** Description changed:
= apparmor SRU =
[Rationale]
For backporting snapd to 14.04 LTS, we need to provide proper AppArmor
confinement for snaps when running under the 16.04 hardware enablement kernel.
The apparmor userspace package in 14.04 is missing support key mediation
features such
signee: (unassigned) => Tyler Hicks (tyhicks)
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to libseccomp in Ubuntu.
https://bugs.launchpad.net/bugs/1450642
Title:
seccomp missing many new syscalls
Status in Snappy:
Fix
** Description changed:
[Impact]
Several syscalls were discovered to be missing when using the launcher on
snappy. These should be added so we may properly support seccomp filtering.
[Test Case]
seccomp itself has a comprehensive testsuite, and while it doesn't fail the
build, regress
We've released security updates to address this issue for all supported
Ubuntu releases:
https://launchpad.net/ubuntu/+source/game-music-emu/0.6.0-3ubuntu0.16.10.1
https://launchpad.net/ubuntu/+source/game-music-emu/0.6.0-3ubuntu0.16.04.1
https://launchpad.net/ubuntu/+source/game-music-emu/0.5.5-2
** Information type changed from Private Security to Public
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to xorg in Ubuntu.
https://bugs.launchpad.net/bugs/1650359
Title:
g compiz error
Status in xorg package in Ubuntu:
** Information type changed from Private Security to Public
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to ntp in Ubuntu.
https://bugs.launchpad.net/bugs/1649477
Title:
package ntpdate 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 fai
Public bug reported:
A user with CAP_MAC_ADMIN in the init namespace can create an AppArmor
policy namespace and load a profile belonging to that AppArmor
namespace. Once that's done, the user can confine a process with that
namespaced AppArmor profile and enter into a user namespace. That
process
This is a feature bug that the security team is using for tracking.
Moving the bug status back to confirmed.
** Changed in: linux (Ubuntu)
Status: Incomplete => Confirmed
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to
** Description changed:
[Impact]
Several syscalls were discovered to be missing when using the launcher on
snappy. These should be added so we may properly support seccomp filtering.
[Test Case]
seccomp itself has a comprehensive testsuite, and while it doesn't fail the
build, regress
I've completed my verification of the libseccomp 2.1.1-1ubuntu1~trusty1
SRU.
I followed the test plan and everything went as expected. I think this
SRU is good to go.
** Tags removed: verification-needed
** Tags added: verification-complete
** Tags removed: verification-complete
** Tags added: v
I've completed my verification of the dbus 1.6.18-0ubuntu4.5 SRU. The
documented Test Plan went as expected. It leverages extensive automated
tests that were written when the AppArmor D-Bus mediation patch set was
upstreamed into the D-Bus project. I am confident of the dbus SRU and
feel like it is
I've completed my verification of the apparmor
2.10.95-0ubuntu2.5~14.04.1 SRU. Testing very went well and I did not
uncover any issues. I completed the entire Test Case as documented in
the bug description. The AppArmor test plan was completed on the 14.04
release and HWE kernels as well as all of
I wanted to mention that snaps were working with libseccomp from trusty-
proposed in my testing. I tested with the hello-world, pwgen-tyhicks,
and lxd snaps on amd64. However, bug #1653487 shows there is a snapd
build test failure with the libseccomp from trusty-proposed and it needs
to be triaged
** Information type changed from Private Security to Public
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to systemd in Ubuntu.
https://bugs.launchpad.net/bugs/1705158
Title:
package systemd-sysv 232-21ubuntu5 failed to inst
Hello and thanks for the bug report! To reduce the risk of regressions,
we prefer to backport security fixes to our stable releases rather than
bump them to an entirely new version of the openssh package. Please
refer to the Ubuntu CVE Tracker for known issues affecting OpenSSH:
https://people.c
** Information type changed from Private Security to Public
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to xorg in Ubuntu.
https://bugs.launchpad.net/bugs/1706246
Title:
O Programa "Configure - Debian" entrou no modo texto
Marking this bug as invalid since there's no useful information
included.
