Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in Linux
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in Linux
ID: USN-2854-1
Distribution: Ubuntu
Plattformen: Ubuntu 14.04 LTS
Datum: So, 20. Dezember 2015, 16:41
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8551
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8550
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8552
Applikationen: Linux

Originalnachricht

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============0520724881955887854==
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature";
boundary="8mGEhB3W76u9losKI01vaq6Dh628BoDJk"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--8mGEhB3W76u9losKI01vaq6Dh628BoDJk
Content-Type: text/plain; charset=utf-
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-2854-1
December 20, 2015

linux-lts-vivid vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description:
- linux-lts-vivid: Linux hardware enablement kernel from Vivid

Details:

Felix Wilhelm discovered a race condition in the Xen paravirtualized
drivers which can cause double fetch vulnerabilities. An attacker in the
paravirtualized guest could exploit this flaw to cause a denial of service
(crash the host) or potentially execute arbitrary code on the host.
(CVE-2015-8550)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not
perform sanity checks on the device's state. An attacker could exploit this
flaw to cause a denial of service (NULL dereference) on the host.
(CVE-2015-8551)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not
perform sanity checks on the device's state. An attacker could exploit this
flaw to cause a denial of service by flooding the logging system with
WARN() messages causing the initial domain to exhaust disk space.
(CVE-2015-8552)

Jann Horn discovered a ptrace issue with user namespaces in the Linux
kernel. The namespace owner could potentially exploit this flaw by ptracing
a root owned process entering the user namespace to elevate its privileges
and potentially gain access outside of the namespace.
(http://bugs.launchpad.net/bugs/1527374)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
linux-image-3.19.0-42-generic 3.19.0-42.48~14.04.1
linux-image-3.19.0-42-generic-lpae 3.19.0-42.48~14.04.1
linux-image-3.19.0-42-lowlatency 3.19.0-42.48~14.04.1
linux-image-3.19.0-42-powerpc-e500mc 3.19.0-42.48~14.04.1
linux-image-3.19.0-42-powerpc-smp 3.19.0-42.48~14.04.1
linux-image-3.19.0-42-powerpc64-emb 3.19.0-42.48~14.04.1
linux-image-3.19.0-42-powerpc64-smp 3.19.0-42.48~14.04.1

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
http://www.ubuntu.com/usn/usn-2854-1
CVE-2015-8550, CVE-2015-8551, CVE-2015-8552,
http://bugs.launchpad.net/bugs/1527374

Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-vivid/3.19.0-42.48~14.04.1



--8mGEhB3W76u9losKI01vaq6Dh628BoDJk
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWdpvHAAoJEAUvNnAY1cPYQWEP/14yvRX5eYIifmxJzMBCIPIx
NvPR2WxyBetH7RLFnIgieei9pHJT5GlgpJf7lz4TruafgSSJG6AxYoBOe0SWo1m/
ifrelnvt+VWrIX5y93+agG58NbpuHF3Y2xLEB5aHV6pz1cixEIwpE1+FmO4wrIA/
18BxVuBkDWNbdPHzakpmmDKJIV1LePZXAPbgzf6bxdKfBCvs5B8MP2bsxBLp9Wez
IXX0pOAigFMKbZMik35nROsIRamfz3t6drcReQcqdfpOeEgfL74NOQoZ2SBa3kXJ
qHnItA0d48UpsRNopHq6pYLGm570HggravPsuJKbedRJxBwIOYX59jzGVeCM3poI
2TmiiWCe+GSghtx5zM4eKct704DhS8Ag8kVEPIVGYuLIuFSbtywxisDNlxI+FORX
e1TU0K983BNI/exew7m5bxG2jqu7OyWnwNaeMBYzxuFTuQKXb7ybQJtrrrNNPn74
XRnoqGsS13o7hrA17bH3ILCmUEHwmEaaR3QOrYY6ws4dZNHNfnLXDjl7DmbMVRh7
yRB2cZE+NCNMZ+/nn7azWBazpY4EFbPeSNq1Y7igVqRJ2ycDug0u2T0MYn3tu1JX
4/u7YqwOhiBHivUvUWSGPRacHFhX4bRJU3WqhYau7l1hPPEmcSO4ATfuT6NtMfl+
roTdKH6Da1FAVpBxPJvy
=aMAM
-----END PGP SIGNATURE-----

--8mGEhB3W76u9losKI01vaq6Dh628BoDJk--


--===============0520724881955887854==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============0520724881955887854==--
Pro-Linux
Traut euch!
Neue Nachrichten
Werbung