Fedora 27 is officially released!

Fedora 27 is here! Thanks and congratulations to all of the
people in the Fedora community who worked so hard to bring
this together.

Read the official announcement at:

* https://fedoramagazine.org/announcing-fedora-27/

or just go ahead and grab it from:

* https://getfedora.org/

We're also releasing a beta of Fedora Modular Server, which
you can get from:

* https://getfedora.org/server/prerelease/


--
Matthew Miller
<mattdm@fedoraproject.org>
Fedora Project Leader
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org

[USN-3479-1] PostgreSQL vulnerabilities

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCgAGBQJaCvC0AAoJEGVp2FWnRL6TRBQQAIYi87CwGSs5BWTkFcVFrujk
xZooMu+MFYNdAlwL7+gSHgqNfy923ODYs//N3CWyNum6YcaUfzktGWiAsFyki8tf
INa/dWMjzSrtUgngj8PRNfQvdlb19ZYydGCJWNAiippDQjlpX3JfMEnv2F+Sf7RV
kEg5jF5I05AYlD11esgeOHe81fRUXjNQvhnklBHhdacVQQdrJmxl6vm2uGopEN1w
rn6/MtC9AEjsk0+j4xM+sYbbP9rpa2mjYA7y2BOfbLDEESJo1jwqKXW2hsz0fhAD
DZcHv00TA/uwuUz0KrIxaPit7z8S5U2mKlJSCcTlmI9R/QIdi56O+70Rux003cbS
EcCln7QK/dm26iAYjKT8IG4fhS3QZY7fEQxsKJEIurOB4sLWUW9PP2hooNhas6EQ
mTGdqLV9kogGpcrjrBVNJDxvvTPLJ5RMU1SxovJM+CltxtYBl/nlKBUFTsiLHdDT
fxLmmQWtxXsJ2lx+DOP99EQcPGLFeAQ/3o7Nq0CDgpJEuQV32liUjqZfhuDX2YKc
NdW83Xu4ff25GzMvzsfgmVo0aff6b2SfbvdJ/40imIo50mGnYpHxtTb3ODHcbJFE
WwRR/NinV/9pDKZNZ1wPR5zUSenjT29TqT9pQfTU03vGvQK3UsSPIBYH9PCb6zDL
06wyr4bmVqZT2cNUWm5c
=hP8c
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3479-1
November 14, 2017

postgresql-9.3, postgresql-9.5, postgresql-9.6 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 17.10
- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in PostgreSQL.

Software Description:
- postgresql-9.6: Object-relational SQL database
- postgresql-9.5: Object-relational SQL database
- postgresql-9.3: Object-relational SQL database

Details:

David Rowley discovered that PostgreSQL incorrectly handled memory when
processing certain JSON functions. A remote attacker could possibly use
this issue to obtain sensitive information. (CVE-2017-15098)

Dean Rasheed discovered that PostgreSQL incorrectly enforced SELECT
privileges when processing INSERT ... ON CONFLICT DO UPDATE commands. A
remote attacker could possibly use this issue to obtain sensitive
information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 17.04 and
Ubuntu 17.10.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.10:
postgresql-9.6 9.6.6-0ubuntu0.17.10

Ubuntu 17.04:
postgresql-9.6 9.6.6-0ubuntu0.17.04

Ubuntu 16.04 LTS:
postgresql-9.5 9.5.10-0ubuntu0.16.04

Ubuntu 14.04 LTS:
postgresql-9.3 9.3.20-0ubuntu0.14.04

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.

References:
https://www.ubuntu.com/usn/usn-3479-1
CVE-2017-15098, CVE-2017-15099

Package Information:
https://launchpad.net/ubuntu/+source/postgresql-9.6/9.6.6-0ubuntu0.17.10
https://launchpad.net/ubuntu/+source/postgresql-9.6/9.6.6-0ubuntu0.17.04
https://launchpad.net/ubuntu/+source/postgresql-9.5/9.5.10-0ubuntu0.16.04
https://launchpad.net/ubuntu/+source/postgresql-9.3/9.3.20-0ubuntu0.14.04

[USN-3478-2] Perl vulnerability

==========================================================================
Ubuntu Security Notice USN-3478-2
November 13, 2017

perl vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 ESM

Summary:

Perl could be made to crash if it received specially crafted
input.

