Ubuntu Secutity Notices
USN-4124-2: Exim vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 ESM
Exim could be made to run programs as an administrator if it received specially crafted network traffic.
Software Description- exim4 - Exim is a mail transport agent
USN-4124-1 fixed a vulnerability in Exim. This update provides the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
It was discovered that Exim incorrectly handled certain decoding operations. A remote attacker could possibly use this issue to execute arbitrary commands.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 14.04 ESM
- exim4-daemon-heavy - 4.82-3ubuntu2.4+esm1
- exim4-daemon-light - 4.82-3ubuntu2.4+esm1
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4134-1: IBus vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
IBus would allow local users to capture key strokes of other locally logged in users.
Software Description- ibus - Intelligent Input Bus - core
Simon McVittie discovered that IBus did not enforce appropriate access controls on its private D-Bus socket. A local unprivileged user who discovers the IBus socket address of another user could exploit this to capture the key strokes of the other user.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.04
- ibus - 1.5.19-1ubuntu2.1
- Ubuntu 18.04 LTS
- ibus - 1.5.17-3ubuntu5.1
- Ubuntu 16.04 LTS
- ibus - 1.5.11-1ubuntu2.2
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to reboot your computer to make all the necessary changes.
ReferencesUSN-4133-1: Wireshark vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Wireshark could be made to crash if it received specially crafted network traffic or input files.
Software Description- wireshark - network traffic analyzer
It was discovered that Wireshark improperly handled certain input. A remote or local attacker could cause Wireshark to crash by injecting malformed packets onto the wire or convincing someone to read a malformed packet trace file.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.04
- libwireshark-data - 2.6.10-1~ubuntu19.04.0
- libwireshark11 - 2.6.10-1~ubuntu19.04.0
- libwiretap8 - 2.6.10-1~ubuntu19.04.0
- libwscodecs2 - 2.6.10-1~ubuntu19.04.0
- libwsutil9 - 2.6.10-1~ubuntu19.04.0
- tshark - 2.6.10-1~ubuntu19.04.0
- wireshark - 2.6.10-1~ubuntu19.04.0
- wireshark-common - 2.6.10-1~ubuntu19.04.0
- wireshark-gtk - 2.6.10-1~ubuntu19.04.0
- wireshark-qt - 2.6.10-1~ubuntu19.04.0
- Ubuntu 18.04 LTS
- libwireshark-data - 2.6.10-1~ubuntu18.04.0
- libwireshark11 - 2.6.10-1~ubuntu18.04.0
- libwiretap8 - 2.6.10-1~ubuntu18.04.0
- libwscodecs2 - 2.6.10-1~ubuntu18.04.0
- libwsutil9 - 2.6.10-1~ubuntu18.04.0
- tshark - 2.6.10-1~ubuntu18.04.0
- wireshark - 2.6.10-1~ubuntu18.04.0
- wireshark-common - 2.6.10-1~ubuntu18.04.0
- wireshark-gtk - 2.6.10-1~ubuntu18.04.0
- wireshark-qt - 2.6.10-1~ubuntu18.04.0
- Ubuntu 16.04 LTS
- libwireshark-data - 2.6.10-1~ubuntu16.04.0
- libwireshark11 - 2.6.10-1~ubuntu16.04.0
- libwiretap8 - 2.6.10-1~ubuntu16.04.0
- libwscodecs2 - 2.6.10-1~ubuntu16.04.0
- libwsutil9 - 2.6.10-1~ubuntu16.04.0
- tshark - 2.6.10-1~ubuntu16.04.0
- wireshark - 2.6.10-1~ubuntu16.04.0
- wireshark-common - 2.6.10-1~ubuntu16.04.0
- wireshark-gtk - 2.6.10-1~ubuntu16.04.0
- wireshark-qt - 2.6.10-1~ubuntu16.04.0
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
This update uses a new upstream release, which includes additional bug fixes. In general, a standard system update will make all the necessary changes.