** Information type changed from Private Security to Public
** Changed in: lxc (Ubuntu)
Status: New => Invalid
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which i
** Information type changed from Private Security to Public
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to pulseaudio in Ubuntu.
https://bugs.launchpad.net/bugs/1705835
Title:
I cant turn the volume.
Status in pulseaudio
** Information type changed from Private Security to Public
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apport in Ubuntu.
https://bugs.launchpad.net/bugs/1705109
Title:
package python3-problem-report 2.20.1-0ubuntu2.10
Hello and thanks for the bug report. We've previously triaged this issue
in the Ubuntu CVE Tracker:
https://people.canonical.com/~ubuntu-
security/cve/2016/CVE-2016-1238.html
Please watch that page for the latest information for this issue. Thanks
again!
** Changed in: perl (Ubuntu)
Importa
Thanks for taking the time to report this bug and helping to make Ubuntu
better. We appreciate the difficulties you are facing, but this appears
to be a "regular" (non-security) bug. I have unmarked it as a security
issue since this bug does not show evidence of allowing attackers to
cross privile
** Also affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Changed in: linux (Ubuntu)
Status: New => In Progress
** Changed in: linux (Ubuntu)
Assignee: (unassigned) => Tyler Hicks (tyhicks)
** Changed in: libseccomp (Ubuntu)
Assignee: (unassigned) =&
A status update is in order. We settled on a design that meets
everyone's kernel needs. Those patches have been accepted into linux-
next and they're on their way into 4.14.
https://lkml.kernel.org/r/%3C20170815220319.GA63342@beast%3E
I've submitted Artful backports to the kernel team:
https
The kernel patches were committed to the Ubuntu Artful kernel git repo:
https://lists.ubuntu.com/archives/kernel-team/2017-August/086714.html
** Changed in: linux (Ubuntu)
Status: In Progress => Fix Committed
--
You received this bug notification because you are a member of Ubuntu
Touch s
** Information type changed from Private Security to Public
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to xorg in Ubuntu.
https://bugs.launchpad.net/bugs/1713189
Title:
Got stop job running c1 session
Status in xorg pack
@zyga those are both good questions.
- Detection functionality is included in kernel patches. There's a new
seccomp(2) operation to check if the log action is available and an
added test to ensure that there's a certain combination of valid/invalid
seccomp(2) arguments that can be used to detect i
@sdeziel ubuntu-security was asked to comment on it a few days ago. I've
just freed up enough to take a look.
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to gnutls26 in Ubuntu.
https://bugs.launchpad.net/bugs/1709193
Title:
Ignore my last comment. You were asking about Xenial but it was the
Trusty SRU that was blocked on ubuntu-security review.
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to gnutls26 in Ubuntu.
https://bugs.launchpad.net/bugs/170
I agree with juliank's assessment in comment #22. The 2nd Trusty debdiff
allows md5 to be used throughout the entire cert chain which is
apparently not what Simon intended. I don't think it is the right
approach.
--
You received this bug notification because you are a member of Ubuntu
Touch seede
No, it is actually in-progress now:
http://lkml.iu.edu/hypermail/linux/kernel/1701.0/00452.html
http://lkml.iu.edu/hypermail/linux/kernel/1701.0/00472.html
https://github.com/seccomp/libseccomp/pull/64
Vacation time and a sprint last week have kept me from working on a
second revision of the patc
** Also affects: apparmor-easyprof-ubuntu (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor-easyprof-ubuntu
in Ubuntu.
https://bugs.launchpad.net/bugs/1628286
Title:
ress
** Changed in: apparmor-easyprof-ubuntu (Ubuntu)
Assignee: (unassigned) => Tyler Hicks (tyhicks)
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor-easyprof-ubuntu
in Ubuntu.
https://bugs.launchpad.net/
I'm bumping the importance of the upstream AppArmor task to high. I
think this regression is going to affect a considerable number of users
since there has never been a restriction on the ordering of dbus rule
components.
