==========================================================================
Ubuntu Security Notice USN-3788-2
October 23, 2018
texlive-bin vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.10
Summary:
Several security issues were fixed in Tex Live.
Software Description:
- texlive-bin: TeX Live: path search library for TeX (development part)
Details:
USN-3788-1 fixed vulnerabilities in Tex Live. This update provides
the corresponding update for Ubuntu 18.10
Original advisory details:
It was discovered that Tex Live incorrectly handled certain files.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2018-17407)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.10:
texlive-binaries 2018.20180824.48463-1ubuntu0.1
In general, a standard system update will make all the necessary
changes.
References:
https://usn.ubuntu.com/usn/usn-3788-2
https://usn.ubuntu.com/usn/usn-3788-1
CVE-2018-17407
Package Information:
https://launchpad.net/ubuntu/+source/texlive-bin/2018.20180824.48463-1ubuntu0.1
Tuesday, October 23, 2018
Monday, October 22, 2018
[USN-3777-3] Linux kernel (Azure) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3777-3
October 23, 2018
linux-azure vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
Details:
USN-3777-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
%LTS. This update provides the corresponding updates for the
Linux kernel for Azure Cloud systems.
Jann Horn discovered that the vmacache subsystem did not properly handle
sequence number overflows, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or execute arbitrary code. (CVE-2018-17182)
It was discovered that the paravirtualization implementation in the Linux
kernel did not properly handle some indirect calls, reducing the
effectiveness of Spectre v2 mitigations for paravirtual guests. A local
attacker could use this to expose sensitive information. (CVE-2018-15594)
It was discovered that microprocessors utilizing speculative execution and
prediction of return addresses via Return Stack Buffer (RSB) may allow
unauthorized memory reads via sidechannel attacks. An attacker could use
this to expose sensitive information. (CVE-2018-15572)
Jann Horn discovered that microprocessors utilizing speculative execution
and branch prediction may allow unauthorized memory reads via sidechannel
attacks. This flaw is known as Spectre. A local attacker could use this to
expose sensitive information, including kernel memory. (CVE-2017-5715)
It was discovered that a stack-based buffer overflow existed in the iSCSI
target implementation of the Linux kernel. A remote attacker could use this
to cause a denial of service (system crash). (CVE-2018-14633)
Jann Horn and Ken Johnson discovered that microprocessors utilizing
speculative execution of a memory read may allow unauthorized memory reads
via a sidechannel attack. This flaw is known as Spectre Variant 4. A local
attacker could use this to expose sensitive information, including kernel
memory. (CVE-2018-3639)
It was discovered that a memory leak existed in the IRDA subsystem of the
Linux kernel. A local attacker could use this to cause a denial of service
(kernel memory exhaustion). (CVE-2018-6554)
It was discovered that a use-after-free vulnerability existed in the IRDA
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2018-6555)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
linux-image-4.15.0-1025-azure 4.15.0-1025.26
linux-image-azure 4.15.0.1025.25
Ubuntu 16.04 LTS:
linux-image-4.15.0-1025-azure 4.15.0-1025.26~16.04.1
linux-image-azure 4.15.0.1025.31
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/usn/usn-3777-3
https://usn.ubuntu.com/usn/usn-3777-1
CVE-2017-5715, CVE-2018-14633, CVE-2018-15572, CVE-2018-15594,
CVE-2018-17182, CVE-2018-3639, CVE-2018-6554, CVE-2018-6555
Package Information:
https://launchpad.net/ubuntu/+source/linux-azure/4.15.0-1025.26
https://launchpad.net/ubuntu/+source/linux-azure/4.15.0-1025.26~16.04.1
Ubuntu Security Notice USN-3777-3
October 23, 2018
linux-azure vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
Details:
USN-3777-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
%LTS. This update provides the corresponding updates for the
Linux kernel for Azure Cloud systems.
Jann Horn discovered that the vmacache subsystem did not properly handle
sequence number overflows, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or execute arbitrary code. (CVE-2018-17182)
It was discovered that the paravirtualization implementation in the Linux
kernel did not properly handle some indirect calls, reducing the
effectiveness of Spectre v2 mitigations for paravirtual guests. A local
attacker could use this to expose sensitive information. (CVE-2018-15594)
It was discovered that microprocessors utilizing speculative execution and
prediction of return addresses via Return Stack Buffer (RSB) may allow
unauthorized memory reads via sidechannel attacks. An attacker could use
this to expose sensitive information. (CVE-2018-15572)
Jann Horn discovered that microprocessors utilizing speculative execution
and branch prediction may allow unauthorized memory reads via sidechannel
attacks. This flaw is known as Spectre. A local attacker could use this to
expose sensitive information, including kernel memory. (CVE-2017-5715)
It was discovered that a stack-based buffer overflow existed in the iSCSI
target implementation of the Linux kernel. A remote attacker could use this
to cause a denial of service (system crash). (CVE-2018-14633)
Jann Horn and Ken Johnson discovered that microprocessors utilizing
speculative execution of a memory read may allow unauthorized memory reads
via a sidechannel attack. This flaw is known as Spectre Variant 4. A local
attacker could use this to expose sensitive information, including kernel
memory. (CVE-2018-3639)
It was discovered that a memory leak existed in the IRDA subsystem of the
Linux kernel. A local attacker could use this to cause a denial of service
(kernel memory exhaustion). (CVE-2018-6554)
It was discovered that a use-after-free vulnerability existed in the IRDA
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2018-6555)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
linux-image-4.15.0-1025-azure 4.15.0-1025.26
linux-image-azure 4.15.0.1025.25
Ubuntu 16.04 LTS:
linux-image-4.15.0-1025-azure 4.15.0-1025.26~16.04.1
linux-image-azure 4.15.0.1025.31
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/usn/usn-3777-3
https://usn.ubuntu.com/usn/usn-3777-1
CVE-2017-5715, CVE-2018-14633, CVE-2018-15572, CVE-2018-15594,
CVE-2018-17182, CVE-2018-3639, CVE-2018-6554, CVE-2018-6555
Package Information:
https://launchpad.net/ubuntu/+source/linux-azure/4.15.0-1025.26
https://launchpad.net/ubuntu/+source/linux-azure/4.15.0-1025.26~16.04.1
[USN-3798-2] Linux kernel (Trusty HWE) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3798-2
October 23, 2018
linux-lts-trusty vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-lts-trusty: Linux hardware enablement kernel from Trusty for Precise ESM
Details:
USN-3798-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu
12.04 LTS.
Dmitry Vyukov discovered that the key management subsystem in the Linux
kernel did not properly restrict adding a key that already exists but is
negatively instantiated. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2015-8539)
It was discovered that a use-after-free vulnerability existed in the device
driver for XCeive xc2028/xc3028 tuners in the Linux kernel. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2016-7913)
Pengfei Ding (丁鹏飞), Chenfu Bao (包沉浮), and Lenx Wei (韦韬)
discovered a race condition in the generic SCSI driver (sg) of the Linux
kernel. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2017-0794)
Eric Biggers discovered that the key management subsystem in the Linux
kernel did not properly restrict adding a key that already exists but is
uninstantiated. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2017-15299)
It was discovered that a NULL pointer dereference could be triggered in the
OCFS2 file system implementation in the Linux kernel. A local attacker
could use this to cause a denial of service (system crash).
(CVE-2017-18216)
Luo Quan and Wei Yang discovered that a race condition existed in the
Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel when
handling ioctl()s. A local attacker could use this to cause a denial of
service (system deadlock). (CVE-2018-1000004)
范龙飞 discovered that a race condition existed in the Advanced Linux
Sound Architecture (ALSA) subsystem of the Linux kernel that could lead to
a use- after-free or an out-of-bounds buffer access. A local attacker with
access to /dev/snd/seq could use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2018-7566)
It was discovered that a buffer overflow existed in the NFC Logical Link
Control Protocol (llcp) implementation in the Linux kernel. An attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2018-9518)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
linux-image-3.13.0-161-generic 3.13.0-161.211~precise1
linux-image-3.13.0-161-generic-lpae 3.13.0-161.211~precise1
linux-image-generic-lpae-lts-trusty 3.13.0.161.151
linux-image-generic-lts-trusty 3.13.0.161.151
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/usn/usn-3798-2
https://usn.ubuntu.com/usn/usn-3798-1
CVE-2015-8539, CVE-2016-7913, CVE-2017-0794, CVE-2017-15299,
CVE-2017-18216, CVE-2018-1000004, CVE-2018-7566, CVE-2018-9518
Ubuntu Security Notice USN-3798-2
October 23, 2018
linux-lts-trusty vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-lts-trusty: Linux hardware enablement kernel from Trusty for Precise ESM
Details:
USN-3798-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu
12.04 LTS.
Dmitry Vyukov discovered that the key management subsystem in the Linux
kernel did not properly restrict adding a key that already exists but is
negatively instantiated. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2015-8539)
It was discovered that a use-after-free vulnerability existed in the device
driver for XCeive xc2028/xc3028 tuners in the Linux kernel. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2016-7913)
Pengfei Ding (丁鹏飞), Chenfu Bao (包沉浮), and Lenx Wei (韦韬)
discovered a race condition in the generic SCSI driver (sg) of the Linux
kernel. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2017-0794)
Eric Biggers discovered that the key management subsystem in the Linux
kernel did not properly restrict adding a key that already exists but is
uninstantiated. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2017-15299)
It was discovered that a NULL pointer dereference could be triggered in the
OCFS2 file system implementation in the Linux kernel. A local attacker
could use this to cause a denial of service (system crash).
