Ubuntu Security Advisories

USN-4017-1: Linux kernel vulnerabilities

5 hours 48 minutes ago
linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-hwe, linux-kvm, linux-oem, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 19.04
  • Ubuntu 18.10
  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 LTS
Summary

The system could be made to crash if it received specially crafted network traffic.

Software Description
  • linux - Linux kernel
  • linux-aws - Linux kernel for Amazon Web Services (AWS) systems
  • linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems
  • linux-kvm - Linux kernel for cloud environments
  • linux-raspi2 - Linux kernel for Raspberry Pi 2
  • linux-snapdragon - Linux kernel for Snapdragon processors
  • linux-azure - Linux kernel for Microsoft Azure Cloud systems
  • linux-hwe - Linux hardware enablement (HWE) kernel
  • linux-oem - Linux kernel for OEM processors
  • linux-oracle - Linux kernel for Oracle Cloud systems
  • linux-aws-hwe - Linux kernel for Amazon Web Services (AWS-HWE) systems
Details

Jonathan Looney discovered that the TCP retransmission queue implementation in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. (CVE-2019-11478)

Jonathan Looney discovered that an integer overflow existed in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service (system crash). (CVE-2019-11477)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.04
linux-image-5.0.0-1008-aws - 5.0.0-1008.8
linux-image-5.0.0-1008-gcp - 5.0.0-1008.8
linux-image-5.0.0-1008-kvm - 5.0.0-1008.8
linux-image-5.0.0-1010-raspi2 - 5.0.0-1010.10
linux-image-5.0.0-1014-snapdragon - 5.0.0-1014.14
linux-image-5.0.0-17-generic - 5.0.0-17.18
linux-image-5.0.0-17-generic-lpae - 5.0.0-17.18
linux-image-5.0.0-17-lowlatency - 5.0.0-17.18
linux-image-aws - 5.0.0.1008.8
linux-image-gcp - 5.0.0.1008.8
linux-image-generic - 5.0.0.17.18
linux-image-generic-lpae - 5.0.0.17.18
linux-image-gke - 5.0.0.1008.8
linux-image-kvm - 5.0.0.1008.8
linux-image-lowlatency - 5.0.0.17.18
linux-image-raspi2 - 5.0.0.1010.7
linux-image-snapdragon - 5.0.0.1014.7
linux-image-virtual - 5.0.0.17.18
Ubuntu 18.10
linux-image-4.18.0-1013-gcp - 4.18.0-1013.14
linux-image-4.18.0-1014-kvm - 4.18.0-1014.14
linux-image-4.18.0-1016-raspi2 - 4.18.0-1016.18
linux-image-4.18.0-1018-aws - 4.18.0-1018.20
linux-image-4.18.0-1020-azure - 4.18.0-1020.20
linux-image-4.18.0-22-generic - 4.18.0-22.23
linux-image-4.18.0-22-generic-lpae - 4.18.0-22.23
linux-image-4.18.0-22-lowlatency - 4.18.0-22.23
linux-image-4.18.0-22-snapdragon - 4.18.0-22.23
linux-image-aws - 4.18.0.1018.18
linux-image-azure - 4.18.0.1020.21
linux-image-gcp - 4.18.0.1013.13
linux-image-generic - 4.18.0.22.23
linux-image-generic-lpae - 4.18.0.22.23
linux-image-gke - 4.18.0.1013.13
linux-image-kvm - 4.18.0.1014.14
linux-image-lowlatency - 4.18.0.22.23
linux-image-raspi2 - 4.18.0.1016.13
linux-image-snapdragon - 4.18.0.22.23
linux-image-virtual - 4.18.0.22.23
Ubuntu 18.04 LTS
linux-image-4.15.0-1015-oracle - 4.15.0-1015.17
linux-image-4.15.0-1034-gcp - 4.15.0-1034.36
linux-image-4.15.0-1036-kvm - 4.15.0-1036.36
