-----BEGIN PGP PUBLIC KEY BLOCK-----
xsFNBGT1vF8BEAC2w6Af0VgaEvUzWv6T0qj98y+DqoSm76w3SdXg1rTgR/pX3a9c
tlfnoCZcyeSf+ttUnkha9vyzFfhz0u5IFDehqadQyfBCxemeEA+b1KBhSMGpiuRd
KMwOggQObp7oGdjImQRDT2CfQOWg1KsVk2o4lIuYZNcg8BWSyVlKxXEJ+hKmeDmO
P53rzY7l/gSHaeJ2bpYY5dCw0OLVLb/3QdrPthvYg4zvGzgvVwEKGsocADboqFYk
GuffEuYe1DYOCXbAx6Q59ZP/V7IlIFE9kiUpOAAAf6r/qkVBm3Zj4DtTuTMipsdJ
A6cQvvuMx9Qm37u7fOhosdNczZ2Zt38bLu9Gz2oL9mG0YBCe8Qfgf+pXLc6BKOLB
dwymVtV43cz7vlDOhRojWpsVxggV1FecjJ+cdP4FWAusE11ST60pY/W+y61MLzfs
qy3O3MIoQjXBaEGGTtPiEpVeZL+1v8aJuB5sJLAj56OmgSpcc7NqBHwUgjoeMA4y
87utHUSr4II/Ay1H4xOEZoCE+vIC61G32TwTco3WMhtISSOnRZHsc6GRuBeVr5fq
xEvmmo8lG+u5IgDpakbC/OpDxzemCiYJWCiUgF7X7VnlLLBVyxUMv9P1edursuk1
E2W5sl7RYIiPos23YU/Q66rER/egPX6YmsAr38FcqGYh9ZOauSfmKQ0pDwARAQAB
zVVEYXZpZCBGZXJuYW5kZXogR29uemFsZXogKFNpZ24gKyBlbmNyeXB0IGtleSkg
PGRhdmlkLmZlcm5hbmRlemdvbnphbGV6QGNhbm9uaWNhbC5jb20+wsGUBBMBCgA+
FiEELi4vmPVwZWdpuqdqlvdwxzm8Ws4FAmT1vF8CGwMFCQICKQAFCwkIBwIGFQoJ
CAsCBBYCAwECHgECF4AACgkQlvdwxzm8Ws5bUBAAkWPMosnc2/qqCyLSxkO5ACoT
p527SNCSJU0oQqHghxa7dLQr4NrjMsiNIR3GzVl+IeOR3BvIIwGl3VwQ110dAegX
kQ7jSq6k5bMT9UWJ5O6ju47cxQ1QzYwp5xD1rel8CPouvHHoqIGF0IWB74/BDPRK
7HPsip0P/mQFDaqm/lfxJXE9ZX/nsrqfzQpPMMyChXQbkMYr3Nw5j5AiOwHIZX2c
NksAiziNhzqjK5zPRYLIAwMuFgSyAOoBQamclRbPSNEV5A4D+jOflFy4II636ZEh
gs8+e8ggMb4tCofgolHLOzgzOReClVed6jegQI3rU/YFiyA8oC5pEnTk3qnc6Uzd
Fsrmh8nj2sSElcIf6HL2AITyzbja6MHSbNa5yoVqePQNZySYn+odOHA5TETR8U1p
KGs5oNQvMvWIW+o8t8m+di/a3vwzl9M4HnwCAM513qnv5Bqt/qucedCSFNQvf0Xs
f+2YxWckYC6w0QjJyvR22zYrhd4K87rr6HTu+qeonnivU1ePSc6SMEbvHS8uWgh0
nN+qCxkh4UzqBL2qnkRxB3VGF1peLGPjefmIkGt236B9/xkEcSOD7ZHz9xa00jQx
3tDLTHnelsLvk8gnIaBku0cnMtCo5DUyOH04pKif7uhbPLkNbEy4zyD9ga2hoX5R
gkeELpyDEi6bhMs66z/OwU0EZPW8XwEQAM/loHx2tM4KYXFBrQmsaFlOHFHTrj80
hMWDM4KEXo9+ufaXZnoJFAjo4Dmh+MT4Xcfs1ooowoWlik6nDQ6DwYtk237YwK/f
s4H/SbZ/p3uwdN+vCcXcQm5lUf927iVALCE9jJBwZrfr5EA808elZZzQSCT05lMm
lnHICso+l1qjysReXb6mzFqGGvgRtU9HnvkFKW8dx4W/++VVSJP7tf2aKVcpyWj4
GrS8I+4S6RYDMlUGNky1/fZWZsuJPv0Prv6NqhS/8QbwpI3b0RwK//ZF7ur8KIHE
+fiA8weqxHGQG0pAOZNgCjc5YF9sz4ooMZMhQHKVRknNVcGng6HORaZJkKtZKRHd
kCDo0DrQLiKmlKo8DkZozv9YFVxyoYESAfcxLhnKiaRT/RE6QLt85VUItPl8lEQh