(CVE-2017-18216)
Luo Quan and Wei Yang discovered that a race condition existed in the
Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel when
handling ioctl()s. A local attacker could use this to cause a denial of
service (system deadlock). (CVE-2018-1000004)
范龙飞 discovered that a race condition existed in the Advanced Linux
Sound Architecture (ALSA) subsystem of the Linux kernel that could lead to
a use- after-free or an out-of-bounds buffer access. A local attacker with
access to /dev/snd/seq could use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2018-7566)
It was discovered that a buffer overflow existed in the NFC Logical Link
Control Protocol (llcp) implementation in the Linux kernel. An attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2018-9518)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
linux-image-3.13.0-161-generic 3.13.0-161.211~precise1
linux-image-3.13.0-161-generic-lpae 3.13.0-161.211~precise1
linux-image-generic-lpae-lts-trusty 3.13.0.161.151
linux-image-generic-lts-trusty 3.13.0.161.151
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/usn/usn-3798-2
https://usn.ubuntu.com/usn/usn-3798-1
CVE-2015-8539, CVE-2016-7913, CVE-2017-0794, CVE-2017-15299,
CVE-2017-18216, CVE-2018-1000004, CVE-2018-7566, CVE-2018-9518
[USN-3798-1] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3798-1
October 23, 2018
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
Details:
Dmitry Vyukov discovered that the key management subsystem in the Linux
kernel did not properly restrict adding a key that already exists but is
negatively instantiated. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2015-8539)
It was discovered that a use-after-free vulnerability existed in the device
driver for XCeive xc2028/xc3028 tuners in the Linux kernel. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2016-7913)
Pengfei Ding (丁鹏飞), Chenfu Bao (包沉浮), and Lenx Wei (韦韬)
discovered a race condition in the generic SCSI driver (sg) of the Linux
kernel. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2017-0794)
Eric Biggers discovered that the key management subsystem in the Linux
kernel did not properly restrict adding a key that already exists but is
uninstantiated. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2017-15299)
It was discovered that a NULL pointer dereference could be triggered in the
OCFS2 file system implementation in the Linux kernel. A local attacker
could use this to cause a denial of service (system crash).
(CVE-2017-18216)
Luo Quan and Wei Yang discovered that a race condition existed in the
Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel when
handling ioctl()s. A local attacker could use this to cause a denial of
service (system deadlock). (CVE-2018-1000004)
范龙飞 discovered that a race condition existed in the Advanced Linux
Sound Architecture (ALSA) subsystem of the Linux kernel that could lead to
a use- after-free or an out-of-bounds buffer access. A local attacker with
access to /dev/snd/seq could use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2018-7566)
It was discovered that a buffer overflow existed in the NFC Logical Link
Control Protocol (llcp) implementation in the Linux kernel. An attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2018-9518)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
linux-image-3.13.0-161-generic 3.13.0-161.211
linux-image-3.13.0-161-generic-lpae 3.13.0-161.211
linux-image-3.13.0-161-lowlatency 3.13.0-161.211
linux-image-3.13.0-161-powerpc-e500 3.13.0-161.211
linux-image-3.13.0-161-powerpc-e500mc 3.13.0-161.211
linux-image-3.13.0-161-powerpc-smp 3.13.0-161.211
linux-image-3.13.0-161-powerpc64-emb 3.13.0-161.211
linux-image-3.13.0-161-powerpc64-smp 3.13.0-161.211
linux-image-generic 3.13.0.161.171
linux-image-generic-lpae 3.13.0.161.171
linux-image-highbank 3.13.0.161.171
linux-image-lowlatency 3.13.0.161.171
linux-image-powerpc-e500 3.13.0.161.171
linux-image-powerpc-e500mc 3.13.0.161.171
linux-image-powerpc-smp 3.13.0.161.171
linux-image-powerpc64-emb 3.13.0.161.171
linux-image-powerpc64-smp 3.13.0.161.171
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/usn/usn-3798-1
CVE-2015-8539, CVE-2016-7913, CVE-2017-0794, CVE-2017-15299,
CVE-2017-18216, CVE-2018-1000004, CVE-2018-7566, CVE-2018-9518
Package Information:
https://launchpad.net/ubuntu/+source/linux/3.13.0-161.211
Ubuntu Security Notice USN-3798-1
October 23, 2018
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
Details:
Dmitry Vyukov discovered that the key management subsystem in the Linux
kernel did not properly restrict adding a key that already exists but is
negatively instantiated. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2015-8539)
It was discovered that a use-after-free vulnerability existed in the device
driver for XCeive xc2028/xc3028 tuners in the Linux kernel. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2016-7913)
Pengfei Ding (丁鹏飞), Chenfu Bao (包沉浮), and Lenx Wei (韦韬)
discovered a race condition in the generic SCSI driver (sg) of the Linux
kernel. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2017-0794)
Eric Biggers discovered that the key management subsystem in the Linux
kernel did not properly restrict adding a key that already exists but is
uninstantiated. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2017-15299)
It was discovered that a NULL pointer dereference could be triggered in the
OCFS2 file system implementation in the Linux kernel. A local attacker
could use this to cause a denial of service (system crash).
(CVE-2017-18216)
Luo Quan and Wei Yang discovered that a race condition existed in the
Advanced Linux Sound Architecture (ALSA) subsystem of the Linux kernel when
handling ioctl()s. A local attacker could use this to cause a denial of
service (system deadlock). (CVE-2018-1000004)
范龙飞 discovered that a race condition existed in the Advanced Linux
Sound Architecture (ALSA) subsystem of the Linux kernel that could lead to
a use- after-free or an out-of-bounds buffer access. A local attacker with
access to /dev/snd/seq could use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2018-7566)
It was discovered that a buffer overflow existed in the NFC Logical Link
Control Protocol (llcp) implementation in the Linux kernel. An attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2018-9518)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
linux-image-3.13.0-161-generic 3.13.0-161.211
linux-image-3.13.0-161-generic-lpae 3.13.0-161.211
linux-image-3.13.0-161-lowlatency 3.13.0-161.211
linux-image-3.13.0-161-powerpc-e500 3.13.0-161.211
linux-image-3.13.0-161-powerpc-e500mc 3.13.0-161.211
linux-image-3.13.0-161-powerpc-smp 3.13.0-161.211
linux-image-3.13.0-161-powerpc64-emb 3.13.0-161.211
linux-image-3.13.0-161-powerpc64-smp 3.13.0-161.211
linux-image-generic 3.13.0.161.171
linux-image-generic-lpae 3.13.0.161.171
linux-image-highbank 3.13.0.161.171
linux-image-lowlatency 3.13.0.161.171
linux-image-powerpc-e500 3.13.0.161.171
linux-image-powerpc-e500mc 3.13.0.161.171
linux-image-powerpc-smp 3.13.0.161.171
linux-image-powerpc64-emb 3.13.0.161.171
linux-image-powerpc64-smp 3.13.0.161.171
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/usn/usn-3798-1
CVE-2015-8539, CVE-2016-7913, CVE-2017-0794, CVE-2017-15299,
CVE-2017-18216, CVE-2018-1000004, CVE-2018-7566, CVE-2018-9518
Package Information:
https://launchpad.net/ubuntu/+source/linux/3.13.0-161.211
[USN-3797-1] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3797-1
October 23, 2018
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-kvm: Linux kernel for cloud environments
- linux-raspi2: Linux kernel for Raspberry Pi 2
- linux-snapdragon: Linux kernel for Snapdragon processors
Details:
Noam Rathaus discovered that a use-after-free vulnerability existed in the
Infiniband implementation in the Linux kernel. An attacker could use this
to cause a denial of service (system crash). (CVE-2018-14734)
It was discovered that an integer overflow existed in the CD-ROM driver of
the Linux kernel. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2018-16658)
It was discovered that an integer overflow existed in the HID Bluetooth
implementation in the Linux kernel that could lead to a buffer overwrite.
An attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2018-9363)
Yves Younan discovered that the CIPSO labeling implementation in the Linux
kernel did not properly handle IP header options in some situations. A
remote attacker could use this to specially craft network traffic that
could cause a denial of service (infinite loop). (CVE-2018-10938)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
linux-image-4.4.0-1036-kvm 4.4.0-1036.42
linux-image-4.4.0-1070-aws 4.4.0-1070.80
linux-image-4.4.0-1099-raspi2 4.4.0-1099.107
linux-image-4.4.0-1103-snapdragon 4.4.0-1103.108
linux-image-4.4.0-138-generic 4.4.0-138.164
linux-image-4.4.0-138-generic-lpae 4.4.0-138.164
linux-image-4.4.0-138-lowlatency 4.4.0-138.164
linux-image-4.4.0-138-powerpc-e500mc 4.4.0-138.164
linux-image-4.4.0-138-powerpc-smp 4.4.0-138.164
linux-image-4.4.0-138-powerpc64-emb 4.4.0-138.164
linux-image-4.4.0-138-powerpc64-smp 4.4.0-138.164
linux-image-aws 4.4.0.1070.72
linux-image-generic 4.4.0.138.144
linux-image-generic-lpae 4.4.0.138.144
linux-image-kvm 4.4.0.1036.35
linux-image-lowlatency 4.4.0.138.144
linux-image-powerpc-e500mc 4.4.0.138.144
linux-image-powerpc-smp 4.4.0.138.144
linux-image-powerpc64-emb 4.4.0.138.144
linux-image-powerpc64-smp 4.4.0.138.144
linux-image-raspi2 4.4.0.1099.99
linux-image-snapdragon 4.4.0.1103.95
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/usn/usn-3797-1
CVE-2018-10938, CVE-2018-14734, CVE-2018-16658, CVE-2018-9363
Package Information:
https://launchpad.net/ubuntu/+source/linux/4.4.0-138.164
https://launchpad.net/ubuntu/+source/linux-aws/4.4.0-1070.80
https://launchpad.net/ubuntu/+source/linux-kvm/4.4.0-1036.42
https://launchpad.net/ubuntu/+source/linux-raspi2/4.4.0-1099.107
https://launchpad.net/ubuntu/+source/linux-snapdragon/4.4.0-1103.108
Ubuntu Security Notice USN-3797-1
October 23, 2018
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-kvm: Linux kernel for cloud environments
- linux-raspi2: Linux kernel for Raspberry Pi 2
- linux-snapdragon: Linux kernel for Snapdragon processors
Details:
Noam Rathaus discovered that a use-after-free vulnerability existed in the
Infiniband implementation in the Linux kernel. An attacker could use this
to cause a denial of service (system crash). (CVE-2018-14734)
It was discovered that an integer overflow existed in the CD-ROM driver of
the Linux kernel. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2018-16658)
It was discovered that an integer overflow existed in the HID Bluetooth
implementation in the Linux kernel that could lead to a buffer overwrite.
An attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2018-9363)
Yves Younan discovered that the CIPSO labeling implementation in the Linux
kernel did not properly handle IP header options in some situations. A
remote attacker could use this to specially craft network traffic that
could cause a denial of service (infinite loop). (CVE-2018-10938)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
linux-image-4.4.0-1036-kvm 4.4.0-1036.42
linux-image-4.4.0-1070-aws 4.4.0-1070.80
linux-image-4.4.0-1099-raspi2 4.4.0-1099.107
linux-image-4.4.0-1103-snapdragon 4.4.0-1103.108
linux-image-4.4.0-138-generic 4.4.0-138.164
linux-image-4.4.0-138-generic-lpae 4.4.0-138.164
linux-image-4.4.0-138-lowlatency 4.4.0-138.164
linux-image-4.4.0-138-powerpc-e500mc 4.4.0-138.164
linux-image-4.4.0-138-powerpc-smp 4.4.0-138.164
linux-image-4.4.0-138-powerpc64-emb 4.4.0-138.164
linux-image-4.4.0-138-powerpc64-smp 4.4.0-138.164
linux-image-aws 4.4.0.1070.72
linux-image-generic 4.4.0.138.144
linux-image-generic-lpae 4.4.0.138.144
linux-image-kvm 4.4.0.1036.35
linux-image-lowlatency 4.4.0.138.144
linux-image-powerpc-e500mc 4.4.0.138.144
linux-image-powerpc-smp 4.4.0.138.144
linux-image-powerpc64-emb 4.4.0.138.144
linux-image-powerpc64-smp 4.4.0.138.144
linux-image-raspi2 4.4.0.1099.99
linux-image-snapdragon 4.4.0.1103.95
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/usn/usn-3797-1
CVE-2018-10938, CVE-2018-14734, CVE-2018-16658, CVE-2018-9363
Package Information:
https://launchpad.net/ubuntu/+source/linux/4.4.0-138.164
https://launchpad.net/ubuntu/+source/linux-aws/4.4.0-1070.80
https://launchpad.net/ubuntu/+source/linux-kvm/4.4.0-1036.42
https://launchpad.net/ubuntu/+source/linux-raspi2/4.4.0-1099.107
https://launchpad.net/ubuntu/+source/linux-snapdragon/4.4.0-1103.108
[USN-3797-2] Linux kernel (Xenial HWE) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3797-2
October 23, 2018
linux-lts-xenial, linux-aws vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty
Details:
USN-3797-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
Noam Rathaus discovered that a use-after-free vulnerability existed in the
Infiniband implementation in the Linux kernel. An attacker could use this
to cause a denial of service (system crash). (CVE-2018-14734)
It was discovered that an integer overflow existed in the CD-ROM driver of
the Linux kernel. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2018-16658)
It was discovered that a integer overflow existed in the HID Bluetooth
implementation in the Linux kernel that could lead to a buffer overwrite.
An attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2018-9363)
Yves Younan discovered that the CIPSO labeling implementation in the Linux
kernel did not properly handle IP header options in some situations. A
remote attacker could use this to specially craft network traffic that
could cause a denial of service (infinite loop). (CVE-2018-10938)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
linux-image-4.4.0-1032-aws 4.4.0-1032.35
linux-image-4.4.0-138-generic 4.4.0-138.164~14.04.1
linux-image-4.4.0-138-generic-lpae 4.4.0-138.164~14.04.1
linux-image-4.4.0-138-lowlatency 4.4.0-138.164~14.04.1
linux-image-4.4.0-138-powerpc-e500mc 4.4.0-138.164~14.04.1
linux-image-4.4.0-138-powerpc-smp 4.4.0-138.164~14.04.1
linux-image-4.4.0-138-powerpc64-emb 4.4.0-138.164~14.04.1
linux-image-4.4.0-138-powerpc64-smp 4.4.0-138.164~14.04.1
linux-image-aws 4.4.0.1032.32
linux-image-generic-lpae-lts-xenial 4.4.0.138.118
linux-image-generic-lts-xenial 4.4.0.138.118
linux-image-lowlatency-lts-xenial 4.4.0.138.118
linux-image-powerpc-e500mc-lts-xenial 4.4.0.138.118
linux-image-powerpc-smp-lts-xenial 4.4.0.138.118
linux-image-powerpc64-emb-lts-xenial 4.4.0.138.118
linux-image-powerpc64-smp-lts-xenial 4.4.0.138.118
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/usn/usn-3797-2
https://usn.ubuntu.com/usn/usn-3797-1
CVE-2018-10938, CVE-2018-14734, CVE-2018-16658, CVE-2018-9363
Package Information:
https://launchpad.net/ubuntu/+source/linux-aws/4.4.0-1032.35
https://launchpad.net/ubuntu/+source/linux-lts-xenial/4.4.0-138.164~14.04.1
Ubuntu Security Notice USN-3797-2
October 23, 2018
linux-lts-xenial, linux-aws vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty
Details:
USN-3797-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
Noam Rathaus discovered that a use-after-free vulnerability existed in the
Infiniband implementation in the Linux kernel. An attacker could use this
to cause a denial of service (system crash). (CVE-2018-14734)
It was discovered that an integer overflow existed in the CD-ROM driver of
the Linux kernel. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2018-16658)
It was discovered that a integer overflow existed in the HID Bluetooth
implementation in the Linux kernel that could lead to a buffer overwrite.
An attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2018-9363)
Yves Younan discovered that the CIPSO labeling implementation in the Linux
kernel did not properly handle IP header options in some situations. A
remote attacker could use this to specially craft network traffic that
could cause a denial of service (infinite loop). (CVE-2018-10938)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
linux-image-4.4.0-1032-aws 4.4.0-1032.35
linux-image-4.4.0-138-generic 4.4.0-138.164~14.04.1
linux-image-4.4.0-138-generic-lpae 4.4.0-138.164~14.04.1
linux-image-4.4.0-138-lowlatency 4.4.0-138.164~14.04.1
linux-image-4.4.0-138-powerpc-e500mc 4.4.0-138.164~14.04.1
linux-image-4.4.0-138-powerpc-smp 4.4.0-138.164~14.04.1
linux-image-4.4.0-138-powerpc64-emb 4.4.0-138.164~14.04.1
linux-image-4.4.0-138-powerpc64-smp 4.4.0-138.164~14.04.1
linux-image-aws 4.4.0.1032.32
linux-image-generic-lpae-lts-xenial 4.4.0.138.118
linux-image-generic-lts-xenial 4.4.0.138.118
linux-image-lowlatency-lts-xenial 4.4.0.138.118
linux-image-powerpc-e500mc-lts-xenial 4.4.0.138.118
linux-image-powerpc-smp-lts-xenial 4.4.0.138.118
linux-image-powerpc64-emb-lts-xenial 4.4.0.138.118
linux-image-powerpc64-smp-lts-xenial 4.4.0.138.118
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://usn.ubuntu.com/usn/usn-3797-2
https://usn.ubuntu.com/usn/usn-3797-1
CVE-2018-10938, CVE-2018-14734, CVE-2018-16658, CVE-2018-9363
Package Information:
https://launchpad.net/ubuntu/+source/linux-aws/4.4.0-1032.35
https://launchpad.net/ubuntu/+source/linux-lts-xenial/4.4.0-138.164~14.04.1
[USN-3796-3] Paramiko vulnerability
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAlvOE8kACgkQZWnYVadE
vpNQnQ//bSvyhy8Ozb2HEz50/Ow7BaWJjWCZyV+OmDtXR4lJKtuJ4Jm5Uh0Nrd3m
gnxQPndFYcn4+l7uJ9+/UHPXOgCp+w61TTlkWG4L3iF6Vqmds3j/m/z2orwsDBoF
vb0n+QhN+pOZ3bwOAeJwG42jJcxcTmKjHI9LpkdyjkHe0b9wQH/e4N+bAjHzaaOH
BgvVxfdTJTlxnSz/WSlba1glwO/TX5XPEkYqQN2F00EJJi+ZP3Lyrco3nF7OTgtD
ietwF8oOdmuEBvyRugXz8/3Qf54yGBN5ttYIzWC52nAHpG4C8uOOEO1UkyggPVnF
GXt+c/RoJ4x41M1uFYUo1RO5F99nNonEx0OZ/eqYWxS8X6zviNEZqVDS+qETN7pa
Yr+JJfx4mUAsNoLZy7KMcf6vLeoFLo1mNx8ZLtzkbg1lIXfXeqS4KS9a/XWaUyRI
lVaNe6mnFGfbMRobIrSxITRVNSeMK8t4+XbOv3JlVZGZkM4oGltI0eP/6acKAZcN
mcta0RKa+T8L+afSmrbh86OZjG+5CLF91Uz+F+CvlCaeNBkn+Y0SONcZGBlEaSie
gBPVgAgMHAEfaOv+AhoPSyhFmF0CSkQOvwGeMJ5k8TFeT7A18fcojaQNViRho4dC
rRfs8q6fbpOTo/xU9OJHqSvGJUVagq3dYtGfd8lE0/A9GvdK0z4=
=bKUE
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3796-3
October 22, 2018
paramiko vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.10
Summary:
Paramiko could allow unintended access to network services.
Software Description:
- paramiko: Python SSH2 library
Details:
USN-3796-1 fixed a vulnerability in Paramiko. This update provides the
corresponding update for Ubuntu 18.10.
Original advisory details:
Daniel Hoffman discovered that Paramiko incorrectly handled authentication
when being used as a server. A remote attacker could use this issue to
bypass authentication without any credentials.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.10:
python-paramiko 2.4.1-0ubuntu3.1
python3-paramiko 2.4.1-0ubuntu3.1
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3796-3
https://usn.ubuntu.com/usn/usn-3796-1
CVE-2018-1000805
Package Information:
https://launchpad.net/ubuntu/+source/paramiko/2.4.1-0ubuntu3.1
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAlvOE8kACgkQZWnYVadE
vpNQnQ//bSvyhy8Ozb2HEz50/Ow7BaWJjWCZyV+OmDtXR4lJKtuJ4Jm5Uh0Nrd3m
gnxQPndFYcn4+l7uJ9+/UHPXOgCp+w61TTlkWG4L3iF6Vqmds3j/m/z2orwsDBoF
vb0n+QhN+pOZ3bwOAeJwG42jJcxcTmKjHI9LpkdyjkHe0b9wQH/e4N+bAjHzaaOH
BgvVxfdTJTlxnSz/WSlba1glwO/TX5XPEkYqQN2F00EJJi+ZP3Lyrco3nF7OTgtD
ietwF8oOdmuEBvyRugXz8/3Qf54yGBN5ttYIzWC52nAHpG4C8uOOEO1UkyggPVnF
GXt+c/RoJ4x41M1uFYUo1RO5F99nNonEx0OZ/eqYWxS8X6zviNEZqVDS+qETN7pa
Yr+JJfx4mUAsNoLZy7KMcf6vLeoFLo1mNx8ZLtzkbg1lIXfXeqS4KS9a/XWaUyRI
lVaNe6mnFGfbMRobIrSxITRVNSeMK8t4+XbOv3JlVZGZkM4oGltI0eP/6acKAZcN
mcta0RKa+T8L+afSmrbh86OZjG+5CLF91Uz+F+CvlCaeNBkn+Y0SONcZGBlEaSie
gBPVgAgMHAEfaOv+AhoPSyhFmF0CSkQOvwGeMJ5k8TFeT7A18fcojaQNViRho4dC
rRfs8q6fbpOTo/xU9OJHqSvGJUVagq3dYtGfd8lE0/A9GvdK0z4=
=bKUE
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3796-3
October 22, 2018
paramiko vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.10
Summary:
Paramiko could allow unintended access to network services.
Software Description:
- paramiko: Python SSH2 library
Details:
USN-3796-1 fixed a vulnerability in Paramiko. This update provides the
corresponding update for Ubuntu 18.10.
Original advisory details:
Daniel Hoffman discovered that Paramiko incorrectly handled authentication
when being used as a server. A remote attacker could use this issue to
bypass authentication without any credentials.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.10:
python-paramiko 2.4.1-0ubuntu3.1
python3-paramiko 2.4.1-0ubuntu3.1
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3796-3
https://usn.ubuntu.com/usn/usn-3796-1
CVE-2018-1000805
Package Information:
https://launchpad.net/ubuntu/+source/paramiko/2.4.1-0ubuntu3.1
[USN-3792-3] Net-SNMP vulnerability
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAlvOE7cACgkQZWnYVadE
vpOuzw//XzLgGQ6fr3LqpnIajbGZHm9cc/dstzs34O/EGYn0F/2CVCnr7IHFnx05
UmuHpF5a3GG9s0XkiZiPV99D+ryejQOH/Na0T7dEYrAJmMlpvSLUYJ5Re2qN5CnW
YwVMU2y79ZlJeCxrbIKiOSukfMrb7UwnbQPOrmjzY5YovX+KcL4oku8gwTq9ieBH
kSf7YHjvEd0MQydVAtvomWquUIbVhgq3PyUtdlz326su0HdCDMW9Eb8CWm1K+PYD
r0uqDAjmPZ/sGlgMLBiqSo3oWtlPp/I72tn6BWJsoBrkruquFK7QbB72M/TFNWcP
6KLV0Vc81fdnAJyNrtCGjc/SbaE0Kik6xzO2V2nBIIFjBL8/PIQJfoVS+TSyNKri
gXtXAOTeoCD7dffNwABEBGI5/RSqSmriRcswrnfseTZHTvWfhz3rajxSo5qDOxZo
Kgw7r203xS1ygba9sQW/AOvj+oDou5Ej6/Kvw2bPYeYs79WLyDf9QPqyJyD+T4PD
LSwdMmneDfDoDEyT/6hwpSUqTblTzX29SHbx6qowrWq2VjeOHUekQoyLnUjnk3pt
bgmGiCgo5YutvpVcTrKZSMxkT6zEGjjcKx1Qywzv6I/Gmi0XyXNNRts83ivKLelR
hMemLv+v6p5xskkUrbWw27WxvDULac/HxmzIdiIvg8MLs27djBw=
=PllG
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3792-3
October 22, 2018
net-snmp vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.10
Summary:
Net-SNMP could be made to crash if it received specially crafted network
traffic.
