Tuesday, October 1, 2024

[USN-6964-2] ORC vulnerability

-----BEGIN PGP SIGNATURE-----

wsD5BAABCAAjFiEEcxdv4gCCE8W9nrt5a1+PL+d1/EgFAmb8AooFAwAAAAAACgkQa1+PL+d1/Eh3
EAv+Jq5FQ+QPeudDrqciaMK6UxMkc2NT4vKCQcP6KR9M+keR4wajtPV/qZIQVapRlfQj1x3HFASs
KPVhRr6Ut3Cb2jSBQ8BgSfBndc+MyXJ5DL1TLQhdxq/cgyFEwQT/uykGNfMhk7wrZRMkyKObZNCP
aekci49UhE0whZtin2MCFoXLNVSB2J5BIaHDg56mxLhpfIa5CyfPuTdf+VQBrZzBAAUf4RYzWTXX
wHevAvlZMGH37QmX9TkAEEw/+Cyt4YeGUjLeyeNbP+Fum0gJZst/SXDDellDDKH4RNYIT/5cJ+pc
JQmTz4v+MbiTlIpcSuZMHRBco7noCTGw8NRUcAzwB3kC+W+8d+lJu4jkruVGcYp7ePbIzWhEAxTM
Gco+aah7nwyZmHBhRbB7WAmEqVJ8K9BlbxiHmg7HIVyHUoZlE5mkKJ/9Pw9XHwf4BIqiTjPafL03
GTuhoaOGd5DnlCxrbm+EgsisekovcALJB0/SVStXXPBLXV7Ter4KVMbCaOBy
=dUIZ
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6964-2
October 01, 2024

orc vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

ORC could be made to crash or execute arbitrary code

Software Description:
- orc: Library of Optimized Inner Loops Runtime Compiler

Details:

USN-6964-1 fixed a vulnerability in ORC. This update provides the
corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

 Noriko Totsuka discovered that ORC incorrectly handled certain
 specially crafted files. An attacker could possibly use this issue
 to execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS
  liborc-0.4-0                    1:0.4.28-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  liborc-0.4-dev                  1:0.4.28-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  liborc-0.4-0                    1:0.4.25-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  liborc-0.4-dev                  1:0.4.25-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-6964-2
  https://ubuntu.com/security/notices/USN-6964-1
  CVE-2024-40897

No comments:

Post a Comment