Software Description:
- perl: Practical Extraction and Report Language

Details:

USN-3478-1 fixed two vulnerabilities in Perl. This update
provides the corresponding update for Ubuntu 12.04 ESM.

Original advisory details:

 Jakub Wilk discovered that Perl incorrectly handled certain regular
 expressions. An attacker could use this issue to cause Perl to crash,
 resulting in a denial of service, or possibly execute arbitrary code.
 (CVE-2017-12883)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 ESM:
  perl                            5.14.2-6ubuntu2.6

In general, a standard system update will make all the necessary
changes.

References:
  https://www.ubuntu.com/usn/usn-3478-2
  https://www.ubuntu.com/usn/usn-3478-1
  CVE-2017-12883

[USN-3478-1] Perl vulnerabilities

==========================================================================
Ubuntu Security Notice USN-3478-1
November 13, 2017

perl vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Perl could be made to crash if it received specially crafted
input.

Software Description:
- perl: Practical Extraction and Report Language

Details:

Jakub Wilk discovered that Perl incorrectly handled certain regular
expressions. An attacker could use this issue to cause Perl to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2017-12837, CVE-2017-12883)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.04:
  perl                            5.24.1-2ubuntu1.1

Ubuntu 16.04 LTS:
  perl                            5.22.1-9ubuntu0.2

Ubuntu 14.04 LTS:
  perl                            5.18.2-2ubuntu1.3

In general, a standard system update will make all the necessary
changes.

References:
  https://www.ubuntu.com/usn/usn-3478-1
  CVE-2017-12837, CVE-2017-12883

Package Information:
  https://launchpad.net/ubuntu/+source/perl/5.24.1-2ubuntu1.1
  https://launchpad.net/ubuntu/+source/perl/5.22.1-9ubuntu0.2
  https://launchpad.net/ubuntu/+source/perl/5.18.2-2ubuntu1.3

F28 System Wide Change: time-1.8

= System Wide Change: time-1.8 =
https://fedoraproject.org/wiki/Changes/time-1.8

Change owner(s):
* Petr <ppisar AT redhat DOT com>

A new time tool version 1.8 has changed output format.

== Detailed Description ==
After many years a new 1.8 version of time tool was released. This
version brings some noticeable changes:

License changed from (GPLv2+) to (GPLv3+ and GFDL).
Additional exit codes are used to report measured command failures and
failures to execute the command.
A measured command failure is reported by default. See the first line
in this output:

$ time /usr/bin/false
Command exited with non-zero status 1
0.00user 0.00system 0:00.00elapsed 100%CPU (0avgtext+0avgdata 1196maxresident)k
0inputs+0outputs (0major+55minor)pagefaults 0swaps

In previous Fedora versions, the first line was printed only if -v
option was specified. This is not true anymore and the line is printed
by default. You can disable it with a new -q option:

$ time -q /usr/bin/false
0.00user 0.00system 0:00.00elapsed 100%CPU (0avgtext+0avgdata 1268maxresident)k
0inputs+0outputs (0major+55minor)pagefaults 0swaps

Because this violated POSIX mode, Fedora changed time-1.8 not to print
the first line when invoked with -p option and upstream accepted the
change so that future time versions will behave like Fedora. For
Fedora users, there is no change in the POSIX mode output:

$ time -p /usr/bin/false
real 0.00
user 0.00
sys 0.00

If you use time tool in your script without the -p option, then either
adjust your script to expect different output, or add -q option. Be
ware of portability across distributions using different time
versions.


== Scope ==
* Proposal owners:
The time package will be upgraded and patched to preserve output
format in the POSIX mode.

