Ubuntu Secutity Notices
USN-4314-1: pam-krb5 vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM
- Ubuntu 12.04 ESM
pam-krb5 could be made to execute arbitrary code if it received a specially crafted response.
Software Description- libpam-krb5 - PAM module for MIT Kerberos
Russ Allbery discovered that pam-krb5 incorrectly handled some responses. An attacker could possibly use this issue to execute arbitrary code.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.10
- libpam-krb5 - 4.8-2ubuntu0.1
- Ubuntu 18.04 LTS
- libpam-krb5 - 4.8-1ubuntu0.1
- Ubuntu 16.04 LTS
- libpam-krb5 - 4.7-2ubuntu0.1
- Ubuntu 14.04 ESM
- libpam-krb5 - 4.6-2ubuntu0.1~esm1
- Ubuntu 12.04 ESM
- libpam-krb5 - 4.5-3ubuntu0.1
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4313-1: Linux kernel vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.10
- Ubuntu 18.04 LTS
The system could be made to expose sensitive information or run programs as an administrator.
Software Description- linux - Linux kernel
- linux-aws - Linux kernel for Amazon Web Services (AWS) systems
- linux-azure - Linux kernel for Microsoft Azure Cloud systems
- linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems
- linux-kvm - Linux kernel for cloud environments
- linux-oracle - Linux kernel for Oracle Cloud systems
- linux-raspi2 - Linux kernel for Raspberry Pi 2
- linux-azure-5.3 - Linux kernel for Microsoft Azure Cloud systems
- linux-gcp-5.3 - Linux kernel for Google Cloud Platform (GCP) systems
- linux-gke-5.3 - Linux kernel for Google Container Engine (GKE) systems
- linux-hwe - Linux hardware enablement (HWE) kernel
- linux-oracle-5.3 - Linux kernel buildinfo for version 5.3.0 on 64 bit x86 SMP
- linux-raspi2-5.3 - Linux kernel for Raspberry Pi 2
Manfred Paul discovered that the bpf verifier in the Linux kernel did not properly calculate register bounds for certain operations. A local attacker could use this to expose sensitive information (kernel memory) or gain administrative privileges.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.10
- linux-image-5.3.0-1013-oracle - 5.3.0-1013.14
- linux-image-5.3.0-1014-kvm - 5.3.0-1014.15
- linux-image-5.3.0-1015-aws - 5.3.0-1015.16
- linux-image-5.3.0-1016-gcp - 5.3.0-1016.17
- linux-image-5.3.0-1018-azure - 5.3.0-1018.19
- linux-image-5.3.0-1021-raspi2 - 5.3.0-1021.23
- linux-image-5.3.0-45-generic - 5.3.0-45.37
- linux-image-5.3.0-45-generic-lpae - 5.3.0-45.37
- linux-image-5.3.0-45-lowlatency - 5.3.0-45.37
- linux-image-5.3.0-45-snapdragon - 5.3.0-45.37
- linux-image-aws - 5.3.0.1015.17
- linux-image-azure - 5.3.0.1018.37
- linux-image-gcp - 5.3.0.1016.17
- linux-image-generic - 5.3.0.45.38
- linux-image-generic-lpae - 5.3.0.45.38
- linux-image-gke - 5.3.0.1016.17
- linux-image-kvm - 5.3.0.1014.16
- linux-image-lowlatency - 5.3.0.45.38
- linux-image-oracle - 5.3.0.1013.14
- linux-image-raspi2 - 5.3.0.1021.18
- linux-image-snapdragon - 5.3.0.45.38
- linux-image-virtual - 5.3.0.45.38
- Ubuntu 18.04 LTS
- linux-image-5.3.0-1013-oracle - 5.3.0-1013.14~18.04.1
- linux-image-5.3.0-1016-gcp - 5.3.0-1016.17~18.04.1
- linux-image-5.3.0-1016-gke - 5.3.0-1016.17~18.04.1
- linux-image-5.3.0-1018-azure - 5.3.0-1018.19~18.04.1
- linux-image-5.3.0-1021-raspi2 - 5.3.0-1021.23~18.04.1
- linux-image-5.3.0-45-generic - 5.3.0-45.37~18.04.1
- linux-image-5.3.0-45-generic-lpae - 5.3.0-45.37~18.04.1
- linux-image-5.3.0-45-lowlatency - 5.3.0-45.37~18.04.1
- linux-image-azure-edge - 5.3.0.1018.18
- linux-image-gcp-edge - 5.3.0.1016.15
- linux-image-generic-hwe-18.04 - 5.3.0.45.101
- linux-image-generic-lpae-hwe-18.04 - 5.3.0.45.101
- linux-image-gke-5.3 - 5.3.0.1016.6
- linux-image-lowlatency-hwe-18.04 - 5.3.0.45.101
- linux-image-oracle-edge - 5.3.0.1013.12
- linux-image-raspi2-hwe-18.04 - 5.3.0.1021.10
- linux-image-snapdragon-hwe-18.04 - 5.3.0.45.101
- linux-image-virtual-hwe-18.04 - 5.3.0.45.101
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to reboot your computer to make all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well.