linux-image-4.15.0-1038-raspi2 - 4.15.0-1038.40
linux-image-4.15.0-1041-aws - 4.15.0-1041.43
linux-image-4.15.0-1043-oem - 4.15.0-1043.48
linux-image-4.15.0-1055-snapdragon - 4.15.0-1055.59
linux-image-4.15.0-52-generic - 4.15.0-52.56
linux-image-4.15.0-52-generic-lpae - 4.15.0-52.56
linux-image-4.15.0-52-lowlatency - 4.15.0-52.56
linux-image-4.18.0-1020-azure - 4.18.0-1020.20~18.04.1
linux-image-4.18.0-22-generic - 4.18.0-22.23~18.04.1
linux-image-4.18.0-22-generic-lpae - 4.18.0-22.23~18.04.1
linux-image-4.18.0-22-lowlatency - 4.18.0-22.23~18.04.1
linux-image-4.18.0-22-snapdragon - 4.18.0-22.23~18.04.1
linux-image-aws - 4.15.0.1041.40
linux-image-azure - 4.18.0.1020.19
linux-image-gcp - 4.15.0.1034.36
linux-image-generic - 4.15.0.52.54
linux-image-generic-hwe-18.04 - 4.18.0.22.72
linux-image-generic-lpae - 4.15.0.52.54
linux-image-generic-lpae-hwe-18.04 - 4.18.0.22.72
linux-image-kvm - 4.15.0.1036.36
linux-image-lowlatency - 4.15.0.52.54
linux-image-lowlatency-hwe-18.04 - 4.18.0.22.72
linux-image-oem - 4.15.0.1043.47
linux-image-oracle - 4.15.0.1015.18
linux-image-raspi2 - 4.15.0.1038.36
linux-image-snapdragon - 4.15.0.1055.58
linux-image-snapdragon-hwe-18.04 - 4.18.0.22.72
linux-image-virtual - 4.15.0.52.54
linux-image-virtual-hwe-18.04 - 4.18.0.22.72
Ubuntu 16.04 LTS
linux-image-4.15.0-1015-oracle - 4.15.0-1015.17~16.04.1
linux-image-4.15.0-1034-gcp - 4.15.0-1034.36~16.04.1
linux-image-4.15.0-1041-aws - 4.15.0-1041.43~16.04.1
linux-image-4.15.0-1047-azure - 4.15.0-1047.51
linux-image-4.15.0-52-generic - 4.15.0-52.56~16.04.1
linux-image-4.15.0-52-generic-lpae - 4.15.0-52.56~16.04.1
linux-image-4.15.0-52-lowlatency - 4.15.0-52.56~16.04.1
linux-image-4.4.0-1048-kvm - 4.4.0-1048.55
linux-image-4.4.0-1085-aws - 4.4.0-1085.96
linux-image-4.4.0-1111-raspi2 - 4.4.0-1111.120
linux-image-4.4.0-1115-snapdragon - 4.4.0-1115.121
linux-image-4.4.0-151-generic - 4.4.0-151.178
linux-image-4.4.0-151-generic-lpae - 4.4.0-151.178
linux-image-4.4.0-151-lowlatency - 4.4.0-151.178
linux-image-4.4.0-151-powerpc-e500mc - 4.4.0-151.178
linux-image-4.4.0-151-powerpc-smp - 4.4.0-151.178
linux-image-4.4.0-151-powerpc64-emb - 4.4.0-151.178
linux-image-4.4.0-151-powerpc64-smp - 4.4.0-151.178
linux-image-aws - 4.4.0.1085.88
linux-image-aws-hwe - 4.15.0.1041.41
linux-image-azure - 4.15.0.1047.51
linux-image-gcp - 4.15.0.1034.48
linux-image-generic - 4.4.0.151.159
linux-image-generic-hwe-16.04 - 4.15.0.52.73
linux-image-generic-lpae - 4.4.0.151.159
linux-image-generic-lpae-hwe-16.04 - 4.15.0.52.73
linux-image-gke - 4.15.0.1034.48
linux-image-kvm - 4.4.0.1048.48
linux-image-lowlatency - 4.4.0.151.159
linux-image-lowlatency-hwe-16.04 - 4.15.0.52.73
linux-image-oem - 4.15.0.52.73
linux-image-oracle - 4.15.0.1015.9
linux-image-powerpc-e500mc - 4.4.0.151.159
linux-image-powerpc-smp - 4.4.0.151.159
linux-image-powerpc64-emb - 4.4.0.151.159
linux-image-powerpc64-smp - 4.4.0.151.159
linux-image-raspi2 - 4.4.0.1111.111
linux-image-snapdragon - 4.4.0.1115.107
linux-image-virtual - 4.4.0.151.159
linux-image-virtual-hwe-16.04 - 4.15.0.52.73

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well.

