Ubuntu Security Notice USN-1825-1

15th May, 2013

linux vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 12.04 LTS

Summary

The system could be made to run programs as an administrator.

Software description

• linux
  - Linux kernel
  
  

Details

An flaw was discovered in the Linux kernel's perf_events interface. A local
user could exploit this flaw to escalate privileges on the system.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 12.04 LTS:

linux-image-3.2.0-43-powerpc64-smp

3.2.0-43.68

linux-image-3.2.0-43-powerpc-smp

3.2.0-43.68

linux-image-3.2.0-43-generic-pae

3.2.0-43.68

linux-image-3.2.0-43-virtual

3.2.0-43.68

linux-image-3.2.0-43-highbank

3.2.0-43.68

linux-image-3.2.0-43-omap

3.2.0-43.68

linux-image-3.2.0-43-generic

3.2.0-43.68

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

CVE-2013-2094

Ubuntu Security Notice USN-1826-1

15th May, 2013

linux vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 12.10

Summary

The system could be made to run programs as an administrator.

Software description

• linux
  - Linux kernel
  
  

Details

An flaw was discovered in the Linux kernel's perf_events interface. A local
user could exploit this flaw to escalate privileges on the system.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 12.10:

linux-image-3.5.0-30-omap

3.5.0-30.51

linux-image-3.5.0-30-generic

3.5.0-30.51

linux-image-3.5.0-30-highbank

3.5.0-30.51

linux-image-3.5.0-30-powerpc-smp

3.5.0-30.51

linux-image-3.5.0-30-powerpc64-smp

3.5.0-30.51

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

CVE-2013-2094

Ubuntu Security Notice USN-1827-1

15th May, 2013

linux vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 13.04

Summary

The system could be made to run programs as an administrator.

Software description

• linux
  - Linux kernel
  
  

Details

An flaw was discovered in the Linux kernel's perf_events interface. A local
user could exploit this flaw to escalate privileges on the system.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 13.04:

linux-image-3.8.0-21-generic

3.8.0-21.32

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

CVE-2013-2094

Ubuntu Security Notice USN-1828-1

15th May, 2013

linux-lts-quantal vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 12.04 LTS

Summary

The system could be made to run programs as an administrator.

Software description

• linux-lts-quantal
  - Linux hardware enablement kernel from Quantal
  
  

Details

An flaw was discovered in the Linux kernel's perf_events interface. A local
user could exploit this flaw to escalate privileges on the system.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 12.04 LTS:

linux-image-3.5.0-30-generic

3.5.0-30.51~precise1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

CVE-2013-2094

Ubuntu Security Notice USN-1821-1

9th May, 2013

telepathy-idle vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 13.04



• Ubuntu 12.10



• Ubuntu 12.04 LTS

Summary

telepathy-idle could be made to expose sensitive information over the
network.

Software description

• telepathy-idle
  - IRC connection manager for Telepathy
  
  

Details

It was discovered that telepathy-idle did not perform any server
certificate validation when using SSL connections. If a remote attacker
were able to perform a man-in-the-middle attack, this flaw could be
exploited to alter or compromise confidential information.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 13.04:

telepathy-idle

0.1.14-1ubuntu0.1

Ubuntu 12.10:

telepathy-idle

0.1.12-1ubuntu0.1

Ubuntu 12.04 LTS:

telepathy-idle

0.1.11-2ubuntu0.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart your session to make all
the necessary changes.

References

CVE-2007-6746

Ubuntu Security Notice USN-1822-1

14th May, 2013

firefox vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 13.04



• Ubuntu 12.10



• Ubuntu 12.04 LTS

Summary

Firefox could be made to crash or run programs as your login if it
opened a malicious website.

Software description

• firefox
  - Mozilla Open Source web browser
  
  

Details

Multiple memory safety issues were discovered in Firefox. If the user were
tricked into opening a specially crafted page, an attacker could possibly
exploit these to cause a denial of service via application crash, or
potentially execute code with the privileges of the user invoking Firefox.
(CVE-2013-0801, CVE-2013-1669)

Cody Crews discovered that some constructors could be used to bypass
restrictions enforced by their Chrome Object Wrapper (COW). An attacker
could exploit this to conduct cross-site scripting (XSS) attacks.
(CVE-2013-1670)

It was discovered that the file input element could expose the full local
path under certain conditions. An attacker could potentially exploit this
to steal sensitive information. (CVE-2013-1671)

A use-after-free was discovered when resizing video content whilst it is
playing. An attacker could potentially exploit this to execute code with
the privileges of the user invoking Firefox. (CVE-2013-1674)

It was discovered that some DOMSVGZoomEvent functions could be used
without being properly initialized, which could lead to information
leakage. (CVE-2013-1675)

Abhishek Arya discovered multiple memory safety issues in Firefox. If
the user were tricked into opening a specially crafted page, an attacker
could possibly exploit these to cause a denial of service via application
crash, or potentially execute code with the privileges of the user
invoking Firefox. (CVE-2013-1676, CVE-2013-1677, CVE-2013-1678,
CVE-2013-1679, CVE-2013-1680, CVE-2013-1681)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 13.04:

firefox

21.0+build2-0ubuntu0.13.04.2

Ubuntu 12.10:

firefox

21.0+build2-0ubuntu0.12.10.2

Ubuntu 12.04 LTS:

firefox

21.0+build2-0ubuntu0.12.04.3

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Firefox to make
all the necessary changes.