Software Description:
- net-snmp: SNMP (Simple Network Management Protocol) server and applications
Details:
USN-3792-1 fixed a vulnerability in Net-SNMP. This update provides the
corresponding update for Ubuntu 18.10.
Original advisory details:
It was discovered that Net-SNMP incorrectly handled certain certain crafted
packets. A remote attacker could possibly use this issue to cause Net-SNMP
to crash, resulting in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.10:
libsnmp30 5.7.3+dfsg-1.8ubuntu3.18.10.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3792-3
https://usn.ubuntu.com/usn/usn-3792-1
CVE-2018-18065
Package Information:
https://launchpad.net/ubuntu/+source/net-snmp/5.7.3+dfsg-1.8ubuntu3.18.10.1
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAlvOE7cACgkQZWnYVadE
vpOuzw//XzLgGQ6fr3LqpnIajbGZHm9cc/dstzs34O/EGYn0F/2CVCnr7IHFnx05
UmuHpF5a3GG9s0XkiZiPV99D+ryejQOH/Na0T7dEYrAJmMlpvSLUYJ5Re2qN5CnW
YwVMU2y79ZlJeCxrbIKiOSukfMrb7UwnbQPOrmjzY5YovX+KcL4oku8gwTq9ieBH
kSf7YHjvEd0MQydVAtvomWquUIbVhgq3PyUtdlz326su0HdCDMW9Eb8CWm1K+PYD
r0uqDAjmPZ/sGlgMLBiqSo3oWtlPp/I72tn6BWJsoBrkruquFK7QbB72M/TFNWcP
6KLV0Vc81fdnAJyNrtCGjc/SbaE0Kik6xzO2V2nBIIFjBL8/PIQJfoVS+TSyNKri
gXtXAOTeoCD7dffNwABEBGI5/RSqSmriRcswrnfseTZHTvWfhz3rajxSo5qDOxZo
Kgw7r203xS1ygba9sQW/AOvj+oDou5Ej6/Kvw2bPYeYs79WLyDf9QPqyJyD+T4PD
LSwdMmneDfDoDEyT/6hwpSUqTblTzX29SHbx6qowrWq2VjeOHUekQoyLnUjnk3pt
bgmGiCgo5YutvpVcTrKZSMxkT6zEGjjcKx1Qywzv6I/Gmi0XyXNNRts83ivKLelR
hMemLv+v6p5xskkUrbWw27WxvDULac/HxmzIdiIvg8MLs27djBw=
=PllG
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3792-3
October 22, 2018
net-snmp vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.10
Summary:
Net-SNMP could be made to crash if it received specially crafted network
traffic.
Software Description:
- net-snmp: SNMP (Simple Network Management Protocol) server and applications
Details:
USN-3792-1 fixed a vulnerability in Net-SNMP. This update provides the
corresponding update for Ubuntu 18.10.
Original advisory details:
It was discovered that Net-SNMP incorrectly handled certain certain crafted
packets. A remote attacker could possibly use this issue to cause Net-SNMP
to crash, resulting in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.10:
libsnmp30 5.7.3+dfsg-1.8ubuntu3.18.10.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3792-3
https://usn.ubuntu.com/usn/usn-3792-1
CVE-2018-18065
Package Information:
https://launchpad.net/ubuntu/+source/net-snmp/5.7.3+dfsg-1.8ubuntu3.18.10.1
[USN-3795-2] libssh vulnerability
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAlvOE6IACgkQZWnYVadE
vpNmYRAAl7yapsiQyhwNawVJ8kR3ZHpCSYb56uCcpaZYvdh+lkNtQf8Bl/vKEBkX
j37VJnJuT4iJom519qlnf6Rn+7fHQMtQ36Um/HnR5j0i/WQvZWqBzVAIU/v/JJpQ
Uqr087YlglfLwrxjAtwYDdTxRPdJjwllnhYJAWPI/mqNpXxm6MSsINgaGlT+0eWp
chUS9/ItitQbH/f1ebVPv5rklw9TqrT7mj+WcHxGDh6OGiODcDI5HXey/xfLUeXa
6prLzol8SXUOaN8eUT4uHQRPKKCNB+bCPVneNxx37l3vIxYauDUf4+ED7ZtILL+F
AOAYDfOjA3VlMRbC+w3a6XvLaQPddOEj3DvqXrUHIo/IK7usUeA5cNAqJ9JINjfC
ra8XpikwJ4kpknoOKdbox49tFSZgNuIWyECf5N7mPvnIEO7a+1aTIQ4ckJ+sNyLx
K4xDHJkvRHMNt958pCQWfCtgHH4K+uzAvW+60+ryeIeEQ4wCHZzurDyND6s7xIQ4
7W3CC74rWzroKEMpU+1FDuL9As+LG0C4Kqxr44Ot3tFbtjyvrtj0erDNaFXnhuUu
Of0MGLpsm2qYa3dGAeK8vc5O51xc7ujGaUoJwMslG1GjELPPZiQfvIZWz4D1O8Y+
RBHolA7DKIbulE+n9AllonfMWcMz5pCU+OOfMEJ9tfWSCkgG3xY=
=J+LQ
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3795-2
October 22, 2018
libssh vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.10
Summary:
libssh could allow unintended access to network services.
Software Description:
- libssh: A tiny C SSH library
Details:
USN-3795-1 fixed a vulnerability in libssh. This update provides the
corresponding update for Ubuntu 18.10.
Original advisory details:
Peter Winter-Smith discovered that libssh incorrectly handled
authentication when being used as a server. A remote attacker could use
this issue to bypass authentication without any credentials.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.10:
libssh-4 0.8.1-1ubuntu0.1
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3795-2
https://usn.ubuntu.com/usn/usn-3795-1
CVE-2018-10933
Package Information:
https://launchpad.net/ubuntu/+source/libssh/0.8.1-1ubuntu0.1
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAlvOE6IACgkQZWnYVadE
vpNmYRAAl7yapsiQyhwNawVJ8kR3ZHpCSYb56uCcpaZYvdh+lkNtQf8Bl/vKEBkX
j37VJnJuT4iJom519qlnf6Rn+7fHQMtQ36Um/HnR5j0i/WQvZWqBzVAIU/v/JJpQ
Uqr087YlglfLwrxjAtwYDdTxRPdJjwllnhYJAWPI/mqNpXxm6MSsINgaGlT+0eWp
chUS9/ItitQbH/f1ebVPv5rklw9TqrT7mj+WcHxGDh6OGiODcDI5HXey/xfLUeXa
6prLzol8SXUOaN8eUT4uHQRPKKCNB+bCPVneNxx37l3vIxYauDUf4+ED7ZtILL+F
AOAYDfOjA3VlMRbC+w3a6XvLaQPddOEj3DvqXrUHIo/IK7usUeA5cNAqJ9JINjfC
ra8XpikwJ4kpknoOKdbox49tFSZgNuIWyECf5N7mPvnIEO7a+1aTIQ4ckJ+sNyLx
K4xDHJkvRHMNt958pCQWfCtgHH4K+uzAvW+60+ryeIeEQ4wCHZzurDyND6s7xIQ4
7W3CC74rWzroKEMpU+1FDuL9As+LG0C4Kqxr44Ot3tFbtjyvrtj0erDNaFXnhuUu
Of0MGLpsm2qYa3dGAeK8vc5O51xc7ujGaUoJwMslG1GjELPPZiQfvIZWz4D1O8Y+
RBHolA7DKIbulE+n9AllonfMWcMz5pCU+OOfMEJ9tfWSCkgG3xY=
=J+LQ
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-3795-2
October 22, 2018
libssh vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.10
Summary:
libssh could allow unintended access to network services.
Software Description:
- libssh: A tiny C SSH library
Details:
USN-3795-1 fixed a vulnerability in libssh. This update provides the
corresponding update for Ubuntu 18.10.
