==========================================================================
Ubuntu Security Notice USN-2795-1
November 05, 2015

linux-lts-trusty vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 12.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux-lts-trusty: Linux hardware enablement kernel from Trusty

Details:

It was discovered that in certain situations, a directory could be renamed
outside of a bind mounted location. An attacker could use this to escape
bind mount containment and gain access to sensitive information.
(CVE-2015-2925)

Moein Ghasemzadeh discovered that the USB WhiteHEAT serial driver contained
hardcoded attributes about the USB devices. An attacker could construct a
fake WhiteHEAT USB device that, when inserted, causes a denial of service
(system crash). (CVE-2015-5257)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
linux-image-3.13.0-67-generic 3.13.0-67.110~precise1
linux-image-3.13.0-67-generic-lpae 3.13.0-67.110~precise1

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References:
http://www.ubuntu.com/usn/usn-2795-1
CVE-2015-2925, CVE-2015-5257

Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-trusty/3.13.0-67.110~precise1

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJWO4tAAAoJEC8Jno0AXoH0h0QP+wQEa/DdKkMJWgBNCdZkktPM
VaOCgxZ6YV9c4JCHT304jv+aMAYjki67c/F0Swm905szALDJYT9xj7/tcbYZV9j2
XOeIQOIxfhuqN0ClPSkx8hJ7iKmm+i7SYIA1f8M6xczfw24eSEJ8dc1CGYMiHOW/
KEhz9NJGt0bUBE9PP3ME3TkbfOuTnwkESCuAP+9Gxr/6i2+uvCH5UHqDnD6kI3DV
UP1ZrVuR7mwrr/iOhdeAJ2RvtzQObfGIX6jG/ckqpsjCd0c0jmDRX67Hkahee/Wb
NFDlazX/c3mKg/LQJ5bBCMxbbP9LaSSoLEe+fu9kvn56aD/Ka6swDBmHOjNs8gHb
/bUItYHyedMkqdvf8uETIWb4h27+bgpZ2dw06ttwjclWydjaB0U011ybp6btOXNL
C/uTi6/qR0o7g3QdOsK58iXOrxmpb9QS6kBrXFf9ZmJX7NSIUKg0oZVfafde7uFC
2lUPu2iSZl6BLwXmMVjWzsmd2bbpPjbM1s0jqvNpalkbKJpjvBHVkTYe9pAN6wiN
FVxQ4t6b3s6VaAfImwxsGECaIvizsojXO2ml9H8nnsS8nnLGHFKNMcrb4LIf6EWV
YGartHSpCEumjjz2L7E5u+SbZY0S2pm3ZHUU1qDsspLeMPs+clC6OuVZSOLCJmRw
N04zwcTRE3mKk9IH4vPI
=a1us
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

==========================================================================
Ubuntu Security Notice USN-2794-1
November 05, 2015

linux vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux: Linux kernel

Details:

It was discovered that in certain situations, a directory could be renamed
outside of a bind mounted location. An attacker could use this to escape
bind mount containment and gain access to sensitive information.
(CVE-2015-2925)

Moein Ghasemzadeh discovered that the USB WhiteHEAT serial driver contained
hardcoded attributes about the USB devices. An attacker could construct a
fake WhiteHEAT USB device that, when inserted, causes a denial of service
(system crash). (CVE-2015-5257)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
linux-image-3.13.0-67-generic 3.13.0-67.110
linux-image-3.13.0-67-generic-lpae 3.13.0-67.110
linux-image-3.13.0-67-lowlatency 3.13.0-67.110
linux-image-3.13.0-67-powerpc-e500 3.13.0-67.110
linux-image-3.13.0-67-powerpc-e500mc 3.13.0-67.110
linux-image-3.13.0-67-powerpc-smp 3.13.0-67.110
linux-image-3.13.0-67-powerpc64-emb 3.13.0-67.110
linux-image-3.13.0-67-powerpc64-smp 3.13.0-67.110

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References:
http://www.ubuntu.com/usn/usn-2794-1
CVE-2015-2925, CVE-2015-5257