ReferencesUSN-4311-1: BlueZ vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Several security issues were fixed in BlueZ.
Software Description- bluez - Bluetooth tools and daemons
It was discovered that BlueZ incorrectly handled bonding HID and HOGP devices. A local attacker could possibly use this issue to impersonate non-bonded devices. (CVE-2020-0556)
It was discovered that BlueZ incorrectly handled certain commands. A local attacker could use this issue to cause BlueZ to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-7837)
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.10
- bluez - 5.50-0ubuntu5.1
- libbluetooth3 - 5.50-0ubuntu5.1
- Ubuntu 18.04 LTS
- bluez - 5.48-0ubuntu3.4
- libbluetooth3 - 5.48-0ubuntu3.4
- Ubuntu 16.04 LTS
- bluez - 5.37-0ubuntu5.3
- libbluetooth3 - 5.37-0ubuntu5.3
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4312-1: Timeshift vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.10
Timeshift could be made to run programs as an administrator.
Software Description- timeshift - System restore utility
Matthias Gerstner discovered that Timeshift did not securely create temporary files. An attacker could exploit a race condition in Timeshift and potentially execute arbitrary commands as root.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.10
- timeshift - 19.01+ds-2ubuntu0.1
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4310-1: WebKitGTK+ vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.10
- Ubuntu 18.04 LTS
Several security issues were fixed in WebKitGTK+.
Software Description- webkit2gtk - Web content engine library for GTK+
A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.10
- libjavascriptcoregtk-4.0-18 - 2.28.0-0ubuntu0.19.10.2
- libwebkit2gtk-4.0-37 - 2.28.0-0ubuntu0.19.10.2
- Ubuntu 18.04 LTS
- libjavascriptcoregtk-4.0-18 - 2.28.0-0ubuntu0.18.04.3
- libwebkit2gtk-4.0-37 - 2.28.0-0ubuntu0.18.04.3
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any applications that use WebKitGTK+, such as Epiphany, to make all the necessary changes.
ReferencesUSN-4308-2: Twisted vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 ESM
Several security issues were fixed in Twisted.
Software Description- twisted - Event-based framework for internet applications
USN-4308-1 fixed several vulnerabilities in Twisted. This update provides the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
it was discovered that Twisted incorrectly validated or sanitized certain URIs or HTTP methods. A remote attacker could use this issue to inject invalid characters and possibly perform header injection attacks. (CVE-2019-12387)
It was discovered that Twisted incorrectly verified XMPP TLS certificates. A remote attacker could possibly use this issue to perform a man-in-the-middle attack and obtain sensitive information. (CVE-2019-12855)
Jake Miller and ZeddYu Lu discovered that Twisted incorrectly handled certain content-length headers. A remote attacker could possibly use this issue to perform HTTP request splitting attacks. (CVE-2020-10108, CVE-2020-10109)
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 14.04 ESM
- python-twisted - 13.2.0-1ubuntu1.2+esm1
- python-twisted-bin - 13.2.0-1ubuntu1.2+esm1
- python-twisted-web - 13.2.0-1ubuntu1.2+esm1
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4134-3: IBus vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
IBus could allow local users to capture key strokes of other locally logged in users.
Software Description- ibus - Intelligent Input Bus - core
USN-4134-1 fixed a vulnerability in IBus. The update caused a regression in some Qt applications and the fix was subsequently reverted in USN-4134-2. The regression has since been resolved and so this update fixes the original vulnerability.