Original advisory details:
Peter Winter-Smith discovered that libssh incorrectly handled
authentication when being used as a server. A remote attacker could use
this issue to bypass authentication without any credentials.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.10:
libssh-4 0.8.1-1ubuntu0.1
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3795-2
https://usn.ubuntu.com/usn/usn-3795-1
CVE-2018-10933
Package Information:
https://launchpad.net/ubuntu/+source/libssh/0.8.1-1ubuntu0.1
[USN-3790-2] Requests vulnerability
==========================================================================
Ubuntu Security Notice USN-3790-2
October 22, 2018
requests vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.10
Summary:
Requests could be made to expose sensitive information if it
received a specially crafted HTTP header.
Software Description:
- requests: elegant and simple HTTP library for Python
Details:
USN-3790-1 fixed vulnerabilities in Requests. This update provides
the corresponding update for Ubuntu 18.10
Original advisory details:
It was discovered that Requests incorrectly handled certain HTTP
headers. An attacker could possibly use this issue to access sensitive
information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.10:
python-requests 2.18.4-2ubuntu0.18.10.1
python3-requests 2.18.4-2ubuntu0.18.10.1
In general, a standard system update will make all the necessary
changes.
References:
https://usn.ubuntu.com/usn/usn-3790-2
https://usn.ubuntu.com/usn/usn-3790-1
CVE-2018-18074
Package Information:
https://launchpad.net/ubuntu/+source/requests/2.18.4-2ubuntu0.18.10.1
Ubuntu Security Notice USN-3790-2
October 22, 2018
requests vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.10
Summary:
Requests could be made to expose sensitive information if it
received a specially crafted HTTP header.
Software Description:
- requests: elegant and simple HTTP library for Python
Details:
USN-3790-1 fixed vulnerabilities in Requests. This update provides
the corresponding update for Ubuntu 18.10
Original advisory details:
It was discovered that Requests incorrectly handled certain HTTP
headers. An attacker could possibly use this issue to access sensitive
information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.10:
python-requests 2.18.4-2ubuntu0.18.10.1
python3-requests 2.18.4-2ubuntu0.18.10.1
In general, a standard system update will make all the necessary
changes.
References:
https://usn.ubuntu.com/usn/usn-3790-2
https://usn.ubuntu.com/usn/usn-3790-1
CVE-2018-18074
Package Information:
https://launchpad.net/ubuntu/+source/requests/2.18.4-2ubuntu0.18.10.1
[CentOS-announce] CESA-2018:2942 Critical CentOS 7 java-1.8.0-openjdk Security Update
CentOS Errata and Security Advisory 2018:2942 Critical
Upstream details at : https://access.redhat.com/errata/RHSA-2018:2942
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
9b0e9718995176baa60a1b6255be237c6e5c1a32b992d0ec9b9d6dfdd63e53dd java-1.8.0-openjdk-1.8.0.191.b12-0.el7_5.i686.rpm
de28afb2c6ac7ba0cabe579f18556d2db93dd353821f1afbd352c689e05d2594 java-1.8.0-openjdk-1.8.0.191.b12-0.el7_5.x86_64.rpm
ebb413d9754ce3802915fafbd5e8981b384695cc63ef6b36f2fc3a1d1dca0a3d java-1.8.0-openjdk-accessibility-1.8.0.191.b12-0.el7_5.i686.rpm
200695ef0188b557a215a07240521ec10ba9ae8a3c1bd24f9a538560667f9419 java-1.8.0-openjdk-accessibility-1.8.0.191.b12-0.el7_5.x86_64.rpm
20d43426186ccea7f314bb648e172ea005dc20d4ac1579f1055197c5f9d03167 java-1.8.0-openjdk-accessibility-debug-1.8.0.191.b12-0.el7_5.i686.rpm
58fe7e287e6109c7aef6fe6ff2157f5cf55bc480c363b08d0f1160a53c741298 java-1.8.0-openjdk-accessibility-debug-1.8.0.191.b12-0.el7_5.x86_64.rpm
f00fe6e02fd11d22ecd005467a3d290ded7da77fe12befc4f185c6348930084a java-1.8.0-openjdk-debug-1.8.0.191.b12-0.el7_5.i686.rpm
689bb6f3baf737044da0151c85a439c64e7510c2fd387b59a9e7e69c00f625a2 java-1.8.0-openjdk-debug-1.8.0.191.b12-0.el7_5.x86_64.rpm
0dccca8428044d48d68a14f05b33faf12bfa7e7538e542e697a4027074053b21 java-1.8.0-openjdk-demo-1.8.0.191.b12-0.el7_5.i686.rpm
0c2a3d25658ec786915729ded22d614befad39fd9760d30f728eb912ca4b4d01 java-1.8.0-openjdk-demo-1.8.0.191.b12-0.el7_5.x86_64.rpm
3d8a7d52c30d256d7121aab8b4c1ea890e873f65d1b567bced20dd4713d63add java-1.8.0-openjdk-demo-debug-1.8.0.191.b12-0.el7_5.i686.rpm
51edf6417f25ddec17820199829ea7ee023396dded46f0ecf4357ea69b78417c java-1.8.0-openjdk-demo-debug-1.8.0.191.b12-0.el7_5.x86_64.rpm
14da8e4faf28166a647f7e65f7142febe33b7172be1167a82983fff0d2af2d75 java-1.8.0-openjdk-devel-1.8.0.191.b12-0.el7_5.i686.rpm
656e24f21d2b5571656ca04543b71fc9289672d4823c3c2baa0c9c9e10f7a350 java-1.8.0-openjdk-devel-1.8.0.191.b12-0.el7_5.x86_64.rpm
897b6d04c02310e8911e4cd764501568334d5540698f7b191413d92fd9af3afd java-1.8.0-openjdk-devel-debug-1.8.0.191.b12-0.el7_5.i686.rpm
79f16d3c2a1b7f17f8656e45f5aff73f23faf3734029aad1cfe6f734f1dbbe98 java-1.8.0-openjdk-devel-debug-1.8.0.191.b12-0.el7_5.x86_64.rpm
75a66b41c490aaa5a937551bb55e4a1a0c7d8f62c9e6cb84e9a47e99f3581f50 java-1.8.0-openjdk-headless-1.8.0.191.b12-0.el7_5.i686.rpm
93d4359d53ad9fdd3c6bc185f354e58f1c1981476ac5079b10b1f3a7625c949b java-1.8.0-openjdk-headless-1.8.0.191.b12-0.el7_5.x86_64.rpm
d1d183dd5fc0aae33f47a01198b9d6a23bb396ac772cca5bfd58da2dd78923a6 java-1.8.0-openjdk-headless-debug-1.8.0.191.b12-0.el7_5.i686.rpm
944271660651618b66ce31cf9a79f9fd4e7c9e449de17e8fcc349a6eb0a6fdb7 java-1.8.0-openjdk-headless-debug-1.8.0.191.b12-0.el7_5.x86_64.rpm
6d19225f904e922baa53c9b0970a38757851a0a74f38fae777f1b71da4ef17c5 java-1.8.0-openjdk-javadoc-1.8.0.191.b12-0.el7_5.noarch.rpm
745cac8aedcd76e3c30d11e2eda2edac2eb9e8049603b8c044d51dd8509afdc5 java-1.8.0-openjdk-javadoc-debug-1.8.0.191.b12-0.el7_5.noarch.rpm