ReferencesUSN-4129-2: curl vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 ESM
- Ubuntu 12.04 ESM
curl could be made to crash or possibly execute arbitrary code if it incorrectly handled memory during TFTP transfers.
Software Description- curl - HTTP, HTTPS, and FTP client and client libraries
USN-4129-1 fixed a vulnerability in curl. This update provides the corresponding update for Ubuntu 12.04 ESM and 14.04 ESM.
Original advisory details:
Thomas Vegas discovered that curl incorrectly handled memory during TFTP transfers. A remote attacker could use this issue to crash curl, resulting in a denial of service, or possibly execute arbitrary code.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 14.04 ESM
- curl - 7.35.0-1ubuntu2.20+esm3
- libcurl3 - 7.35.0-1ubuntu2.20+esm3
- libcurl3-gnutls - 7.35.0-1ubuntu2.20+esm3
- libcurl3-nss - 7.35.0-1ubuntu2.20+esm3
- Ubuntu 12.04 ESM
- curl - 7.22.0-3ubuntu4.27
- libcurl3 - 7.22.0-3ubuntu4.27
- libcurl3-gnutls - 7.22.0-3ubuntu4.27
- libcurl3-nss - 7.22.0-3ubuntu4.27
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4132-2: Expat vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 ESM
- Ubuntu 12.04 ESM
Expat could be made to expose sensitive information if it received a specially crafted XML file.
Software Description- expat - XML parsing C library
USN-4132-1 fixed a vulnerability in Expat. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
It was discovered that Expat incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 14.04 ESM
- lib64expat1 - 2.1.0-4ubuntu1.4+esm2
- libexpat1 - 2.1.0-4ubuntu1.4+esm2
- Ubuntu 12.04 ESM
- lib64expat1 - 2.0.1-7.2ubuntu1.7
- libexpat1 - 2.0.1-7.2ubuntu1.7
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4132-1: Expat vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Expat could be made to expose sensitive information if it received a specially crafted XML file.
Software Description- expat - XML parsing C library
It was discovered that Expat incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.04
- libexpat1 - 2.2.6-1ubuntu0.19.5
- Ubuntu 18.04 LTS
- libexpat1 - 2.2.5-3ubuntu0.2
- Ubuntu 16.04 LTS
- lib64expat1 - 2.1.0-7ubuntu0.16.04.5
- libexpat1 - 2.1.0-7ubuntu0.16.04.5
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4131-1: VLC vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.04 LTS
Several security issues were fixed in VLC.
Software Description- vlc - multimedia player and streamer
It was discovered that VLC incorrectly handled certain media files. If a user were tricked into opening a specially-crafted file, a remote attacker could use this issue to cause VLC to crash, resulting in a denial of service, or possibly execute arbitrary code.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.04
- vlc - 3.0.8-0ubuntu19.04.1
- Ubuntu 18.04 LTS
- vlc - 3.0.8-0ubuntu18.04.1
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4130-1: WebKitGTK+ vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.04 LTS
Several security issues were fixed in WebKitGTK+.
Software Description- webkit2gtk - Web content engine library for GTK+
A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.04
- libjavascriptcoregtk-4.0-18 - 2.24.4-0ubuntu0.19.04.1
- libwebkit2gtk-4.0-37 - 2.24.4-0ubuntu0.19.04.1
- Ubuntu 18.04 LTS
- libjavascriptcoregtk-4.0-18 - 2.24.4-0ubuntu0.18.04.1
- libwebkit2gtk-4.0-37 - 2.24.4-0ubuntu0.18.04.1
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any applications that use WebKitGTK+, such as Epiphany, to make all the necessary changes.
ReferencesUSN-4129-1: curl vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Several security issues were fixed in curl.