References

USN-4017-2: Linux kernel vulnerabilities

9 hours 1 minute ago
linux, linux-aws, linux-azure, linux-lts-trusty, linux-lts-xenial vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 ESM
  • Ubuntu 12.04 ESM
Summary

The system could be made to crash if it received specially crafted network traffic.

Software Description
  • linux - Linux kernel
  • linux-aws - Linux kernel for Amazon Web Services (AWS) systems
  • linux-azure - Linux kernel for Microsoft Azure Cloud systems
  • linux-lts-xenial - Linux hardware enablement kernel from Xenial for Trusty
  • linux-lts-trusty - Linux hardware enablement kernel from Trusty for Precise ESM
Details

USN-4017-1 fixed vulnerabilities in the Linux kernel for Ubuntu. This update provides the corresponding updates for the Linux kernel for Ubuntu 16.04 ESM and Ubuntu 14.04 ESM.

Jonathan Looney discovered that the TCP retransmission queue implementation in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of service. (CVE-2019-11478)

Jonathan Looney discovered that an integer overflow existed in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service (system crash). (CVE-2019-11477)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.04 ESM
linux-image-3.13.0-171-generic - 3.13.0-171.222
linux-image-3.13.0-171-generic-lpae - 3.13.0-171.222
linux-image-3.13.0-171-lowlatency - 3.13.0-171.222
linux-image-4.15.0-1047-azure - 4.15.0-1047.51~14.04.1
linux-image-4.4.0-1046-aws - 4.4.0-1046.50
linux-image-4.4.0-151-generic - 4.4.0-151.178~14.04.1
linux-image-4.4.0-151-generic-lpae - 4.4.0-151.178~14.04.1
linux-image-4.4.0-151-lowlatency - 4.4.0-151.178~14.04.1
linux-image-aws - 4.4.0.1046.47
linux-image-azure - 4.15.0.1047.34
linux-image-generic - 3.13.0.171.182
linux-image-generic-lpae - 3.13.0.171.182
linux-image-generic-lpae-lts-xenial - 4.4.0.151.133
linux-image-generic-lts-xenial - 4.4.0.151.133
linux-image-lowlatency-lts-xenial - 4.4.0.151.133
Ubuntu 12.04 ESM
linux-image-3.13.0-171-generic - 3.13.0-171.222~12.04.1
linux-image-3.13.0-171-generic-lpae - 3.13.0-171.222~12.04.1
linux-image-3.13.0-171-lowlatency - 3.13.0-171.222~12.04.1
linux-image-3.2.0-141-generic - 3.2.0-141.188
linux-image-generic - 3.2.0.141.156
linux-image-generic-lpae-lts-trusty - 3.13.0.171.159
linux-image-generic-lts-trusty - 3.13.0.171.159

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well.

References

USN-3991-3: Firefox regression

3 days 6 hours ago
firefox regression

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 19.04
  • Ubuntu 18.10
  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 LTS
Summary

USN-3991-2 caused a regression in Firefox

Software Description
  • firefox - Mozilla Open Source web browser
Details

USN-3991-1 fixed vulnerabilities in Firefox, and USN-3991-2 fixed a subsequent regression. The update caused an additional regression that resulted in Firefox failing to load correctly after executing it in safe mode. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, trick the user in to launching local executable binaries, obtain sensitive information, conduct cross-site scripting (XSS) attacks, or execute arbitrary code. (CVE-2019-11691, CVE-2019-11692, CVE-2019-11693, CVE-2019-11695, CVE-2019-11696, CVE-2019-11699, CVE-2019-11701, CVE-2019-7317, CVE-2019-9800, CVE-2019-9814, CVE-2019-9817, CVE-2019-9819, CVE-2019-9820, CVE-2019-9821)

It was discovered that pressing certain key combinations could bypass addon installation prompt delays. If a user opened a specially crafted website, an attacker could potentially exploit this to trick them in to installing a malicious extension. (CVE-2019-11697)

It was discovered that history data could be exposed via drag and drop of hyperlinks to and from bookmarks. If a user were tricked in to dragging a specially crafted hyperlink to the bookmark toolbar or sidebar, and subsequently back in to the web content area, an attacker could potentially exploit this to obtain sensitive information. (CVE-2019-11698)

A type confusion bug was discovered with object groups and UnboxedObjects. If a user were tricked in to opening a specially crafted website after enabling the UnboxedObjects feature, an attacker could potentially exploit this to bypass security checks. (CVE-2019-9816)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.04
firefox - 67.0.2+build2-0ubuntu0.19.04.1
Ubuntu 18.10
firefox - 67.0.2+build2-0ubuntu0.18.10.1
Ubuntu 18.04 LTS
firefox - 67.0.2+build2-0ubuntu0.18.04.1
Ubuntu 16.04 LTS
firefox - 67.0.2+build2-0ubuntu0.16.04.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Firefox to make all the necessary changes.

