==========================================================================
Ubuntu Security Notice USN-2849-1
December 19, 2015

linux-lts-utopic vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux-lts-utopic: Linux hardware enablement kernel from Utopic

Details:

Felix Wilhelm discovered a race condition in the Xen paravirtualized
drivers which can cause double fetch vulnerabilities. An attacker in the
paravirtualized guest could exploit this flaw to cause a denial of service
(crash the host) or potentially execute arbitrary code on the host.
(CVE-2015-8550)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not
perform sanity checks on the device’s state. An attacker could exploit this
flaw to cause a denial of service (NULL dereference) on the host.
(CVE-2015-8551)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not
perform sanity checks on the device’s state. An attacker could exploit this
flaw to cause a denial of service by flooding the logging system with
WARN() messages causing the initial domain to exhaust disk space.
(CVE-2015-8552)

Jann Horn discovered a ptrace issue with user namespaces in the Linux
kernel. The namespace owner could potentially exploit this flaw by ptracing
a root owned process entering the user namespace to elevate its privileges
and potentially gain access outside of the namespace.
(http://bugs.launchpad.net/bugs/1527374)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
linux-image-3.16.0-57-generic 3.16.0-57.77~14.04.1
linux-image-3.16.0-57-generic-lpae 3.16.0-57.77~14.04.1
linux-image-3.16.0-57-lowlatency 3.16.0-57.77~14.04.1
linux-image-3.16.0-57-powerpc-e500mc 3.16.0-57.77~14.04.1
linux-image-3.16.0-57-powerpc-smp 3.16.0-57.77~14.04.1
linux-image-3.16.0-57-powerpc64-emb 3.16.0-57.77~14.04.1
linux-image-3.16.0-57-powerpc64-smp 3.16.0-57.77~14.04.1

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
http://www.ubuntu.com/usn/usn-2849-1
CVE-2015-8550, CVE-2015-8551, CVE-2015-8552, http://bugs.launchpad.net/bugs/1527374

Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-utopic/3.16.0-57.77~14.04.1

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJWdfmXAAoJEAUvNnAY1cPYmBQP/1XcPFhhaz+/9d+2bBrHkdLS
kgN9jJojVLhlftQKQtGphAziyqhi7LC3R0imIg2VCGfFIPoBMIkcb2vEDasA011J
Xw8UmixbGFXNrSFEttaP99E2Zp1PbbNA/02UYipzSCtTiB6KkjsgGp8nFfC1xX1v
gqEWGGvxMhnk++E/A+sX5+9aqcEJSVqyW1tAiH5upD1oPezmK0YLlU+7xwt3f6Zh
advnxzjpBK9QPdxnGnOC07cw93QH65tGQrpcZW5qCTe3QuBmLXJl+TL2hEbQyoPK
qPOCHO+NcVHfq3vPw+L3FeoimsWCiPV6gBmg2o3fAp1AwgWbW8XY1eUkMLhrAse3
/Dj/kGyGryoa9px2qXh73G02z1QPquylHYEJyUTgLcm52jrQCM63S59JtlH3AdLt
2eWcpF1G2Tzj8WM9oYM7sVec/dbcJ+YcOsm9kYsuqwXLfylBIZaACQfHq5VEn6gX
tZk85sL39r2HMf/V5s9B/5c9t2HUSw/BelOfkFJBFyIFiBDAaTVwhtUT8Air3qPl
JAc1NUyGscM3I7Ikxhu6cIHlNWekcd873yasCUa+Aa6yuexmynSwMoFjXvO0fYWm
nK+CIzu9DGdvZbES31SfZaYAr4mhjbXx094RuqSUdBaiAcoyLuK0r/C5u24nhNz4
4fcqlY9gSROzqPsgnAYj
=4Q5c
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

==========================================================================
Ubuntu Security Notice USN-2846-1
December 19, 2015

linux vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 12.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux: Linux kernel

Details:

Felix Wilhelm discovered a race condition in the Xen paravirtualized
drivers which can cause double fetch vulnerabilities. An attacker in the
paravirtualized guest could exploit this flaw to cause a denial of service
(crash the host) or potentially execute arbitrary code on the host.
(CVE-2015-8550)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not
perform sanity checks on the device’s state. An attacker could exploit this
flaw to cause a denial of service (NULL dereference) on the host.
(CVE-2015-8551)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not
perform sanity checks on the device’s state. An attacker could exploit this
flaw to cause a denial of service by flooding the logging system with
WARN() messages causing the initial domain to exhaust disk space.
(CVE-2015-8552)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
linux-image-3.2.0-97-generic 3.2.0-97.137
linux-image-3.2.0-97-generic-pae 3.2.0-97.137
linux-image-3.2.0-97-highbank 3.2.0-97.137
linux-image-3.2.0-97-omap 3.2.0-97.137
linux-image-3.2.0-97-powerpc-smp 3.2.0-97.137
linux-image-3.2.0-97-powerpc64-smp 3.2.0-97.137
linux-image-3.2.0-97-virtual 3.2.0-97.137

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
http://www.ubuntu.com/usn/usn-2846-1
CVE-2015-8550, CVE-2015-8551, CVE-2015-8552

Package Information:
https://launchpad.net/ubuntu/+source/linux/3.2.0-97.137

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJWdflnAAoJEAUvNnAY1cPY8ucQAIl68XiWgjIWzvzMzWE9p5ol
VG5wwGnpwQf58ty8Wb2HjO0qEwQOvRd2RCa8OGWSTWXCrrBVnML3bOZXTkqiQFCZ
MDBFX+/6NZErJF0BsLGskeqBUnANQK6xlYijTg5Uv7PVnsAQb0/fHb2tUnwl3nTh
P4DUWSxvEDyaUT66d+XGdBnIW5gtVAI4ogs9+H59z9sHnGWn4L45cwC7G7gPhGvA
mtOujICg4tL9suLCPNQfugEz0hWFMGaM2gOytkTcA87jefEtjOHGLUvfPv6f9pjW
U3K0tYyhhSTXO12F0uYPibWXzVBwwFb+rSc8V7Ce+oHVnJaliOTONWn8fCF+8ITG
UTPk3zMkNEPOFSXo2zZqspRe0rjG34SwWU+JFDBjFgyAFEIRob4nMXdfFIWo75bP
Nw4z7lUBt6zXcFbE98VQsJkvCM6JxOC03XBmHEj3//+m/yr02iPxDCl7vwFqviFv
Ge8AoYw+sESIMpli7jdPvZ0sBkh2CNvYCmhzrawM3pGcKlzh9ikg7WnCVzC1PDkG
EsqDIHJYqITHE8tJtJCMSrYg+QZMskqp+H2dJxcb93+1+i0UJNEq105xiXBUFKXp
EAGDmRmQdfe82+dFk/1ipt1zyHS3Ysc5jUMTelvMCKs5CiPu7xDvmJNi0B4F0aez
SBmS2nwQGSsDXoBtAmc/
=CjPR
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

==========================================================================
Ubuntu Security Notice USN-2847-1
December 19, 2015

linux-lts-trusty vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 12.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux-lts-trusty: Linux hardware enablement kernel from Trusty

Details:

Felix Wilhelm discovered a race condition in the Xen paravirtualized
drivers which can cause double fetch vulnerabilities. An attacker in the
paravirtualized guest could exploit this flaw to cause a denial of service
(crash the host) or potentially execute arbitrary code on the host.
(CVE-2015-8550)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not
perform sanity checks on the device’s state. An attacker could exploit this
flaw to cause a denial of service (NULL dereference) on the host.
(CVE-2015-8551)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not
perform sanity checks on the device’s state. An attacker could exploit this
flaw to cause a denial of service by flooding the logging system with
WARN() messages causing the initial domain to exhaust disk space.
(CVE-2015-8552)

Jann Horn discovered a ptrace issue with user namespaces in the Linux
kernel. The namespace owner could potentially exploit this flaw by ptracing
a root owned process entering the user namespace to elevate its privileges
and potentially gain access outside of the namespace.
(http://bugs.launchpad.net/bugs/1527374)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
linux-image-3.13.0-74-generic 3.13.0-74.118~precise1
linux-image-3.13.0-74-generic-lpae 3.13.0-74.118~precise1