** Changed in: apparmor
Importance: Medium => High
--
You received this
On 01/24/2017 06:13 AM, Christian Boltz wrote:
> Well, up to 2.10 dbus rule handling in the tools was simply matching for
> "dbus.*," and writing the line back to the profile without any changes.
> I'm not sure if I'd call full support for dbus rules (including handling
> of log events) a regressio
** Changed in: apparmor-easyprof-ubuntu (Ubuntu)
Status: In Progress => Won't Fix
** Changed in: apparmor
Status: Triaged => In Progress
** Changed in: apparmor
Assignee: (unassigned) => Tyler Hicks (tyhicks)
** Changed in: apparmor-easyprof-ubuntu (Ubuntu)
On 01/27/2017 12:05 PM, Christian Boltz wrote:
> FYI: FileRule accepts the permissions in any order, so maybe you could
> look at how it's done there. (Needless to say that having a list of
> possible permissions is easier to handle, but maybe it helps
> nevertheless.)
I'll have a look at that.
>
This isn't fixed in AppArmor upstream. As an upstream, we decided
against taking in this policy update until the patches to perform D-Bus
mediation have landed in the upstream kernel. Without those patches,
we'd be granting full access to the D-Bus system bus socket from the
very commonly used name
*** This bug is a duplicate of bug 1660109 ***
https://bugs.launchpad.net/bugs/1660109
** Information type changed from Private Security to Public
** This bug has been marked a duplicate of bug 1660109
[, Realtek ALC880, Green Headphone Out, Front] No sound at all
--
You received this bu
Hi Gordon - Thanks for the bug report! I don't see anything related to
an inability to download updates. The only errors that I see in the
information attached to this bug report is that the nvidia driver cannot
be loaded but the nouveau driver is successfully loaded so I don't think
that should be
** Information type changed from Private Security to Public
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to alsa-driver in Ubuntu.
https://bugs.launchpad.net/bugs/1660109
Title:
[, Realtek ALC880, Green Headphone Out, Front
Thanks for taking the time to report this bug and helping to make Ubuntu
better. We appreciate the difficulties you are facing, but this appears
to be a "regular" (non-security) bug. I have unmarked it as a security
issue since this bug does not show evidence of allowing attackers to
cross privile
Thanks for the bug report! This only seems to affect the apparmor
package that was SRU'ed to trusty from xenial. Xenial doesn't look to be
affected.
** Changed in: apparmor (Ubuntu)
Importance: Undecided => Medium
** Changed in: apparmor (Ubuntu)
Status: New => Confirmed
** Also affect
** Changed in: apparmor (Ubuntu Trusty)
Assignee: (unassigned) => Tyler Hicks (tyhicks)
** Changed in: apparmor (Ubuntu Trusty)
Status: Confirmed => Triaged
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscri
I submitted my patch to the list:
https://lists.ubuntu.com/archives/apparmor/2017-February/010537.html
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor-easyprof-ubuntu
in Ubuntu.
https://bugs.launchpad.net/bugs/1628286
I just checked the upstream bug
(https://bugs.freedesktop.org/show_bug.cgi?id=98165) again and there's
still no final solution.
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to cairo in Ubuntu.
https://bugs.launchpad.net/bugs/1
** Description changed:
Jasper is being removed from Debian. It would be great if this could be
- done in Ubuntu too before 16.10 is released.
+ done in Ubuntu too before 17.04 is released.
https://web.archive.org/web/20160402170040/https://release.debian.org/transitions/html
/jasper-rm.
** Changed in: apparmor (Ubuntu Trusty)
Status: Triaged => In Progress
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1661406
Title:
apparmor failing to be purged
Assignee: (unassigned) => Tyler Hicks (tyhicks)
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1661406
Title:
apparmor failing to be purged when /var/lib/apparmor/profi
** Description changed:
+ [Impact]
+
+ The apparmor package cannot be successfully purged when
+ /var/lib/apparmor/profiles or /var/lib/apparmor do not exist. This is
+ the case in default installs of the apparmor 2.10.95-0ubuntu2.5~14.04.1
+ package in Ubuntu 14.04 LTS.
