If you have a Change proposal that requires changes to Infrastructure,
those proposals must be submitted (i.e. in ChangeReadyForWrangler
category) today, 26 June.
Other deadlines approaching:
* 2019-07-02 — Changes requiring mass rebuild
* 2019-07-02 — System-Wide changes
* 2019-07-23 — Self-contained changes
For more development milestones in the F31 schedule, see:
https://fedorapeople.org/groups/schedule/f-31/f-31-devel-tasks.html
--
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Wednesday, June 26, 2019
[USN-4038-2] bzip2 vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4038-2
June 26, 2019
bzip2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 ESM
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in bzip2.
Software Description:
- bzip2: high-quality block-sorting file compressor - utilities
Details:
USN-4038-1 fixed several vulnerabilities in bzip2. This update provides
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
Aladdin Mubaied discovered that bzip2 incorrectly handled certain files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2016-3189)
It was discovered that bzip2 incorrectly handled certain files.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2019-12900)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 ESM:
bzip2 1.0.6-5ubuntu0.1~esm1
lib32bz2-1.0 1.0.6-5ubuntu0.1~esm1
lib64bz2-1.0 1.0.6-5ubuntu0.1~esm1
libbz2-1.0 1.0.6-5ubuntu0.1~esm1
Ubuntu 12.04 ESM:
bzip2 1.0.6-1ubuntu0.1
lib32bz2-1.0 1.0.6-1ubuntu0.1
lib64bz2-1.0 1.0.6-1ubuntu0.1
libbz2-1.0 1.0.6-1ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4038-2
https://usn.ubuntu.com/4038-1
CVE-2016-3189, CVE-2019-12900
Ubuntu Security Notice USN-4038-2
June 26, 2019
bzip2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 ESM
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in bzip2.
Software Description:
- bzip2: high-quality block-sorting file compressor - utilities
Details:
USN-4038-1 fixed several vulnerabilities in bzip2. This update provides
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
Aladdin Mubaied discovered that bzip2 incorrectly handled certain files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2016-3189)
It was discovered that bzip2 incorrectly handled certain files.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2019-12900)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 ESM:
bzip2 1.0.6-5ubuntu0.1~esm1
lib32bz2-1.0 1.0.6-5ubuntu0.1~esm1
lib64bz2-1.0 1.0.6-5ubuntu0.1~esm1
libbz2-1.0 1.0.6-5ubuntu0.1~esm1
Ubuntu 12.04 ESM:
bzip2 1.0.6-1ubuntu0.1
lib32bz2-1.0 1.0.6-1ubuntu0.1
lib64bz2-1.0 1.0.6-1ubuntu0.1
libbz2-1.0 1.0.6-1ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4038-2
https://usn.ubuntu.com/4038-1
CVE-2016-3189, CVE-2019-12900
[USN-4038-1] bzip2 vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4038-1
June 26, 2019
bzip2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in bzip2.
Software Description:
- bzip2: high-quality block-sorting file compressor - utilities
Details:
Aladdin Mubaied discovered that bzip2 incorrectly handled certain files.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3189)
It was discovered that bzip2 incorrectly handled certain files.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2019-12900)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 19.04:
bzip2 1.0.6-9ubuntu0.19.04
libbz2-1.0 1.0.6-9ubuntu0.19.04
Ubuntu 18.10:
bzip2 1.0.6-9ubuntu0.18.10
libbz2-1.0 1.0.6-9ubuntu0.18.10
Ubuntu 18.04 LTS:
bzip2 1.0.6-8.1ubuntu0.1
libbz2-1.0 1.0.6-8.1ubuntu0.1
Ubuntu 16.04 LTS:
bzip2 1.0.6-8ubuntu0.1
libbz2-1.0 1.0.6-8ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4038-1
CVE-2016-3189, CVE-2019-12900
Package Information:
https://launchpad.net/ubuntu/+source/bzip2/1.0.6-9ubuntu0.19.04
https://launchpad.net/ubuntu/+source/bzip2/1.0.6-9ubuntu0.18.10
https://launchpad.net/ubuntu/+source/bzip2/1.0.6-8.1ubuntu0.1
https://launchpad.net/ubuntu/+source/bzip2/1.0.6-8ubuntu0.1
Ubuntu Security Notice USN-4038-1
June 26, 2019
bzip2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in bzip2.
Software Description:
- bzip2: high-quality block-sorting file compressor - utilities
Details:
Aladdin Mubaied discovered that bzip2 incorrectly handled certain files.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3189)
It was discovered that bzip2 incorrectly handled certain files.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2019-12900)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 19.04:
bzip2 1.0.6-9ubuntu0.19.04
libbz2-1.0 1.0.6-9ubuntu0.19.04
Ubuntu 18.10:
bzip2 1.0.6-9ubuntu0.18.10
libbz2-1.0 1.0.6-9ubuntu0.18.10
Ubuntu 18.04 LTS:
bzip2 1.0.6-8.1ubuntu0.1
libbz2-1.0 1.0.6-8.1ubuntu0.1
Ubuntu 16.04 LTS:
bzip2 1.0.6-8ubuntu0.1
libbz2-1.0 1.0.6-8ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4038-1
CVE-2016-3189, CVE-2019-12900
Package Information:
https://launchpad.net/ubuntu/+source/bzip2/1.0.6-9ubuntu0.19.04
https://launchpad.net/ubuntu/+source/bzip2/1.0.6-9ubuntu0.18.10
https://launchpad.net/ubuntu/+source/bzip2/1.0.6-8.1ubuntu0.1
https://launchpad.net/ubuntu/+source/bzip2/1.0.6-8ubuntu0.1
Tuesday, June 25, 2019
Fedora 31 System-Wide Change proposal: Golang 1.13
https://fedoraproject.org/wiki/Changes/golang1.13
== Summary ==
Rebase of Golang package to upcoming version 1.13 in Fedora 31,
including rebuild of all dependent packages(pre-release version of Go
will be used for rebuild, if released version will not be available at
the time of the mass rebuild).