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
http://www.ubuntu.com/usn/usn-2847-1
CVE-2015-8550, CVE-2015-8551, CVE-2015-8552, http://bugs.launchpad.net/bugs/1527374

Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-trusty/3.13.0-74.118~precise1

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJWdfk9AAoJEAUvNnAY1cPYs/cQALNnd+MrGU94+18YRrs5zf+5
Ict8rajaAGBnZ391X6MhETKCBOFlz+3ajn5TEUJuZ06Mu7lbCDwJHtnzBoo1LDr8
ihxAO3vdTJAxRSoZIFd24M8zr+X6AsIRnN47oYnrL4uCbyGys/BO5MaFW7FaqPmQ
COuAugyTKux2DJEjZW4FY/JPmvQGjCQbRnCWs/+Oqwua8bXzQf2XqG6xstXwxl2I
XGYoXYUM+Akjffh3VOgIlnG7znigZDsC6zXWpElycCZFjV8hEZ/HXYu6ziWlMsKA
RixtTKS+6kF1+/ahizyHzBa6f8++LTE49a2pavwlepDAZrkaA6fg+1SZ6kgvCEa3
uo3Ot0oABiB9QsIpCXp6F4UaPzIcMkHf3MReZXRL/2xKhLoEQ5uqSLBqWr2Hiseh
5AsDNEikNfIfuJ6Kwpv9BOp/tZGCFTVwJqAUeaYmSxIpW/1jiysG0YibYOclmeTg
tfvYiKDHGiMe8SSwUuwgtx/29KtHxLFhTb276i6Bhdr6VxVi+OzEIN2NCwHeLivf
3rAuAoRgM+XMaaWU+8xX6rG83nrtuG7fXn085feJSnKJ4lXmGjsoJLwUbAT8+tlt
VqYGuDV23TBD8/upt4GY1NA9jXsPnqWJ0I7unWloiPfBoTR950MHpVp/XYaI23Hd
5QrG46kFazjiIgv5qhBs
=Hrhx
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

==========================================================================
Ubuntu Security Notice USN-2848-1
December 19, 2015

linux vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux: Linux kernel

Details:

Felix Wilhelm discovered a race condition in the Xen paravirtualized
drivers which can cause double fetch vulnerabilities. An attacker in the
paravirtualized guest could exploit this flaw to cause a denial of service
(crash the host) or potentially execute arbitrary code on the host.
(CVE-2015-8550)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not
perform sanity checks on the device’s state. An attacker could exploit this
flaw to cause a denial of service (NULL dereference) on the host.
(CVE-2015-8551)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not
perform sanity checks on the device’s state. An attacker could exploit this
flaw to cause a denial of service by flooding the logging system with
WARN() messages causing the initial domain to exhaust disk space.
(CVE-2015-8552)

Jann Horn discovered a ptrace issue with user namespaces in the Linux
kernel. The namespace owner could potentially exploit this flaw by ptracing
a root owned process entering the user namespace to elevate its privileges
and potentially gain access outside of the namespace.
(http://bugs.launchpad.net/bugs/1527374)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
linux-image-3.13.0-74-generic 3.13.0-74.118
linux-image-3.13.0-74-generic-lpae 3.13.0-74.118
linux-image-3.13.0-74-lowlatency 3.13.0-74.118
linux-image-3.13.0-74-powerpc-e500 3.13.0-74.118
linux-image-3.13.0-74-powerpc-e500mc 3.13.0-74.118
linux-image-3.13.0-74-powerpc-smp 3.13.0-74.118
linux-image-3.13.0-74-powerpc64-emb 3.13.0-74.118
linux-image-3.13.0-74-powerpc64-smp 3.13.0-74.118

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
http://www.ubuntu.com/usn/usn-2848-1
CVE-2015-8550, CVE-2015-8551, CVE-2015-8552, http://bugs.launchpad.net/bugs/1527374

