Extended Security Maintenance for Ubuntu 16.04 (Xenial Xerus) begins April 30 2021

Ubuntu announced its 16.04 (Xenial Xerus) release almost 5 years ago, on
April 21, 2016. As with the earlier LTS releases, Ubuntu committed to
ongoing security and critical fixes for a period of 5 years. The standard
support period is now nearing its end and Ubuntu 16.04 LTS will transition to
Extended Security Maintenance (ESM) on Friday, April 30th, 2021.

Users are encouraged to evaluate and upgrade to our latest 20.04 LTS
release via 18.04 LTS. The supported upgrade path from Ubuntu 16.04 LTS is
via Ubuntu 18.04 LTS. Instructions and caveats for the upgrades may be found
at:

https://help.ubuntu.com/community/BionicUpgrades for Ubuntu 18.04 LTS
https://help.ubuntu.com/community/FocalUpgrades for Ubuntu 20.04 LTS

Ubuntu 18.04 LTS and 20.04 LTS continue to be actively supported with
security updates and bug fixes. All announcements of official security
updates for Ubuntu releases are sent to the ubuntu-security-announce mailing
list, information about which may be found here:

https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

Canonical provides Extended Security Maintenance for Ubuntu 16.04 LTS to
customers through Ubuntu Advantage. The announcement including details
about how and where to purchase extended support can be found here:

https://ubuntu.com/blog/ubuntu-16-04-lts-esm-migration-path
https://www.ubuntu.com/esm

Since its launch in October 2004, Ubuntu has become one of the most
highly regarded Linux distributions with millions of users in homes,
schools, businesses and governments around the world. Ubuntu is Open
Source software, costs nothing to download, and users are free to
customise or alter their software in order to meet their needs.

On behalf of the Ubuntu Release Team,

Łukasz 'sil2100' Zemczak

--
ubuntu-announce mailing list
ubuntu-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-announce

[USN-4754-3] Python vulnerabilities

==========================================================================
Ubuntu Security Notice USN-4754-3
March 12, 2021

python2.7, python3.7, python3.8 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS

Summary:

Several security issues were fixed in Python 2.7 and Python 3.8.

Software Description:
- python2.7: An interactive high-level object-oriented language
- python3.7: An interactive high-level object-oriented language
- python3.8: An interactive high-level object-oriented language

Details:

USN-4754-1 fixed vulnerabilities in Python. This update provides
the corresponding updates for Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.

In the case of Python 2.7 for 20.04 ESM, these additional fixes are included:

It was dicovered that Python allowed remote attackers to cause a denial of
service (resource consumption) via a ZIP bomb. (CVE-2019-9674)

It was discovered that Python had potentially misleading information about
whether sorting occurs. This fix updates the documentation about it.
(CVE-2019-17514)

It was discovered that Python incorrectly handled certain TAR archives.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2019-20907)

It was discovered that Python allowed an HTTP server to conduct Regular
Expression Denial of Service (ReDoS) attacks against a client because of
urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
(CVE-2020-8492)

It was discovered that Python allowed CRLF injection if the attacker controls
the HTTP request method, as demonstrated by inserting CR and LF control
characters in the first argument of HTTPConnection.request. (CVE-2020-26116)

Original advisory details:

It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code
or cause a denial of service. (CVE-2020-27619, CVE-2021-3177)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
python2.7 2.7.18-1~20.04.1
python2.7-minimal 2.7.18-1~20.04.1

Ubuntu 18.04 LTS:
python3.7 3.7.5-2~18.04.4
python3.7-minimal 3.7.5-2~18.04.4
python3.8 3.8.0-3~18.04.1
python3.8-minimal 3.8.0-3~18.04.1

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-4754-3
https://ubuntu.com/security/notices/USN-4754-1
CVE-2019-17514, CVE-2019-20907, CVE-2019-9674, CVE-2020-26116,
CVE-2020-27619, CVE-2020-8492, CVE-2021-3177

Package Information:
https://launchpad.net/ubuntu/+source/python2.7/2.7.18-1~20.04.1
https://launchpad.net/ubuntu/+source/python3.7/3.7.5-2~18.04.4
https://launchpad.net/ubuntu/+source/python3.8/3.8.0-3~18.04.1

Fedora Linux 34 Beta is NO-GO

Due to an outstanding blocker bug, F34 Beta RC1 was declared NO-GO in
today's meeting[1].

