USN-3064-1 GnuPG vulnerability | Cloud Foundry

USN-3064-1 GnuPG vulnerability High Vendor Canonical Ubuntu, gnupg Versions Affected Canonical Ubuntu 14.04 LTS Description Felix Dörre and Vladimir Klebanov discovered that GnuPG incorrectly handled mixing functions in the random number generator. An attacker able to obtain 4640 bits from the RN...

USN-3048-1 curl vulnerability | Cloud Foundry

USN-3048-1 curl vulnerability Medium Vendor Canonical Ubuntu, curl Versions Affected Canonical Ubuntu 14.04 LTS Description Bru Rom discovered that curl incorrectly handled client certificates when resuming a TLS session. CVE-2016-5419 It was discovered that curl incorrectly handled client...

USN-3061-1 OpenSSH vulnerability | Cloud Foundry

USN-3061-1 OpenSSH vulnerability Medium Vendor Canonical Ubuntu, openssh Versions Affected Canonical Ubuntu 14.04 LTS Description Eddie Harari discovered that OpenSSH incorrectly handled password hashing when authenticating non-existing users. A remote attacker could perform a timing attack and...

USN-3065-1 Libgcrypt vulnerability | Cloud Foundry

USN-3065-1 Libgcrypt vulnerability High Vendor Canonical Ubuntu, libgcrypt Versions Affected Canonical Ubuntu 14.04 LTS Description Felix Dörre and Vladimir Klebanov discovered that Libgcrypt incorrectly handled mixing functions in the random number generator. An attacker able to obtain 4640 bits...

USN-3012-1 Wget vulnerability | Cloud Foundry

USN-3012-1 Wget vulnerability Medium Vendor Canonical Ubuntu, wget Versions Affected Canonical Ubuntu 14.04 LTS Description Dawid Golunski discovered that Wget incorrectly handled filenames when being redirected from an HTTP to an FTP URL. A malicious server could possibly use this issue to...

USN 3020-1 Linux kernel (Vivid HWE) vulnerabilities | Cloud Foundry

USN 3020-1 Linux kernel Vivid HWE vulnerabilities Low – High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description Jesse Hertz and Tim Newsham discovered that the Linux netfilter implementation did not correctly perform validation when handling 32 bit compatibility...

USN-3001-1 Linux kernel (Vivid HWE) vulnerabilities | Cloud Foundry

USN-3001-1 Linux kernel Vivid HWE vulnerabilities High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables scatter/gather I/O. A remote attacker could use this to...

USN-2991-1 nginx vulnerability | Cloud Foundry

USN-2991-1 nginx vulnerability Medium Vendor Nginx, Canonical Ubuntu Versions Affected BOSH-release versions prior to 255.11 Description It was discovered that nginx incorrectly handled saving client request bodies to temporary files. A remote attacker could possibly use this issue to cause nginx...

CVE-2016-4435 BOSH Agent Anonymous Endpoint | Cloud Foundry

CVE-2016-4435 BOSH Agent Anonymous Endpoint Medium Vendor Cloud Foundry Foundation Versions Affected BOSH stemcell versions prior to 3232.6 and 3146.13 Description An endpoint of the Agent running on the BOSH Director VM may allow unauthenticated clients to read or write blobs or cause a denial o...

USN-2977-1 Linux kernel (Vivid HWE) vulnerabilities | Cloud Foundry

USN-2977-1 Linux kernel Vivid HWE vulnerabilities High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description Philip Pettersson discovered that the Linux kernel’s ASN.1 DER decoder did not properly process certificate files with tags of indefinite length. A local...

USN-2959-1 OpenSSL vulnerabilities | Cloud Foundry

USN-2959-1 OpenSSL vulnerabilities High Vendor Canonical Ubuntu, OpenSSL Versions Affected Canonical Ubuntu 14.04 LTS, OpenSSLv1 Description Huzaifa Sidhpurwala, Hanno Böck, and David Benjamin discovered that OpenSSL incorrectly handled memory when decoding ASN.1 structures. A remote attacker cou...

USN-2949-1 Linux kernel (Vivid HWE) vulnerabilities | Cloud Foundry

USN-2949-1 Linux kernel Vivid HWE vulnerabilities Low/Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description Venkatesh Pottem discovered a use-after-free vulnerability in the Linux kernel’s CXGB3 driver. A local attacker could use this to cause a denial of service...

USN-2910-1 Linux kernel vulnerability | Cloud Foundry

USN-2910-1 Linux kernel vulnerability High Vendor Ubuntu Versions Affected Ubuntu 14.04 Description halfdog discovered that OverlayFS, when mounting on top of a FUSE mount, incorrectly propagated file attributes, including setuid. A local unprivileged attacker could use this to gain privileges...

USN-2900-1 GNU libc vulnerability | Cloud Foundry

USN-2900-1 GNU libc vulnerability High Vendor glibc Versions Affected Ubuntu 14.04 Description It was discovered that the GNU C Library incorrectly handled receiving responses while performing DNS resolution. A remote attacker could use this issue to cause the GNU C Library to crash, resulting in...

USN-2871-1 Linux kernel vulnerability | Cloud Foundry

USN-2871-1 Linux kernel vulnerability High Vendor Ubuntu Versions Affected Ubuntu 14.04 Description Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A local attacker could use this to cau...

USN-2869-1 OpenSSH vulnerability | Cloud Foundry

USN-2869-1 OpenSSH vulnerability High Vendor OpenSSH Versions Affected Ubuntu 14.04 Description It was discovered that the OpenSSH client experimental support for resuming connections contained multiple security issues. A malicious server could use this issue to leak client memory to the server,...

USN-2865-1 GnuTLS vulnerability | Cloud Foundry

USN-2865-1 GnuTLS vulnerability Medium Vendor GnuTLS Versions Affected Ubuntu 14.04 Description Karthikeyan Bhargavan and Gaetan Leurent discovered that GnuTLS incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were able to perform a man-in-the-middle attack, this fl...

USN-2836-1 grub2 vulnerability | Cloud Foundry

USN-2836-1 grub2 vulnerability Medium Vendor grub2 Versions Affected Ubuntu 14.04 Description Hector Marco and Ismael Ripoll discovered that GRUB incorrectly handled the backspace key when configured to use authentication. A local attacker could use this issue to bypass GRUB password protection...

USN-2857-1 Linux kernel vulnerability | Cloud Foundry

USN-2857-1 Linux kernel vulnerability High Vendor Linux kernel Versions Affected Ubuntu 14.04 Description Nathan Williams discovered that overlayfs in the Linux kernel incorrectly handled setattr operations. A local unprivileged attacker could use this to create files with administrative permissi...

USN-2830-1 OpenSSL vulnerability | Cloud Foundry

USN-2830-1 OpenSSL vulnerability Medium Vendor OpenSSL Versions Affected Ubuntu 14.04 Description Loïc Jonas Etienne discovered that OpenSSL incorrectly handled ASN.1 signatures with a missing PSS parameter. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a...