== Owner ==
* Name: [[User:Jcajka| Jakub Čajka]]
* Email: jcajka@redhat.com
== Detailed Description ==
Rebase of Golang package to upcoming version 1.13 in Fedora 31. Golang
1.13 is schedule to be released in Aug.
Due to current nature and state of Go packages, rebuild of dependent
package will be required to pick up the changes.
With this rebase we will slightly deviate from upstream default
config. By setting GOSUMDB=off and GOPROXY=direct, instead of them set
to the default Google's services(or any other provider). This will
still preserve the ability of users to set the nobs to value of their
liking. By setting this we will prevent unintended (personal)
information leaks. There will be no impact on users of the compiler.
== Benefit to Fedora ==
Staying closely behind upstream by providing latest release of golang,
which includes performance improvements and improvements in support
for currently supported platforms among other bug fixes and new
features. For complete list of changes see upstream change notes at
https://tip.golang.org/doc/go1.13 . In result Fedora will be providing
solid development platform for Go language.
== Scope ==
* Proposal owners: Rebase golang package in f31, help with resolving
possible issues found during package rebuilds.
* Other developers: fix possible issues with help from golang maintainers
* Release engineering: Rebuild of dependent packages as part of
planned mass-rebuild. https://pagure.io/releng/issue/8481
* Policies and guidelines: N/A
* Trademark approval: N/A
== Upgrade/compatibility impact ==
None
== How To Test ==
;0.
:a)Install golang 1.13 from rawhide and use it to build your
application(s)/package(s).
:b)Scratch build against rawhide.
;1.
:Your application/package built using golang 1.13 should work as expected.
== User Experience ==
None
== Dependencies ==
(see wiki page)
Not all of listed require re-build as they might not ship binaries.
== Contingency Plan ==
* Contingency mechanism:Reverting to golang version 1.12.X if
significatnt issues are discovered.
* Contingency deadline: Beta Freeze(?)
* Blocks release? No
* Blocks product? No
== Documentation ==
https://tip.golang.org/doc/go1.13
--
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
== Summary ==
Rebase of Golang package to upcoming version 1.13 in Fedora 31,
including rebuild of all dependent packages(pre-release version of Go
will be used for rebuild, if released version will not be available at
the time of the mass rebuild).
== Owner ==
* Name: [[User:Jcajka| Jakub Čajka]]
* Email: jcajka@redhat.com
== Detailed Description ==
Rebase of Golang package to upcoming version 1.13 in Fedora 31. Golang
1.13 is schedule to be released in Aug.
Due to current nature and state of Go packages, rebuild of dependent
package will be required to pick up the changes.
With this rebase we will slightly deviate from upstream default
config. By setting GOSUMDB=off and GOPROXY=direct, instead of them set
to the default Google's services(or any other provider). This will
still preserve the ability of users to set the nobs to value of their
liking. By setting this we will prevent unintended (personal)
information leaks. There will be no impact on users of the compiler.
== Benefit to Fedora ==
Staying closely behind upstream by providing latest release of golang,
which includes performance improvements and improvements in support
for currently supported platforms among other bug fixes and new
features. For complete list of changes see upstream change notes at
https://tip.golang.org/doc/go1.13 . In result Fedora will be providing
solid development platform for Go language.
== Scope ==
* Proposal owners: Rebase golang package in f31, help with resolving
possible issues found during package rebuilds.
* Other developers: fix possible issues with help from golang maintainers
* Release engineering: Rebuild of dependent packages as part of
planned mass-rebuild. https://pagure.io/releng/issue/8481
* Policies and guidelines: N/A
* Trademark approval: N/A
== Upgrade/compatibility impact ==
None
== How To Test ==
;0.
:a)Install golang 1.13 from rawhide and use it to build your
application(s)/package(s).
:b)Scratch build against rawhide.
;1.
:Your application/package built using golang 1.13 should work as expected.
== User Experience ==
None
== Dependencies ==
(see wiki page)
Not all of listed require re-build as they might not ship binaries.
== Contingency Plan ==
* Contingency mechanism:Reverting to golang version 1.12.X if
significatnt issues are discovered.
* Contingency deadline: Beta Freeze(?)
* Blocks release? No
* Blocks product? No
== Documentation ==
https://tip.golang.org/doc/go1.13
--
Ben Cotton
He / Him / His
Fedora Program Manager
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
[USN-4036-1] OpenStack Neutron vulnerability
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl0SJLIACgkQZWnYVadE
vpPezA//fpQ8neIwx7H5Fy9ULTZ9TgkX+FY0fukMQweu0FoMptDbW9JyHGZYBlfi
6xHzqOhGjPFS+GtWOTpIWpJaDZc6iTjJzAgfWlkn/lZlCVxMBGYN1fBxMW5heF5m
ENQ2sKbiOoxCasXn6pTxj0C9JmNpk54LEGjLMzYn3HXS3g4ZU9pjgOrW47kTUfnX
0m9pK9iiKgZ7XAj1Pwd8hTlzTze0SRgFGecbmJy7Izq82X6VVyOBPJoiTn1ZOKXX
Rh3w/wODIttoM8p1GlZIgI2CQ2gbdNTDB8Jzy/iphQ/q01Kg89COFZoc5noYEeP4
Pbyymjd++7/ukbu8fJW7trq3ivK3NREId8HHoIkJQj6vPE5lG7kYYtWGYGBM9Y7N
ub4dQyVkj3a7MM1bXPIFiz8vy8jdb8r7Jeg53fKFmMKpdlqKyUH4zr4w3bWMKmlL
qjlS16CsT6wiUWo6OAUCa9844km4bIDp3197WgxizVLSJ2b7Kjk9wEkKEWOtFJAF
HPSQzPuAmW+9OurIT7qGAv/FU7exGOoXc1XsdGGDoFx6HvzHqANBAFmFPp+TKlt7
ruozG6K7iwGgvK5AXkoP7PGb2g+Eh8kvDy7qxS3+AuMiX4cHqGTrGY/jPO5a+mlE
79nqnL3MhRF0ndOaCGswnX9vXoMcN4/JjuC2+ICezJwCwcPP6qs=
=fuFL
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-4036-1
June 25, 2019
neutron vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.10
- Ubuntu 16.04 LTS
Summary:
A system hardening measure could be bypassed.