+
+ [Test Case]
+
+ Ens
Committed as r3634
** Changed in: apparmor
Status: In Progress => Fix Committed
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor-easyprof-ubuntu
in Ubuntu.
https://bugs.launchpad.net/bugs/1628286
Title:
[uti
** Information type changed from Private Security to Public
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1670124
Title:
package libapt-pkg4.12 1.0.1ubuntu2.8 failed to insta
** Information type changed from Private Security to Public
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to pulseaudio in Ubuntu.
https://bugs.launchpad.net/bugs/1669654
Title:
package pulseaudio 1:8.0-0ubuntu3.2 failed to
** Information type changed from Private Security to Public Security
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to lxc in Ubuntu.
https://bugs.launchpad.net/bugs/1654676
Title:
lxc-user-nic does not ensure that target net
** Information type changed from Private Security to Public
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to cups in Ubuntu.
https://bugs.launchpad.net/bugs/1671420
Title:
package cups-daemon 2.0.2-1ubuntu3 failed to install
Thanks for taking the time to report this bug and helping to make Ubuntu
better. We appreciate the difficulties you are facing, but this appears
to be a "regular" (non-security) bug. I have unmarked it as a security
issue since this bug does not show evidence of allowing attackers to
cross privile
** Information type changed from Private Security to Public
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to xorg in Ubuntu.
https://bugs.launchpad.net/bugs/1670106
Title:
i don't know
Status in xorg package in Ubuntu:
Ne
Thanks for the bug report! We'll at least need to know what Ubuntu
release you're running and how to reproduce the warning. Please provide
this info and set the status back to "New".
** Changed in: ibus (Ubuntu)
Status: New => Incomplete
--
You received this bug notification because you a
Merged into the upstream tree as r3645:
http://bazaar.launchpad.net/~apparmor-
dev/apparmor/master/revision/3645
** Also affects: apparmor
Importance: Undecided
Status: New
** Changed in: apparmor
Importance: Undecided => High
** Changed in: apparmor
Status: New => Fix Com
** Changed in: apparmor
Milestone: None => 2.12
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1590561
Title:
webbrowser-app crashes on startup on fresh zesty Unity8:
I've successfully performed the testing described in the [libseccomp
Test Case] section of the bug 1567597 description using libseccomp
2.3.1-2.1ubuntu2~16.04.1 from xenial-proposed. It includes the
libseccomp live tests (which aren't used during the build) and a
specific test of the new seccomp lo
I've successfully performed the testing described in the [libseccomp
Test Case] section of this bug description using libseccomp
2.3.1-2.1ubuntu2~16.04.1 from xenial-proposed.
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to li
** Information type changed from Private Security to Public Security
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apport in Ubuntu.
https://bugs.launchpad.net/bugs/1726372
Title:
Multiple security issues in Apport
Statu
The patch in comment #4 of bug 1726372 was mostly complete but issues
were discovered late as we were approached the CRD for the CVEs
described in that bug:
1) The patch should be updated to forward the new dump_mode argument into the
container. This is a trivial change.
2) The patch changed the
Do we have a strong reason to start handling crashes inside of "non-
full" containers on stable Ubuntu releases? I'm specifically talking
about when this conditional evaluates to True:
elif not is_same_ns(host_pid, "pid") and is_same_ns(host_pid, "mnt"):
If there's no strong reason, can we only
Going back to point #3 in comment 2, I don't see anything that will
protect against an updated apport in the host from forwarding a crash to
a non-updated apport in a container, causing the container's apport to
confuse dump_mode as a global_pid. Am I missing something that protects
against that or
I suspect that you're correct but I'd rather not widen the attack
surface of apport without having a strong reason to do so. If there's
not strong justification, maybe enabling the handling of those crashes
in the dev release and seeing how it plays out would be a better
approach.
--
You received
The reason I'm being picky about the pidns thing is because I think this
update needs to go through -security since it fixes regressions caused
by the security update. We try to be as conservative as possible with
those updates.
--
You received this bug notification because you are a member of Ub
If you don't run the `ulimit -c unlimited` command, your crash program
will not result in apport writing out a core file.