* Other developers:
Review their scripts and packages whether they use time' in non-POSIX
mode and parse time's output. If they are affected, they should add -q
option to the time command, or adjust their code do deal with the new
first line.

* Release engineering:
https://pagure.io/releng/issue/7153

* List of deliverables:
Not affected

* Policies and guidelines:
No change is needed.

* Trademark approval:
No approval is needed.
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org

[USN-3476-1] postgresql-common vulnerabilities

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCgAGBQJaBMOrAAoJEGVp2FWnRL6TBcMP/iLAyLZmgsMDc4KyqmMSQ7Ok
KZeRt96KEvHyB+bFO83sEenOjPMdWSCBKp8rEKpXaXR3/gd/xe8huVip+c9eiIoq
JDeKWRJT/P59kQTEpMWDBxFfEhDvwpNRX6e0b4kvVZMRQed+iEa6eNDeTW+ixDul
BBEntTz0ovjD9m0Ty9DaVrUM5X/fXnRcvV1qgHPpUXKPZBehHgJownRQcxQJQEyx
8R5sPhN31q3VnULTnjREP7lDNz8jXb3+HbTsAXiph4ayn8Vi4Rn4pdqdJ7C5LQXb
mW3jBzcSYvwvpfpl3CnyNu+NKTE9wiXLj+H6H6z86EQyXe/QcDPnRaWKJCY5PgRa
mtUS9HR+O0525T3PGC6ZaKr9233AvSa7GCMIQAEYABgMHMiKpIt48isF8X3UFzpu
3xum9VPU9hOst5qiGUC1UtJLk0H1Tc2gz8bX/wOeY8UP2pguFp3wnjkut0FGQf/9
OIvQga1aEQu+7HVck64zAQ2L7wXZNHbuBwgM+0T2+7GyRg2h9gzpmlx5/b+eWlwp
OwzURxRVs4D3XqGkKMJFEYmmdd3Bil1bDCJukE3MasHgyKMvJthYAsc0qxmbvLIg
5PSgze3+frjD3gaIB3wBf6dtd6fF4VjXaLrjcZRxiGzzeFBAk5uRCHIdytQfb10A
XgpXy64ZNiWm1fHdXfL6
=CfEe
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3476-1
November 09, 2017

postgresql-common vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 17.10
- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

postgresql-common could be made to overwrite files as the administrator.

Software Description:
- postgresql-common: PostgreSQL database-cluster manager

Details:

Dawid Golunski discovered that the postgresql-common pg_ctlcluster script
incorrectly handled symlinks. A local attacker could possibly use this
issue to escalate privileges. This issue only affected Ubuntu 14.04 LTS and
Ubuntu 16.04 LTS. (CVE-2016-1255)

It was discovered that the postgresql-common helper scripts incorrectly
handled symlinks. A local attacker could possibly use this issue to
escalate privileges. (CVE-2017-8806)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.10:
postgresql-common 184ubuntu1.1

Ubuntu 17.04:
postgresql-common 179ubuntu0.1

Ubuntu 16.04 LTS:
postgresql-common 173ubuntu0.1

Ubuntu 14.04 LTS:
postgresql-common 154ubuntu1.1

In general, a standard system update will make all the necessary changes.

References:
https://www.ubuntu.com/usn/usn-3476-1
CVE-2016-1255, CVE-2017-8806

Package Information:
https://launchpad.net/ubuntu/+source/postgresql-common/184ubuntu1.1
https://launchpad.net/ubuntu/+source/postgresql-common/179ubuntu0.1
https://launchpad.net/ubuntu/+source/postgresql-common/173ubuntu0.1
https://launchpad.net/ubuntu/+source/postgresql-common/154ubuntu1.1

Fedora 27 Modular Server Beta status is GO

The Fedora-Modular-27-20171108.2 RC compose [1][2] is considered as
GOLD and is going to be shipped on 2017-Nov-14 as F27 Modular Server
Beta release.