Software Description:
- neutron: OpenStack Virtual Network Service
Details:
Erik Olof Gunnar Andersson discovered that OpenStack Neutron incorrectly
handled certain security group rules in the iptables firewall module. An
authenticated attacker could possibly use this issue to block further
application of security group rules for other instances.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.10:
python-neutron 2:13.0.2-0ubuntu3.4
python3-neutron 2:13.0.2-0ubuntu3.4
Ubuntu 16.04 LTS:
python-neutron 2:8.4.0-0ubuntu7.4
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4036-1
CVE-2019-9735
Package Information:
https://launchpad.net/ubuntu/+source/neutron/2:13.0.2-0ubuntu3.4
https://launchpad.net/ubuntu/+source/neutron/2:8.4.0-0ubuntu7.4
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl0SJLIACgkQZWnYVadE
vpPezA//fpQ8neIwx7H5Fy9ULTZ9TgkX+FY0fukMQweu0FoMptDbW9JyHGZYBlfi
6xHzqOhGjPFS+GtWOTpIWpJaDZc6iTjJzAgfWlkn/lZlCVxMBGYN1fBxMW5heF5m
ENQ2sKbiOoxCasXn6pTxj0C9JmNpk54LEGjLMzYn3HXS3g4ZU9pjgOrW47kTUfnX
0m9pK9iiKgZ7XAj1Pwd8hTlzTze0SRgFGecbmJy7Izq82X6VVyOBPJoiTn1ZOKXX
Rh3w/wODIttoM8p1GlZIgI2CQ2gbdNTDB8Jzy/iphQ/q01Kg89COFZoc5noYEeP4
Pbyymjd++7/ukbu8fJW7trq3ivK3NREId8HHoIkJQj6vPE5lG7kYYtWGYGBM9Y7N
ub4dQyVkj3a7MM1bXPIFiz8vy8jdb8r7Jeg53fKFmMKpdlqKyUH4zr4w3bWMKmlL
qjlS16CsT6wiUWo6OAUCa9844km4bIDp3197WgxizVLSJ2b7Kjk9wEkKEWOtFJAF
HPSQzPuAmW+9OurIT7qGAv/FU7exGOoXc1XsdGGDoFx6HvzHqANBAFmFPp+TKlt7
ruozG6K7iwGgvK5AXkoP7PGb2g+Eh8kvDy7qxS3+AuMiX4cHqGTrGY/jPO5a+mlE
79nqnL3MhRF0ndOaCGswnX9vXoMcN4/JjuC2+ICezJwCwcPP6qs=
=fuFL
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-4036-1
June 25, 2019
neutron vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.10
- Ubuntu 16.04 LTS
Summary:
A system hardening measure could be bypassed.
Software Description:
- neutron: OpenStack Virtual Network Service
Details:
Erik Olof Gunnar Andersson discovered that OpenStack Neutron incorrectly
handled certain security group rules in the iptables firewall module. An
authenticated attacker could possibly use this issue to block further
application of security group rules for other instances.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.10:
python-neutron 2:13.0.2-0ubuntu3.4
python3-neutron 2:13.0.2-0ubuntu3.4
Ubuntu 16.04 LTS:
python-neutron 2:8.4.0-0ubuntu7.4
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4036-1
CVE-2019-9735
Package Information:
https://launchpad.net/ubuntu/+source/neutron/2:13.0.2-0ubuntu3.4
https://launchpad.net/ubuntu/+source/neutron/2:8.4.0-0ubuntu7.4
[USN-4037-1] policykit-desktop-privileges update
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl0SJMIACgkQZWnYVadE
vpPW6w//TdYE14X7MtEnooS9YHIKu/zSpqwSWxMgePhz6zWkRZiXzLunY3Ce3rig
o01wy6yex9TKl3vA9PGplpzRxbTBiyn8F9rw2ZkZhfSjbPeb/FPvS/uulFRONd1K
7WTWjV50Xbu+GwxQF1f7XLHwybKsy6P+m25y6J7dDNkAR7ZivDAiSbpAKlCgfI9M
6t3sVFJffJQc0gGxt8/k9AcVI2c6sfZutd9tgZRXesczttQxRXa2xifXwL3SKgeP
tDe93Ej7Rn5vC+hYKHOmU5gBz7rptPrb0y+DgprndcfyRVckkwNaVISQseysaYCm
84ZtIbCoH0VqPcPLOOp1BUsOVnbGvQ721r8ptdn299+0SgwIuIhUhrSvP/Q7/V56
C/WugkycmetDEw0mLLfB5MXg05fhXuzi7CZfqjVCEhPVxJlTEJRqj2P/MTklXAUo
bLbyXMa+DuO1L9/FvNc0qjlrxgUyeB6AUYqqhD+HsIyYKVqrdwnrlGnCtpVh2iCC
Cw606Ek35I6bhYNYOW+mMu1Lhavp63Xcx/YOJLYncLhvxHWhGLvAVauIF98SkIsa
CUesHEkoTAu1vbxQIr/GZmt32yfyEVhTi4BSxAF0dydI3LTYxLxDE3M5WXUqY9pZ
OC8siY3kjKQFKmgTGa9qA9XnR09jfLHQ/8m9g2p4/F+WjvJXlHw=
=7tPH
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-4037-1
June 25, 2019
policykit-desktop-privileges update
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
A security improvement has been made to policykit-desktop-privileges.