Software Description- curl - HTTP, HTTPS, and FTP client and client libraries
Thomas Vegas discovered that curl incorrectly handled memory when using Kerberos over FTP. A remote attacker could use this issue to crash curl, resulting in a denial of service. (CVE-2019-5481)
Thomas Vegas discovered that curl incorrectly handled memory during TFTP transfers. A remote attacker could use this issue to crash curl, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-5482)
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.04
- curl - 7.64.0-2ubuntu1.2
- libcurl3-gnutls - 7.64.0-2ubuntu1.2
- libcurl3-nss - 7.64.0-2ubuntu1.2
- libcurl4 - 7.64.0-2ubuntu1.2
- Ubuntu 18.04 LTS
- curl - 7.58.0-2ubuntu3.8
- libcurl3-gnutls - 7.58.0-2ubuntu3.8
- libcurl3-nss - 7.58.0-2ubuntu3.8
- libcurl4 - 7.58.0-2ubuntu3.8
- Ubuntu 16.04 LTS
- curl - 7.47.0-1ubuntu2.14
- libcurl3 - 7.47.0-1ubuntu2.14
- libcurl3-gnutls - 7.47.0-1ubuntu2.14
- libcurl3-nss - 7.47.0-1ubuntu2.14
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4115-2: Linux kernel regression
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
USN 4115-1 introduced a regression in the Linux kernel.
Software Description- linux - Linux kernel
- linux-aws - Linux kernel for Amazon Web Services (AWS) systems
- linux-gke-4.15 - Linux kernel for Google Container Engine (GKE) systems
- linux-kvm - Linux kernel for cloud environments
- linux-oracle - Linux kernel for Oracle Cloud systems
- linux-raspi2 - Linux kernel for Raspberry Pi 2
- linux-aws-hwe - Linux kernel for Amazon Web Services (AWS-HWE) systems
- linux-azure - Linux kernel for Microsoft Azure Cloud systems
- linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems
- linux-hwe - Linux hardware enablement (HWE) kernel
USN 4115-1 fixed vulnerabilities in the Linux 4.15 kernel for Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. Unfortunately, as part of the update, a regression was introduced that caused a kernel crash when handling fragmented packets in some situations. This update addresses the issue.
We apologize for the inconvenience.
Original advisory details:
Hui Peng and Mathias Payer discovered that the Option USB High Speed driver in the Linux kernel did not properly validate metadata received from the device. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-19985)
Zhipeng Xie discovered that an infinite loop could triggered in the CFS Linux kernel process scheduler. A local attacker could possibly use this to cause a denial of service. (CVE-2018-20784)
It was discovered that the Intel Wi-Fi device driver in the Linux kernel did not properly validate certain Tunneled Direct Link Setup (TDLS). A physically proximate attacker could use this to cause a denial of service (Wi-Fi disconnect). (CVE-2019-0136)
It was discovered that the Bluetooth UART implementation in the Linux kernel did not properly check for missing tty operations. A local attacker could use this to cause a denial of service. (CVE-2019-10207)
Amit Klein and Benny Pinkas discovered that the Linux kernel did not sufficiently randomize IP ID values generated for connectionless networking protocols. A remote attacker could use this to track particular Linux devices. (CVE-2019-10638)
Amit Klein and Benny Pinkas discovered that the location of kernel addresses could be exposed by the implementation of connection-less network protocols in the Linux kernel. A remote attacker could possibly use this to assist in the exploitation of another vulnerability in the Linux kernel. (CVE-2019-10639)
It was discovered that an integer overflow existed in the Linux kernel when reference counting pages, leading to potential use-after-free issues. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-11487)
Jann Horn discovered that a race condition existed in the Linux kernel when performing core dumps. A local attacker could use this to cause a denial of service (system crash) or expose sensitive information. (CVE-2019-11599)