For more information please check the meeting minutes [3] from the
Go/No-Go meeting.

[1] http://kojipkgs.fedoraproject.org/compose/27/Fedora-Modular-27-20171108.2
[2] http://dl.fedoraproject.org/pub/alt/stage/27_Modular_Beta-1.5
[3] https://meetbot.fedoraproject.org/fedora-meeting-1/2017-11-09/f27-final-and-server-beta-go-no-go-meeting.2017-11-09-18.02.html

Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org

Fedora 27 Final status is GO

The Fedora-27-20171105.0 (Fedora_27_RC_1.6 ) compose [1][2] is
considered as GOLD and is going to be shipped on 2017-Nov-14 as Fedora
27 Final release.

For more information please check the meeting minutes [3] from the
Go/No-Go meeting.

[1] https://kojipkgs.fedoraproject.org/compose/27/Fedora-27-20171105.0/compose/
[2] http://dl.fedoraproject.org/pub/alt/stage/27_RC-1.6/
[3] https://meetbot.fedoraproject.org/fedora-meeting-1/2017-11-09/f27-final-and-server-beta-go-no-go-meeting.2017-11-09-18.02.html

Regards,
Jan
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org

[USN-3346-3] Bind vulnerabilities

==========================================================================
Ubuntu Security Notice USN-3346-3
November 08, 2017

bind9 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 ESM

Summary:

Bind could be made to serve incorrect information or expose sensitive
information over the network.

Software Description:
- bind9: Internet Domain Name Server

Details:

USN-3346-1 and USN-3346-2 fixed two vulnerabilities in Bind and a
regression, respectively. This update provides the corresponding update
for Ubuntu 12.04 ESM.

Original advisory details:

 Clément Berthaux discovered that Bind did not correctly check TSIG
 authentication for zone update requests. An attacker could use this
 to improperly perform zone updates. (CVE-2017-3143)

 Clément Berthaux discovered that Bind did not correctly check TSIG
 authentication for zone transfer requests. An attacker could use this
 to improperly transfer entire zones. (CVE-2017-3142)

 In addition, this update adds the new root zone key signing key (KSK).

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 ESM:
  bind9                           1:9.8.1.dfsg.P1-4ubuntu0.23

After a standard system update you need to restart Bind to make
all the necessary changes.

References:
  https://www.ubuntu.com/usn/usn-3346-3
  https://www.ubuntu.com/usn/usn-3346-1
  CVE-2017-3142, CVE-2017-3143

[arch-announce] The end of i686 support

Following 9 months of [deprecation period][1], support for the i686
architecture effectively ends today. By the end of November, i686
packages will be removed from our mirrors and later from the packages
archive.

For users unable to upgrade their hardware to x86_64, an alternative is
a community maintained fork named [Arch Linux 32][2]. See their website
for details on migrating existing installations.

[1]: https://www.archlinux.org/news/phasing-out-i686-support/
[2]: https://archlinux32.org/

URL: https://www.archlinux.org/news/the-end-of-i686-support/
_______________________________________________
arch-announce mailing list
arch-announce@archlinux.org
https://lists.archlinux.org/listinfo/arch-announce

[USN-3473-1] OpenJDK 8 vulnerabilities

==========================================================================
Ubuntu Security Notice USN-3473-1
November 08, 2017

openjdk-8 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 17.10
- Ubuntu 17.04
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in OpenJDK 8.

Software Description:
- openjdk-8: Open Source Java implementation

Details:

It was discovered that the Smart Card IO subsystem in OpenJDK did not
properly maintain state. An attacker could use this to specially construct
an untrusted Java application or applet to gain access to a smart card,
bypassing sandbox restrictions. (CVE-2017-10274)

Gaston Traberg discovered that the Serialization component of OpenJDK did
not properly limit the amount of memory allocated when performing
deserializations. An attacker could use this to cause a denial of service
(memory exhaustion). (CVE-2017-10281)