References

USN-4015-2: DBus vulnerability

5 days 12 hours ago
dbus vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 ESM
  • Ubuntu 12.04 ESM
Summary

DBus could allow unintended access to services.

Software Description
  • dbus - simple interprocess messaging system
Details

USN-4015-1 fixed a vulnerability in DBus. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

Joe Vennix discovered that DBus incorrectly handled DBUS_COOKIE_SHA1 authentication. A local attacker could possibly use this issue to bypass authentication and connect to DBus servers with elevated privileges.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.04 ESM
dbus - 1.6.18-0ubuntu4.5+esm1
libdbus-1-3 - 1.6.18-0ubuntu4.5+esm1
Ubuntu 12.04 ESM
dbus - 1.4.18-1ubuntu1.9
libdbus-1-3 - 1.4.18-1ubuntu1.9

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make all the necessary changes.

References

USN-4016-2: Neovim vulnerability

6 days 8 hours ago
Neovim vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 19.04
  • Ubuntu 18.10
Summary

Neovim could be made to run programs as your login if it opened a specially crafted file.

Software Description
  • neovim - heavily refactored vim fork
Details

It was discovered that Neovim incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2019-12735)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.04
neovim - 0.3.4-1ubuntu0.19.04.1
neovim-runtime - 0.3.4-1ubuntu0.19.04.1
Ubuntu 18.10
neovim - 0.3.1-1ubuntu0.1
neovim-runtime - 0.3.1-1ubuntu0.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

USN-4016-1: Vim vulnerabilities

6 days 9 hours ago
vim vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 19.04
  • Ubuntu 18.10
  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 LTS
Summary

Several security issues were fixed in Vim.

Software Description
  • vim - Vi IMproved - enhanced vi editor
Details

It was discovered that Vim incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-5953)

It was discovered that Vim incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2019-12735)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.04
vim - 2:8.1.0320-1ubuntu3.1
vim-common - 2:8.1.0320-1ubuntu3.1
vim-gui-common - 2:8.1.0320-1ubuntu3.1
vim-runtime - 2:8.1.0320-1ubuntu3.1
Ubuntu 18.10
vim - 2:8.0.1766-1ubuntu1.1
vim-common - 2:8.0.1766-1ubuntu1.1
vim-gui-common - 2:8.0.1766-1ubuntu1.1
vim-runtime - 2:8.0.1766-1ubuntu1.1
Ubuntu 18.04 LTS
vim - 2:8.0.1453-1ubuntu1.1
vim-common - 2:8.0.1453-1ubuntu1.1
vim-gui-common - 2:8.0.1453-1ubuntu1.1
vim-runtime - 2:8.0.1453-1ubuntu1.1
Ubuntu 16.04 LTS
vim - 2:7.4.1689-3ubuntu1.3
vim-common - 2:7.4.1689-3ubuntu1.3
vim-gui-common - 2:7.4.1689-3ubuntu1.3
vim-runtime - 2:7.4.1689-3ubuntu1.3

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

USN-4015-1: DBus vulnerability

6 days 10 hours ago
dbus vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 19.04
  • Ubuntu 18.10
  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 LTS
Summary

DBus could allow unintended access to services.

Software Description
  • dbus - simple interprocess messaging system
Details

Joe Vennix discovered that DBus incorrectly handled DBUS_COOKIE_SHA1 authentication. A local attacker could possibly use this issue to bypass authentication and connect to DBus servers with elevated privileges.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.04
dbus - 1.12.12-1ubuntu1.1
libdbus-1-3 - 1.12.12-1ubuntu1.1
Ubuntu 18.10
dbus - 1.12.10-1ubuntu2.1
libdbus-1-3 - 1.12.10-1ubuntu2.1
Ubuntu 18.04 LTS
dbus - 1.12.2-1ubuntu1.1
libdbus-1-3 - 1.12.2-1ubuntu1.1
Ubuntu 16.04 LTS
dbus - 1.10.6-1ubuntu3.4
libdbus-1-3 - 1.10.6-1ubuntu3.4

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make all the necessary changes.