The next Fedora Linux 34 Beta Go/No-Go meeting[2] will be held at 1700
UTC on Thursday 18 March in #fedora-meeting. We will aim for the
"target date #1" milestone of 23 March. The release schedule[3] has
been updated accordingly. This change does not impact the final
release date.

[1] https://meetbot.fedoraproject.org/fedora-meeting/2021-03-11/f34-beta-go_no_go-meeting.2021-03-11-17.00.html
[2] https://apps.fedoraproject.org/calendar/meeting/9923/?from_date=2021-03-15
[3] https://fedorapeople.org/groups/schedule/f-34/f-34-key-tasks.html

--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

[USN-4763-1] Pillow vulnerabilities

==========================================================================
Ubuntu Security Notice USN-4763-1
March 11, 2021

pillow vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Pillow.

Software Description:
- pillow: Python Imaging Library

Details:

It was discovered that Pillow incorrectly handled certain Tiff image files.
If a user or automated system were tricked into opening a specially-crafted
Tiff file, a remote attacker could cause Pillow to crash, resulting in a
denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2021-25289,
CVE-2021-25291)

It was discovered that Pillow incorrectly handled certain Tiff image files.
If a user or automated system were tricked into opening a specially-crafted
Tiff file, a remote attacker could cause Pillow to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2021-25290)

It was discovered that Pillow incorrectly handled certain PDF files. If a
user or automated system were tricked into opening a specially-crafted
PDF file, a remote attacker could cause Pillow to hang, resulting in a
denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04
LTS, and Ubuntu 20.10. (CVE-2021-25292)

It was discovered that Pillow incorrectly handled certain SGI image files.
If a user or automated system were tricked into opening a specially-crafted
SGI file, a remote attacker could possibly cause Pillow to crash,
resulting in a denial of service. This issue only affected Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-25293)

Jiayi Lin, Luke Shaffer, Xinran Xie, and Akshay Ajayan discovered that
Pillow incorrectly handled certain BLP files. If a user or automated system
were tricked into opening a specially-crafted BLP file, a remote attacker
could possibly cause Pillow to consume resources, resulting in a denial of
service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and
Ubuntu 20.10. (CVE-2021-27921)

Jiayi Lin, Luke Shaffer, Xinran Xie, and Akshay Ajayan discovered that
Pillow incorrectly handled certain ICNS files. If a user or automated
system were tricked into opening a specially-crafted ICNS file, a remote
attacker could possibly cause Pillow to consume resources, resulting in a
denial of service. (CVE-2021-27922)

Jiayi Lin, Luke Shaffer, Xinran Xie, and Akshay Ajayan discovered that
Pillow incorrectly handled certain ICO files. If a user or automated
system were tricked into opening a specially-crafted ICO file, a remote
attacker could possibly cause Pillow to consume resources, resulting in a
denial of service. (CVE-2021-27922)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
python3-pil 7.2.0-1ubuntu0.2

Ubuntu 20.04 LTS:
python3-pil 7.0.0-4ubuntu0.3

Ubuntu 18.04 LTS:
python-pil 5.1.0-1ubuntu0.5
python3-pil 5.1.0-1ubuntu0.5

Ubuntu 16.04 LTS:
python-pil 3.1.2-0ubuntu1.6
python3-pil 3.1.2-0ubuntu1.6

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-4763-1
CVE-2021-25289, CVE-2021-25290, CVE-2021-25291, CVE-2021-25292,
CVE-2021-25293, CVE-2021-27921, CVE-2021-27922, CVE-2021-27923

Package Information:
https://launchpad.net/ubuntu/+source/pillow/7.2.0-1ubuntu0.2
https://launchpad.net/ubuntu/+source/pillow/7.0.0-4ubuntu0.3
https://launchpad.net/ubuntu/+source/pillow/5.1.0-1ubuntu0.5
https://launchpad.net/ubuntu/+source/pillow/3.1.2-0ubuntu1.6

[USN-4762-1] OpenSSH vulnerability

==========================================================================
Ubuntu Security Notice USN-4762-1
March 10, 2021

openssh vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.10
- Ubuntu 20.04 LTS

Summary:

OpenSSH could be made to crash or run programs if it received specially
crafted network traffic.