Package Information:
https://launchpad.net/ubuntu/+source/linux/3.13.0-67.110

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJWO4syAAoJEC8Jno0AXoH03gEP/1nYFnXnK6N1/36h5yLZKVoN
YZwzqVpNW/fo7MrtaAPLPIUz90rNWN+EMyG/SIuSsbDmEI/+gAD7BaNixI+b9KpK
FotOd5ZZjFn3OUd6knu0DuBfcvbdtJWYP8VTMSyZnpUFRNvtp+Sw9ajJI2oqo17B
NsSygL8Aaa0+euQEl+Vjk+B1W/Ufkr4BUFRROVKuf7JbR2Sg8dcIZ6vCL3szpK3H
1Syq9moGjwSEo8DY7RguwQa54P6qG4yg3HgAWPtko2sYbtAoQny2/Zh76XRxNzy2
Wn69dPHPcRVNZhuIhj4o2zE0GXX0o25gmsHBYpYByHBXzLBiEBAitTjM+TrvjCK9
sOl4IFMNOu0+j2I8pJ2mRm+bBnSvZq5vR6o3qwPpF5Iq5xNI+UiOvah9GVJOufzl
54AhI0VJeV6S3SBSQaPSMGc2OQvz5qUVS4NGuEP4D2OfM9JkLF59jR02xLKJL2eK
t7VA/oEbBmNlTqBoXMsWDwKRn8RMHOTlbhily8fYaYh0fUJScE72vaHpUiTpk4rI
4NirXVmuU8Hd195fIuDL7y1iW/qd+pQcOgPEF8j57ZJPfXt255pyWALCdBjBCaxX
Jhrj6/J+yJyBlh0ViSXsMiVftzK6ZQ+cPsZ7ySJNmzl4z1yT7JKCvtQh1+NcVgRj
XbnQdyZigzJKKkTTkzXy
=RLky
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

==========================================================================
Ubuntu Security Notice USN-2798-1
November 05, 2015

linux-lts-vivid vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux-lts-vivid: Linux hardware enablement kernel from Vivid

Details:

It was discovered that in certain situations, a directory could be renamed
outside of a bind mounted location. An attacker could use this to escape
bind mount containment and gain access to sensitive information.
(CVE-2015-2925)

Moein Ghasemzadeh discovered that the USB WhiteHEAT serial driver contained
hardcoded attributes about the USB devices. An attacker could construct a
fake WhiteHEAT USB device that, when inserted, causes a denial of service
(system crash). (CVE-2015-5257)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
linux-image-3.19.0-32-generic 3.19.0-32.37~14.04.1
linux-image-3.19.0-32-generic-lpae 3.19.0-32.37~14.04.1
linux-image-3.19.0-32-lowlatency 3.19.0-32.37~14.04.1
linux-image-3.19.0-32-powerpc-e500mc 3.19.0-32.37~14.04.1
linux-image-3.19.0-32-powerpc-smp 3.19.0-32.37~14.04.1
linux-image-3.19.0-32-powerpc64-emb 3.19.0-32.37~14.04.1
linux-image-3.19.0-32-powerpc64-smp 3.19.0-32.37~14.04.1

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References:
http://www.ubuntu.com/usn/usn-2798-1
CVE-2015-2925, CVE-2015-5257

Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-vivid/3.19.0-32.37~14.04.1

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJWO54wAAoJEC8Jno0AXoH0lx8P/1MN55L1rapYpIzVDf+j2y7b
v+/RmTrXVVBttWCJpoxiHDWYRD5vSFnSuviRlfjHvYcT6tLo8WwKLkmV5tNyVLA8
vt1OHPCvE+w7usH/X00BIAKyYPbDUyDurnp+co296F9LsdfZfsRJmL77tFb9Fn/d
ona7o2nyP7YMk1OlTeubwzD3im9AZsH63jirMM9lOKXTnoshxz9QglWCQdkIlcrg
ls6RmkFW6ZboNGMBh2Jy+hX535ZP9S0BsOhGJqzk7IY0mZB70JjSlQZZ6rp7AXEA
vfNA9Z5Hs+2PPXyB/uh2QCwfScGc0aA0yforgZaZ5AqCdm4UVZP7zmbNKrhWbFBJ
OFNRS+GwRRJyUBHBu2VtTwGcaPSMYQhbtquxxgQJKA2EbRlhripzLjwM7p/tOxQ7
bTwKYcY7yxZPUf7Txook97shBhK8tCuFAYlqhvgLwR42i6na6JYrH0DZ6VEwM7Ik
r7qI7evdNWA5KvcqF/p9hLymNJ4b18angjWscdK/vmwSt/pTMAf/IhzIs7ZrbxRM
WNov8MfgNh02g9OSGvrzw4f3Z9ybo/zwxVGrwNwFimwUrgnWUxu7QgRZdvSyGxZI
QjV7ME2mdKjT2H4cKDIeF0JkjruOhRrbnDCxfD7i32bfiAei89WthGTBEpm3JLyH
gJ7WKr/MhnpC0y86iXhk
=CAce
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

==========================================================================
Ubuntu Security Notice USN-2799-1
November 05, 2015

linux vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 15.04

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux: Linux kernel

Details:

It was discovered that in certain situations, a directory could be renamed
outside of a bind mounted location. An attacker could use this to escape
bind mount containment and gain access to sensitive information.
(CVE-2015-2925)

Moein Ghasemzadeh discovered that the USB WhiteHEAT serial driver contained
hardcoded attributes about the USB devices. An attacker could construct a
fake WhiteHEAT USB device that, when inserted, causes a denial of service
(system crash). (CVE-2015-5257)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.04:
linux-image-3.19.0-32-generic 3.19.0-32.37
linux-image-3.19.0-32-generic-lpae 3.19.0-32.37
linux-image-3.19.0-32-lowlatency 3.19.0-32.37
linux-image-3.19.0-32-powerpc-e500mc 3.19.0-32.37
linux-image-3.19.0-32-powerpc-smp 3.19.0-32.37
linux-image-3.19.0-32-powerpc64-emb 3.19.0-32.37
linux-image-3.19.0-32-powerpc64-smp 3.19.0-32.37

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.

References:
http://www.ubuntu.com/usn/usn-2799-1
CVE-2015-2925, CVE-2015-5257

Package Information:
https://launchpad.net/ubuntu/+source/linux/3.19.0-32.37

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJWO54+AAoJEC8Jno0AXoH0uLkP/0xrvaKdHNdTqgYQMvJCxq5i
pcaQjNUtOZpBRMOu2jxJjzp+IO/2/wfnvFUgQJOzmTszQaWJ5yLl6KM+uc/W4Qgc
hbAYCNhEx/d1WxWq7j4snPSXPRff8QOcdYs5glR0YCwFJ1zpylP3OPCMk4YLyG9n
2kFAF8pZsthW+pe4R1RRX9LZ4L80yqrAnt0JsjoOspQp88l+O3feJZF9o2bpadKB
zl6qMQ2XENE0JssobfaQB9/Re4uRgw+2zNjA/f2+yDnS8FhLck/CvtFA1UVS0r5z
RGxeuGZG41mZzINy9afDVMClxoFCc4v0QltsblrL45SwbVjg3Mj6DF/n52hjlhR/
stGNF3kparzu4H8WkLOZLKQKhOXJzZfE24reb51EChX3p24tlj8o8UkMg2vtNhp+
Chg6Ba93Q/wxaCMeHTxev7PQBBdR9xhJklzLMzhoR7LHG3yeFLfti2laI/l5rGYX
jYXQHOU4cFNxzPbTzNHT5IKJAQCkSA+DSjFYeYAPzsR0+fYycrE1mPsnOpNUjp1n
64eAkc+gBinvspVTpynsZHDTILPcm59DkusZfy80pMqlEhZ67VOYdRkd02YFqhhq
f8feK7bzYjZv+f31FUG59E8SP8pekjfYniMug+EBGHA9bkRnP8i4/efDgvIMSfeo
ka9KJv9X437XTf0Pnu11
=1dnD
—–END PGP SIGNATURE—–
—