It was discovered that a null pointer dereference vulnerability existed in the LSI Logic MegaRAID driver in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-11810)
It was discovered that the GTCO tablet input driver in the Linux kernel did not properly bounds check the initial HID report sent by the device. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-13631)
Praveen Pandey discovered that the Linux kernel did not properly validate sent signals in some situations on PowerPC systems with transactional memory disabled. A local attacker could use this to cause a denial of service. (CVE-2019-13648)
It was discovered that the floppy driver in the Linux kernel did not properly validate meta data, leading to a buffer overread. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-14283)
It was discovered that the floppy driver in the Linux kernel did not properly validate ioctl() calls, leading to a division-by-zero. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-14284)
Tuba Yavuz discovered that a race condition existed in the DesignWare USB3 DRD Controller device driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service. (CVE-2019-14763)
It was discovered that an out-of-bounds read existed in the QLogic QEDI iSCSI Initiator Driver in the Linux kernel. A local attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2019-15090)
It was discovered that the Raremono AM/FM/SW radio device driver in the Linux kernel did not properly allocate memory, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2019-15211)
It was discovered at a double-free error existed in the USB Rio 500 device driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service. (CVE-2019-15212)
It was discovered that a race condition existed in the Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel, leading to a potential use-after-free. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-15214)
It was discovered that a race condition existed in the CPiA2 video4linux device driver for the Linux kernel, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-15215)
It was discovered that a race condition existed in the Softmac USB Prism54 device driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15220)
It was discovered that a use-after-free vulnerability existed in the AppleTalk implementation in the Linux kernel if an error occurs during initialization. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-15292)
Jason Wang discovered that an infinite loop vulnerability existed in the virtio net driver in the Linux kernel. A local attacker in a guest VM could possibly use this to cause a denial of service in the host system. (CVE-2019-3900)
Daniele Antonioli, Nils Ole Tippenhauer, and Kasper B. Rasmussen discovered that the Bluetooth protocol BR/EDR specification did not properly require sufficiently strong encryption key lengths. A physically proximate attacker could use this to expose sensitive information. (CVE-2019-9506)
It was discovered that a race condition existed in the USB YUREX device driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15216)
It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel made improper assumptions about the device characteristics. A physically proximate attacker could use this cause a denial of service (system crash). (CVE-2019-15218)
It was discovered that the Line 6 POD USB device driver in the Linux kernel did not properly validate data size information from the device. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15221)
Muyu Yu discovered that the CAN implementation in the Linux kernel in some situations did not properly restrict the field size when processing outgoing frames. A local attacker with CAP_NET_ADMIN privileges could use this to execute arbitrary code. (CVE-2019-3701)