Software Description:
- openssh: secure shell (SSH) for secure access to remote machines

Details:

It was discovered that the OpenSSH ssh-agent incorrectly handled memory. A
remote attacker able to connect to the agent could use this issue to cause
it to crash, resulting in a denial of service, or possibly execute
arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
openssh-client 1:8.3p1-1ubuntu0.1

Ubuntu 20.04 LTS:
openssh-client 1:8.2p1-4ubuntu0.2

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-4762-1
CVE-2021-28041

Package Information:
https://launchpad.net/ubuntu/+source/openssh/1:8.3p1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/openssh/1:8.2p1-4ubuntu0.2

[USN-4761-1] Git vulnerability

==========================================================================
Ubuntu Security Notice USN-4761-1
March 09, 2021

git vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Git could be made to run programs if it received specially crafted network
traffic.

Software Description:
- git: fast, scalable, distributed revision control system

Details:

Matheus Tavares discovered that Git incorrectly handled delay-capable
clean/smudge filters when being used on case-insensitive filesystems. A
remote attacker could possibly use this issue to execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
git 1:2.27.0-1ubuntu1.1

Ubuntu 20.04 LTS:
git 1:2.25.1-1ubuntu3.1

Ubuntu 18.04 LTS:
git 1:2.17.1-1ubuntu0.8

Ubuntu 16.04 LTS:
git 1:2.7.4-0ubuntu1.10

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-4761-1
CVE-2021-21300

Package Information:
https://launchpad.net/ubuntu/+source/git/1:2.27.0-1ubuntu1.1
https://launchpad.net/ubuntu/+source/git/1:2.25.1-1ubuntu3.1
https://launchpad.net/ubuntu/+source/git/1:2.17.1-1ubuntu0.8
https://launchpad.net/ubuntu/+source/git/1:2.7.4-0ubuntu1.10

F35 Change: "Fedora Linux" in /etc/os-release

https://fedoraproject.org/wiki/Changes/Fedora_Linux_in_os-release

== Summary ==

"Fedora" is the name of our project. Our general-purpose Linux distribution is "Fedora Linux". Let's refer to it that way in the OS itself.

== Owner ==


* Name: [[User:mattdm| Matthew Miller]]

* Email: mattdm At fedoraproject.org (bugzilla: mattdm AT redhat.com)


== Detailed Description ==


This change isn't big — it is simply expanding

* <tt>NAME=Fedora</tt> to <tt>NAME="Fedora Linux"</tt>  and
* <tt>PRETTY_NAME="Fedora Linux [##] ([edition or spin])</tt>

in the file <tt>/etc/os-release</tt>.

The short identifier <tt>ID=fedora</tt> will remain the same, so scripted interactions should be unaffected.


== Feedback ==
Community Blog article posted: https://communityblog.fedoraproject.org/fedora-is-a-community-fedora-linux-is-our-os/

== Benefit to Fedora ==

The distinction between our project and our output is important, because as a project and a community we are more than the bits we produce — and, we produce more things (including software bits!) from that included in the Fedora Linux distribution.

We make EPEL, ELN, and thousands of packages in Copr. These are all part of Fedora — but aren't Fedora Linux. We also make artwork, music, documentation, videos, websites, tools, and more. These things too are part of our project, but aren't part of the Fedora Linux distribution. The habit of calling just one thing we make "Fedora" makes it hard to talk about the project and all of the things we do within our [https://docs.fedoraproject.org/en-US/project/#_our_mission mission].

Of course, years of colloquial usage can't be changed overnight, but changing the place where we officially identify the operating system name is an important start. Rather than a big education campaign, let's fix our own usage and go from there.

== Scope ==
* Proposal owners: Will submit a PR for the <tt>fedora-release</tt> package.

* Other developers: Should be no impact, but may need to update any scripts using <TT>NAME</TT> instead of <TT>ID</TT>.

* Release engineering: To review and accept the PR when ready.

* Policies and guidelines: This change itself does not represent a change to policies, but it's good to consider where usage can be changed in existing documents.

* Trademark approval: Not required. Note that this has been cleared by Fedora Legal.

