datagram Sockets (RDS) settings. A local user could exploit
this flaw to read data from other sysctl settings. (CVE-2015-2042)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
linux-image-3.13.0-49-generic 3.13.0-49.81
linux-image-3.13.0-49-generic-lpae 3.13.0-49.81
linux-image-3.13.0-49-lowlatency 3.13.0-49.81
linux-image-3.13.0-49-powerpc-e500 3.13.0-49.81
linux-image-3.13.0-49-powerpc-e500mc 3.13.0-49.81
linux-image-3.13.0-49-powerpc-smp 3.13.0-49.81
linux-image-3.13.0-49-powerpc64-emb 3.13.0-49.81
linux-image-3.13.0-49-powerpc64-smp 3.13.0-49.81
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2563-1
CVE-2015-1421, CVE-2015-1465, CVE-2015-1593, CVE-2015-2041,
CVE-2015-2042
Package Information:
https://launchpad.net/ubuntu/+source/linux/3.13.0-49.81
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIcBAEBCgAGBQJVJbHmAAoJEAUvNnAY1cPYDvwP/1XGwHsCAf8egJsC8JAZoWWx
gQAs/xS0EeDfltVMjxl1LqrW00fe2kGXGwEHJxGOGRXtbxLcQl/mXlfhR5ObdvHs
a0V92BzJmEQ9S/MCcGN8BqBN1I4um2Wk2Vla8QLZFUpLdZblpGLXanh5wRDXV3b1
0li8NT+z6JXnE2reVPKUhPDtc4Jsgm8VLlbPH8BPug1JmTP5+CZhuPhQKnuEk4IE
WIu7BYtiUP7Eg8Xy6fRso/o1w3jFsfbnYBSLJbD3UsQxsBnMVWssv3NAVRtJd4Db
veA1YhHTvtRWPqSueaJI1iTckaUZL6tiu0/zIlVQo9MrtrDYjxzJnPLpZXoJi5aV
nhXl3jQDbP3OZhei5bOUXWRiEicyqaF/dE3qLo7RJjQ0kC+QKPx7/kizcHv0YLLH
gUsaGuWUVcJhqweQR5uu6YqRd+HOhTLxMjSep0umy1lcxX6aN2p5t/QYIx1I13cX
4hClam/EquJFasgebuDbW/nb1gRHRJNh+wx6ZBFy1oU97jX214gImiRGhQz/kVB+
z08tA/F2HwazgW/ZgPYhTtpdqTKhoElYIElVcByV8jHSIJ2rYDngLjuDRHCFr+FE
SGIY6x0C5BKef6gph8XrDmNDJ8aSwjjDuNpugMKZG3ETQAG7BAHQ2gP2UV+pNKP6
7xkXwdYG/WIk7DOi+B3O
=bSLI
—–END PGP SIGNATURE—–
—
7e