Vladis Dronov discovered that the debug interface for the Linux kernel’s HID subsystem did not properly validate passed parameters in some situations. A local privileged attacker could use this to cause a denial of service (infinite loop). (CVE-2019-3819)
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 18.04 LTS
- linux-image-4.15.0-1023-oracle - 4.15.0-1023.26
- linux-image-4.15.0-1042-gke - 4.15.0-1042.44
- linux-image-4.15.0-1044-kvm - 4.15.0-1044.44
- linux-image-4.15.0-1045-raspi2 - 4.15.0-1045.49
- linux-image-4.15.0-1048-aws - 4.15.0-1048.50
- linux-image-4.15.0-62-generic - 4.15.0-62.69
- linux-image-4.15.0-62-generic-lpae - 4.15.0-62.69
- linux-image-4.15.0-62-lowlatency - 4.15.0-62.69
- linux-image-aws - 4.15.0.1048.47
- linux-image-generic - 4.15.0.62.64
- linux-image-generic-lpae - 4.15.0.62.64
- linux-image-gke - 4.15.0.1042.45
- linux-image-gke-4.15 - 4.15.0.1042.45
- linux-image-kvm - 4.15.0.1044.44
- linux-image-lowlatency - 4.15.0.62.64
- linux-image-oracle - 4.15.0.1023.26
- linux-image-powerpc-e500mc - 4.15.0.62.64
- linux-image-powerpc-smp - 4.15.0.62.64
- linux-image-powerpc64-emb - 4.15.0.62.64
- linux-image-powerpc64-smp - 4.15.0.62.64
- linux-image-raspi2 - 4.15.0.1045.43
- linux-image-virtual - 4.15.0.62.64
- Ubuntu 16.04 LTS
- linux-image-4.15.0-1023-oracle - 4.15.0-1023.26~16.04.1
- linux-image-4.15.0-1042-gcp - 4.15.0-1042.44
- linux-image-4.15.0-1048-aws - 4.15.0-1048.50~16.04.1
- linux-image-4.15.0-1057-azure - 4.15.0-1057.62
- linux-image-4.15.0-62-generic - 4.15.0-62.69~16.04.1
- linux-image-4.15.0-62-generic-lpae - 4.15.0-62.69~16.04.1
- linux-image-4.15.0-62-lowlatency - 4.15.0-62.69~16.04.1
- linux-image-aws-hwe - 4.15.0.1048.48
- linux-image-azure - 4.15.0.1057.60
- linux-image-gcp - 4.15.0.1042.56
- linux-image-generic-hwe-16.04 - 4.15.0.62.82
- linux-image-generic-lpae-hwe-16.04 - 4.15.0.62.82
- linux-image-gke - 4.15.0.1042.56
- linux-image-lowlatency-hwe-16.04 - 4.15.0.62.82
- linux-image-oem - 4.15.0.62.82
- linux-image-oracle - 4.15.0.1023.17
- linux-image-virtual-hwe-16.04 - 4.15.0.62.82
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to reboot your computer to make all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well.
ReferencesUSN-4120-2: systemd regression
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.04 LTS
USN-4120-1 caused a regression in systemd.
Software Description- systemd - system and service manager
USN-4120-1 fixed a vulnerability in systemd. The update included a recent SRU from the updates pocket that introduced networking problems for some users. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the systemd-resolved D-Bus interface did not enforce appropriate access controls. A local unprivileged user could exploit this to modify a system’s DNS resolver settings.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.04
- systemd - 240-6ubuntu5.7
- Ubuntu 18.04 LTS
- systemd - 237-3ubuntu10.29
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to reboot your computer to make all the necessary changes.
ReferencesUSN-4128-1: Tomcat vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Several security issues were fixed in Tomcat 8.
Software Description- tomcat8 - Servlet and JSP engine
It was discovered that the Tomcat 8 SSI printenv command echoed user provided data without escaping it. An attacker could possibly use this issue to perform an XSS attack. (CVE-2019-0221)
It was discovered that Tomcat 8 did not address HTTP/2 connection window exhaustion on write while addressing CVE-2019-0199. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-10072)
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 18.04 LTS
- libtomcat8-java - 8.5.39-1ubuntu1~18.04.3
- tomcat8 - 8.5.39-1ubuntu1~18.04.3
- Ubuntu 16.04 LTS
- libtomcat8-java - 8.0.32-1ubuntu1.10
- tomcat8 - 8.0.32-1ubuntu1.10
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4127-2: Python vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 ESM
- Ubuntu 12.04 ESM
Several security issues were fixed in Python.
