Ubuntu
apparmor package

  1. Bug #1390592
  2. Comment #5

Comment 5 for bug 1390592

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package apparmor - 2.8.95~2430-0ubuntu5.1

---------------
apparmor (2.8.95~2430-0ubuntu5.1) trusty-security; urgency=medium

  * SECURITY UPDATE: An AppArmor profile compilation bug may result in
    applications being confined in a way that is inconsistent with the profile
    author's intent. The compilation bug is specific to certain combinations
    of AppArmor rule types and conditionals of those rule types.
    (LP: #1390592)
    - debian/patches/fix-esc-seq-interp.patch: Fix the profile compilation bug
      by limiting the number of bytes that are consumed when interpreting
      hexadecimal, octal, and decimal escape sequences
    - debian/patches/tests-allow-arbitrary-profile-names.patch,
      debian/patches/tests-add-ptrace-tests-for-lp1390592.patch: Add
      regression tests for the profile compilation bug
    - CVE-2014-1424
 -- Tyler Hicks <email address hidden> Fri, 14 Nov 2014 13:46:22 -0600