Package Information:
https://launchpad.net/ubuntu/+source/linux/3.13.0-74.118

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJWdfl+AAoJEAUvNnAY1cPYi/8P/36a99LWVQNKw7zC8G31aaBv
yAnkOXQvZhtIQbfAZnin/t8x/ajMQUvljGVBcEz1xC2kO5uwR8ispCZsBZsDPAwc
TLcTu+d32iNoI5mZBIaNbOWCIH3t0dzoRZQcCJebhGJTFNQziUVwj+LBNkn8jW3T
z0HpNfw0a/0t1PEWNwnCzoPmiKxGgyTpgoMCfzbr82GJQnB8ETkBe1Ddawk4uyei
oBZjXi+qdTfEwkteO8oEKdJWE6KnFto6IEs4FzQ8j2DtB1PvL7gWH4g1vYeBDaya
drJrUD5DydXhBzJx5sF4nV8alz03RUKjS2YgVY13wzOsSGm0Qz7RHejMNUNI38tj
FitPbt4Bz0bpp/KEJqwpY80v2r3nWjS1TVvJnmwVi5OLxGJL/DP8DRBlUUkdgxO8
ggvCzyDZdB7xVpYaPVPOsXnGcS0wFDSh/FDX3NgvU1Eco6wfAQVOkX+MLi20LAZR
5SLBM/a2Rjs2i2ULcJu/sqn7zpu9r/HJR756ct+M59v3rOvWErtzbt3J016Le+Bg
/cwnOnTtDr01dlIYpYM3MqrW9BVoZ2eqlKaiVIeUbAIkx72P7eFqAd8mgRJHk680
/bdtoUB6EzZwNswp528yOEzae/1Nq5zEq3kvJDTA5lbK/dOfIAPKDR9LJXpLDL0I
pPQ3rhFdOzDi2mmZVVaC
=6SN2
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

==========================================================================
Ubuntu Security Notice USN-2850-1
December 19, 2015

linux vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 15.04

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux: Linux kernel

Details:

Felix Wilhelm discovered a race condition in the Xen paravirtualized
drivers which can cause double fetch vulnerabilities. An attacker in the
paravirtualized guest could exploit this flaw to cause a denial of service
(crash the host) or potentially execute arbitrary code on the host.
(CVE-2015-8550)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not
perform sanity checks on the device’s state. An attacker could exploit this
flaw to cause a denial of service (NULL dereference) on the host.
(CVE-2015-8551)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not
perform sanity checks on the device’s state. An attacker could exploit this
flaw to cause a denial of service by flooding the logging system with
WARN() messages causing the initial domain to exhaust disk space.
(CVE-2015-8552)

Jann Horn discovered a ptrace issue with user namespaces in the Linux
kernel. The namespace owner could potentially exploit this flaw by ptracing
a root owned process entering the user namespace to elevate its privileges
and potentially gain access outside of the namespace.
(http://bugs.launchpad.net/bugs/1527374)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.04:
linux-image-3.19.0-42-generic 3.19.0-42.48
linux-image-3.19.0-42-generic-lpae 3.19.0-42.48
linux-image-3.19.0-42-lowlatency 3.19.0-42.48
linux-image-3.19.0-42-powerpc-e500mc 3.19.0-42.48
linux-image-3.19.0-42-powerpc-smp 3.19.0-42.48
linux-image-3.19.0-42-powerpc64-emb 3.19.0-42.48
linux-image-3.19.0-42-powerpc64-smp 3.19.0-42.48

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
http://www.ubuntu.com/usn/usn-2850-1
CVE-2015-8550, CVE-2015-8551, CVE-2015-8552, http://bugs.launchpad.net/bugs/1527374

