Ubuntu Security Notice 3449-1 - George Shuklin discovered that OpenStack Nova incorrectly handled the migration process. A remote authenticated user could use this issue to consume resources, resulting in a denial of service. George Shuklin and Tushar Patil discovered that OpenStack Nova incorrectly handled deleting instances. A remote authenticated user could use this issue to consume disk resources, resulting in a denial of service. Various other issues were also addressed.
a1c121127571465465556c60817389564c88cc2b4526a38cad3b673cd9b43192
Ubuntu Security Notice 3448-1 - Boris Bobrov discovered that OpenStack Keystone incorrectly handled federation mapping when there are rules in which group-based assignments are not used. A remote authenticated user may receive all the roles assigned to a project regardless of the federation mapping, contrary to expectations.
c17d9dfabe42e69aeb2a88ad9d00135975ba69cdd7efa593c4a28685c4d015dd
Ubuntu Security Notice 3447-1 - Beth Lancaster and Brandon Sawyers discovered that OpenStack Horizon was incorrect protected against cross-site scripting attacks. A remote authenticated user could use this issue to inject web script or HTML in a dashboard form.
53a3044240cbe88ed44bc7604ffffe0d572d14209249f0931744fb0afe88c512
Ubuntu Security Notice 3446-1 - Hemanth Makkapati discovered that OpenStack Glance incorrectly handled access restrictions. A remote authenticated user could use this issue to change the status of images, contrary to access restrictions. Mike Fedosin and Alexei Galkin discovered that OpenStack Glance incorrectly handled the storage quota. A remote authenticated user could use this issue to consume disk resources, leading to a denial of service. Various other issues were also addressed.
c2b70a7ccfc102af1ef9b25ac50e9320f7bcc8f428ac519c5a48bf065d703413
Debian Linux Security Advisory 3995-1 - Two vulnerabilities were found in libXfont, the X11 font rasterisation library, which could result in denial of service or memory disclosure.
503d20b928ef095ca057d857cc63ae7e77ee6c86ba1399cb9a0e3ad6a979a2db
net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message. Andrey Konovalov discovered that a divide-by-zero error existed in the TCP stack implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash).
e235bcfa41bd438b8a2e50aacb2a8bacd839c9df405a35c1482334716e19c84e
Ubuntu Security Notice 3445-2 - USN-3445-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement kernel from Ubuntu 14.04 LTS for Ubuntu 12.04 ESM. Eyal Itkin discovered that the IP over IEEE 1394 implementation in the Linux kernel contained a buffer overflow when handling fragmented packets. A remote attacker could use this to possibly execute arbitrary code with administrative privileges. Various other issues were also addressed.
9b609f3594ffb5cbddb2ca39b9f6093d1fe7386b8d5c1f7dc3d59ec49f31677b
Ubuntu Security Notice 3443-3 - Andrey Konovalov discovered that a divide-by-zero error existed in the TCP stack implementation in the Linux kernel. A local attacker could use this to cause a denial of service.
19be1a3d5907e770c00ea1797a6929c2703ecae51cb82b9db481931945123b9e
Ubuntu Security Notice 3444-2 - USN-3444-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Jan H. Schonherr discovered that the Xen subsystem did not properly handle block IO merges correctly in some situations. An attacker in a guest vm could use this to cause a denial of service or possibly gain administrative privileges in the host. Various other issues were also addressed.
518bcce32879974ad8c212f843cedd77f31b8046a4cedeede70651b97fc3502a
Ubuntu Security Notice 3445-1 - Eyal Itkin discovered that the IP over IEEE 1394 implementation in the Linux kernel contained a buffer overflow when handling fragmented packets. A remote attacker could use this to possibly execute arbitrary code with administrative privileges. Andrey Konovalov discovered that a divide-by-zero error existed in the TCP stack implementation in the Linux kernel. A local attacker could use this to cause a denial of service. Various other issues were also addressed.
41148c3875df1318c2d2413af391b6fecd0574d0356664d817900e15ef26bca7
Ubuntu Security Notice 3444-1 - Jan H. Schonherr discovered that the Xen subsystem did not properly handle block IO merges correctly in some situations. An attacker in a guest vm could use this to cause a denial of service or possibly gain administrative privileges in the host. Andrey Konovalov discovered that a divide-by-zero error existed in the TCP stack implementation in the Linux kernel. A local attacker could use this to cause a denial of service. Various other issues were also addressed.
45432b2e9ed775afbc92575ea36657a660514dafa40944283f494d7e97fd75ca
Ubuntu Security Notice 3436-1 - Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing-like context, an attacker could potentially exploit these to read uninitialized memory, bypass phishing and malware protection, conduct cross-site scripting attacks, cause a denial of service via application crash, or execute arbitrary code. Martin Thomson discovered that NSS incorrectly generated handshake hashes. A remote attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. Various other issues were also addressed.
c318a713d641f72943a1eb076cf9dbfb8ac780f39348d155d5975aee3254be42
Ubuntu Security Notice 3424-2 - USN-3424-1 fixed several vulnerabilities in libxml2. This update provides the corresponding update for Ubuntu 12.04 ESM. A It was discovered that a type confusion error existed in libxml2. An A attacker could use this to specially construct XML data that A could cause a denial of service or possibly execute arbitrary A code. Various other issues were also addressed.
c343e80592279896a14f60197bcfc8fb6122c7d25ea404b1ad14ddf26be54f7c
Ubuntu Security Notice 3443-2 - USN-3443-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04. This update provides the corresponding updates for the Linux Hardware Enablement kernel from Ubuntu 17.04 for Ubuntu 16.04 LTS. It was discovered that on the PowerPC architecture, the kernel did not properly sanitize the signal stack when handling sigreturn. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Various other issues were also addressed.
5c273dbcfa4fc131f8caefa862ef0f9c20f8cdc948d57b8c155a6acf896ceb70
Ubuntu Security Notice 3443-1 - It was discovered that on the PowerPC architecture, the kernel did not properly sanitize the signal stack when handling sigreturn. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Andrey Konovalov discovered that a divide-by-zero error existed in the TCP stack implementation in the Linux kernel. A local attacker could use this to cause a denial of service. Various other issues were also addressed.
457c630329cf0d0feb195089191ce4f05331adfbb5f0f6cd7ad55a13ca9cb9d0