Aggregator

USN-3922-2: PHP vulnerabilities

2 days 6 hours ago
php5 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.04 LTS
Summary

Several security issues were fixed in PHP.

Software Description
  • php5 - HTML-embedded scripting language interpreter
Details

USN-3922-1 fixed vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 14.04 LTS.

It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to access sensitive information. (CVE-2019-9022)

It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2019-9675)

Original advisory details:

It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information. (CVE-2019-9637, CVE-2019-9638, CVE-2019-9639, CVE-2019-9640, CVE-2019-9641)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.04 LTS
libapache2-mod-php5 - 5.5.9+dfsg-1ubuntu4.29
php5-cgi - 5.5.9+dfsg-1ubuntu4.29
php5-cli - 5.5.9+dfsg-1ubuntu4.29
php5-fpm - 5.5.9+dfsg-1ubuntu4.29
php5-xmlrpc - 5.5.9+dfsg-1ubuntu4.29

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

USN-3953-1: PHP vulnerabilities

2 days 7 hours ago
php7.0, php7.2 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 19.04
  • Ubuntu 18.10
  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 LTS
Summary

Several security issues were fixed in PHP.

Software Description
  • php7.2 - HTML-embedded scripting language interpreter
  • php7.0 - HTML-embedded scripting language interpreter
Details

It was discovered that PHP incorrectly handled certain exif tags in JPEG images. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.04
libapache2-mod-php7.2 - 7.2.17-0ubuntu0.19.04.1
php7.2-cgi - 7.2.17-0ubuntu0.19.04.1
php7.2-cli - 7.2.17-0ubuntu0.19.04.1
php7.2-fpm - 7.2.17-0ubuntu0.19.04.1
Ubuntu 18.10
libapache2-mod-php7.2 - 7.2.17-0ubuntu0.18.10.1
php7.2-cgi - 7.2.17-0ubuntu0.18.10.1
php7.2-cli - 7.2.17-0ubuntu0.18.10.1
php7.2-fpm - 7.2.17-0ubuntu0.18.10.1
Ubuntu 18.04 LTS
libapache2-mod-php7.2 - 7.2.17-0ubuntu0.18.04.1
php7.2-cgi - 7.2.17-0ubuntu0.18.04.1
php7.2-cli - 7.2.17-0ubuntu0.18.04.1
php7.2-fpm - 7.2.17-0ubuntu0.18.04.1
Ubuntu 16.04 LTS
libapache2-mod-php7.0 - 7.0.33-0ubuntu0.16.04.4
php7.0-cgi - 7.0.33-0ubuntu0.16.04.4
php7.0-cli - 7.0.33-0ubuntu0.16.04.4
php7.0-fpm - 7.0.33-0ubuntu0.16.04.4

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In Ubuntu 18.04 LTS, Ubuntu 18.10, and Ubuntu 19.04, this update uses a new upstream release, which includes additional bug fixes.

In general, a standard system update will make all the necessary changes.

References

USN-3952-1: Pacemaker vulnerabilities

2 days 7 hours ago
pacemaker vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 19.04
  • Ubuntu 18.10
  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 LTS
Summary

Several security issues were fixed in Pacemaker.

Software Description
  • pacemaker - Cluster resource manager
Details

Jan Pokorný discovered that Pacemaker incorrectly handled client-server authentication. A local attacker could possibly use this issue to escalate privileges. (CVE-2018-16877)

Jan Pokorný discovered that Pacemaker incorrectly handled certain verifications. A local attacker could possibly use this issue to cause a denial of service. (CVE-2018-16878)

Jan Pokorný discovered that Pacemaker incorrectly handled certain memory operations. A local attacker could possibly use this issue to obtain sensitive information in log outputs. This issue only applied to Ubuntu 18.04 LTS, Ubuntu 18.10, and Ubuntu 19.04. (CVE-2019-3885)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.04
pacemaker - 1.1.18-2ubuntu1.19.04.1
Ubuntu 18.10
pacemaker - 1.1.18-2ubuntu1.18.10.1
Ubuntu 18.04 LTS
pacemaker - 1.1.18-0ubuntu1.1
Ubuntu 16.04 LTS
pacemaker - 1.1.14-2ubuntu1.6

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

USN-3951-1: Dovecot vulnerability

2 days 7 hours ago
dovecot vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 19.04
  • Ubuntu 18.10
Summary

Dovecot could be made to crash if it received specially crafted network traffic.

Software Description
  • dovecot - IMAP and POP3 email server
Details

It was discovered that the Dovecot JSON encoder incorrectly handled certain invalid UTF-8 characters. A remote attacker could possibly use this issue to cause Dovecot to repeatedly crash, resulting in a denial of service.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.04
dovecot-core - 1:2.3.4.1-1ubuntu2.1
Ubuntu 18.10
dovecot-core - 1:2.3.2.1-1ubuntu3.3

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References