4f616aa6afc6c10f3f4945328c9240f5137fa46ee3e7259f8cc605a7e805514b java-1.8.0-openjdk-javadoc-zip-1.8.0.191.b12-0.el7_5.noarch.rpm
51323aab38ddd36f4728cb357e4fd333175aeac53df6ff154ff440ea092071cc java-1.8.0-openjdk-javadoc-zip-debug-1.8.0.191.b12-0.el7_5.noarch.rpm
c601c87a3c8a2379f3ab69d44ccb7d6eefd67dfa1b1debc494d30a6a4ce738a0 java-1.8.0-openjdk-src-1.8.0.191.b12-0.el7_5.i686.rpm
89499e98c3f7ef8e7804c237974c302ac7022708e0a199908c674928de742842 java-1.8.0-openjdk-src-1.8.0.191.b12-0.el7_5.x86_64.rpm
6bc179ef5abab92a4f46045cc10dc4348d2359bddaa5cdf85c86b2e9055f9a57 java-1.8.0-openjdk-src-debug-1.8.0.191.b12-0.el7_5.i686.rpm
0dc3e87d3c2fd2149d44250f654031b59023e312804a0ef689cd079fc9e6e4d5 java-1.8.0-openjdk-src-debug-1.8.0.191.b12-0.el7_5.x86_64.rpm
Source:
e98a223e70a66648032fee4515aa0ccd4c067a86e4cede1daf4e53974642a292 java-1.8.0-openjdk-1.8.0.191.b12-0.el7_5.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHSA-2018:2942
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
9b0e9718995176baa60a1b6255be237c6e5c1a32b992d0ec9b9d6dfdd63e53dd java-1.8.0-openjdk-1.8.0.191.b12-0.el7_5.i686.rpm
de28afb2c6ac7ba0cabe579f18556d2db93dd353821f1afbd352c689e05d2594 java-1.8.0-openjdk-1.8.0.191.b12-0.el7_5.x86_64.rpm
ebb413d9754ce3802915fafbd5e8981b384695cc63ef6b36f2fc3a1d1dca0a3d java-1.8.0-openjdk-accessibility-1.8.0.191.b12-0.el7_5.i686.rpm
200695ef0188b557a215a07240521ec10ba9ae8a3c1bd24f9a538560667f9419 java-1.8.0-openjdk-accessibility-1.8.0.191.b12-0.el7_5.x86_64.rpm
20d43426186ccea7f314bb648e172ea005dc20d4ac1579f1055197c5f9d03167 java-1.8.0-openjdk-accessibility-debug-1.8.0.191.b12-0.el7_5.i686.rpm
58fe7e287e6109c7aef6fe6ff2157f5cf55bc480c363b08d0f1160a53c741298 java-1.8.0-openjdk-accessibility-debug-1.8.0.191.b12-0.el7_5.x86_64.rpm
f00fe6e02fd11d22ecd005467a3d290ded7da77fe12befc4f185c6348930084a java-1.8.0-openjdk-debug-1.8.0.191.b12-0.el7_5.i686.rpm
689bb6f3baf737044da0151c85a439c64e7510c2fd387b59a9e7e69c00f625a2 java-1.8.0-openjdk-debug-1.8.0.191.b12-0.el7_5.x86_64.rpm
0dccca8428044d48d68a14f05b33faf12bfa7e7538e542e697a4027074053b21 java-1.8.0-openjdk-demo-1.8.0.191.b12-0.el7_5.i686.rpm
0c2a3d25658ec786915729ded22d614befad39fd9760d30f728eb912ca4b4d01 java-1.8.0-openjdk-demo-1.8.0.191.b12-0.el7_5.x86_64.rpm
3d8a7d52c30d256d7121aab8b4c1ea890e873f65d1b567bced20dd4713d63add java-1.8.0-openjdk-demo-debug-1.8.0.191.b12-0.el7_5.i686.rpm
51edf6417f25ddec17820199829ea7ee023396dded46f0ecf4357ea69b78417c java-1.8.0-openjdk-demo-debug-1.8.0.191.b12-0.el7_5.x86_64.rpm
14da8e4faf28166a647f7e65f7142febe33b7172be1167a82983fff0d2af2d75 java-1.8.0-openjdk-devel-1.8.0.191.b12-0.el7_5.i686.rpm
656e24f21d2b5571656ca04543b71fc9289672d4823c3c2baa0c9c9e10f7a350 java-1.8.0-openjdk-devel-1.8.0.191.b12-0.el7_5.x86_64.rpm
897b6d04c02310e8911e4cd764501568334d5540698f7b191413d92fd9af3afd java-1.8.0-openjdk-devel-debug-1.8.0.191.b12-0.el7_5.i686.rpm
79f16d3c2a1b7f17f8656e45f5aff73f23faf3734029aad1cfe6f734f1dbbe98 java-1.8.0-openjdk-devel-debug-1.8.0.191.b12-0.el7_5.x86_64.rpm
75a66b41c490aaa5a937551bb55e4a1a0c7d8f62c9e6cb84e9a47e99f3581f50 java-1.8.0-openjdk-headless-1.8.0.191.b12-0.el7_5.i686.rpm
93d4359d53ad9fdd3c6bc185f354e58f1c1981476ac5079b10b1f3a7625c949b java-1.8.0-openjdk-headless-1.8.0.191.b12-0.el7_5.x86_64.rpm
d1d183dd5fc0aae33f47a01198b9d6a23bb396ac772cca5bfd58da2dd78923a6 java-1.8.0-openjdk-headless-debug-1.8.0.191.b12-0.el7_5.i686.rpm
944271660651618b66ce31cf9a79f9fd4e7c9e449de17e8fcc349a6eb0a6fdb7 java-1.8.0-openjdk-headless-debug-1.8.0.191.b12-0.el7_5.x86_64.rpm
6d19225f904e922baa53c9b0970a38757851a0a74f38fae777f1b71da4ef17c5 java-1.8.0-openjdk-javadoc-1.8.0.191.b12-0.el7_5.noarch.rpm
745cac8aedcd76e3c30d11e2eda2edac2eb9e8049603b8c044d51dd8509afdc5 java-1.8.0-openjdk-javadoc-debug-1.8.0.191.b12-0.el7_5.noarch.rpm
4f616aa6afc6c10f3f4945328c9240f5137fa46ee3e7259f8cc605a7e805514b java-1.8.0-openjdk-javadoc-zip-1.8.0.191.b12-0.el7_5.noarch.rpm
51323aab38ddd36f4728cb357e4fd333175aeac53df6ff154ff440ea092071cc java-1.8.0-openjdk-javadoc-zip-debug-1.8.0.191.b12-0.el7_5.noarch.rpm
c601c87a3c8a2379f3ab69d44ccb7d6eefd67dfa1b1debc494d30a6a4ce738a0 java-1.8.0-openjdk-src-1.8.0.191.b12-0.el7_5.i686.rpm
89499e98c3f7ef8e7804c237974c302ac7022708e0a199908c674928de742842 java-1.8.0-openjdk-src-1.8.0.191.b12-0.el7_5.x86_64.rpm
6bc179ef5abab92a4f46045cc10dc4348d2359bddaa5cdf85c86b2e9055f9a57 java-1.8.0-openjdk-src-debug-1.8.0.191.b12-0.el7_5.i686.rpm
0dc3e87d3c2fd2149d44250f654031b59023e312804a0ef689cd079fc9e6e4d5 java-1.8.0-openjdk-src-debug-1.8.0.191.b12-0.el7_5.x86_64.rpm
Source:
e98a223e70a66648032fee4515aa0ccd4c067a86e4cede1daf4e53974642a292 java-1.8.0-openjdk-1.8.0.191.b12-0.el7_5.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CESA-2018:2943 Critical CentOS 6 java-1.8.0-openjdk Security Update
CentOS Errata and Security Advisory 2018:2943 Critical
Upstream details at : https://access.redhat.com/errata/RHSA-2018:2943
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
10e294486f79da36e480a94314963c0f717e456e9012f7b06910fea207426df0 java-1.8.0-openjdk-1.8.0.191.b12-0.el6_10.i686.rpm
263fdc2d3ff25a6f22505624021937a5441a2590d233ffe64af12f4bb15ed717 java-1.8.0-openjdk-debug-1.8.0.191.b12-0.el6_10.i686.rpm
0720e6b37c2af702b40ff4a3be4d8359a13137d206dc58dbc8542b1e0d3df212 java-1.8.0-openjdk-demo-1.8.0.191.b12-0.el6_10.i686.rpm
b3dbc54235955614622f83e7c019ae09344099d7e39276d6585d5c80600d488f java-1.8.0-openjdk-demo-debug-1.8.0.191.b12-0.el6_10.i686.rpm
37000c7965df7f72b3df937148a57dc360851bfd1caa5d84af4ddfb6099d86ef java-1.8.0-openjdk-devel-1.8.0.191.b12-0.el6_10.i686.rpm
7c034a5e931f94ac96f67f7685b01ccf4c1a016789d9e6ceb2fd6873f82f408e java-1.8.0-openjdk-devel-debug-1.8.0.191.b12-0.el6_10.i686.rpm