We apologize for the inconvenience.
Original advisory details:
Simon McVittie discovered that IBus did not enforce appropriate access controls on its private D-Bus socket. A local unprivileged user who discovers the IBus socket address of another user could exploit this to capture the key strokes of the other user.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.10
- ibus - 1.5.21-1~exp2ubuntu2.1
- Ubuntu 18.04 LTS
- ibus - 1.5.17-3ubuntu5.3
- Ubuntu 16.04 LTS
- ibus - 1.5.11-1ubuntu2.4
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to reboot your computer to make all the necessary changes.
ReferencesUSN-4309-1: Vim vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM
- Ubuntu 12.04 ESM
Several security issues were fixed in Vim.
Software Description- vim - Vi IMproved - enhanced vi editor
It was discovered that Vim incorrectly handled certain sources. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04 LTS (CVE-2017-1110)
It was discovered that Vim incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. (CVE-2017-5953)
It was discovered that Vim incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.06 LTS. (CVE-2018-20786)
It was discovered that Vim incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.10. (CVE-2019-20079)
It was discovered that Vim incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 12.04 ESM, Ubuntu 14.04 ESM and Ubuntu 16.04 LTS. (CVE-2017-6349, CVE-2017-6350)
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.10
- vim - 2:8.1.0875-5ubuntu2.1
- vim-common - 2:8.1.0875-5ubuntu2.1
- vim-gui-common - 2:8.1.0875-5ubuntu2.1
- vim-runtime - 2:8.1.0875-5ubuntu2.1
- Ubuntu 18.04 LTS
- vim - 2:8.0.1453-1ubuntu1.3
- vim-common - 2:8.0.1453-1ubuntu1.3
- vim-gui-common - 2:8.0.1453-1ubuntu1.3
- vim-runtime - 2:8.0.1453-1ubuntu1.3
- Ubuntu 16.04 LTS
- vim - 2:7.4.1689-3ubuntu1.4
- vim-common - 2:7.4.1689-3ubuntu1.4
- vim-gui-common - 2:7.4.1689-3ubuntu1.4
- vim-runtime - 2:7.4.1689-3ubuntu1.4
- Ubuntu 14.04 ESM
- vim - 2:7.4.052-1ubuntu3.1+esm1
- vim-common - 2:7.4.052-1ubuntu3.1+esm1
- vim-gui-common - 2:7.4.052-1ubuntu3.1+esm1
- vim-runtime - 2:7.4.052-1ubuntu3.1+esm1
- Ubuntu 12.04 ESM
- vim - 2:7.3.429-2ubuntu2.3
- vim-common - 2:7.3.429-2ubuntu2.3
- vim-gui-common - 2:7.3.429-2ubuntu2.3
- vim-runtime - 2:7.3.429-2ubuntu2.3
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4308-1: Twisted vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Several security issues were fixed in Twisted.
Software Description- twisted - Event-based framework for internet applications
it was discovered that Twisted incorrectly validated or sanitized certain URIs or HTTP methods. A remote attacker could use this issue to inject invalid characters and possibly perform header injection attacks. (CVE-2019-12387)
It was discovered that Twisted incorrectly verified XMPP TLS certificates. A remote attacker could possibly use this issue to perform a man-in-the-middle attack and obtain sensitive information. (CVE-2019-12855)
It was discovered that Twisted incorrectly handled HTTP/2 connections. A remote attacker could possibly use this issue to cause Twisted to hang or consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.10. (CVE-2019-9512, CVE-2019-9514, CVE-2019-9515)
Jake Miller and ZeddYu Lu discovered that Twisted incorrectly handled certain content-length headers. A remote attacker could possibly use this issue to perform HTTP request splitting attacks. (CVE-2020-10108, CVE-2020-10109)
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.10
- python-twisted - 18.9.0-3ubuntu1.1
- python-twisted-bin - 18.9.0-3ubuntu1.1
- python-twisted-web - 18.9.0-3ubuntu1.1
- python3-twisted - 18.9.0-3ubuntu1.1
- python3-twisted-bin - 18.9.0-3ubuntu1.1
- Ubuntu 18.04 LTS
- python-twisted - 17.9.0-2ubuntu0.1
- python-twisted-bin - 17.9.0-2ubuntu0.1
- python-twisted-web - 17.9.0-2ubuntu0.1
- python3-twisted - 17.9.0-2ubuntu0.1
- python3-twisted-bin - 17.9.0-2ubuntu0.1
- Ubuntu 16.04 LTS
- python-twisted - 16.0.0-1ubuntu0.4
- python-twisted-bin - 16.0.0-1ubuntu0.4
- python-twisted-web - 16.0.0-1ubuntu0.4
- python3-twisted - 16.0.0-1ubuntu0.4
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4307-1: Apache HTTP Server update
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
TLSv1.3 support has been enabled in Apache HTTP Server in Ubuntu 18.04 LTS.