Package Information:
https://launchpad.net/ubuntu/+source/linux/3.19.0-42.48

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJWdfm0AAoJEAUvNnAY1cPY82sP/3D1MIakFEs/PaaOyFfW8csP
oOD1eRYkp8qF7lEU413nWP2RhersinZsi5Hjj6wvw4C72yCXXaPkNuzBUp7Q+A94
sdItbA8K954eCvltshqsOJ7R9GWzCnd/K9x804E0SI/nfge+BLuHc2sdymYS1AA2
0ZQz3nrhtkUdEWReEPzK/KEz6Xc3sy8FOi1NjO/ImhfHj3ZQ+ez2MGRnONf9t6cy
44DK8pfJ6BoC9eIySU+/Uib9dOqhn1663uKwjhTwDEiO+6L/qpqQ7dvTJQNXlM6W
cEsz5pqYYd+bsuCwCuTfW7h+6B97XmfH/Az457R3aZtRFWZfUet12KqVPI2+lozS
pJxiP53baakBClDPOwCOPjP3zjolKkZGKJ9VNZNfgW8rodF5h91czU61VDEIyPao
xTnj7nOXBcbgY6704WATdf9RT5HywHIMq3hBCzk85GwFpr+DM3VjwPO/cHZ4Y4JD
PDYNKFW1MZLZGqOmYV1TZy6wTwaj1BRN1OkEO2dU1EPewxFi6469xIwmv/oaoXLF
PA4Dzxx3TL2//kbBa21jAL0pHgVVBsJXiTPYhQ1KzHpGsU1zNOZ50rrwQHljFRdM
FXggsnTg+8HcrPxPa4kTvbFmwwhBEbqQ7556TeQ/nj9F3Iwmt5bRq+PVtJukjEuP
kjQc8TLtUNfYxenakfAY
=+QV2
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

==========================================================================
Ubuntu Security Notice USN-2851-1
December 19, 2015

linux vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 15.10

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux: Linux kernel

Details:

Felix Wilhelm discovered a race condition in the Xen paravirtualized
drivers which can cause double fetch vulnerabilities. An attacker in the
paravirtualized guest could exploit this flaw to cause a denial of service
(crash the host) or potentially execute arbitrary code on the host.
(CVE-2015-8550)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not
perform sanity checks on the device’s state. An attacker could exploit this
flaw to cause a denial of service (NULL dereference) on the host.
(CVE-2015-8551)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not
perform sanity checks on the device’s state. An attacker could exploit this
flaw to cause a denial of service by flooding the logging system with
WARN() messages causing the initial domain to exhaust disk space.
(CVE-2015-8552)

Jann Horn discovered a ptrace issue with user namespaces in the Linux
kernel. The namespace owner could potentially exploit this flaw by ptracing
a root owned process entering the user namespace to elevate its privileges
and potentially gain access outside of the namespace.
(http://bugs.launchpad.net/bugs/1527374)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
linux-image-4.2.0-22-generic 4.2.0-22.27
linux-image-4.2.0-22-generic-lpae 4.2.0-22.27
linux-image-4.2.0-22-lowlatency 4.2.0-22.27
linux-image-4.2.0-22-powerpc-e500mc 4.2.0-22.27
linux-image-4.2.0-22-powerpc-smp 4.2.0-22.27
linux-image-4.2.0-22-powerpc64-emb 4.2.0-22.27
linux-image-4.2.0-22-powerpc64-smp 4.2.0-22.27

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
http://www.ubuntu.com/usn/usn-2851-1
CVE-2015-8550, CVE-2015-8551, CVE-2015-8552, http://bugs.launchpad.net/bugs/1527374

Package Information:
https://launchpad.net/ubuntu/+source/linux/4.2.0-22.27

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJWdfnPAAoJEAUvNnAY1cPYDQAP/j6VABilCRE6QT8DxwJJME12
KMF7IC2Xv6D/LukzTsvo0S05nvrGkRYo7wZFODAQF+PnJbt/Cmzz143xQ9xW+h25
HPYRc6iSHdIf0Jpr7RuShmN3PH66XIVU49PVteGhJXQVpLzpvrnrKc29IRCe9dM8
YxqtQIE2bzxf6FApMK+FUnoXCnlRF2kix8v5aVKcr7lQEMhfN2WNqtQk0x1HivhO
Il3i6p5LYd+N+zQgtczTjcwTf6q5L0FoUWPppnU1YDbhakUib+j5crxCDgy8f2NC
VlVLhC5PhH0Vynn7sTiZX3zqvcRXm0ISMsM5vfGo/3vdb0tpQuyQsIw7oloaayxM
BwL15dkD1WnSxiW8l0DjEJL17j4RWQ3NEBIxqEmOkVLAlC+pCqXKJtuqW9xwLXci
MjQ2FlJpzPvGvLC7PmpSW8sggdT8GtvJay4DeWqeO7wyT09ve/shP64cNCV0GTk5
I4v5wfoFk4y3XKhjnI4UOKXJe3k7z3gbBWafSvxH8Zpu4PPzrnBXwBzC/SDbuCyz
hyYpLNG+2py84CirKvSrXoHqY5K8pM77n1l8I1rZoiYimp5lno+XecqSk7/joWED
LKqQarOarJOMLF4Ie3BFhwJcml5ACygQRV9sZtwx3SZnH3zgVdthk+AkFXbebyPp
0/JHe+3av82dAZZXGZ26
=3Kvg
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

