[USN-6736-2] klibc vulnerabilities

-----BEGIN PGP SIGNATURE-----

wsD5BAABCAAjFiEEcxdv4gCCE8W9nrt5a1+PL+d1/EgFAmZPRj4FAwAAAAAACgkQa1+PL+d1/EgU
Zgv/cN8udZEh/yEIfm6SckSK+IcBQTpPXg3NoVU7LPtmLL/8OT14qNWLcUOoqZ1G91p+W4IO0rBd
XCb89wD7ILyTh3yla1/waYbW4Pmh6XYBmbBqR0IO7g/7nFrHD8TYyt29aoIVtnoURr2roVrw1wJc
HmaeAUjRB9qwmdoKveu+O7C3TTDnoke3NRjeG5rtk+fDCz1d4vIbbCA6XU5D2vtZ+bkXnmgb/c1T
GR5znPYqYvZwfDgpLMnd4LD5lHmJIFLhoBEjKv2YTc3UGK4CJ8tFr9iCVBTBNTHufaXOGow+kboC
WfSAqYzYBCsVvu11iFOdvFYQ/gGdhc3UMOfwbYGWjix2MxSZ0STnJammiQQ38Z2sPzmoH8wJaXnK
4QOgKFKdOUqy38cKlQAY3/nlPkZeN0PoZmewBhkxrL8MFGHk6Brm/Jx2K3bbpqZU0vJbcCqm4Iq5
YuJxi44iPpSmkWTIrHXfSRxux1maw6XpnN2ljOXdel/HyhoJ5812oM8riP9F
=lodI
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6736-2
May 23, 2024

klibc vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS

Summary:

Several security issues were fixed in klibc.

Software Description:
- klibc: small utilities built with klibc for early boot

Details:

USN-6736-1 fixed vulnerabilities in klibc. This update provides the
corresponding updates for Ubuntu 24.04 LTS.

Original advisory details:

 It was discovered that zlib, vendored in klibc, incorrectly handled
pointer
 arithmetic. An attacker could use this issue to cause klibc to crash or to
 possibly execute arbitrary code. (CVE-2016-9840, CVE-2016-9841)

 Danilo Ramos discovered that zlib, vendored in klibc, incorrectly handled
 memory when performing certain deflating operations. An attacker could use
 this issue to cause klibc to crash or to possibly execute arbitrary code.
 (CVE-2018-25032)

 Evgeny Legerov discovered that zlib, vendored in klibc, incorrectly
handled
 memory when performing certain inflate operations. An attacker could use
 this issue to cause klibc to crash or to possibly execute arbitrary code.
 (CVE-2022-37434)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
   klibc-utils                     2.0.13-4ubuntu0.1
   libklibc                         2.0.13-4ubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6736-2
   https://ubuntu.com/security/notices/USN-6736-1
   CVE-2016-9840, CVE-2016-9841, CVE-2018-25032, CVE-2022-37434

Package Information:
   https://launchpad.net/ubuntu/+source/klibc/2.0.13-4ubuntu0.1