However, even if you don't run that command, the reproducer in bug
1726372 will cause apport to write out a core file.
--
You received this bug notification because you are a
Sigh... Thanks for being patient with me on that. I think my brain just
wrote everything at the top of main() off as setting up the namespace
for some reason. That's embarrassing... :)
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscri
@Brian did you have any thoughts on the debdiff?
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apport in Ubuntu.
https://bugs.launchpad.net/bugs/1732518
Title:
Please re-enable container support in apport
Status in appor
I don't feel like the change from fstack-protector-strong
to fstack-protector should be made. The performance testing results in
the spreadsheet don't suggest that the change positively impacts
performance in a meaningful way. fstack-protector-strong slightly
outperforms fstack-protector in some si
I took a quick look at this bug to attempt to locate the problem. I
originally thought it was due to the Python utils' parser not supporting
include rules that are missing a leading '#' but that's not the case
since the regex in utils/apparmor/regex.py supports such an include
rule:
RE_INCLUDE =
** Description changed:
Hi,
in our testing I found an issue that might now surface due to stacked
profiles working.
Our setup is a Xenial (or newer) Host with LXD Containers for all supported
releases.
In that Xenial+ are good but recently the Trusty containers ran into an issue.
Af
Status: New
** Changed in: apparmor (Ubuntu)
Status: New => Invalid
** Changed in: apparmor (Ubuntu)
Assignee: Tyler Hicks (tyhicks) => (unassigned)
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to appa
** Description changed:
The network-interface-security upstart job unconditionally loads the
usr.sbin.dhclient AppArmor profile even if the job is running in a
LXC/LXD container that cannot load AppArmor policy.
I don't see any negative side effects from this behavior, so I don't
thin
I'm making this bug public now that we have security updates published
which disable the guest session. My hope is that we can re-enable it
after the changes suggested by pitti can be investigated/implemented.
** No longer affects: apparmor (Ubuntu Artful)
** No longer affects: apparmor (Ubuntu Z
If you have a use case which requires the guest session, you can
manually re-enable it by writing the following contents to
/etc/lightdm/lightdm.conf:
# Manually enable guest sessions despite them not being confined
# IMPORTANT: Makes the system vulnerable to CVE-2017-8900
# https://bugs.launchpad
** Changed in: lightdm (Ubuntu Artful)
Assignee: (unassigned) => Robert Ancell (robert-ancell)
** Changed in: lightdm
Assignee: (unassigned) => Robert Ancell (robert-ancell)
** Changed in: lightdm (Ubuntu Yakkety)
Assignee: (unassigned) => Tyler Hicks (tyhicks)
** C
Hello - Thanks for the bug report!
I'm unable to reproduce the behavior that you're experiencing. Please
include more information about your environment such as the apparmor
package version and kernel version (/proc/version_signature).
Here's how I tested:
$ cmd="dbus-send --print-reply --system
@sles the supported way to move the entire profile and all subprofiles
into complain mode is via the aa-complain utility in the apparmor-utils
package. You may find that easier than manually adjusting individual
profile flags.
--
You received this bug notification because you are a member of Ubun
AppArmor has difficulties mediating filesystem access when overlayfs is
involved. That's a known issue but isn't one that is easily solved due
to the internal design of overlayfs and its use of private vfsmounts. It
also isn't something that we're planning to fix for the 17.10 cycle.
I thought tha
** Information type changed from Private Security to Public
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to coreutils in Ubuntu.
https://bugs.launchpad.net/bugs/717313
Title:
df reports negative disk usage
Status in coreut
On 07/05/2017 08:14 PM, Daniel Axtens wrote:
> Hi Tyler,
>
> Do you know what the changes between the ga-16.04 and hwe-16.04 kernel
> are that make apparmor+overlayfs work?