==========================================================================
Ubuntu Security Notice USN-2854-1
December 20, 2015

linux-lts-vivid vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux-lts-vivid: Linux hardware enablement kernel from Vivid

Details:

Felix Wilhelm discovered a race condition in the Xen paravirtualized
drivers which can cause double fetch vulnerabilities. An attacker in the
paravirtualized guest could exploit this flaw to cause a denial of service
(crash the host) or potentially execute arbitrary code on the host.
(CVE-2015-8550)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not
perform sanity checks on the device’s state. An attacker could exploit this
flaw to cause a denial of service (NULL dereference) on the host.
(CVE-2015-8551)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not
perform sanity checks on the device’s state. An attacker could exploit this
flaw to cause a denial of service by flooding the logging system with
WARN() messages causing the initial domain to exhaust disk space.
(CVE-2015-8552)

Jann Horn discovered a ptrace issue with user namespaces in the Linux
kernel. The namespace owner could potentially exploit this flaw by ptracing
a root owned process entering the user namespace to elevate its privileges
and potentially gain access outside of the namespace.
(http://bugs.launchpad.net/bugs/1527374)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
linux-image-3.19.0-42-generic 3.19.0-42.48~14.04.1
linux-image-3.19.0-42-generic-lpae 3.19.0-42.48~14.04.1
linux-image-3.19.0-42-lowlatency 3.19.0-42.48~14.04.1
linux-image-3.19.0-42-powerpc-e500mc 3.19.0-42.48~14.04.1
linux-image-3.19.0-42-powerpc-smp 3.19.0-42.48~14.04.1
linux-image-3.19.0-42-powerpc64-emb 3.19.0-42.48~14.04.1
linux-image-3.19.0-42-powerpc64-smp 3.19.0-42.48~14.04.1

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
http://www.ubuntu.com/usn/usn-2854-1
CVE-2015-8550, CVE-2015-8551, CVE-2015-8552,
http://bugs.launchpad.net/bugs/1527374

Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-vivid/3.19.0-42.48~14.04.1

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJWdpvHAAoJEAUvNnAY1cPYQWEP/14yvRX5eYIifmxJzMBCIPIx
NvPR2WxyBetH7RLFnIgieei9pHJT5GlgpJf7lz4TruafgSSJG6AxYoBOe0SWo1m/
ifrelnvt+VWrIX5y93+agG58NbpuHF3Y2xLEB5aHV6pz1cixEIwpE1+FmO4wrIA/
18BxVuBkDWNbdPHzakpmmDKJIV1LePZXAPbgzf6bxdKfBCvs5B8MP2bsxBLp9Wez
IXX0pOAigFMKbZMik35nROsIRamfz3t6drcReQcqdfpOeEgfL74NOQoZ2SBa3kXJ
qHnItA0d48UpsRNopHq6pYLGm570HggravPsuJKbedRJxBwIOYX59jzGVeCM3poI
2TmiiWCe+GSghtx5zM4eKct704DhS8Ag8kVEPIVGYuLIuFSbtywxisDNlxI+FORX
e1TU0K983BNI/exew7m5bxG2jqu7OyWnwNaeMBYzxuFTuQKXb7ybQJtrrrNNPn74
XRnoqGsS13o7hrA17bH3ILCmUEHwmEaaR3QOrYY6ws4dZNHNfnLXDjl7DmbMVRh7
yRB2cZE+NCNMZ+/nn7azWBazpY4EFbPeSNq1Y7igVqRJ2ycDug0u2T0MYn3tu1JX
4/u7YqwOhiBHivUvUWSGPRacHFhX4bRJU3WqhYau7l1hPPEmcSO4ATfuT6NtMfl+
roTdKH6Da1FAVpBxPJvy
=aMAM
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

==========================================================================
Ubuntu Security Notice USN-2853-1
December 20, 2015

linux-lts-wily vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in the kernel.