References

USN-4014-2: GLib vulnerability

6 days 15 hours ago
glib2.0 vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 ESM
  • Ubuntu 12.04 ESM
Summary

GLib could be made to expose sensitive information if it received a specially crafted file.

Software Description
  • glib2.0 - GLib Input, Output and Streaming Library (fam module)
Details

USN-4014-1 fixed a vulnerability in GLib. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that GLib incorrectly handled certain files. An attacker could possibly use this issue to access sensitive information.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.04 ESM
libglib2.0-0 - 2.40.2-0ubuntu1.1+esm1
libglib2.0-bin - 2.40.2-0ubuntu1.1+esm1
libglib2.0-dev - 2.40.2-0ubuntu1.1+esm1
Ubuntu 12.04 ESM
libglib2.0-0 - 2.32.4-0ubuntu1.2
libglib2.0-bin - 2.32.4-0ubuntu1.2
libglib2.0-dev - 2.32.4-0ubuntu1.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

USN-4014-1: GLib vulnerability

1 week ago
glib2.0 vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 19.04
  • Ubuntu 18.10
  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 LTS
Summary

GLib could be made to expose sensitive information if it received a specially crafted file.

Software Description
  • glib2.0 - GLib library of C routines
Details

It was discovered that GLib incorrectly handled certain files. An attacker could possibly use this issue to access sensitive information.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.04
libglib2.0-0 - 2.60.0-1ubuntu0.1
libglib2.0-bin - 2.60.0-1ubuntu0.1
libglib2.0-dev - 2.60.0-1ubuntu0.1
Ubuntu 18.10
libglib2.0-0 - 2.58.1-2ubuntu0.1
libglib2.0-bin - 2.58.1-2ubuntu0.1
libglib2.0-dev - 2.58.1-2ubuntu0.1
Ubuntu 18.04 LTS
libglib2.0-0 - 2.56.4-0ubuntu0.18.04.3
libglib2.0-bin - 2.56.4-0ubuntu0.18.04.3
libglib2.0-dev - 2.56.4-0ubuntu0.18.04.3
Ubuntu 16.04 LTS
libglib2.0-0 - 2.48.2-0ubuntu4.2
libglib2.0-bin - 2.48.2-0ubuntu4.2
libglib2.0-dev - 2.48.2-0ubuntu4.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

USN-4013-1: libsndfile vulnerabilities

1 week ago
libsndfile vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 18.10
  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 LTS
Summary

Several security issues were fixed in libsndfile.

Software Description
  • libsndfile - Library for reading/writing audio files
Details

It was discovered that libsndfile incorrectly handled certain malformed files. A remote attacker could use this issue to cause libsndfile to crash, resulting in a denial of service, or possibly execute arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.10
libsndfile1 - 1.0.28-4ubuntu0.18.10.1
Ubuntu 18.04 LTS
libsndfile1 - 1.0.28-4ubuntu0.18.04.1
Ubuntu 16.04 LTS
libsndfile1 - 1.0.25-10ubuntu0.16.04.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart your session to make all the necessary changes.

References

USN-4012-1: elfutils vulnerabilities

1 week ago
elfutils vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 18.10
  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 LTS
Summary

Several security issues were fixed in elfutils.

Software Description
  • elfutils - collection of utilities to handle ELF objects
Details

It was discovered that elfutils incorrectly handled certain malformed files. If a user or automated system were tricked into processing a specially crafted file, elfutils could be made to crash or consume resources, resulting in a denial of service.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.10
elfutils - 0.170-0.5.0ubuntu1.1
libasm1 - 0.170-0.5.0ubuntu1.1
libdw1 - 0.170-0.5.0ubuntu1.1
libelf1 - 0.170-0.5.0ubuntu1.1
Ubuntu 18.04 LTS
elfutils - 0.170-0.4ubuntu0.1
libasm1 - 0.170-0.4ubuntu0.1
libdw1 - 0.170-0.4ubuntu0.1
libelf1 - 0.170-0.4ubuntu0.1
Ubuntu 16.04 LTS
elfutils - 0.165-3ubuntu1.2
libasm1 - 0.165-3ubuntu1.2
libdw1 - 0.165-3ubuntu1.2
libelf1 - 0.165-3ubuntu1.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

USN-4008-3: Linux kernel (Xenial HWE) vulnerabilities

1 week 3 days ago
linux-lts-xenial, linux-aws vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 ESM
Summary

Several security issues were fixed in the Linux kernel.