Software Description:
- policykit-desktop-privileges: run common desktop actions without password
Details:
The policykit-desktop-privileges Startup Disk Creator policy allowed
administrative users to overwrite disks. As a security improvement, this
operation now requires authentication.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 19.04:
policykit-desktop-privileges 0.20ubuntu19.04.1
Ubuntu 18.10:
policykit-desktop-privileges 0.20ubuntu18.10.1
Ubuntu 18.04 LTS:
policykit-desktop-privileges 0.20ubuntu18.04.1
Ubuntu 16.04 LTS:
policykit-desktop-privileges 0.20ubuntu16.04.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4037-1
https://launchpad.net/bugs/1832337
Package Information:
https://launchpad.net/ubuntu/+source/policykit-desktop-privileges/0.20ubuntu19.04.1
https://launchpad.net/ubuntu/+source/policykit-desktop-privileges/0.20ubuntu18.10.1
https://launchpad.net/ubuntu/+source/policykit-desktop-privileges/0.20ubuntu18.04.1
https://launchpad.net/ubuntu/+source/policykit-desktop-privileges/0.20ubuntu16.04.1
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl0SJMIACgkQZWnYVadE
vpPW6w//TdYE14X7MtEnooS9YHIKu/zSpqwSWxMgePhz6zWkRZiXzLunY3Ce3rig
o01wy6yex9TKl3vA9PGplpzRxbTBiyn8F9rw2ZkZhfSjbPeb/FPvS/uulFRONd1K
7WTWjV50Xbu+GwxQF1f7XLHwybKsy6P+m25y6J7dDNkAR7ZivDAiSbpAKlCgfI9M
6t3sVFJffJQc0gGxt8/k9AcVI2c6sfZutd9tgZRXesczttQxRXa2xifXwL3SKgeP
tDe93Ej7Rn5vC+hYKHOmU5gBz7rptPrb0y+DgprndcfyRVckkwNaVISQseysaYCm
84ZtIbCoH0VqPcPLOOp1BUsOVnbGvQ721r8ptdn299+0SgwIuIhUhrSvP/Q7/V56
C/WugkycmetDEw0mLLfB5MXg05fhXuzi7CZfqjVCEhPVxJlTEJRqj2P/MTklXAUo
bLbyXMa+DuO1L9/FvNc0qjlrxgUyeB6AUYqqhD+HsIyYKVqrdwnrlGnCtpVh2iCC
Cw606Ek35I6bhYNYOW+mMu1Lhavp63Xcx/YOJLYncLhvxHWhGLvAVauIF98SkIsa
CUesHEkoTAu1vbxQIr/GZmt32yfyEVhTi4BSxAF0dydI3LTYxLxDE3M5WXUqY9pZ
OC8siY3kjKQFKmgTGa9qA9XnR09jfLHQ/8m9g2p4/F+WjvJXlHw=
=7tPH
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-4037-1
June 25, 2019
policykit-desktop-privileges update
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
A security improvement has been made to policykit-desktop-privileges.
Software Description:
- policykit-desktop-privileges: run common desktop actions without password
Details:
The policykit-desktop-privileges Startup Disk Creator policy allowed
administrative users to overwrite disks. As a security improvement, this
operation now requires authentication.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 19.04:
policykit-desktop-privileges 0.20ubuntu19.04.1
Ubuntu 18.10:
policykit-desktop-privileges 0.20ubuntu18.10.1
Ubuntu 18.04 LTS:
policykit-desktop-privileges 0.20ubuntu18.04.1
Ubuntu 16.04 LTS:
policykit-desktop-privileges 0.20ubuntu16.04.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4037-1
https://launchpad.net/bugs/1832337
Package Information:
https://launchpad.net/ubuntu/+source/policykit-desktop-privileges/0.20ubuntu19.04.1
https://launchpad.net/ubuntu/+source/policykit-desktop-privileges/0.20ubuntu18.10.1
https://launchpad.net/ubuntu/+source/policykit-desktop-privileges/0.20ubuntu18.04.1
https://launchpad.net/ubuntu/+source/policykit-desktop-privileges/0.20ubuntu16.04.1
[USN-4035-1] Ceph vulnerabilities
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl0SJJ4ACgkQZWnYVadE
vpNiEg/8CX2Ymvluuwf7yyViHAO45xaI86kl90i4SiPjndN6RNhZ3KfA8KyX/Dol
2ABrEdZQCmTCX9RUzcS1MekhHT7MzQjBvRizq4v+c7OZHI9H1OwjcDftP+bYqX26
TRYhS/2HBIFK1OgpeAeIa8NlOh6rZ5foc90caiAjyV6TfkdRkjoGFoaU2RBGIpSl
2+Xf/dG456rNKC8+bfVIVDb1KmpUVWd3LhvktXJkyNaOoWugb3FLEKFPA3/YUiXg
eVFWp/Q09T4cGkrERaTZyz9WNMT+3vvyxbq9QXRcjfDkb1eAV17oTrSm69gWnCDJ
inx4osYZzJiE+EEqzThbscU3vjKjH7l5VOKOFO90X7hNN8gnG6+Gfc7JDvhJwoq2
id9++bxQ4sXK8xk9JG53I4AFIUgMYr3mA7wh9dG/GfBSV6sM0NoV5iryXytAfDEf
y6UXthXQON9OdU73Vqw/6/fulZMh0p40Zsn4MwfuFQ/9GQmp678W1Gty2lFBntfg
KJ0l9UV2Eg8hTsJKrbxCw9geCfJx2tmsP8VE8AB/xwYuAW/EQeu4T8IFsNzbZPQE
AdAB47tU/KPZHA2G+6Zyj/Fos8hcmXfztySsqGXbH7iyJmLGLQ/YkDWV+AeMaHuL
RlT7iv3RhmCYzJaZ+D66ctvJ/3+uyILMsvm7/1k21+1fyp0NIlo=
=voua
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-4035-1
June 25, 2019
ceph vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in Ceph.