Software Description:
– linux-lts-wily: Linux hardware enablement kernel from Wily

Details:

Felix Wilhelm discovered a race condition in the Xen paravirtualized
drivers which can cause double fetch vulnerabilities. An attacker in the
paravirtualized guest could exploit this flaw to cause a denial of service
(crash the host) or potentially execute arbitrary code on the host.
(CVE-2015-8550)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not
perform sanity checks on the device’s state. An attacker could exploit this
flaw to cause a denial of service (NULL dereference) on the host.
(CVE-2015-8551)

Konrad Rzeszutek Wilk discovered the Xen PCI backend driver does not
perform sanity checks on the device’s state. An attacker could exploit this
flaw to cause a denial of service by flooding the logging system with
WARN() messages causing the initial domain to exhaust disk space.
(CVE-2015-8552)

Jann Horn discovered a ptrace issue with user namespaces in the Linux
kernel. The namespace owner could potentially exploit this flaw by ptracing
a root owned process entering the user namespace to elevate its privileges
and potentially gain access outside of the namespace.
(http://bugs.launchpad.net/bugs/1527374)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
linux-image-4.2.0-22-generic 4.2.0-22.27~14.04.1
linux-image-4.2.0-22-generic-lpae 4.2.0-22.27~14.04.1
linux-image-4.2.0-22-lowlatency 4.2.0-22.27~14.04.1
linux-image-4.2.0-22-powerpc-e500mc 4.2.0-22.27~14.04.1
linux-image-4.2.0-22-powerpc-smp 4.2.0-22.27~14.04.1
linux-image-4.2.0-22-powerpc64-emb 4.2.0-22.27~14.04.1
linux-image-4.2.0-22-powerpc64-smp 4.2.0-22.27~14.04.1

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
http://www.ubuntu.com/usn/usn-2853-1
CVE-2015-8550, CVE-2015-8551, CVE-2015-8552,
http://bugs.launchpad.net/bugs/1527374

Package Information:
https://launchpad.net/ubuntu/+source/linux-lts-wily/4.2.0-22.27~14.04.1

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJWdpt+AAoJEAUvNnAY1cPYNHkP/16SlrKcp17mC/NEr/iDeLOn
wKuuZxiP9nEi+CA/TrcBeCVkZBtFGZj0xljoda3qvEUeD8C3Sw0AnMddZDcGfxE5
vw2ckoOHbYbLkHbX532XMFiRhB7I1uspLmZzwzNwxnFt4hLX0sNc36DgYndnFgjo
990RDOFNzVXI6tP70Wuztn9sDyEMN/PHb+xaRNGAnrBmEzsmi/lur5lQo0KT3hH0
Tqmamh7072BnASHfOL+Cz1JnJbRSiD6JZw5+oJpSP+fInb9mU5d+cSfmYK9d8Xua
2tjsOsyr7iJ0lThfVqGNm/O6UdbceKlVSOFFStWCLu7veiaIbHTN919OcplYB1Rh
+ZS/YdGfdHcU4m+NgpUreqrICMbzbpqpl2AoTIkEYDvhvEFl3eVB1fN+3vYFQwcB
RV/VU6YV5+JPSjo7jCawcKBSGtMp+/n/MUvE/2m9h9VECK4O6ZOt9YcdTP5ljQ3w
/zbSstdlfVWvzCrtKDum0bAiUFHp9agl+L2+Ostc3sjMDEsa70Yp8UZblLoMp0X/
ynpTT4liTE//i0zPkMT9mITY6PZ9GUVZEcYm7G2WQvkNk8vhkUs7jxNCwfhQFWvu
EySPF1TspTj6uINnpquhhwMIFKPsRbAl7rBU/AzA4ZDl0D82p05UqWA71oxYNxOW
hi2A7Nh0aFbHycaG/mpw
=qscx
—–END PGP SIGNATURE—–
—
7e