USN-3585-1: Twisted vulnerability

twisted vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

Twisted could be made to run programs if it received specially crafted
network traffic.

Software Description

  • twisted – Event-based framework for internet applications

Details

It was discovered that Twisted incorrectly handled certain HTTP requests.
An attacker could possibly use this issue to execute arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 16.04 LTS
python-twisted16.0.0-1ubuntu0.2
python-twisted-bin16.0.0-1ubuntu0.2
python-twisted-web16.0.0-1ubuntu0.2
python3-twisted16.0.0-1ubuntu0.2
Ubuntu 14.04 LTS
python-twisted13.2.0-1ubuntu1.2
python-twisted-bin13.2.0-1ubuntu1.2
python-twisted-web13.2.0-1ubuntu1.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

Read More

LibreOffice Will (Finally) Use Native GTK Dialogs on Linux

libreoffice gtk dialog -- newThe next major release of LibreOffice will use native GTK3 dialogs on Linux desktops.  “Wait —LibreOffice doesn’t already use GTK dialogs?!” you might be asking. It was certainly my own first reaction when I opened an e-mail about the news in our tip inbox this morning (btw – thanks Dee!) Admittedly I do not use LibreOffice properly. Like, at all. […]

This post, LibreOffice Will (Finally) Use Native GTK Dialogs on Linux, was written by Joey Sneddon and first appeared on OMG! Ubuntu!.

Read More

USN-3588-1: Memcached vulnerabilities

memcached vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in Memcached.

Software Description

  • memcached – high-performance memory object caching system

Details

Daniel Shapira discovered an integer overflow issue in Memcached. A remote
attacker could use this to cause a denial of service (daemon crash).
(CVE-2017-9951)

It was discovered that Memcached listened to UDP by default. A remote
attacker could use this as part of a distributed denial of service attack.
(CVE-2018-1000115)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.10
memcached1.4.33-1ubuntu3.2
Ubuntu 16.04 LTS
memcached1.4.25-2ubuntu1.3
Ubuntu 14.04 LTS
memcached1.4.14-0ubuntu9.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

Please note that after applying this update, Memcached will no longer
listen to UDP by default. If UDP service is desired, please add
‘-U 11211’ to /etc/memcached.conf and restart the memcached service.

References

Read More

USN-3587-1: Dovecot vulnerabilities

dovecot vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in Dovecot.

Software Description

  • dovecot – IMAP and POP3 email server

Details

It was discovered that Dovecot incorrectly handled parsing certain email
addresses. A remote attacker could use this issue to cause Dovecot to
crash, resulting in a denial of service, or possibly obtain sensitive
information. (CVE-2017-14461)

It was discovered that Dovecot incorrectly handled TLS SNI config lookups.
A remote attacker could possibly use this issue to cause Dovecot to crash,
resulting in a denial of service. (CVE-2017-15130)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.10
dovecot-core1:2.2.27-3ubuntu1.3
Ubuntu 16.04 LTS
dovecot-core1:2.2.22-1ubuntu2.7
Ubuntu 14.04 LTS
dovecot-core1:2.2.9-1ubuntu2.4

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

Read More

USN-3575-2: QEMU regression

qemu regression

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

USN-3575-1 introduced a regression in QEMU.

Software Description

  • qemu – Machine emulator and virtualizer

Details

USN-3575-1 fixed vulnerabilities in QEMU. The fix for CVE-2017-11334 caused
a regression in Xen environments. This update removes the problematic fix
pending further investigation.

We apologize for the inconvenience.

Original advisory details:

It was discovered that QEMU incorrectly handled guest ram. A privileged
attacker inside the guest could use this issue to cause QEMU to crash,
resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS
and Ubuntu 16.04 LTS. (CVE-2017-11334)

David Buchanan discovered that QEMU incorrectly handled the VGA device. A
privileged attacker inside the guest could use this issue to cause QEMU to
crash, resulting in a denial of service. This issue was only addressed in
Ubuntu 17.10. (CVE-2017-13672)

Thomas Garnier discovered that QEMU incorrectly handled multiboot. An
attacker could use this issue to cause QEMU to crash, resulting in a denial
of service, or possibly execute arbitrary code on the host. In the default
installation, when QEMU is used with libvirt, attackers would be isolated
by the libvirt AppArmor profile. This issue only affected Ubuntu 14.04 LTS
and Ubuntu 16.04 LTS. (CVE-2017-14167)

Tuomas Tynkkynen discovered that QEMU incorrectly handled VirtFS directory
sharing. An attacker could use this issue to obtain sensitive information
from host memory. (CVE-2017-15038)

Eric Blake discovered that QEMU incorrectly handled memory in the
NBD server. An attacker could use this issue to cause the NBD server to
crash, resulting in a denial of service. This issue only affected Ubuntu
17.10. (CVE-2017-15118)

Eric Blake discovered that QEMU incorrectly handled certain options to the
NBD server. An attacker could use this issue to cause the NBD server to
crash, resulting in a denial of service. This issue only affected Ubuntu
14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-15119)

Daniel Berrange discovered that QEMU incorrectly handled the VNC server. A
remote attacker could possibly use this issue to consume memory, resulting
in a denial of service. This issue was only addressed in Ubuntu 17.10.
(CVE-2017-15124)

Carl Brassey discovered that QEMU incorrectly handled certain websockets. A
remote attacker could possibly use this issue to consume memory, resulting
in a denial of service. This issue only affected Ubuntu 17.10.
(CVE-2017-15268)

Guoxiang Niu discovered that QEMU incorrectly handled the Cirrus VGA
device. A privileged attacker inside the guest could use this issue to
cause QEMU to crash, resulting in a denial of service. (CVE-2017-15289)

Cyrille Chatras discovered that QEMU incorrectly handled certain PS2 values
during migration. An attacker could possibly use this issue to cause QEMU
to crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10.
(CVE-2017-16845)

It was discovered that QEMU incorrectly handled the Virtio Vring
implementation. An attacker could possibly use this issue to cause QEMU to
crash, resulting in a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 17.10. (CVE-2017-17381)

Eric Blake discovered that QEMU incorrectly handled certain rounding
operations. An attacker could possibly use this issue to cause QEMU to
crash, resulting in a denial of service. This issue only affected Ubuntu
14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-18043)

Jiang Xin and Lin ZheCheng discovered that QEMU incorrectly handled the
VGA device. A privileged attacker inside the guest could use this issue to
cause QEMU to crash, resulting in a denial of service. (CVE-2018-5683)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 16.04 LTS
qemu1:2.5+dfsg-5ubuntu10.24
Ubuntu 14.04 LTS
qemu2.0.0+dfsg-2ubuntu1.40

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.

References

Read More