USN-2438-1: NVIDIA graphics drivers vulnerabilities

Releases

• Ubuntu 14.10
• Ubuntu 14.04 ESM
• Ubuntu 12.04

Packages

• nvidia-graphics-drivers-304 - NVIDIA binary Xorg driver
• nvidia-graphics-drivers-304-updates - NVIDIA binary Xorg driver
• nvidia-graphics-drivers-331 - NVIDIA binary Xorg driver
• nvidia-graphics-drivers-331-updates - NVIDIA binary Xorg driver

Details

It was discovered that the NVIDIA graphics drivers incorrectly handled GLX
indirect rendering support. An attacker able to connect to an X server,
either locally or remotely, could use these issues to cause the X server to
crash or execute arbitrary code resulting in possible privilege escalation.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.10

• nvidia-304 - 304.125-0ubuntu0.1
• nvidia-304-updates - 304.125-0ubuntu0.1
• nvidia-331 - 331.113-0ubuntu0.1
• nvidia-331-updates - 331.113-0ubuntu0.1

Ubuntu 14.04

• nvidia-304 - 304.125-0ubuntu0.0.1
• nvidia-304-updates - 304.125-0ubuntu0.0.1
• nvidia-331 - 331.113-0ubuntu0.0.4
• nvidia-331-updates - 331.113-0ubuntu0.0.4

Ubuntu 12.04

• nvidia-304 - 304.125-0ubuntu0.0.0.1
• nvidia-304-updates - 304.125-0ubuntu0.0.0.1
• nvidia-331 - 331.113-0ubuntu0.0.0.3
• nvidia-331-updates - 331.113-0ubuntu0.0.0.3

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

• CVE-2014-8091
• CVE-2014-8098
• CVE-2014-8298

Related notices

• USN-2436-1: xserver-common, xserver-xorg-dev, xorg-server-lts-trusty, xdmx, xnest, xserver-xorg-core-lts-trusty, xvfb, xserver-xorg-core, xserver-xorg-xmir, xorg-server-source, xdmx-tools, xorg-server, xserver-xorg-core-udeb, xserver-xephyr