It was discovered that the Remote Method Invocation (RMI) component in
OpenJDK did not properly handle unreferenced objects. An attacker could use
this to specially construct an untrusted Java application or applet that
could escape sandbox restrictions. (CVE-2017-10285)

It was discovered that the HTTPUrlConnection classes in OpenJDK did not
properly handle newlines. An attacker could use this to convince a Java
application or applet to inject headers into http requests.
(CVE-2017-10295)

Francesco Palmarini, Marco Squarcina, Mauro Tempesta, and Riccardo Focardi
discovered that the Serialization component of OpenJDK did not properly
restrict the amount of memory allocated when deserializing objects from
Java Cryptography Extension KeyStore (JCEKS). An attacker could use this to
cause a denial of service (memory exhaustion). (CVE-2017-10345)

It was discovered that the Hotspot component of OpenJDK did not properly
perform loader checks when handling the invokespecial JVM instruction. An
attacker could use this to specially construct an untrusted Java
application or applet that could escape sandbox restrictions.
(CVE-2017-10346)

Gaston Traberg discovered that the Serialization component of OpenJDK did
not properly limit the amount of memory allocated when performing
deserializations in the SimpleTimeZone class. An attacker could use this to
cause a denial of service (memory exhaustion). (CVE-2017-10347)

It was discovered that the Serialization component of OpenJDK did not
properly limit the amount of memory allocated when performing
deserializations. An attacker could use this to cause a denial of service
(memory exhaustion). (CVE-2017-10348, CVE-2017-10357)

It was discovered that the JAXP component in OpenJDK did not properly limit
the amount of memory allocated when performing deserializations. An
attacker could use this to cause a denial of service (memory exhaustion).
(CVE-2017-10349)

It was discovered that the JAX-WS component in OpenJDK did not properly
limit the amount of memory allocated when performing deserializations. An
attacker could use this to cause a denial of service (memory exhaustion).
(CVE-2017-10350)

It was discovered that the Networking component of OpenJDK did not properly
set timeouts on FTP client actions. A remote attacker could use this to
cause a denial of service (application hang). (CVE-2017-10355)

Francesco Palmarini, Marco Squarcina, Mauro Tempesta, Riccardo Focardi, and
Tobias Ospelt discovered that the Security component in OpenJDK did not
sufficiently protect password-based encryption keys in key stores. An
attacker could use this to expose sensitive information. (CVE-2017-10356)

Jeffrey Altman discovered that the Kerberos client implementation in
OpenJDK incorrectly trusted unauthenticated portions of Kerberos tickets. A
remote attacker could use this to impersonate trusted network services or
perform other attacks. (CVE-2017-10388)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.10:
openjdk-8-jdk 8u151-b12-0ubuntu0.17.10.2
openjdk-8-jdk-headless 8u151-b12-0ubuntu0.17.10.2
openjdk-8-jre 8u151-b12-0ubuntu0.17.10.2
openjdk-8-jre-headless 8u151-b12-0ubuntu0.17.10.2
openjdk-8-jre-zero 8u151-b12-0ubuntu0.17.10.2

Ubuntu 17.04:
openjdk-8-jdk 8u151-b12-0ubuntu0.17.04.2
openjdk-8-jdk-headless 8u151-b12-0ubuntu0.17.04.2
openjdk-8-jre 8u151-b12-0ubuntu0.17.04.2
openjdk-8-jre-headless 8u151-b12-0ubuntu0.17.04.2
openjdk-8-jre-zero 8u151-b12-0ubuntu0.17.04.2

Ubuntu 16.04 LTS:
openjdk-8-jdk 8u151-b12-0ubuntu0.16.04.2
openjdk-8-jdk-headless 8u151-b12-0ubuntu0.16.04.2
openjdk-8-jre 8u151-b12-0ubuntu0.16.04.2
openjdk-8-jre-headless 8u151-b12-0ubuntu0.16.04.2
openjdk-8-jre-jamvm 8u151-b12-0ubuntu0.16.04.2
openjdk-8-jre-zero 8u151-b12-0ubuntu0.16.04.2

This update uses a new upstream release, which includes additional
bug fixes. After a standard system update you need to restart any
Java applications or applets to make all the necessary changes.