No, we're not currently aware of any code changes that would cause the
behavioral change that is reported in the bug. Now th
@fnordahl Hi! Let's keep the discussion about bug 1701297 in that bug
since it is focused on the change in behavior between the Xenial release
kernel and the HWE kernel. That's not what this bug is about. John is
investigating the change in behavior issue. Jamie's previous
investigations of overlay
John is going to build a test kernel, based on the ga-16.04 kernel, with
the binfmt_elf commit cherry-picked from the hwe-16.04. That will let
someone from the MAAS team attempt to reproduce the issue with the test
kernel and, if the deployment succeeds, it'll tell us that the
binfmt_elf commit is
@Andres One thing that I'm struggling with is why this bug hasn't been
seen before. IIUC, it should be present in the very first ga-16.04
kernel that Ubuntu 16.04 LTS was released with (in addition to earlier
kernels while Xenial was a development release). Has MAAS 2.1.x and
ga-16.04 kernels just
To elaborate a bit more, the apparmor and overlayfs incompatibility has
been a known kernel issue from before 16.04's release and, at this time,
isn't something that is likely to be fixed in 16.04. I'd like to better
understand if something changed in userspace that started tickling the
incompatibi
The attach_disconnected flag was added to the dnsmasq profile just
before 16.04 was released:
https://launchpad.net/ubuntu/+source/apparmor/2.10.95-0ubuntu2
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu
Hello - This is expected behavior. When a profile requested in the
changeprofile operation has not been loaded into the kernel, the write()
on /proc/PID/attr/current will fail with errno set to ENOENT.
This is documented in the aa_change_profile(2) man page:
ENOENT
The specifi
Hello - CVE-2015-1692 was assigned to Microsoft Internet Explorer and
does not affect Ubuntu.
It seems like you're requesting support rather than reporting a security
issue. Please see http://www.ubuntu.com/support for a number of support
options.
** CVE added: http://www.cve.mitre.org/cgi-
bin/c
Marking the lightdm as invalid as it seems, from Nathan's description,
that the issue is with light-locker.
** Changed in: lightdm (Ubuntu)
Status: New => Invalid
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to lightdm
HI Nathan - Thanks for the bug report. I'm going to make it public so
that more people can be aware of this issue in hopes that it'll get
attention.
** Information type changed from Private Security to Public Security
--
You received this bug notification because you are a member of Ubuntu
Touch
I've subscribed the light-locker devs team so that they're aware.
Note that bug 1473904 and bug 1440499 are similar light-locker bypass
issues.
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to lightdm in Ubuntu.
https://bugs.l
** Information type changed from Private Security to Public
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to xorg in Ubuntu.
https://bugs.launchpad.net/bugs/1514016
Title:
travamentos
Status in xorg package in Ubuntu:
New
** Information type changed from Private Security to Public
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to xorg in Ubuntu.
https://bugs.launchpad.net/bugs/1514031
Title:
i cannot boot
Status in xorg package in Ubuntu:
N
** Attachment removed: "JournalErrors.txt"
https://bugs.launchpad.net/ubuntu/+source/xorg/+bug/1514016/+attachment/4514553/+files/JournalErrors.txt
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to xorg in Ubuntu.
https://bu
Hi Bernd - Thanks for the bug report! While I think that this is
something that should be fixed upstream, I don't feel like it is a
security issue.
By running `python setup.py ...`, you're already trusting that setup.py
is not malicious. It could execute xmessage directly.
Do you know if there ar
Hi Cory and Kevin! The Ubuntu Security team (most of the work was done
by Marc Deslauriers) has actively fixed individual Python packages in
Ubuntu's main archive pocket that are vulnerable to certificate
verification flaws prior to the Python 2.7.9 change. While many packages
were already doing pr
@kwoot - please see comment #10 for python2.7 options that may be
available in 12.04 and 14.04 in the future. I wanted to point out to you
that python3.4 in 14.04 already has the ability to enable full
certification verification through the /etc/python3.4/cert-
verification.conf configuration file.
** Information type changed from Private Security to Public
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to initramfs-tools in Ubuntu.
https://bugs.launchpad.net/bugs/1539203
Title:
package linux-image-4.3.0-7-generic 4.3.0
101 - 200 of 593 matches
Mail list logo