Software Description- python2.7 - An interactive high-level object-oriented language
- python3.4 - An interactive high-level object-oriented language
USN-4127-1 fixed several vulnerabilities in Python. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading to a denial of service. This issue only affected Ubuntu 14.04 ESM. (CVE-2018-20406)
It was discovered that Python incorrectly validated the domain when handling cookies. An attacker could possibly trick Python into sending cookies to the wrong domain. (CVE-2018-20852)
Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly handled Unicode encoding during NFKC normalization. An attacker could possibly use this issue to obtain sensitive information. (CVE-2019-9636, CVE-2019-10160)
Colin Read and Nicolas Edet discovered that Python incorrectly handled parsing certain X509 certificates. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 ESM. (CVE-2019-5010)
It was discovered that Python incorrectly handled certain urls. A remote attacker could possibly use this issue to perform CRLF injection attacks. (CVE-2019-9740, CVE-2019-9947)
Sihoon Lee discovered that Python incorrectly handled the local_file: scheme. A remote attacker could possibly use this issue to bypass blacklist meschanisms. (CVE-2019-9948)
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 14.04 ESM
- python2.7 - 2.7.6-8ubuntu0.6+esm2
- python2.7-minimal - 2.7.6-8ubuntu0.6+esm2
- python3.4 - 3.4.3-1ubuntu1~14.04.7+esm2
- python3.4-minimal - 3.4.3-1ubuntu1~14.04.7+esm2
- Ubuntu 12.04 ESM
- python2.7 - 2.7.3-0ubuntu3.14
- python2.7-minimal - 2.7.3-0ubuntu3.14
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4126-2: FreeType vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 ESM
- Ubuntu 12.04 ESM
FreeType could be made to expose sensitive information if it opened a specially crafted font file.
Software Description- freetype - FreeType 2 is a font engine library
USN-4126-1 fixed a vulnerability in FreeType. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
It was discovered that FreeType incorrectly handled certain font files. An attacker could possibly use this issue to access sensitive information. (CVE-2015-9381, CVE-2015-9382)
Original advisory details:
It was discovered that FreeType incorrectly handled certain font files. An attacker could possibly use this issue to access sensitive information. (CVE-2015-9383)
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 14.04 ESM
- libfreetype6 - 2.5.2-1ubuntu2.8+esm1
- Ubuntu 12.04 ESM
- libfreetype6 - 2.4.8-1ubuntu2.7
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to restart your session to make all the necessary changes.
ReferencesUSN-4127-1: Python vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Several security issues were fixed in Python.
Software Description- python2.7 - An interactive high-level object-oriented language
- python3.7 - An interactive high-level object-oriented language
- python3.6 - An interactive high-level object-oriented language
- python3.5 - An interactive high-level object-oriented language
It was discovered that Python incorrectly handled certain pickle files. An attacker could possibly use this issue to consume memory, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-20406)
It was discovered that Python incorrectly validated the domain when handling cookies. An attacker could possibly trick Python into sending cookies to the wrong domain. (CVE-2018-20852)
Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly handled Unicode encoding during NFKC normalization. An attacker could possibly use this issue to obtain sensitive information. (CVE-2019-9636, CVE-2019-10160)
Colin Read and Nicolas Edet discovered that Python incorrectly handled parsing certain X509 certificates. An attacker could possibly use this issue to cause Python to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-5010)
It was discovered that Python incorrectly handled certain urls. A remote attacker could possibly use this issue to perform CRLF injection attacks. (CVE-2019-9740, CVE-2019-9947)
Sihoon Lee discovered that Python incorrectly handled the local_file: scheme. A remote attacker could possibly use this issue to bypass blacklist meschanisms. (CVE-2019-9948)
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.04
- python2.7 - 2.7.16-2ubuntu0.1
- python2.7-minimal - 2.7.16-2ubuntu0.1
- python3.7 - 3.7.3-2ubuntu0.1
- python3.7-minimal - 3.7.3-2ubuntu0.1
- Ubuntu 18.04 LTS
- python2.7 - 2.7.15-4ubuntu4~18.04.1
- python2.7-minimal - 2.7.15-4ubuntu4~18.04.1
- python3.6 - 3.6.8-1~18.04.2
- python3.6-minimal - 3.6.8-1~18.04.2
- Ubuntu 16.04 LTS
- python2.7 - 2.7.12-1ubuntu0~16.04.8
- python2.7-minimal - 2.7.12-1ubuntu0~16.04.8
- python3.5 - 3.5.2-2ubuntu0~16.04.8
- python3.5-minimal - 3.5.2-2ubuntu0~16.04.8
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4126-1: FreeType vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
FreeType could be made to expose sensitive information if it opened a specially crafted font file.
