This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============3737132200845282512==
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature";
 boundary="KHXBjiXlrxDS6aomM6SecPKscfecspfJG"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--KHXBjiXlrxDS6aomM6SecPKscfecspfJG
Content-Type: text/plain; charset=utf-
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-2353-1
September 23, 2014

apt vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS

Summary:

APT could be made to crash or run programs if it received specially crafted
network traffic.

Software Description:
- apt: Advanced front-end for dpkg

Details:

It was discovered that APT incorrectly handled certain http URLs. If a
remote attacker were able to perform a man-in-the-middle attack, this flaw
could be exploited to cause APT to crash, resulting in a denial of service,
or possibly execute arbitrary code. (CVE-2014-6273)

In addition, this update fixes regressions introduced by the USN-2348-1
security update: APT incorrectly handled file:/// sources on a different
partition, incorrectly handled Dir::state::lists set to a relative path,
and incorrectly handled cdrom: sources.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  apt                             1.0.1ubuntu2.4.1

Ubuntu 12.04 LTS:
  apt                             0.8.16~exp12ubuntu10.20.1

Ubuntu 10.04 LTS:
  apt                             0.7.25.3ubuntu9.17.1

In general, a standard system update will make all the necessary changes.

References:
  http://www.ubuntu.com/usn/usn-2353-1
  CVE-2014-6273

Package Information:
  https://launchpad.net/ubuntu/+source/apt/1.0.1ubuntu2.4.1
  https://launchpad.net/ubuntu/+source/apt/0.8.16~exp12ubuntu10.20.1
  https://launchpad.net/ubuntu/+source/apt/0.7.25.3ubuntu9.17.1



--KHXBjiXlrxDS6aomM6SecPKscfecspfJG
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJUIaIZAAoJEGVp2FWnRL6T7EcP/iLC95LQVfbpaHz6ErzfGT+P
8pMsQc/2rmgORlS/VaFKbpjywIxDQt4va8nuRAW+nq7Xb+NzJgUwzSqiUkmN/fGW
FNDBsw+Yn3B/7i354uJbO/Df6oeBKfBkc+mIOQZL1KEaU4l/rZDm0X1NqolI+Oul
ihM3redNppqjRhmbcp9VUiVxvsskvyc921zAUd9l0hdsWe7zbDS3gHCKksE+zRrE
pnWgelkh7fNLzf2/AAMwixwRFHR+sFVzxOi0jCdN28MEYerJti+4nz3To62PngUW
eLtZIqPtlcmInfdy0tlfZu+FKUMePnNv0GhnaS94dqv4Kj9O0W/qwpLcZnhMSsHW
A8IJNFt1Wj5z6AtHwlX2CxVTRjFtXy2uvO5gPiF9B1LlgYYplTLpbK7aOd1IAIow
2zoySzVNbV4fJ93NGPrUCvSSnmg+McrvyTYAroWH3gtThDWiKpwJKZXccEGERbbC
Nnsg74zfFc96uppaHexNmKPsoZPH8FYdBblJuPcn1Zu0yIL6PWfojdY0vMReMYjd
53zg25IHqy8FUpk3UAIBIXNV51FktjlwOtVPVeGyPAtzH+mfFStEevl3E3RV0lGZ
DbaPQwiWB5ZA0E5aUdGpMwXi72dPoDEQwILmry9uTr5hJXOIJfM+kGEmVLR3z3XK
Bw+WzsFkK1AHwZjtyrZ3
=0Szv
-----END PGP SIGNATURE-----

--KHXBjiXlrxDS6aomM6SecPKscfecspfJG--


--===============3737132200845282512==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============3737132200845282512==--