1erCt74VG5UoIW+sE5Lz/xAjwPMK5XUwIZJJHEp/RVRqMzyxoqM0vIexS+CfFn0X
0Ayew3oEL4oguF4NJRb609I25tKFQU/b+AiTvA2DkiZ1hH5yk6kgg4VS21czCDJB
5UoZ8FgGdSP/PN8DQZ50X0A1x2VO83Pje5FhlEUKVs2eKbb48989RNCcYNwHy2lY
Ch3o4HzfS+Zhf2lgljoNJrj/rsSGanMFCmLcLZqQWaNN3I3suuDBr8IZJJiKP/SE
OyoV3lWFnQGhABEBAAHCwXwEGAEKACYWIQQuLi+Y9XBlZ2m6p2qW93DHObxazgUC
ZPW8XwIbDAUJAgIpAAAKCRCW93DHObxazqt5D/938SB3G2m5LzR5aYgBpn3C5arg
O3QO0JHsmzXXzCRZ0f8hPVZPNiuii3UwTX4v4eDcgi8MZnaEmxG0vQosal28Yd6f
jJdwNUv74K68N7xB5kAlwC/jONbAeSmod3EwUq8vKINseV/IzBux/uX3CBwvDpGi
a6v/h0EzuF5HQjguvu7/JSuVxP6y0aJ4gECmOJQMtppSlFBXzD5U6E2X6v6zHvqY
tkgwn00Y9J+V60+vncxAGfSJtcLOceAY2rEmj1bl8rhRCTcacImyh0HKfIST+v9o
Jx+opSyHo1RjhwcbmSoc3U5CGZx+y05H/WceQgett5qOZAGUDZhprTt+j/+scrAR
zZf0zzlpkao8UoergBMYc8iTmJ54/iQSxrk1WjS7OecP45oV7fwBNkQZeZuPITnD
0VP/RPpjd4Qz6eDWaccZPCrS785I0Onylygn5aOktDPU3eOmEhrHMuG+JSjfVqbi
m7jVqPFjWg3Loprmpwa1CGd2039Pa/jWfwh0bxsosSdf09kVj+UvlH4Y85Ve57LU
q9U+cpekCs/VZdL277tiMA2uFvQDSepwmQdBUYxkJSffVfK/cJhzZdY0FjsiVySl
kLVKxp9HzWMCMKaIqdXE+4STZz8/FAE8e3yuEbsXs/pmEtR0MZa8pBwmOvN5CSvG
u/zTgENjjv+UNmNeRA==
=IEGB
-----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE4I1aChuaH07AdH+adlTpHiRAJW0FAmXd2FEACgkQdlTpHiRA
JW2Dxg//UsWFYz7nbDsabxJ1dz4MhAm97QHX+KM5vgHN/bMG8cEiTqw9kbqbi4kD
CXlDZj1dEJzpn6K2iKi37nEiCGmaRtUFLHarn1kaVjpURTZodBDiMX8QGdYNZeuf
io4hhDbwKHk+4YQZ/cyHCDrMuOIpmdMQKsiPe6pmuW0IvecXz9vkETsPIBUTC5dj
uxQcgxfkZRuE4ApHlq3+CQBzodHNryN+oj+94YqD8Z2+iZqq74SSnhPT21UTqQqy
/RR3/p7PmBAFRu141Y4lf8rWxUIkZAS49BMLcDdR+RwO7U427oby+dA0mj3GyZBh
9zskJ9pqruvHcQEHZGuQI3Q3RoRKV2mslpIDqIqySkrj4VsTKpo9vQ8rgdaoWDTC
IWIomM8a7Wjl+Y7gdNiw6eU9F4hAiKqfkpyEzh0yETiUWxiOFGhI8yDWnNx4tJHm
jlAu9zC6VsM+eYegHDVmzv4/7pw1DECGMVEkJ/Tk+R1Tf2/XU9h9HyyeEz7HPH1p
TU5mC+T+AnR56kMp0XP7GVAibGdqInXg7aOeazdNEVhOVBTfYZd/VOtyFwGSwRKY
9TElk6/0A0KAxpTWTS+fkv9nmWSX6q3KJebPbBv3swq3iYILHZHsAyEQ8cwtHjMj
WWV0xw9eZ4iKCwRA0aVFYGTcuO3D4cJpdCaq5jz/epHgRri7wro=
=CjRN
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6663-1
February 27, 2024
openssl update
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
Summary:
Add implicit rejection in PKCS#1 v1.5 in OpenSSL.
Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools
Details:
As a security improvement, this update prevents OpenSSL
from returning an error when detecting wrong padding
in PKCS#1 v1.5 RSA, to prevent its use in possible
Bleichenbacher timing attacks.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
libssl-doc 3.0.10-1ubuntu2.3
libssl3 3.0.10-1ubuntu2.3
openssl 3.0.10-1ubuntu2.3
Ubuntu 22.04 LTS:
libssl-doc 3.0.2-0ubuntu1.15
libssl3 3.0.2-0ubuntu1.15
openssl 3.0.2-0ubuntu1.15
Ubuntu 20.04 LTS:
libssl-doc 1.1.1f-1ubuntu2.22
libssl1.1 1.1.1f-1ubuntu2.22
openssl 1.1.1f-1ubuntu2.22
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libssl-doc 1.1.1-1ubuntu2.1~18.04.23+esm5
libssl1.1 1.1.1-1ubuntu2.1~18.04.23+esm5
openssl 1.1.1-1ubuntu2.1~18.04.23+esm5
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6663-1
https://launchpad.net/bugs/2054090
Package Information:
https://launchpad.net/ubuntu/+source/openssl/3.0.10-1ubuntu2.3
https://launchpad.net/ubuntu/+source/openssl/3.0.2-0ubuntu1.15
https://launchpad.net/ubuntu/+source/openssl/1.1.1f-1ubuntu2.22
Tuesday, February 27, 2024
[USN-6305-2] PHP vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6305-2
February 27, 2024
php7.0, php7.2, php7.4 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in PHP.
Software Description:
- php7.4: HTML-embedded scripting language interpreter
- php7.2: HTML-embedded scripting language interpreter
- php7.0: HTML-embedded scripting language interpreter
Details:
USN-6305-1 fixed several vulnerabilities in PHP. This update provides
the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that PHP incorrectly handled certain XML files.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2023-3823)
It was discovered that PHP incorrectly handled certain PHAR files.
An attacker could possibly use this issue to cause a crash,
expose sensitive information or execute arbitrary code.
(CVE-2023-3824)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
libapache2-mod-php7.4 7.4.3-4ubuntu2.20
php7.4 7.4.3-4ubuntu2.20
php7.4-cgi 7.4.3-4ubuntu2.20
php7.4-cli 7.4.3-4ubuntu2.20
php7.4-fpm 7.4.3-4ubuntu2.20
php7.4-xml 7.4.3-4ubuntu2.20
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libapache2-mod-php7.2 7.2.24-0ubuntu0.18.04.17+esm2
php7.2 7.2.24-0ubuntu0.18.04.17+esm2
php7.2-cgi 7.2.24-0ubuntu0.18.04.17+esm2
php7.2-cli 7.2.24-0ubuntu0.18.04.17+esm2
php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm2
php7.2-xml 7.2.24-0ubuntu0.18.04.17+esm2
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libapache2-mod-php7.0 7.0.33-0ubuntu0.16.04.16+esm8
php7.0 7.0.33-0ubuntu0.16.04.16+esm8
php7.0-cgi 7.0.33-0ubuntu0.16.04.16+esm8
php7.0-cli 7.0.33-0ubuntu0.16.04.16+esm8
php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm8
php7.0-xml 7.0.33-0ubuntu0.16.04.16+esm8
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6305-2
https://ubuntu.com/security/notices/USN-6305-1
CVE-2023-3823, CVE-2023-3824
Package Information:
https://launchpad.net/ubuntu/+source/php7.4/7.4.3-4ubuntu2.20
Ubuntu Security Notice USN-6305-2
February 27, 2024
php7.0, php7.2, php7.4 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in PHP.