References:
https://www.ubuntu.com/usn/usn-3473-1
CVE-2017-10274, CVE-2017-10281, CVE-2017-10285, CVE-2017-10295,
CVE-2017-10345, CVE-2017-10346, CVE-2017-10347, CVE-2017-10348,
CVE-2017-10349, CVE-2017-10350, CVE-2017-10355, CVE-2017-10356,
CVE-2017-10357, CVE-2017-10388

Package Information:
https://launchpad.net/ubuntu/+source/openjdk-8/8u151-b12-0ubuntu0.17.10.2
https://launchpad.net/ubuntu/+source/openjdk-8/8u151-b12-0ubuntu0.17.04.2
https://launchpad.net/ubuntu/+source/openjdk-8/8u151-b12-0ubuntu0.16.04.2

[USN-3475-1] OpenSSL vulnerabilities

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCgAGBQJaALccAAoJEGVp2FWnRL6ThLAQAJOE3xPUtpcqLMxDgB/ZdNd1
0E8ltDi6Tsvt21EJ04PI9lfTwzdBiflDVJE4cwvz2Pd1scAYtE6PRySklVkOvySt
DFr8ySnJKKv9J+MwlWC/3vbFantUtGsiELUoy+5FmokkyWrAXflmtxbsgNsOyJc9
p4UEc3crdg20Sv4h1o3IQqXSDz/0lAzqxLwHCCJpI8AgbKCccso1W4qbqxN23gFt
WQ4CxebxrH+oEwWnVjSvNNvKPMeeEEYG/5ttxZcwo9od/Ot/B6sQZm/sce4Pw9N3
7StAiSHoSswOaSRjE5mjz0wdne1l0DrGlAgJCgux4+Ab8PucYjQFNZsmjr94rP0q
JIuAbs/B3MwkPgbHU6jRaM9EDNHEwZCsG7cCAHH8FRjjL5BwOk7S0nGLJEyQmiSM
ffxOj3fiRqyl5SUVNIf3LoocXsub+9LZV1bSi2d8hti2rNyPMw0zO4/CmQHkPNLV
hMgFDDQBiQAKGkgduvmRl7LDAxILMIS2IgYYnVIm7coB0irmMtKdf2oWa2sLZxO4
/cOACLKGkGYga8JZdKTjkV86Da2aV69732LjxQ7i8CFqiVGyZI6AXR89dZ+/Yocc
hC3PtEz657pOCCuQvG1lIgNlyAsNXrDuOAFVWJpeMuaKODjWTFohRESAsjgY7DJO
J3WB5gMMErEjDhu5DrQu
=LorH
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3475-1
November 06, 2017

openssl vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 17.10
- Ubuntu 17.04
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in OpenSSL.

Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

It was discovered that OpenSSL incorrectly parsed the IPAddressFamily
extension in X.509 certificates, resulting in an erroneous display of the
certificate in text format. (CVE-2017-3735)

It was discovered that OpenSSL incorrectly performed the x86_64 Montgomery
squaring procedure. While unlikely, a remote attacker could possibly use
this issue to recover private keys. This issue only applied to Ubuntu 16.04
LTS, Ubuntu 16.10 and Ubuntu 17.04. (CVE-2017-3736)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.10:
libssl1.0.0 1.0.2g-1ubuntu13.2

Ubuntu 17.04:
libssl1.0.0 1.0.2g-1ubuntu11.3

Ubuntu 16.04 LTS:
libssl1.0.0 1.0.2g-1ubuntu4.9

Ubuntu 14.04 LTS:
libssl1.0.0 1.0.1f-1ubuntu2.23

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
https://www.ubuntu.com/usn/usn-3475-1
CVE-2017-3735, CVE-2017-3736

Package Information:
https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu13.2
https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu11.3
https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu4.9
https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.23