Software Description:
- ceph: distributed storage and file system
Details:
It was discovered that Ceph incorrectly handled read only permissions. An
authenticated attacker could use this issue to obtain dm-crypt encryption
keys. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-14662)
It was discovered that Ceph incorrectly handled certain OMAPs holding
bucket indices. An authenticated attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 16.04 LTS.
(CVE-2018-16846)
It was discovered that Ceph incorrectly sanitized certain debug logs. A
local attacker could possibly use this issue to obtain encryption key
information. This issue was only addressed in Ubuntu 18.10 and Ubuntu
19.04. (CVE-2018-16889)
It was discovered that Ceph incorrectly handled certain civetweb requests.
A remote attacker could possibly use this issue to consume resources,
leading to a denial of service. This issue only affected Ubuntu 18.10 and
Ubuntu 19.04. (CVE-2019-3821)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 19.04:
ceph 13.2.4+dfsg1-0ubuntu2.1
ceph-common 13.2.4+dfsg1-0ubuntu2.1
Ubuntu 18.10:
ceph 13.2.4+dfsg1-0ubuntu0.18.10.2
ceph-common 13.2.4+dfsg1-0ubuntu0.18.10.2
Ubuntu 16.04 LTS:
ceph 10.2.11-0ubuntu0.16.04.2
ceph-common 10.2.11-0ubuntu0.16.04.2
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4035-1
CVE-2018-14662, CVE-2018-16846, CVE-2018-16889, CVE-2019-3821
Package Information:
https://launchpad.net/ubuntu/+source/ceph/13.2.4+dfsg1-0ubuntu2.1
https://launchpad.net/ubuntu/+source/ceph/13.2.4+dfsg1-0ubuntu0.18.10.2
https://launchpad.net/ubuntu/+source/ceph/10.2.11-0ubuntu0.16.04.2
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl0SJJ4ACgkQZWnYVadE
vpNiEg/8CX2Ymvluuwf7yyViHAO45xaI86kl90i4SiPjndN6RNhZ3KfA8KyX/Dol
2ABrEdZQCmTCX9RUzcS1MekhHT7MzQjBvRizq4v+c7OZHI9H1OwjcDftP+bYqX26
TRYhS/2HBIFK1OgpeAeIa8NlOh6rZ5foc90caiAjyV6TfkdRkjoGFoaU2RBGIpSl
2+Xf/dG456rNKC8+bfVIVDb1KmpUVWd3LhvktXJkyNaOoWugb3FLEKFPA3/YUiXg
eVFWp/Q09T4cGkrERaTZyz9WNMT+3vvyxbq9QXRcjfDkb1eAV17oTrSm69gWnCDJ
inx4osYZzJiE+EEqzThbscU3vjKjH7l5VOKOFO90X7hNN8gnG6+Gfc7JDvhJwoq2
id9++bxQ4sXK8xk9JG53I4AFIUgMYr3mA7wh9dG/GfBSV6sM0NoV5iryXytAfDEf
y6UXthXQON9OdU73Vqw/6/fulZMh0p40Zsn4MwfuFQ/9GQmp678W1Gty2lFBntfg
KJ0l9UV2Eg8hTsJKrbxCw9geCfJx2tmsP8VE8AB/xwYuAW/EQeu4T8IFsNzbZPQE
AdAB47tU/KPZHA2G+6Zyj/Fos8hcmXfztySsqGXbH7iyJmLGLQ/YkDWV+AeMaHuL
RlT7iv3RhmCYzJaZ+D66ctvJ/3+uyILMsvm7/1k21+1fyp0NIlo=
=voua
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-4035-1
June 25, 2019
ceph vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in Ceph.
Software Description:
- ceph: distributed storage and file system
Details:
It was discovered that Ceph incorrectly handled read only permissions. An
authenticated attacker could use this issue to obtain dm-crypt encryption
keys. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-14662)
It was discovered that Ceph incorrectly handled certain OMAPs holding
bucket indices. An authenticated attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 16.04 LTS.
(CVE-2018-16846)
It was discovered that Ceph incorrectly sanitized certain debug logs. A
local attacker could possibly use this issue to obtain encryption key
information. This issue was only addressed in Ubuntu 18.10 and Ubuntu
19.04. (CVE-2018-16889)
It was discovered that Ceph incorrectly handled certain civetweb requests.