Software Description
  • linux-aws - Linux kernel for Amazon Web Services (AWS) systems
  • linux-lts-xenial - Linux hardware enablement kernel from Xenial for Trusty
Details

USN-4008-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 ESM.

Robert Święcki discovered that the Linux kernel did not properly apply Address Space Layout Randomization (ASLR) in some situations for setuid elf binaries. A local attacker could use this to improve the chances of exploiting an existing vulnerability in a setuid elf binary. (CVE-2019-11190)

It was discovered that a null pointer dereference vulnerability existed in the LSI Logic MegaRAID driver in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-11810)

It was discovered that a race condition leading to a use-after-free existed in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel. The RDS protocol is blacklisted by default in Ubuntu. If enabled, a local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-11815)

Federico Manuel Bento discovered that the Linux kernel did not properly apply Address Space Layout Randomization (ASLR) in some situations for setuid a.out binaries. A local attacker could use this to improve the chances of exploiting an existing vulnerability in a setuid a.out binary. (CVE-2019-11191)

As a hardening measure, this update disables a.out support.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.04 ESM
linux-image-4.4.0-1045-aws - 4.4.0-1045.48
linux-image-4.4.0-150-generic - 4.4.0-150.176~14.04.1
linux-image-4.4.0-150-generic-lpae - 4.4.0-150.176~14.04.1
linux-image-4.4.0-150-lowlatency - 4.4.0-150.176~14.04.1
linux-image-aws - 4.4.0.1045.46
linux-image-generic-lpae-lts-xenial - 4.4.0.150.132
linux-image-generic-lts-xenial - 4.4.0.150.132
linux-image-lowlatency-lts-xenial - 4.4.0.150.132

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well.

References

USN-3991-2: Firefox regression

1 week 4 days ago
firefox regression

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 19.04
  • Ubuntu 18.10
  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 LTS
Summary

USN-3991-1 caused a regression in Firefox.

Software Description
  • firefox - Mozilla Open Source web browser
Details

USN-3991-1 fixed vulnerabilities in Firefox. The update caused a regression which resulted in issues when upgrading between Ubuntu releases. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, trick the user in to launching local executable binaries, obtain sensitive information, conduct cross-site scripting (XSS) attacks, or execute arbitrary code. (CVE-2019-11691, CVE-2019-11692, CVE-2019-11693, CVE-2019-11695, CVE-2019-11696, CVE-2019-11699, CVE-2019-11701, CVE-2019-7317, CVE-2019-9800, CVE-2019-9814, CVE-2019-9817, CVE-2019-9819, CVE-2019-9820, CVE-2019-9821)

It was discovered that pressing certain key combinations could bypass addon installation prompt delays. If a user opened a specially crafted website, an attacker could potentially exploit this to trick them in to installing a malicious extension. (CVE-2019-11697)

It was discovered that history data could be exposed via drag and drop of hyperlinks to and from bookmarks. If a user were tricked in to dragging a specially crafted hyperlink to the bookmark toolbar or sidebar, and subsequently back in to the web content area, an attacker could potentially exploit this to obtain sensitive information. (CVE-2019-11698)

A type confusion bug was discovered with object groups and UnboxedObjects. If a user were tricked in to opening a specially crafted website after enabling the UnboxedObjects feature, an attacker could potentially exploit this to bypass security checks. (CVE-2019-9816)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.04
firefox - 67.0.1+build1-0ubuntu0.19.04.1
Ubuntu 18.10
firefox - 67.0.1+build1-0ubuntu0.18.10.1
Ubuntu 18.04 LTS
firefox - 67.0.1+build1-0ubuntu0.18.04.1
Ubuntu 16.04 LTS
firefox - 67.0.1+build1-0ubuntu0.16.04.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Firefox to make all the necessary changes.

References

USN-4011-2: Jinja2 vulnerabilities

1 week 4 days ago
jinja2 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 ESM
  • Ubuntu 12.04 ESM
Summary

Several security issues were fixed in Jinja2.