Software Description- apache2 - Apache HTTP server
As a security improvement, this update adds TLSv1.3 support to the Apache HTTP Server package in Ubuntu 18.04 LTS.
TLSv1.3 is enabled by default, and in certain environments may cause compatibility issues. The SSLProtocol directive may be used to disable TLSv1.3 in these problematic environments.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 18.04 LTS
- apache2-bin - 2.4.29-1ubuntu4.13
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4171-5: Apport regression
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
USN-4171-1 introduced a regression in Apport.
Software Description- apport - automatically generate crash reports for debugging
USN-4171-1 fixed vulnerabilities in Apport. This caused a regression in autopkgtest and python2 compatibility. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Kevin Backhouse discovered Apport would read its user-controlled settings file as the root user. This could be used by a local attacker to possibly crash Apport or have other unspecified consequences. (CVE-2019-11481)
Sander Bos discovered a race-condition in Apport during core dump creation. This could be used by a local attacker to generate a crash report for a privileged process that is readable by an unprivileged user. (CVE-2019-11482)
Sander Bos discovered Apport mishandled crash dumps originating from containers. This could be used by a local attacker to generate a crash report for a privileged process that is readable by an unprivileged user. (CVE-2019-11483)
Sander Bos discovered Apport mishandled lock-file creation. This could be used by a local attacker to cause a denial of service against Apport. (CVE-2019-11485)
Kevin Backhouse discovered Apport read various process-specific files with elevated privileges during crash dump generation. This could could be used by a local attacker to generate a crash report for a privileged process that is readable by an unprivileged user. (CVE-2019-15790)
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.10
- apport - 2.20.11-0ubuntu8.6
- python-apport - 2.20.11-0ubuntu8.6
- python3-apport - 2.20.11-0ubuntu8.6
- Ubuntu 18.04 LTS
- apport - 2.20.9-0ubuntu7.12
- python-apport - 2.20.9-0ubuntu7.12
- python3-apport - 2.20.9-0ubuntu7.12
- Ubuntu 16.04 LTS
- apport - 2.20.1-0ubuntu2.22
- python-apport - 2.20.1-0ubuntu2.22
- python3-apport - 2.20.1-0ubuntu2.22
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4306-1: Dino vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
Several security issues were fixed in dino-im.
Software Description- dino-im - modern XMPP client
It was discovered that Dino incorrectly validated inputs. An attacker could use this issue to possibly obtain, inject or remove sensitive information.
This update also includes a fix to the encryption implementation in Dino to support 12 byte IVs, in addition to 16 byte IVs.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 18.04 LTS
- dino-im - 0.0.git20180130-1ubuntu0.1
- dino-im-common - 0.0.git20180130-1ubuntu0.1
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4305-1: ICU vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM
- Ubuntu 12.04 ESM
ICU could be made to execute arbitrary code if it received a specially crafted string.
Software Description- icu - International Components for Unicode library
André Bargull discovered that ICU incorrectly handled certain strings. An attacker could possibly use this issue to execute arbitrary code.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.10
- libicu63 - 63.2-2ubuntu0.1
- Ubuntu 18.04 LTS
- libicu60 - 60.2-3ubuntu3.1
- Ubuntu 16.04 LTS
- libicu55 - 55.1-7ubuntu0.5
- Ubuntu 14.04 ESM
- libicu52 - 52.1-3ubuntu0.8+esm1
- Ubuntu 12.04 ESM
- libicu48 - 4.8.1.1-3ubuntu0.10
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4304-1: Ceph vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.10
- Ubuntu 18.04 LTS
Ceph could be made to stop responding if it received specially crafted network traffic.