f0cd73e105ec804bee3e94a0fc39af5ff160c0584df50fc5274802a036fc5f62 java-1.8.0-openjdk-headless-1.8.0.191.b12-0.el6_10.i686.rpm
92875f69d68f8c74f6a92c870e5274290d673a9a902e66b4b9ac891e7b1f4a13 java-1.8.0-openjdk-headless-debug-1.8.0.191.b12-0.el6_10.i686.rpm
104130bf5d4ed651bd1828f6657d3981d8d25049351fd37b5581a23a5ffc308d java-1.8.0-openjdk-javadoc-1.8.0.191.b12-0.el6_10.noarch.rpm
a763f67e250a3215b92c7b501d169cf7851a864b1f086ba1f9df8ce6505da9c8 java-1.8.0-openjdk-javadoc-debug-1.8.0.191.b12-0.el6_10.noarch.rpm
368dc1878f3de0dc4bd0db96cad65366101ffcfbe34fd21213bfbdfb708371c4 java-1.8.0-openjdk-src-1.8.0.191.b12-0.el6_10.i686.rpm
ed7d7a11c82daceabff7b535917d3949c2317c72ef371ae0c7c2478eea944535 java-1.8.0-openjdk-src-debug-1.8.0.191.b12-0.el6_10.i686.rpm
x86_64:
2d2c6d2a280e29239e43ab60c80593a39339301bf9bcda87e88a7e31de3ca0f7 java-1.8.0-openjdk-1.8.0.191.b12-0.el6_10.x86_64.rpm
bda285f5f4e207b90b159203f72ca8781aee4046a77b2a48c27c659933ac3982 java-1.8.0-openjdk-debug-1.8.0.191.b12-0.el6_10.x86_64.rpm
e408a1d98e6160f93ca1ef352fd6267bfaacf76899172a0107745f6b1c3534c0 java-1.8.0-openjdk-demo-1.8.0.191.b12-0.el6_10.x86_64.rpm
d6f8d3f0a49e0caf3aeaf13136456b7a605d8319fef057eb5648b351f8d8d8f2 java-1.8.0-openjdk-demo-debug-1.8.0.191.b12-0.el6_10.x86_64.rpm
45f67548838bf2d38bf4034fdde912c9508e54d3e430a5845d797eb1048c4461 java-1.8.0-openjdk-devel-1.8.0.191.b12-0.el6_10.x86_64.rpm
a2366bcd33a170bc6e558582ebf25e33c098924f639f9048915a76c82046bbf9 java-1.8.0-openjdk-devel-debug-1.8.0.191.b12-0.el6_10.x86_64.rpm
c8c235b12f05501925f0f7e984284f2028c6edc2d0ad4d8d35f8ace9838e1451 java-1.8.0-openjdk-headless-1.8.0.191.b12-0.el6_10.x86_64.rpm
619da945f3226c01f8cdb522050d00a3d5b7462632c4684eca049aaa80cea068 java-1.8.0-openjdk-headless-debug-1.8.0.191.b12-0.el6_10.x86_64.rpm
104130bf5d4ed651bd1828f6657d3981d8d25049351fd37b5581a23a5ffc308d java-1.8.0-openjdk-javadoc-1.8.0.191.b12-0.el6_10.noarch.rpm
a763f67e250a3215b92c7b501d169cf7851a864b1f086ba1f9df8ce6505da9c8 java-1.8.0-openjdk-javadoc-debug-1.8.0.191.b12-0.el6_10.noarch.rpm
60db35ba2dbe7a5f76f627dfb2d70dde0952f7d2b4d9fb8ab990435c02eb3f43 java-1.8.0-openjdk-src-1.8.0.191.b12-0.el6_10.x86_64.rpm
810e2ab3386ee551a8e04192ae00d7e91d6f71b19caf3e2a829580ba9c5d786a java-1.8.0-openjdk-src-debug-1.8.0.191.b12-0.el6_10.x86_64.rpm
Source:
ca59253e2ebe94076af3f4188ea82542cbce3538326d9078c663c079096b8dbb java-1.8.0-openjdk-1.8.0.191.b12-0.el6_10.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHSA-2018:2943
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
i386:
10e294486f79da36e480a94314963c0f717e456e9012f7b06910fea207426df0 java-1.8.0-openjdk-1.8.0.191.b12-0.el6_10.i686.rpm
263fdc2d3ff25a6f22505624021937a5441a2590d233ffe64af12f4bb15ed717 java-1.8.0-openjdk-debug-1.8.0.191.b12-0.el6_10.i686.rpm
0720e6b37c2af702b40ff4a3be4d8359a13137d206dc58dbc8542b1e0d3df212 java-1.8.0-openjdk-demo-1.8.0.191.b12-0.el6_10.i686.rpm
b3dbc54235955614622f83e7c019ae09344099d7e39276d6585d5c80600d488f java-1.8.0-openjdk-demo-debug-1.8.0.191.b12-0.el6_10.i686.rpm
37000c7965df7f72b3df937148a57dc360851bfd1caa5d84af4ddfb6099d86ef java-1.8.0-openjdk-devel-1.8.0.191.b12-0.el6_10.i686.rpm
7c034a5e931f94ac96f67f7685b01ccf4c1a016789d9e6ceb2fd6873f82f408e java-1.8.0-openjdk-devel-debug-1.8.0.191.b12-0.el6_10.i686.rpm
f0cd73e105ec804bee3e94a0fc39af5ff160c0584df50fc5274802a036fc5f62 java-1.8.0-openjdk-headless-1.8.0.191.b12-0.el6_10.i686.rpm
92875f69d68f8c74f6a92c870e5274290d673a9a902e66b4b9ac891e7b1f4a13 java-1.8.0-openjdk-headless-debug-1.8.0.191.b12-0.el6_10.i686.rpm
104130bf5d4ed651bd1828f6657d3981d8d25049351fd37b5581a23a5ffc308d java-1.8.0-openjdk-javadoc-1.8.0.191.b12-0.el6_10.noarch.rpm
a763f67e250a3215b92c7b501d169cf7851a864b1f086ba1f9df8ce6505da9c8 java-1.8.0-openjdk-javadoc-debug-1.8.0.191.b12-0.el6_10.noarch.rpm
368dc1878f3de0dc4bd0db96cad65366101ffcfbe34fd21213bfbdfb708371c4 java-1.8.0-openjdk-src-1.8.0.191.b12-0.el6_10.i686.rpm
ed7d7a11c82daceabff7b535917d3949c2317c72ef371ae0c7c2478eea944535 java-1.8.0-openjdk-src-debug-1.8.0.191.b12-0.el6_10.i686.rpm
x86_64:
2d2c6d2a280e29239e43ab60c80593a39339301bf9bcda87e88a7e31de3ca0f7 java-1.8.0-openjdk-1.8.0.191.b12-0.el6_10.x86_64.rpm
bda285f5f4e207b90b159203f72ca8781aee4046a77b2a48c27c659933ac3982 java-1.8.0-openjdk-debug-1.8.0.191.b12-0.el6_10.x86_64.rpm
e408a1d98e6160f93ca1ef352fd6267bfaacf76899172a0107745f6b1c3534c0 java-1.8.0-openjdk-demo-1.8.0.191.b12-0.el6_10.x86_64.rpm
d6f8d3f0a49e0caf3aeaf13136456b7a605d8319fef057eb5648b351f8d8d8f2 java-1.8.0-openjdk-demo-debug-1.8.0.191.b12-0.el6_10.x86_64.rpm
45f67548838bf2d38bf4034fdde912c9508e54d3e430a5845d797eb1048c4461 java-1.8.0-openjdk-devel-1.8.0.191.b12-0.el6_10.x86_64.rpm
a2366bcd33a170bc6e558582ebf25e33c098924f639f9048915a76c82046bbf9 java-1.8.0-openjdk-devel-debug-1.8.0.191.b12-0.el6_10.x86_64.rpm
c8c235b12f05501925f0f7e984284f2028c6edc2d0ad4d8d35f8ace9838e1451 java-1.8.0-openjdk-headless-1.8.0.191.b12-0.el6_10.x86_64.rpm
619da945f3226c01f8cdb522050d00a3d5b7462632c4684eca049aaa80cea068 java-1.8.0-openjdk-headless-debug-1.8.0.191.b12-0.el6_10.x86_64.rpm
104130bf5d4ed651bd1828f6657d3981d8d25049351fd37b5581a23a5ffc308d java-1.8.0-openjdk-javadoc-1.8.0.191.b12-0.el6_10.noarch.rpm
a763f67e250a3215b92c7b501d169cf7851a864b1f086ba1f9df8ce6505da9c8 java-1.8.0-openjdk-javadoc-debug-1.8.0.191.b12-0.el6_10.noarch.rpm
60db35ba2dbe7a5f76f627dfb2d70dde0952f7d2b4d9fb8ab990435c02eb3f43 java-1.8.0-openjdk-src-1.8.0.191.b12-0.el6_10.x86_64.rpm
810e2ab3386ee551a8e04192ae00d7e91d6f71b19caf3e2a829580ba9c5d786a java-1.8.0-openjdk-src-debug-1.8.0.191.b12-0.el6_10.x86_64.rpm
Source:
ca59253e2ebe94076af3f4188ea82542cbce3538326d9078c663c079096b8dbb java-1.8.0-openjdk-1.8.0.191.b12-0.el6_10.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Subscribe to:
Posts (Atom)