<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-text-plain" wrap="true" graphical-quote="true"
style="font-family: -moz-fixed; font-size: 16px;" lang="x-western">
<pre wrap="">A new release of the Ubuntu Cloud Images for stable Ubuntu release 11.04 (Natty Narwhal) is available at [1]. These new images superseded the existing images [2]. Images are available for download or immediate use on EC2 via publish AMI ids. Users who wish to update their
existing installations can do so with:
'apt-get update && sudo apt-get dist-upgrade && reboot'.
This release includes HVM images for the Amazon AWS eu-west-1 region.
The linux-image packages was updated to 2.6.38-15.64 [3] and the linux
meta-data package was updated to 2.6.38.15.30 [4].
CVE Updates:
* apt
- Disable apt-key net-update for now, as validation code is still
insecure (CVE-2012-0954)
* bind9
- ghost domain names attack (CVE-2012-1033)
- denial of service via zero length rdata handling (CVE-2012-1667)
* gnutls26
- Denial of service in client application (CVE-2011-4128)
- Denial of service via crafted TLS record (CVE-2012-1573)
* libpng
- denial of service and possible code execution via memory corruption
issue. (CVE-2011-3048)
* libtasn1-3
- denial of service and possible code execution via certain large
length values. (CVE-2012-1569)
* libxml2
- Fix an off by one pointer access in xpointer.c (CVE-2011-3102)
* openssl
- denial of service attack in DTLS implementation (CVE-2012-2333)
- million message attack (MMA) in CMS and PKCS #7 (CVE-2012-0884)
- incomplete fix for CVE-2012-2110 (CVE-2012-2131)
- NULL pointer dereference in S/MIME messages with broken headers
(CVE-2006-7250), (CVE-2012-1165)
- fix various overflows (CVE-2012-2110)
* sudo
- Properly handle multiple netmasks in sudoers Host and Host_List
values (CVE-2012-2337)
* python-crypto
- incorrect ElGamal key generation (CVE-2012-2417)
* update-manager
- Incomplete fix for CVE-2012-0949 (CVE-2012-0950)
- Incorrect permissions on system_state archive may expose repo
passwords (CVE-2012-0948)
- Apport hook may upload system_state archive containing repo passwords
(CVE-2012-0949)
The following packages have been updated. Please see the full changelogs
for a complete listing changes:
* apparmor: 2.6.1-0ubuntu3 => 2.6.1-0ubuntu3.1
* apt: 0.8.13.2ubuntu4.4 => 0.8.13.2ubuntu4.6
* bind9: 1:9.7.3.dfsg-1ubuntu2.3 => 1:9.7.3.dfsg-1ubuntu2.4
* gnutls26: 2.8.6-1ubuntu2 => 2.8.6-1ubuntu2.1
* grub-gfxpayload-lists: 0.2 => 0.2.3
* insserv: 1.14.0-2 => 1.14.0-2ubuntu0.11.04.2
* landscape-client: 11.07.1.1-0ubuntu0.11.04.0 => 12.04.3-0ubuntu0.11.04
* libpng: 1.2.44-1ubuntu3.3 => 1.2.44-1ubuntu3.4
* libtasn1-3: 2.7-1ubuntu1 => 2.7-1ubuntu1.1
* libxml2: 2.7.8.dfsg-2ubuntu0.3 => 2.7.8.dfsg-2ubuntu0.4
* linux: 2.6.38-13.57 => 2.6.38-15.64
* linux-firmware: 1.52 => 1.52.4
* linux-meta: 2.6.38.13.28 => 2.6.38.15.30
* lxc: 0.7.4-0ubuntu7.2 => 0.7.4-0ubuntu7.3
* openssl: 0.9.8o-5ubuntu1.2 => 0.9.8o-5ubuntu1.7
* python-crypto: 2.1.0-2ubuntu1 => 2.1.0-2ubuntu1.1
* sudo: 1.7.4p4-5ubuntu7.1 => 1.7.4p4-5ubuntu7.2
* update-manager: 1:0.150.5.2 => 1:0.150.5.4
--
[1] <span class="moz-txt-link-freetext"><a class="moz-txt-link-freetext" href="http://cloud-images.ubuntu.com/releases/natty/release-20120723">http://cloud-images.ubuntu.com/releases/natty/release-20120723</a></span>
[2] <span class="moz-txt-link-freetext"><a class="moz-txt-link-freetext" href="http://cloud-images.ubuntu.com/releases/natty/release-20120402">http://cloud-images.ubuntu.com/releases/natty/release-20120402</a></span>
[3] <span class="moz-txt-link-freetext"><a class="moz-txt-link-freetext" href="https://launchpad.net/ubuntu/+source/linux/2.6.38-15.64">https://launchpad.net/ubuntu/+source/linux/2.6.38-15.64</a></span>
[4] <span class="moz-txt-link-freetext"><a class="moz-txt-link-freetext" href="https://launchpad.net/ubuntu/+source/linux-meta/2.6.38.15.30/">https://launchpad.net/ubuntu/+source/linux-meta/2.6.38.15.30/</a></span>
<div class="moz-txt-sig">--
Ben Howard
<a class="moz-txt-link-abbreviated" href="mailto:ben.howard@canonical.com">ben.howard@canonical.com</a>
Canonical
GPG ID 0x5406A866
</div></pre>
</div>
</body>
</html>