References

CVE-2013-0801,

CVE-2013-1669,

CVE-2013-1670,

CVE-2013-1671,

CVE-2013-1674,

CVE-2013-1675,

CVE-2013-1676,

CVE-2013-1677,

CVE-2013-1678,

CVE-2013-1679,

CVE-2013-1680,

CVE-2013-1681,

LP: 1178277

Ubuntu Security Notice USN-1823-1

14th May, 2013

thunderbird vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 13.04



• Ubuntu 12.10



• Ubuntu 12.04 LTS

Summary

Several security issues were fixed in Thunderbird.

Software description

• thunderbird
  - Mozilla Open Source mail and newsgroup client
  
  

Details

Multiple memory safety issues were discovered in Thunderbird. If the user
were tricked into opening a specially crafted message with scripting
enabled, an attacker could possibly exploit these to cause a denial of
service via application crash, or potentially execute code with the
privileges of the user invoking Thunderbird. (CVE-2013-0801,
CVE-2013-1669)

Cody Crews discovered that some constructors could be used to bypass
restrictions enforced by their Chrome Object Wrapper (COW). If a user had
scripting enabled, an attacker could exploit this to conduct cross-site
scripting (XSS) attacks. (CVE-2013-1670)

A use-after-free was discovered when resizing video content whilst it is
playing. If a user had scripting enabled, an attacker could potentially
exploit this to execute code with the privileges of the user invoking
Thunderbird. (CVE-2013-1674)

It was discovered that some DOMSVGZoomEvent functions could be used
without being properly initialized, which could lead to information
leakage. (CVE-2013-1675)

Abhishek Arya discovered multiple memory safety issues in Thunderbird. If
the user were tricked into opening a specially crafted message, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of
the user invoking Thunderbird. (CVE-2013-1676, CVE-2013-1677,
CVE-2013-1678, CVE-2013-1679, CVE-2013-1680, CVE-2013-1681)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 13.04:

thunderbird

17.0.6+build1-0ubuntu0.13.04.1

Ubuntu 12.10:

thunderbird

17.0.6+build1-0ubuntu0.12.10.1

Ubuntu 12.04 LTS:

thunderbird

17.0.6+build1-0ubuntu0.12.04.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Thunderbird to make
all the necessary changes.

References

CVE-2013-0801,

CVE-2013-1669,

CVE-2013-1670,

CVE-2013-1674,

CVE-2013-1675,

CVE-2013-1676,

CVE-2013-1677,

CVE-2013-1678,

CVE-2013-1679,

CVE-2013-1680,

CVE-2013-1681,

LP: 1178649

Ubuntu Security Notice USN-1824-1

15th May, 2013

linux vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 10.04 LTS

Summary

Several security issues were fixed in the kernel.

Software description

• linux
  - Linux kernel
  
  

Details

Mathias Krause discovered an information leak in the Linux kernel's ISO
9660 CDROM file system driver. A local user could exploit this flaw to
examine some of the kernel's heap memory. (CVE-2012-6549)

Mathias Krause discovered a flaw in xfrm_user in the Linux kernel. A local
attacker with NET_ADMIN capability could potentially exploit this flaw to
escalate privileges. (CVE-2013-1826)

A buffer overflow was discovered in the Linux Kernel's USB subsystem for
devices reporting the cdc-wdm class. A specially crafted USB device when
plugged-in could cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2013-1860)

An information leak was discovered in the Linux kernel's /dev/dvb device. A
local user could exploit this flaw to obtain sensitive information from the
kernel's stack memory. (CVE-2013-1928)

An information leak in the Linux kernel's dcb netlink interface was
discovered. A local user could obtain sensitive information by examining
kernel stack memory. (CVE-2013-2634)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 10.04 LTS:

linux-image-2.6.32-47-386

2.6.32-47.109

linux-image-2.6.32-47-lpia

2.6.32-47.109

linux-image-2.6.32-47-ia64

2.6.32-47.109

linux-image-2.6.32-47-generic

2.6.32-47.109

linux-image-2.6.32-47-versatile

2.6.32-47.109

linux-image-2.6.32-47-server

2.6.32-47.109

linux-image-2.6.32-47-powerpc64-smp

2.6.32-47.109

linux-image-2.6.32-47-generic-pae

2.6.32-47.109

linux-image-2.6.32-47-powerpc-smp

2.6.32-47.109

linux-image-2.6.32-47-virtual

2.6.32-47.109

linux-image-2.6.32-47-sparc64-smp

2.6.32-47.109

linux-image-2.6.32-47-powerpc

2.6.32-47.109

linux-image-2.6.32-47-preempt

2.6.32-47.109

linux-image-2.6.32-47-sparc64

2.6.32-47.109

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References

CVE-2012-6549,

CVE-2013-1826,

CVE-2013-1860,

CVE-2013-1928,

CVE-2013-2634

Ubuntu Security Notice USN-1820-1

8th May, 2013

gpsd vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 12.04 LTS

Summary

gpsd could be made to crash or possibly run programs if it received
specially crafted input.

Software description

• gpsd
  - Global Positioning System - daemon
  
  

Details

It was discovered that gpsd incorrectly handled certain malformed GPS data.
An attacker could use this issue to cause gpsd to crash, resulting in a
denial of service, or possibly execute arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 12.04 LTS:

gpsd

3.4-2ubuntu0.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2013-2038