* Alignment with Objectives: No specific objective but aligns with a Council goal.

== Upgrade/compatibility impact ==

Updated systems will get the new <tt>/etc/os-release</tt> file and will see changes in the text-mode login prompt and in places like "OS Name" in the About panel in GNOME.


== How To Test ==

1. Update to test version of Fedora 35

2. Observe name change in <tt>/etc/os-release</tt>

3. Optionally, observe name change in GNOME Settings, text-mode login screens, neofetch, etc.

It would also be useful to test any third-party software which may mistakenly look at <tt>NAME</tt> instead of <tt>ID</tt>.

== User Experience ==

Users will see the distribution referred to as "Fedora Linux" rather than just "Fedora".

== Dependencies ==

None.


== Contingency Plan ==
* Contingency mechanism: Change owner or release engineering will revert the change to <tt>fedora-release</tt>
* Contingency deadline: Decision should be made at beta, but in the unlikely event of disaster this could be reverted right up until the last minute.
* Blocks release? No.

== Documentation ==
Fedora is made of people! When used by itself, the term "Fedora" refers to the Fedora Project. When referring to our work, please use either a specific name like <i>Fedora Workstation</i>, <i>Fedora CoreOS</i>, or <i>Fedora KDE Plasma Desktop</i>; or use <i>Fedora Linux</i> to refer to the OS distribution as a whole.

== Release Notes ==
Note: Fedora is made of people! When used by itself, the term "Fedora" refers to the Fedora Project. When referring to our work, please use either a specific name like <i>Fedora Workstation</i>, <i>Fedora CoreOS</i>, or <i>Fedora KDE Plasma Desktop</i>; or use <i>Fedora Linux</i> to refer to the OS distribution as a whole.

--

Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis

[USN-4758-1] Go vulnerability

==========================================================================
Ubuntu Security Notice USN-4758-1
March 08, 2021

golang-1.10, golang-1.14 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Go applications could be made to perform XSS attacks.

Software Description:
- golang-1.14: Go programming language compiler
- golang-1.10: Go programming language compiler

Details:

It was discovered that Go applications incorrectly handled uploaded content. If
a user were tricked into visiting a malicious page, a remote attacker could
exploit this with a crafted file to conduct cross-site scripting (XSS) attacks.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
golang-1.14 1.14.7-2ubuntu1.1
golang-1.14-go 1.14.7-2ubuntu1.1

Ubuntu 20.04 LTS:
golang-1.14 1.14.3-2ubuntu2~20.04.2
golang-1.14-go 1.14.3-2ubuntu2~20.04.2

Ubuntu 18.04 LTS:
golang-1.10 1.10.4-2ubuntu1~18.04.2
golang-1.10-go 1.10.4-2ubuntu1~18.04.2

Ubuntu 16.04 LTS:
golang-1.10 1.10.4-2ubuntu1~16.04.2
golang-1.10-go 1.10.4-2ubuntu1~16.04.2

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-4758-1
CVE-2020-24553

Package Information:
https://launchpad.net/ubuntu/+source/golang-1.14/1.14.7-2ubuntu1.1
https://launchpad.net/ubuntu/+source/golang-1.14/1.14.3-2ubuntu2~20.04.2
https://launchpad.net/ubuntu/+source/golang-1.10/1.10.4-2ubuntu1~18.04.2
https://launchpad.net/ubuntu/+source/golang-1.10/1.10.4-2ubuntu1~16.04.2

OpenBSD Errata: March 9th, 2021 (npppd)

Errata patches for npppd have been released for OpenBSD 6.7 and 6.8.

npppd PPTP protocol handler can cause heap over-read leading to a crash.

Binary updates for the amd64, i386, and arm64 platforms are available via
the syspatch utility. Source code patches can be found on the respective
errata page:

https://www.openbsd.org/errata67.html
https://www.openbsd.org/errata68.html

[USN-4760-1] libzstd vulnerabilities

==========================================================================
Ubuntu Security Notice USN-4760-1
March 08, 2021

libzstd vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS

Summary:

libzstd could be made to expose sensitive information.