Software Description- ceph - distributed storage and file system
Or Friedman discovered that Ceph incorrectly handled disconnects. A remote authenticated attacker could possibly use this issue to cause Ceph to consume resources, leading to a denial of service.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.10
- ceph - 14.2.4-0ubuntu0.19.10.2
- ceph-base - 14.2.4-0ubuntu0.19.10.2
- ceph-common - 14.2.4-0ubuntu0.19.10.2
- Ubuntu 18.04 LTS
- ceph - 12.2.12-0ubuntu0.18.04.5
- ceph-base - 12.2.12-0ubuntu0.18.04.5
- ceph-common - 12.2.12-0ubuntu0.18.04.5
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.
ReferencesUSN-4303-1: Linux kernel vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
The system could be made to expose sensitive information.
Software Description- linux - Linux kernel
- linux-aws - Linux kernel for Amazon Web Services (AWS) systems
- linux-kvm - Linux kernel for cloud environments
Paulo Bonzini discovered that the KVM hypervisor implementation in the Linux kernel could improperly let a nested (level 2) guest access the resources of a parent (level 1) guest in certain situations. An attacker could use this to expose sensitive information.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 16.04 LTS
- linux-image-4.4.0-1068-kvm - 4.4.0-1068.75
- linux-image-4.4.0-1104-aws - 4.4.0-1104.115
- linux-image-4.4.0-176-generic - 4.4.0-176.206
- linux-image-4.4.0-176-generic-lpae - 4.4.0-176.206
- linux-image-4.4.0-176-lowlatency - 4.4.0-176.206
- linux-image-4.4.0-176-powerpc-e500mc - 4.4.0-176.206
- linux-image-4.4.0-176-powerpc-smp - 4.4.0-176.206
- linux-image-4.4.0-176-powerpc64-emb - 4.4.0-176.206
- linux-image-4.4.0-176-powerpc64-smp - 4.4.0-176.206
- linux-image-aws - 4.4.0.1104.108
- linux-image-generic - 4.4.0.176.184
- linux-image-generic-lpae - 4.4.0.176.184
- linux-image-kvm - 4.4.0.1068.68
- linux-image-lowlatency - 4.4.0.176.184
- linux-image-powerpc-e500mc - 4.4.0.176.184
- linux-image-powerpc-smp - 4.4.0.176.184
- linux-image-powerpc64-emb - 4.4.0.176.184
- linux-image-powerpc64-smp - 4.4.0.176.184
- linux-image-virtual - 4.4.0.176.184
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to reboot your computer to make all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well.
ReferencesUSN-4303-2: Linux kernel (HWE) vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 ESM
The system could be made to expose sensitive information.
Software Description- linux-aws - Linux kernel for Amazon Web Services (AWS) systems
- linux-lts-xenial - Linux hardware enablement kernel from Xenial for Trusty
USN-4303-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 ESM.
Paulo Bonzini discovered that the KVM hypervisor implementation in the Linux kernel could improperly let a nested (level 2) guest access the resources of a parent (level 1) guest in certain situations. An attacker could use this to expose sensitive information.
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 14.04 ESM
- linux-image-4.4.0-1064-aws - 4.4.0-1064.68
- linux-image-4.4.0-176-generic - 4.4.0-176.206~14.04.1
- linux-image-4.4.0-176-generic-lpae - 4.4.0-176.206~14.04.1
- linux-image-4.4.0-176-lowlatency - 4.4.0-176.206~14.04.1
- linux-image-4.4.0-176-powerpc-e500mc - 4.4.0-176.206~14.04.1
- linux-image-4.4.0-176-powerpc-smp - 4.4.0-176.206~14.04.1
- linux-image-4.4.0-176-powerpc64-emb - 4.4.0-176.206~14.04.1
- linux-image-4.4.0-176-powerpc64-smp - 4.4.0-176.206~14.04.1
- linux-image-aws - 4.4.0.1064.65
- linux-image-generic-lpae-lts-xenial - 4.4.0.176.155
- linux-image-generic-lts-xenial - 4.4.0.176.155
- linux-image-lowlatency-lts-xenial - 4.4.0.176.155
- linux-image-powerpc-e500mc-lts-xenial - 4.4.0.176.155
- linux-image-powerpc-smp-lts-xenial - 4.4.0.176.155
- linux-image-powerpc64-emb-lts-xenial - 4.4.0.176.155
- linux-image-powerpc64-smp-lts-xenial - 4.4.0.176.155
- linux-image-virtual-lts-xenial - 4.4.0.176.155
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to reboot your computer to make all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well.