Software Description
  • jinja2 - small but fast and easy to use stand-alone template engine
Details

USN-4011-1 fixed several vulnerabilities in Jinja2. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

Olivier Dony discovered that Jinja incorrectly handled str.format. An attacker could possibly use this issue to escape the sandbox. (CVE-2016-10745)

Brian Welch discovered that Jinja incorrectly handled str.format_map. An attacker could possibly use this issue to escape the sandbox. (CVE-2019-10906)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.04 ESM
python-jinja2 - 2.7.2-2ubuntu0.1~esm1
python3-jinja2 - 2.7.2-2ubuntu0.1~esm1
Ubuntu 12.04 ESM
python-jinja2 - 2.6-1ubuntu0.2
python3-jinja2 - 2.6-1ubuntu0.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

USN-4011-1: Jinja2 vulnerabilities

1 week 4 days ago
jinja2 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 19.04
  • Ubuntu 18.10
  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 LTS
Summary

Several security issues were fixed in Jinja2.

Software Description
  • jinja2 - small but fast and easy to use stand-alone template engine
Details

Olivier Dony discovered that Jinja incorrectly handled str.format. An attacker could possibly use this issue to escape the sandbox. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-10745)

Brian Welch discovered that Jinja incorrectly handled str.format_map. An attacker could possibly use this issue to escape the sandbox. (CVE-2019-10906)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.04
python-jinja2 - 2.10-1ubuntu0.19.04.1
python3-jinja2 - 2.10-1ubuntu0.19.04.1
Ubuntu 18.10
python-jinja2 - 2.10-1ubuntu0.18.10.1
python3-jinja2 - 2.10-1ubuntu0.18.10.1
Ubuntu 18.04 LTS
python-jinja2 - 2.10-1ubuntu0.18.04.1
python3-jinja2 - 2.10-1ubuntu0.18.04.1
Ubuntu 16.04 LTS
python-jinja2 - 2.8-1ubuntu0.1
python3-jinja2 - 2.8-1ubuntu0.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

USN-4008-2: AppArmor update

1 week 5 days ago
apparmor update

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 16.04 LTS
Summary

Several policy updates were made for running under the recently updated Linux kernel.

Software Description
  • apparmor - Linux security system
Details

USN-4008-1 fixed multiple security issues in the Linux kernel. This update provides the corresponding changes to AppArmor policy for correctly operating under the Linux kernel with fixes for CVE-2019-11190. Without these changes, some profile transitions may be unintentionally denied due to missing mmap (’m’) rules.

Original advisory details:

Robert Święcki discovered that the Linux kernel did not properly apply Address Space Layout Randomization (ASLR) in some situations for setuid elf binaries. A local attacker could use this to improve the chances of exploiting an existing vulnerability in a setuid elf binary. (CVE-2019-11190)

It was discovered that a null pointer dereference vulnerability existed in the LSI Logic MegaRAID driver in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-11810)

It was discovered that a race condition leading to a use-after-free existed in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel. The RDS protocol is blacklisted by default in Ubuntu. If enabled, a local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-11815)

Federico Manuel Bento discovered that the Linux kernel did not properly apply Address Space Layout Randomization (ASLR) in some situations for setuid a.out binaries. A local attacker could use this to improve the chances of exploiting an existing vulnerability in a setuid a.out binary. (CVE-2019-11191)

As a hardening measure, this update disables a.out support.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 16.04 LTS
apparmor-profiles - 2.10.95-0ubuntu2.11
python3-apparmor - 2.10.95-0ubuntu2.11

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

USN-3957-3: MariaDB vulnerabilities

1 week 5 days ago
mariadb-10.1 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 18.04 LTS
Summary

Several security issues were fixed in MariaDB.

Software Description
  • mariadb-10.1 - MariaDB database
Details

USN-3957-1 fixed multiple vulnerabilities in MySQL. This update provides the corresponding fixes for CVE-2019-2614 and CVE-2019-2627 in MariaDB 10.1.

Ubuntu 18.04 LTS has been updated to MariaDB 10.1.40.

In addition to security fixes, the updated package contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information: https://mariadb.com/kb/en/library/mariadb-10140-changelog/ https://mariadb.com/kb/en/library/mariadb-10140-release-notes/

Original advisory details:

Multiple security issues were discovered in MySQL and this update includes a new upstream MySQL version to fix these issues.

Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 18.10, and Ubuntu 19.04 have been updated to MySQL 5.7.26.

In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.

Please see the following for more information: https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-26.html https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.04 LTS
mariadb-server - 1:10.1.40-0ubuntu0.18.04.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

This update uses a new upstream release, which includes additional bug fixes. In general, a standard system update will make all the necessary changes.

References

USN-4009-2: PHP vulnerabilities

1 week 5 days ago
php5 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 ESM
  • Ubuntu 12.04 ESM
Summary

Several security issues were fixed in PHP.

Software Description
  • php5 - HTML-embedded scripting language interpreter
Details

USN-4009-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that PHP incorrectly decoding certain MIME headers. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2019-11039)

It was discovered that PHP incorrectly handled certain exif tags in images. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-11040)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.04 ESM
libapache2-mod-php5 - 5.5.9+dfsg-1ubuntu4.29+esm3
php5-cgi - 5.5.9+dfsg-1ubuntu4.29+esm3
php5-cli - 5.5.9+dfsg-1ubuntu4.29+esm3
php5-fpm - 5.5.9+dfsg-1ubuntu4.29+esm3
Ubuntu 12.04 ESM
libapache2-mod-php5 - 5.3.10-1ubuntu3.37
php5-cgi - 5.3.10-1ubuntu3.37
php5-cli - 5.3.10-1ubuntu3.37
php5-fpm - 5.3.10-1ubuntu3.37

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

USN-4010-1: Exim vulnerability

1 week 5 days ago
exim4 vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 18.10
  • Ubuntu 18.04 LTS
Summary

Exim could be made to run commands if it received specially crafted network traffic.

Software Description
  • exim4 - Exim is a mail transport agent
Details

It was discovered that Exim incorrectly handled certain decoding operations. A remote attacker could possibly use this issue to execute arbitrary commands.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.10
exim4-daemon-heavy - 4.91-6ubuntu1.1
exim4-daemon-light - 4.91-6ubuntu1.1
Ubuntu 18.04 LTS
exim4-daemon-heavy - 4.90.1-1ubuntu1.2
exim4-daemon-light - 4.90.1-1ubuntu1.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

USN-4009-1: PHP vulnerabilities

1 week 5 days ago
php7.0, php7.2 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 19.04
  • Ubuntu 18.10
  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 LTS
Summary

Several security issues were fixed in PHP.

Software Description
  • php7.2 - HTML-embedded scripting language interpreter
  • php7.0 - HTML-embedded scripting language interpreter
Details

It was discovered that PHP incorrectly handled certain exif tags in images. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2019-11036)

It was discovered that PHP incorrectly decoding certain MIME headers. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2019-11039)

It was discovered that PHP incorrectly handled certain exif tags in images. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-11040)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.04
libapache2-mod-php7.2 - 7.2.19-0ubuntu0.19.04.1
php7.2-cgi - 7.2.19-0ubuntu0.19.04.1
php7.2-cli - 7.2.19-0ubuntu0.19.04.1
php7.2-fpm - 7.2.19-0ubuntu0.19.04.1
Ubuntu 18.10
libapache2-mod-php7.2 - 7.2.19-0ubuntu0.18.10.1
php7.2-cgi - 7.2.19-0ubuntu0.18.10.1
php7.2-cli - 7.2.19-0ubuntu0.18.10.1
php7.2-fpm - 7.2.19-0ubuntu0.18.10.1
Ubuntu 18.04 LTS
libapache2-mod-php7.2 - 7.2.19-0ubuntu0.18.04.1
php7.2-cgi - 7.2.19-0ubuntu0.18.04.1
php7.2-cli - 7.2.19-0ubuntu0.18.04.1
php7.2-fpm - 7.2.19-0ubuntu0.18.04.1
Ubuntu 16.04 LTS
libapache2-mod-php7.0 - 7.0.33-0ubuntu0.16.04.5
php7.0-cgi - 7.0.33-0ubuntu0.16.04.5
php7.0-cli - 7.0.33-0ubuntu0.16.04.5
php7.0-fpm - 7.0.33-0ubuntu0.16.04.5

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In Ubuntu 18.04 LTS, Ubuntu 18.10, and Ubuntu 19.04, this update uses a new upstream release, which includes additional bug fixes.

In general, a standard system update will make all the necessary changes.

References
Checked
51 minutes 28 seconds ago