[USN-6484-1] OpenVPN vulnerabilities

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmVWG6kACgkQZWnYVadE
vpPuGBAAq1e8MoIw5U1RrMkm4s1zg3QY0agC4RuOS5CcBUmUYAvSOTxFVvgs9YIe
+vi1GpE+aoo3s1jht4SXeSllAuLHcEd1qBWmhk51N8uYcMHRR0BW3Uy5wTo4xH0O
SoS6lElwMKDMxdnX7XPKcD7GRlSB32href1wYCqEw4b4X13Ovz7GgJPRF0VB1tl+
lcfR6Tb6pPzZWnh5/KYmm2zhk/2WaN3/+R7jxY0gEr8dN63QANruO/yWi0nzegAZ
FWCOP6+NyHHdE8MYZRsUfCRaknngW0U4bgFegRizREh2yuIb4uoDjQElzctnY25U
zSbStvVIhXLKpf+S+mF8JZjCOpJbmp2ejF0DvPkYTg3JEen6VQ4+I/l2Pl2Q8PlY
KWf/FEbMEA3ra2E7ohvblA+vDFIaH0UdiNj/uNjw7hfzrNArbDsKsB/dLlkfY/XJ
OqM/J2jTNGXkyiean3tJ9ov1jffqVjnh2qs+Q/kTbUOjO5Hzktv5X4zG/wMTex65
otqDNCSu400mAB1poX5DuSTBHlahCVFNbYedNgJaLkrvJtCjvAMtgdRtm7xXM9W3
3gIWnZuqeKsiKMd+BKWlD8tpD6iyLUE8VQf1vPbawSmnrQ49qm64OowfJSZt1qz4
EvpR9XHJoSgbnkYMJbGllTPovrnfHFMKr0oFn8iam9rMjhoLz6w=
=Alu5
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6484-1
November 16, 2023

openvpn vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.10
- Ubuntu 23.04

Summary:

Several security issues were fixed in OpenVPN.

Software Description:
- openvpn: virtual private network software

Details:

It was discovered that OpenVPN incorrectly handled the --fragment option
in certain configurations. A remote attacker could possibly use this issue
to cause OpenVPN to crash, resulting in a denial of service.
(CVE-2023-46849)

It was discovered that OpenVPN incorrectly handled certain memory
operations. A remote attacker could use this issue to cause OpenVPN to
crash, obtain sensitive information, or possibly execute arbitrary code.
(CVE-2023-46850)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
openvpn 2.6.5-0ubuntu1.1

Ubuntu 23.04:
openvpn 2.6.1-1ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6484-1
CVE-2023-46849, CVE-2023-46850

Package Information:
https://launchpad.net/ubuntu/+source/openvpn/2.6.5-0ubuntu1.1
https://launchpad.net/ubuntu/+source/openvpn/2.6.1-1ubuntu1.1