ReferencesUSN-4302-1: Linux kernel vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Several security issues were fixed in the Linux kernel.
Software Description- linux - Linux kernel
- linux-aws - Linux kernel for Amazon Web Services (AWS) systems
- linux-gke-4.15 - Linux kernel for Google Container Engine (GKE) systems
- linux-kvm - Linux kernel for cloud environments
- linux-raspi2 - Linux kernel for Raspberry Pi 2
- linux-snapdragon - Linux kernel for Snapdragon processors
- linux-aws-hwe - Linux kernel for Amazon Web Services (AWS-HWE) systems
- linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems
- linux-hwe - Linux hardware enablement (HWE) kernel
Paulo Bonzini discovered that the KVM hypervisor implementation in the Linux kernel could improperly let a nested (level 2) guest access the resources of a parent (level 1) guest in certain situations. An attacker could use this to expose sensitive information. (CVE-2020-2732)
Gregory Herrero discovered that the fix for CVE-2019-14615 to address the Linux kernel not properly clearing data structures on context switches for certain Intel graphics processors was incomplete. A local attacker could use this to expose sensitive information. (CVE-2020-8832)
It was discovered that the IPMI message handler implementation in the Linux kernel did not properly deallocate memory in certain situations. A local attacker could use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19046)
It was discovered that the Intel WiMAX 2400 driver in the Linux kernel did not properly deallocate memory in certain situations. A local attacker could use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19051)
It was discovered that the Marvell Wi-Fi device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could use this to possibly cause a denial of service (kernel memory exhaustion). (CVE-2019-19056)
It was discovered that the Intel® Wi-Fi device driver in the Linux kernel device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19058)
It was discovered that the Brocade BFA Fibre Channel device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19066)
It was discovered that the Realtek RTL8xxx USB Wi-Fi device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19068)
It was discovered that ZR364XX Camera USB device driver for the Linux kernel did not properly initialize memory. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15217)
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 18.04 LTS
- linux-image-4.15.0-1055-gke - 4.15.0-1055.58
- linux-image-4.15.0-1056-kvm - 4.15.0-1056.57
- linux-image-4.15.0-1057-raspi2 - 4.15.0-1057.61
- linux-image-4.15.0-1063-aws - 4.15.0-1063.67
- linux-image-4.15.0-1074-snapdragon - 4.15.0-1074.81
- linux-image-4.15.0-91-generic - 4.15.0-91.92
- linux-image-4.15.0-91-generic-lpae - 4.15.0-91.92
- linux-image-4.15.0-91-lowlatency - 4.15.0-91.92
- linux-image-aws - 4.15.0.1063.64
- linux-image-aws-lts-18.04 - 4.15.0.1063.64
- linux-image-generic - 4.15.0.91.83
- linux-image-generic-lpae - 4.15.0.91.83
- linux-image-gke - 4.15.0.1055.59
- linux-image-gke-4.15 - 4.15.0.1055.59
- linux-image-kvm - 4.15.0.1056.56
- linux-image-lowlatency - 4.15.0.91.83
- linux-image-powerpc-e500mc - 4.15.0.91.83
- linux-image-powerpc-smp - 4.15.0.91.83
- linux-image-powerpc64-emb - 4.15.0.91.83
- linux-image-powerpc64-smp - 4.15.0.91.83
- linux-image-raspi2 - 4.15.0.1057.55
- linux-image-snapdragon - 4.15.0.1074.77
- linux-image-virtual - 4.15.0.91.83
- Ubuntu 16.04 LTS
- linux-image-4.15.0-1058-gcp - 4.15.0-1058.62
- linux-image-4.15.0-1063-aws - 4.15.0-1063.67~16.04.1
- linux-image-4.15.0-91-generic - 4.15.0-91.92~16.04.1
- linux-image-4.15.0-91-generic-lpae - 4.15.0-91.92~16.04.1
- linux-image-4.15.0-91-lowlatency - 4.15.0-91.92~16.04.1
- linux-image-aws-hwe - 4.15.0.1063.63
- linux-image-gcp - 4.15.0.1058.72
- linux-image-generic-hwe-16.04 - 4.15.0.91.101
- linux-image-generic-lpae-hwe-16.04 - 4.15.0.91.101
- linux-image-gke - 4.15.0.1058.72
- linux-image-lowlatency-hwe-16.04 - 4.15.0.91.101
- linux-image-oem - 4.15.0.91.101
- linux-image-virtual-hwe-16.04 - 4.15.0.91.101
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to reboot your computer to make all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well.