Software Description:
- libzstd: fast lossless compression algorithm

Details:

It was discovered that libzstd incorrectly handled file permissions. A
local attacker could possibly use this issue to access certain files,
contrary to expectations.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
libzstd1 1.4.5+dfsg-4ubuntu0.1
zstd 1.4.5+dfsg-4ubuntu0.1

Ubuntu 20.04 LTS:
libzstd1 1.4.4+dfsg-3ubuntu0.1
zstd 1.4.4+dfsg-3ubuntu0.1

Ubuntu 18.04 LTS:
libzstd1 1.3.3+dfsg-2ubuntu1.2
zstd 1.3.3+dfsg-2ubuntu1.2

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-4760-1
CVE-2021-24031, CVE-2021-24032

Package Information:
https://launchpad.net/ubuntu/+source/libzstd/1.4.5+dfsg-4ubuntu0.1
https://launchpad.net/ubuntu/+source/libzstd/1.4.4+dfsg-3ubuntu0.1
https://launchpad.net/ubuntu/+source/libzstd/1.3.3+dfsg-2ubuntu1.2

[USN-4759-1] GLib vulnerabilities

==========================================================================
Ubuntu Security Notice USN-4759-1
March 08, 2021

glib2.0 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in GLib.

Software Description:
- glib2.0: GLib library of C routines

Details:

Krzesimir Nowak discovered that GLib incorrectly handled certain large
buffers. A remote attacker could use this issue to cause applications
linked to GLib to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2021-27218)

Kevin Backhouse discovered that GLib incorrectly handled certain memory
allocations. A remote attacker could use this issue to cause applications
linked to GLib to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2021-27219)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
libglib2.0-0 2.66.1-2ubuntu0.1

Ubuntu 20.04 LTS:
libglib2.0-0 2.64.6-1~ubuntu20.04.2

Ubuntu 18.04 LTS:
libglib2.0-0 2.56.4-0ubuntu0.18.04.7

Ubuntu 16.04 LTS:
libglib2.0-0 2.48.2-0ubuntu4.7

After a standard system update you need to restart your session to make all
the necessary changes.

References:
https://ubuntu.com/security/notices/USN-4759-1
CVE-2021-27218, CVE-2021-27219

Package Information:
https://launchpad.net/ubuntu/+source/glib2.0/2.66.1-2ubuntu0.1
https://launchpad.net/ubuntu/+source/glib2.0/2.64.6-1~ubuntu20.04.2
https://launchpad.net/ubuntu/+source/glib2.0/2.56.4-0ubuntu0.18.04.7
https://launchpad.net/ubuntu/+source/glib2.0/2.48.2-0ubuntu4.7

[USN-4733-2] GNOME Autoar regression

==========================================================================
Ubuntu Security Notice USN-4733-2
March 08, 2021

gnome-autoar regression
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS

Summary:

USN-4733-1 introduced a regression in GNOME Autoar.

Software Description:
- gnome-autoar: Archive integration support for GNOME

Details:

USN-4733-1 fixed a vulnerability in GNOME Autoar. The upstream fix
introduced a regression when extracting archives containing directories.
This update fixes the problem.

Original advisory details:

Yiğit Can Yılmaz discovered that GNOME Autoar could extract files outside
of the intended directory. If a user were tricked into extracting a
specially crafted archive, a remote attacker could create files in
arbitrary locations, possibly leading to code execution.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
libgnome-autoar-0-0 0.2.4-2ubuntu0.2
libgnome-autoar-gtk-0-0 0.2.4-2ubuntu0.2

Ubuntu 20.04 LTS:
libgnome-autoar-0-0 0.2.3-2ubuntu0.2
libgnome-autoar-gtk-0-0 0.2.3-2ubuntu0.2

Ubuntu 18.04 LTS:
libgnome-autoar-0-0 0.2.3-1ubuntu0.2
libgnome-autoar-gtk-0-0 0.2.3-1ubuntu0.2

After a standard system update you need to restart your session to make
all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-4733-2
https://ubuntu.com/security/notices/USN-4733-1
https://launchpad.net/bugs/1917812

Package Information:
https://launchpad.net/ubuntu/+source/gnome-autoar/0.2.4-2ubuntu0.2
https://launchpad.net/ubuntu/+source/gnome-autoar/0.2.3-2ubuntu0.2
https://launchpad.net/ubuntu/+source/gnome-autoar/0.2.3-1ubuntu0.2