A remote attacker could possibly use this issue to consume resources,
leading to a denial of service. This issue only affected Ubuntu 18.10 and
Ubuntu 19.04. (CVE-2019-3821)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 19.04:
ceph 13.2.4+dfsg1-0ubuntu2.1
ceph-common 13.2.4+dfsg1-0ubuntu2.1
Ubuntu 18.10:
ceph 13.2.4+dfsg1-0ubuntu0.18.10.2
ceph-common 13.2.4+dfsg1-0ubuntu0.18.10.2
Ubuntu 16.04 LTS:
ceph 10.2.11-0ubuntu0.16.04.2
ceph-common 10.2.11-0ubuntu0.16.04.2
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4035-1
CVE-2018-14662, CVE-2018-16846, CVE-2018-16889, CVE-2019-3821
Package Information:
https://launchpad.net/ubuntu/+source/ceph/13.2.4+dfsg1-0ubuntu2.1
https://launchpad.net/ubuntu/+source/ceph/13.2.4+dfsg1-0ubuntu0.18.10.2
https://launchpad.net/ubuntu/+source/ceph/10.2.11-0ubuntu0.16.04.2
[USN-4034-1] ImageMagick vulnerabilities
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl0SJIkACgkQZWnYVadE
vpOBjBAAotlbPkuuuvzmzYU/FU3sTS2ogJ2S3i+Zw3nWDyJH41rRw1/kI0+smyyu
vGg1AkvfMllHAAPm8yj1gCI1BJlCubpQsajNQGRY/zwjOHO+c7acru9vfdD7vA+E
Kjz+10/oSwD8cQs+Qc/IIel2+dyhvTNmnxXf5bd1DK6L0dMU+7dnQmKA1kirax3E
bLI4ZK6FPm9EWa2h351Oy+oVoummPmA21kMksHtymBy3yqlyVluvkDhceqCKSRCR
EMYbYe1o11ZlR27td3oBbP0RiA6loVJ3EW6Md1GjCbQSzoXySi8c6fxSqQpbij90
0ssoFdQiAM5vFTTyhZDcy7QYN0h5DQGrvG4myM16Nv+IjRG2mBd2kGTmv5kCvx9c
K+VersNRM1WHJkCNOLELehSefl42UPGYSb720k6k83lJruvQwFbjpljFSsfJPNEr
XM9PhZZJUrImnxczBQRVG6T29O853a7AKL439Tb8l1znpfK12djzPxsZmkPn315q
NHLyk3YWJwsxYgtz2xdlWQASCv3yc6MtoNVGsewOA6SOjwfZaVj3NEztk6UEMVyx
YxziRKBMDPbEKDtLQ+EG+tYb0/RB83U+J7fqUm5eM2RzqOZUKyy5BeDtvYlkK6qs
sjz5+c0DaJ+4afZDAsz57olz2UoE7ok5V/Cfe0SmGXpqPlClJjI=
=njY5
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-4034-1
June 25, 2019
imagemagick vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in ImageMagick.
Software Description:
- imagemagick: Image manipulation programs and library
Details:
It was discovered that ImageMagick incorrectly handled certain malformed
image files. If a user or automated system using ImageMagick were tricked
into opening a specially crafted image, an attacker could exploit this to
cause a denial of service or possibly execute code with the privileges of
the user invoking the program.
Due to a large number of issues discovered in GhostScript that prevent it
from being used by ImageMagick safely, the update for Ubuntu 18.10 and
Ubuntu 19.04 includes a default policy change that disables support for the
Postscript and PDF formats in ImageMagick. This policy can be overridden if
necessary by using an alternate ImageMagick policy configuration.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 19.04:
imagemagick 8:6.9.10.14+dfsg-7ubuntu2.2
imagemagick-6.q16 8:6.9.10.14+dfsg-7ubuntu2.2
libmagick++-6.q16-8 8:6.9.10.14+dfsg-7ubuntu2.2
libmagickcore-6.q16-6 8:6.9.10.14+dfsg-7ubuntu2.2
libmagickcore-6.q16-6-extra 8:6.9.10.14+dfsg-7ubuntu2.2
Ubuntu 18.10:
imagemagick 8:6.9.10.8+dfsg-1ubuntu2.2
imagemagick-6.q16 8:6.9.10.8+dfsg-1ubuntu2.2
libmagick++-6.q16-8 8:6.9.10.8+dfsg-1ubuntu2.2
libmagickcore-6.q16-6 8:6.9.10.8+dfsg-1ubuntu2.2
libmagickcore-6.q16-6-extra 8:6.9.10.8+dfsg-1ubuntu2.2
Ubuntu 18.04 LTS:
imagemagick 8:6.9.7.4+dfsg-16ubuntu6.7
imagemagick-6.q16 8:6.9.7.4+dfsg-16ubuntu6.7
libmagick++-6.q16-7 8:6.9.7.4+dfsg-16ubuntu6.7
libmagickcore-6.q16-3 8:6.9.7.4+dfsg-16ubuntu6.7
libmagickcore-6.q16-3-extra 8:6.9.7.4+dfsg-16ubuntu6.7
Ubuntu 16.04 LTS:
imagemagick 8:6.8.9.9-7ubuntu5.14
imagemagick-6.q16 8:6.8.9.9-7ubuntu5.14
libmagick++-6.q16-5v5 8:6.8.9.9-7ubuntu5.14
libmagickcore-6.q16-2 8:6.8.9.9-7ubuntu5.14
libmagickcore-6.q16-2-extra 8:6.8.9.9-7ubuntu5.14
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4034-1
CVE-2017-12805, CVE-2017-12806, CVE-2018-14434, CVE-2018-15607,
CVE-2018-16323, CVE-2018-16412, CVE-2018-16413, CVE-2018-16644,
CVE-2018-16645, CVE-2018-17965, CVE-2018-17966, CVE-2018-18016,
CVE-2018-18023, CVE-2018-18024, CVE-2018-18025, CVE-2018-18544,
CVE-2018-20467, CVE-2019-10131, CVE-2019-10649, CVE-2019-10650,
CVE-2019-11470, CVE-2019-11472, CVE-2019-11597, CVE-2019-11598,
CVE-2019-7175, CVE-2019-7395, CVE-2019-7396, CVE-2019-7397,
CVE-2019-7398, CVE-2019-9956
Package Information:
https://launchpad.net/ubuntu/+source/imagemagick/8:6.9.10.14+dfsg-7ubuntu2.2
https://launchpad.net/ubuntu/+source/imagemagick/8:6.9.10.8+dfsg-1ubuntu2.2
https://launchpad.net/ubuntu/+source/imagemagick/8:6.9.7.4+dfsg-16ubuntu6.7
https://launchpad.net/ubuntu/+source/imagemagick/8:6.8.9.9-7ubuntu5.14
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl0SJIkACgkQZWnYVadE
vpOBjBAAotlbPkuuuvzmzYU/FU3sTS2ogJ2S3i+Zw3nWDyJH41rRw1/kI0+smyyu
vGg1AkvfMllHAAPm8yj1gCI1BJlCubpQsajNQGRY/zwjOHO+c7acru9vfdD7vA+E
Kjz+10/oSwD8cQs+Qc/IIel2+dyhvTNmnxXf5bd1DK6L0dMU+7dnQmKA1kirax3E
bLI4ZK6FPm9EWa2h351Oy+oVoummPmA21kMksHtymBy3yqlyVluvkDhceqCKSRCR
EMYbYe1o11ZlR27td3oBbP0RiA6loVJ3EW6Md1GjCbQSzoXySi8c6fxSqQpbij90
0ssoFdQiAM5vFTTyhZDcy7QYN0h5DQGrvG4myM16Nv+IjRG2mBd2kGTmv5kCvx9c
K+VersNRM1WHJkCNOLELehSefl42UPGYSb720k6k83lJruvQwFbjpljFSsfJPNEr
XM9PhZZJUrImnxczBQRVG6T29O853a7AKL439Tb8l1znpfK12djzPxsZmkPn315q
NHLyk3YWJwsxYgtz2xdlWQASCv3yc6MtoNVGsewOA6SOjwfZaVj3NEztk6UEMVyx
YxziRKBMDPbEKDtLQ+EG+tYb0/RB83U+J7fqUm5eM2RzqOZUKyy5BeDtvYlkK6qs
sjz5+c0DaJ+4afZDAsz57olz2UoE7ok5V/Cfe0SmGXpqPlClJjI=
=njY5
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-4034-1
June 25, 2019
imagemagick vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in ImageMagick.
Software Description:
- imagemagick: Image manipulation programs and library
Details:
It was discovered that ImageMagick incorrectly handled certain malformed
image files. If a user or automated system using ImageMagick were tricked
into opening a specially crafted image, an attacker could exploit this to
cause a denial of service or possibly execute code with the privileges of
the user invoking the program.
Due to a large number of issues discovered in GhostScript that prevent it
from being used by ImageMagick safely, the update for Ubuntu 18.10 and
Ubuntu 19.04 includes a default policy change that disables support for the
Postscript and PDF formats in ImageMagick. This policy can be overridden if
necessary by using an alternate ImageMagick policy configuration.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 19.04:
imagemagick 8:6.9.10.14+dfsg-7ubuntu2.2
imagemagick-6.q16 8:6.9.10.14+dfsg-7ubuntu2.2
libmagick++-6.q16-8 8:6.9.10.14+dfsg-7ubuntu2.2
libmagickcore-6.q16-6 8:6.9.10.14+dfsg-7ubuntu2.2
libmagickcore-6.q16-6-extra 8:6.9.10.14+dfsg-7ubuntu2.2
Ubuntu 18.10:
imagemagick 8:6.9.10.8+dfsg-1ubuntu2.2
imagemagick-6.q16 8:6.9.10.8+dfsg-1ubuntu2.2
libmagick++-6.q16-8 8:6.9.10.8+dfsg-1ubuntu2.2
libmagickcore-6.q16-6 8:6.9.10.8+dfsg-1ubuntu2.2
libmagickcore-6.q16-6-extra 8:6.9.10.8+dfsg-1ubuntu2.2
Ubuntu 18.04 LTS:
imagemagick 8:6.9.7.4+dfsg-16ubuntu6.7
imagemagick-6.q16 8:6.9.7.4+dfsg-16ubuntu6.7
libmagick++-6.q16-7 8:6.9.7.4+dfsg-16ubuntu6.7
libmagickcore-6.q16-3 8:6.9.7.4+dfsg-16ubuntu6.7
libmagickcore-6.q16-3-extra 8:6.9.7.4+dfsg-16ubuntu6.7
Ubuntu 16.04 LTS:
imagemagick 8:6.8.9.9-7ubuntu5.14
imagemagick-6.q16 8:6.8.9.9-7ubuntu5.14
libmagick++-6.q16-5v5 8:6.8.9.9-7ubuntu5.14
libmagickcore-6.q16-2 8:6.8.9.9-7ubuntu5.14
libmagickcore-6.q16-2-extra 8:6.8.9.9-7ubuntu5.14
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4034-1
CVE-2017-12805, CVE-2017-12806, CVE-2018-14434, CVE-2018-15607,
CVE-2018-16323, CVE-2018-16412, CVE-2018-16413, CVE-2018-16644,
CVE-2018-16645, CVE-2018-17965, CVE-2018-17966, CVE-2018-18016,
CVE-2018-18023, CVE-2018-18024, CVE-2018-18025, CVE-2018-18544,
CVE-2018-20467, CVE-2019-10131, CVE-2019-10649, CVE-2019-10650,
CVE-2019-11470, CVE-2019-11472, CVE-2019-11597, CVE-2019-11598,
CVE-2019-7175, CVE-2019-7395, CVE-2019-7396, CVE-2019-7397,
CVE-2019-7398, CVE-2019-9956
Package Information:
https://launchpad.net/ubuntu/+source/imagemagick/8:6.9.10.14+dfsg-7ubuntu2.2
https://launchpad.net/ubuntu/+source/imagemagick/8:6.9.10.8+dfsg-1ubuntu2.2
https://launchpad.net/ubuntu/+source/imagemagick/8:6.9.7.4+dfsg-16ubuntu6.7
https://launchpad.net/ubuntu/+source/imagemagick/8:6.8.9.9-7ubuntu5.14
Monday, June 24, 2019
[USN-4033-1] libmysofa vulnerability
==========================================================================
Ubuntu Security Notice USN-4033-1
June 24, 2019
libmysofa vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 18.04 LTS
Summary:
libmysofa could be made to crash if it received specially crafted
input.