ReferencesUSN-4301-1: Linux kernel vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
Several security issues were fixed in the Linux kernel.
Software Description- linux-aws-5.0 - Linux kernel for Amazon Web Services (AWS) systems
- linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems
- linux-gke-5.0 - Linux kernel for Google Container Engine (GKE) systems
- linux-oracle-5.0 - Linux kernel for Oracle Cloud systems
It was discovered that the KVM implementation in the Linux kernel, when paravirtual TLB flushes are enabled in guests, the hypervisor in some situations could miss deferred TLB flushes or otherwise mishandle them. An attacker in a guest VM could use this to expose sensitive information (read memory from another guest VM). (CVE-2019-3016)
Paulo Bonzini discovered that the KVM hypervisor implementation in the Linux kernel could improperly let a nested (level 2) guest access the resources of a parent (level 1) guest in certain situations. An attacker could use this to expose sensitive information. (CVE-2020-2732)
It was discovered that the RPMSG character device interface in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19053)
It was discovered that the Marvell Wi-Fi device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could use this to possibly cause a denial of service (kernel memory exhaustion). (CVE-2019-19056)
It was discovered that the Intel® Wi-Fi device driver in the Linux kernel device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19058, CVE-2019-19059)
It was discovered that the Brocade BFA Fibre Channel device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19066)
It was discovered that the Realtek RTL8xxx USB Wi-Fi device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19068)
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 18.04 LTS
- linux-image-5.0.0-1013-oracle - 5.0.0-1013.18
- linux-image-5.0.0-1027-aws - 5.0.0-1027.30
- linux-image-5.0.0-1032-gke - 5.0.0-1032.33
- linux-image-5.0.0-1033-gcp - 5.0.0-1033.34
- linux-image-aws-edge - 5.0.0.1027.41
- linux-image-gcp - 5.0.0.1033.37
- linux-image-gke-5.0 - 5.0.0.1032.20
- linux-image-oracle - 5.0.0.1013.13
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to reboot your computer to make all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well.
ReferencesUSN-4300-1: Linux kernel vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.10
- Ubuntu 18.04 LTS
Several security issues were fixed in the Linux kernel.
Software Description- linux - Linux kernel
- linux-aws - Linux kernel for Amazon Web Services (AWS) systems
- linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems
- linux-kvm - Linux kernel for cloud environments
- linux-oracle - Linux kernel for Oracle Cloud systems
- linux-raspi2 - Linux kernel for Raspberry Pi 2
- linux-gcp-5.3 - Linux kernel for Google Cloud Platform (GCP) systems
- linux-gke-5.3 - Linux kernel for Google Container Engine (GKE) systems
- linux-hwe - Linux hardware enablement (HWE) kernel
- linux-raspi2-5.3 - Linux kernel for Raspberry Pi 2
It was discovered that the KVM implementation in the Linux kernel, when paravirtual TLB flushes are enabled in guests, the hypervisor in some situations could miss deferred TLB flushes or otherwise mishandle them. An attacker in a guest VM could use this to expose sensitive information (read memory from another guest VM). (CVE-2019-3016)
Paulo Bonzini discovered that the KVM hypervisor implementation in the Linux kernel could improperly let a nested (level 2) guest access the resources of a parent (level 1) guest in certain situations. An attacker could use this to expose sensitive information. (CVE-2020-2732)
It was discovered that the Afatech AF9005 DVB-T USB device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-18809)
It was discovered that the Intel® XL710 Ethernet Controller device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19043)
It was discovered that the RPMSG character device interface in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19053)