Software Description- freetype - FreeType 2 is a font engine library
It was discovered that FreeType incorrectly handled certain font files. An attacker could possibly use this issue to access sensitive information.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 16.04 LTS
- libfreetype6 - 2.6.1-0.1ubuntu2.4
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to restart your session to make all the necessary changes.
ReferencesUSN-4125-1: Memcached vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Memcached could be made to expose sensitive information if it received a specially crafted UNIX socket.
Software Description- memcached - high-performance memory object caching system
It was discovered that Memcached incorrectly handled certain UNIX sockets. An attacker could possibly use this issue to access sensitive information.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.04
- memcached - 1.5.10-0ubuntu1.19.04.2
- Ubuntu 18.04 LTS
- memcached - 1.5.6-0ubuntu1.2
- Ubuntu 16.04 LTS
- memcached - 1.4.25-2ubuntu1.5
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4124-1: Exim vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Exim could be made to run programs as an administrator if it received specially crafted network traffic.
Software Description- exim4 - Exim is a mail transport agent
It was discovered that Exim incorrectly handled certain decoding operations. A remote attacker could possibly use this issue to execute arbitrary commands.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.04
- exim4-daemon-heavy - 4.92-4ubuntu1.3
- exim4-daemon-light - 4.92-4ubuntu1.3
- Ubuntu 18.04 LTS
- exim4-daemon-heavy - 4.90.1-1ubuntu1.4
- exim4-daemon-light - 4.90.1-1ubuntu1.4
- Ubuntu 16.04 LTS
- exim4-daemon-heavy - 4.86.2-2ubuntu2.5
- exim4-daemon-light - 4.86.2-2ubuntu2.5
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4123-1: npm/fstream vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.04 LTS
npm/fstream could be made to overwrite files.
Software Description- node-fstream - Advanced filesystem streaming tools for Node.js
It was discovered that npm/fstream incorrectly handled certain crafted tarballs. An attacker could use this vulnerability to write aritrary files to the filesystem.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.04
- node-fstream - 1.0.10-1ubuntu0.19.04.2
- Ubuntu 18.04 LTS
- node-fstream - 1.0.10-1ubuntu0.18.04.1
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4122-1: Firefox vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Firefox could be made to crash or run programs as your login if it opened a malicious website.
Software Description- firefox - Mozilla Open Source web browser
Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to obtain sensitive information, bypass Content Security Policy (CSP) protections, bypass same-origin restrictions, conduct cross-site scripting (XSS) attacks, cause a denial of service, or execute arbitrary code. (CVE-2019-5849, CVE-2019-11734, CVE-2019-11735, CVE-2019-11737, CVE-2019-11738, CVE-2019-11740, CVE-2019-11742, CVE-2019-11743, CVE-2019-11744, CVE-2019-11746, CVE-2019-11748, CVE-2019-11749, CVE-2019-11750, CVE-2019-11752)
It was discovered that a compromised content process could log in to a malicious Firefox Sync account. An attacker could potentially exploit this, in combination with another vulnerability, to disable the sandbox. (CVE-2019-9812)
It was discovered that addons.mozilla.org and accounts.firefox.com could be loaded in to the same content process. An attacker could potentially exploit this, in combination with another vulnerability that allowed a cross-site scripting (XSS) attack, to modify browser settings. (CVE-2019-11741)
It was discovered that the "Forget about this site" feature in the history pane removes HTTP Strict Transport Security (HSTS) settings for sites on the pre-load list. An attacker could potentially exploit this to bypass the protections offered by HSTS. (CVE-2019-11747)
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.04
- firefox - 69.0+build2-0ubuntu0.19.04.1
- Ubuntu 18.04 LTS
- firefox - 69.0+build2-0ubuntu0.18.04.1
- Ubuntu 16.04 LTS
- firefox - 69.0+build2-0ubuntu0.16.04.4
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to restart Firefox to make all the necessary changes.
References