Software Description:
- libmysofa: library to read HRTFs stored in the AES69-2015 SOFA format
Details:
It was discovered that a libmysofa component does not properly validate
multiplications and additions, and may crash with some specific input.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 19.04:
libmysofa0 0.6~dfsg0-2ubuntu0.19.04.1
Ubuntu 18.10:
libmysofa0 0.6~dfsg0-2ubuntu0.18.10.1
Ubuntu 18.04 LTS:
libmysofa0 0.6~dfsg0-2ubuntu0.18.04.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4033-1
CVE-2019-10672
Package Information:
https://launchpad.net/ubuntu/+source/libmysofa/0.6~dfsg0-2ubuntu0.19.04.1
https://launchpad.net/ubuntu/+source/libmysofa/0.6~dfsg0-2ubuntu0.18.10.1
https://launchpad.net/ubuntu/+source/libmysofa/0.6~dfsg0-2ubuntu0.18.04.1
Ubuntu Security Notice USN-4033-1
June 24, 2019
libmysofa vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 18.04 LTS
Summary:
libmysofa could be made to crash if it received specially crafted
input.
Software Description:
- libmysofa: library to read HRTFs stored in the AES69-2015 SOFA format
Details:
It was discovered that a libmysofa component does not properly validate
multiplications and additions, and may crash with some specific input.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 19.04:
libmysofa0 0.6~dfsg0-2ubuntu0.19.04.1
Ubuntu 18.10:
libmysofa0 0.6~dfsg0-2ubuntu0.18.10.1
Ubuntu 18.04 LTS:
libmysofa0 0.6~dfsg0-2ubuntu0.18.04.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4033-1
CVE-2019-10672
Package Information:
https://launchpad.net/ubuntu/+source/libmysofa/0.6~dfsg0-2ubuntu0.19.04.1
https://launchpad.net/ubuntu/+source/libmysofa/0.6~dfsg0-2ubuntu0.18.10.1
https://launchpad.net/ubuntu/+source/libmysofa/0.6~dfsg0-2ubuntu0.18.04.1
[CentOS-announce] CEEA-2019:1341 CentOS 7 python-adal Enhancement Update
CentOS Errata and Enhancement Advisory 2019:1341
Upstream details at : https://access.redhat.com/errata/RHEA-2019:1341
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
fe2663af350f36f79fa0673c451db5bd8d7561af969af0e617c280053c218158 python-adal-0.6.0-0.el7_6.1.noarch.rpm
Source:
0ba40817dc6bce65e3a74ba1bbe2c0f2206aaf815b71628aaaca6cea6ba3f9e3 python-adal-0.6.0-0.el7_6.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHEA-2019:1341
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
fe2663af350f36f79fa0673c451db5bd8d7561af969af0e617c280053c218158 python-adal-0.6.0-0.el7_6.1.noarch.rpm
Source:
0ba40817dc6bce65e3a74ba1bbe2c0f2206aaf815b71628aaaca6cea6ba3f9e3 python-adal-0.6.0-0.el7_6.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CEEA-2019:1343 CentOS 7 python-msrestazure Enhancement Update
CentOS Errata and Enhancement Advisory 2019:1343
Upstream details at : https://access.redhat.com/errata/RHEA-2019:1343
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
bb04c8e22fe081c7d22a3a7df9c856608ce3ed71dff58ef7315d209e967ad962 python-msrestazure-0.5.1-0.el7_6.1.noarch.rpm
Source:
151d5558178b7f72f58f23898ad5a6b8354a4d3ff2cd3aed5e9d993d692d3bef python-msrestazure-0.5.1-0.el7_6.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHEA-2019:1343
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
bb04c8e22fe081c7d22a3a7df9c856608ce3ed71dff58ef7315d209e967ad962 python-msrestazure-0.5.1-0.el7_6.1.noarch.rpm
Source:
151d5558178b7f72f58f23898ad5a6b8354a4d3ff2cd3aed5e9d993d692d3bef python-msrestazure-0.5.1-0.el7_6.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
[CentOS-announce] CEEA-2019:1342 CentOS 7 python-msrest Enhancement Update
CentOS Errata and Enhancement Advisory 2019:1342
Upstream details at : https://access.redhat.com/errata/RHEA-2019:1342
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
2b7707efdd4389d9360b8675b65ecec0961d8e3a9497ba767c225cffcfcb68ee python-msrest-0.5.4-0.el7_6.1.noarch.rpm
Source:
cf71c5558af8fd15aaf4f88c10606b8211a1c4f867be1eb54a66904430ec6776 python-msrest-0.5.4-0.el7_6.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Upstream details at : https://access.redhat.com/errata/RHEA-2019:1342
The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )
x86_64:
2b7707efdd4389d9360b8675b65ecec0961d8e3a9497ba767c225cffcfcb68ee python-msrest-0.5.4-0.el7_6.1.noarch.rpm
Source:
cf71c5558af8fd15aaf4f88c10606b8211a1c4f867be1eb54a66904430ec6776 python-msrest-0.5.4-0.el7_6.1.src.rpm
--
Johnny Hughes
CentOS Project { http://www.centos.org/ }
irc: hughesjr, #centos@irc.freenode.net
Twitter: @JohnnyCentOS
_______________________________________________
CentOS-announce mailing list
CentOS-announce@centos.org
https://lists.centos.org/mailman/listinfo/centos-announce
Subscribe to:
Posts (Atom)