It was discovered that the Marvell Wi-Fi device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could use this to possibly cause a denial of service (kernel memory exhaustion). (CVE-2019-19056)
It was discovered that the Intel® Wi-Fi device driver in the Linux kernel device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19058, CVE-2019-19059)
It was discovered that the Serial Peripheral Interface (SPI) driver in the Linux kernel device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19064)
It was discovered that the Brocade BFA Fibre Channel device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19066)
It was discovered that the Realtek RTL8xxx USB Wi-Fi device driver in the Linux kernel did not properly deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial of service (kernel memory exhaustion). (CVE-2019-19068)
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.10
- linux-image-5.3.0-1011-oracle - 5.3.0-1011.12
- linux-image-5.3.0-1012-kvm - 5.3.0-1012.13
- linux-image-5.3.0-1013-aws - 5.3.0-1013.14
- linux-image-5.3.0-1014-gcp - 5.3.0-1014.15
- linux-image-5.3.0-1019-raspi2 - 5.3.0-1019.21
- linux-image-5.3.0-42-generic - 5.3.0-42.34
- linux-image-5.3.0-42-generic-lpae - 5.3.0-42.34
- linux-image-5.3.0-42-lowlatency - 5.3.0-42.34
- linux-image-5.3.0-42-snapdragon - 5.3.0-42.34
- linux-image-aws - 5.3.0.1013.15
- linux-image-gcp - 5.3.0.1014.15
- linux-image-generic - 5.3.0.42.36
- linux-image-generic-lpae - 5.3.0.42.36
- linux-image-gke - 5.3.0.1014.15
- linux-image-kvm - 5.3.0.1012.14
- linux-image-lowlatency - 5.3.0.42.36
- linux-image-oracle - 5.3.0.1011.12
- linux-image-raspi2 - 5.3.0.1019.16
- linux-image-snapdragon - 5.3.0.42.36
- linux-image-virtual - 5.3.0.42.36
- Ubuntu 18.04 LTS
- linux-image-5.3.0-1014-gcp - 5.3.0-1014.15~18.04.1
- linux-image-5.3.0-1014-gke - 5.3.0-1014.15~18.04.1
- linux-image-5.3.0-1019-raspi2 - 5.3.0-1019.21~18.04.1
- linux-image-5.3.0-42-generic - 5.3.0-42.34~18.04.1
- linux-image-5.3.0-42-generic-lpae - 5.3.0-42.34~18.04.1
- linux-image-5.3.0-42-lowlatency - 5.3.0-42.34~18.04.1
- linux-image-gcp-edge - 5.3.0.1014.13
- linux-image-generic-hwe-18.04 - 5.3.0.42.99
- linux-image-generic-lpae-hwe-18.04 - 5.3.0.42.99
- linux-image-gke-5.3 - 5.3.0.1014.4
- linux-image-lowlatency-hwe-18.04 - 5.3.0.42.99
- linux-image-raspi2-hwe-18.04 - 5.3.0.1019.8
- linux-image-snapdragon-hwe-18.04 - 5.3.0.42.99
- linux-image-virtual-hwe-18.04 - 5.3.0.42.99
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to reboot your computer to make all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well.
ReferencesUSN-4299-1: Firefox vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Firefox could be made to crash or run programs as your login if it opened a malicious website.
Software Description- firefox - Mozilla Open Source web browser
Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the URL or other browser chrome, obtain sensitive information, bypass Content Security Policy (CSP) protections, or execute arbitrary code. (CVE-2019-20503, CVE-2020-6805, CVE-2020-6806, CVE-2020-6807, CVE-2020-6808, CVE-2020-6810, CVE-2020-6812, CVE-2020-6813, CVE-2020-6814, CVE-2020-6815)
It was discovered that Web Extensions with the all-url permission could access local files. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit this to obtain sensitive information. (CVE-2020-6809)
It was discovered that the Devtools’ ‘Copy as cURL’ feature did not fully escape website-controlled data. If a user were tricked in to using the ‘Copy as cURL’ feature to copy and paste a command with specially crafted data in to a terminal, an attacker could potentially exploit this to execute arbitrary commands via command injection. (CVE-2020-6811)
Update instructionsThe problem can be corrected by updating your system to the following package versions:
- Ubuntu 19.10
- firefox - 74.0+build3-0ubuntu0.19.10.1
- Ubuntu 18.04 LTS
- firefox - 74.0+build3-0ubuntu0.18.04.1
- Ubuntu 16.04 LTS
- firefox - 74.0+build3-0ubuntu0.16.04.1
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
After a standard system update you need to restart Firefox to make all the necessary changes.
References