Software Description:
- php7.4: HTML-embedded scripting language interpreter
- php7.2: HTML-embedded scripting language interpreter
- php7.0: HTML-embedded scripting language interpreter
Details:
USN-6305-1 fixed several vulnerabilities in PHP. This update provides
the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that PHP incorrectly handled certain XML files.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2023-3823)
It was discovered that PHP incorrectly handled certain PHAR files.
An attacker could possibly use this issue to cause a crash,
expose sensitive information or execute arbitrary code.
(CVE-2023-3824)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
libapache2-mod-php7.4 7.4.3-4ubuntu2.20
php7.4 7.4.3-4ubuntu2.20
php7.4-cgi 7.4.3-4ubuntu2.20
php7.4-cli 7.4.3-4ubuntu2.20
php7.4-fpm 7.4.3-4ubuntu2.20
php7.4-xml 7.4.3-4ubuntu2.20
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libapache2-mod-php7.2 7.2.24-0ubuntu0.18.04.17+esm2
php7.2 7.2.24-0ubuntu0.18.04.17+esm2
php7.2-cgi 7.2.24-0ubuntu0.18.04.17+esm2
php7.2-cli 7.2.24-0ubuntu0.18.04.17+esm2
php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm2
php7.2-xml 7.2.24-0ubuntu0.18.04.17+esm2
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libapache2-mod-php7.0 7.0.33-0ubuntu0.16.04.16+esm8
php7.0 7.0.33-0ubuntu0.16.04.16+esm8
php7.0-cgi 7.0.33-0ubuntu0.16.04.16+esm8
php7.0-cli 7.0.33-0ubuntu0.16.04.16+esm8
php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm8
php7.0-xml 7.0.33-0ubuntu0.16.04.16+esm8
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6305-2
https://ubuntu.com/security/notices/USN-6305-1
CVE-2023-3823, CVE-2023-3824
Package Information:
https://launchpad.net/ubuntu/+source/php7.4/7.4.3-4ubuntu2.20
Monday, February 26, 2024
[USN-6662-1] OpenJDK 21 vulnerabilities
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmXdUzgFAwAAAAAACgkQWNrRIKaTkWdR
nRAAg4wfAZNPUGzd+kABf+tUMi5XSflWhBjuZbF7LK/WIcNJlDTqEticaTtJ8jv5RdShK7dia83d
CnlmSK32r3zfctpKOlHBnN5kFq3VhHgO2gciGAgpESLc960M9ophK1MKjI+p9oBXxhdyyeBNvaDU
tuUVurbsBGOaJSf1O4yXn7MEl/PAhgdUYppgkpobgjceaj8PLnzWanV4SwjxMIvkmRcuyc//lSGL
6w3yFMMv0AtFcD4b91vgWE72OdkueKzLLxqB03dW4tPgmE+cXj8dBAnx3tyfoI7+CvKLkQufJ/VN
cl90wOf59w3CDIqrIlsa4PvrPtuISDiUQYGimTr31qkFE7vZyWZPAxFS8XQsaV2Doi7jpvCI3Pii
mSYMnOTmng4bMYawLyQoeAeipsMSJO21RvzSBYAhrDeMkLbY6budfx57Z3aUEDFX2MReUUqm5B7A
Sf52nrzw8LDkYWtngdzki9GafjGm5c7H+2uVGDYhYrdo4wazmYjvIzlVeblwuhICHrVGEitmHf/E
dQgJ9oha3szU70ZpFqBg4na9ooxKQufwYvbtGPSaRgG4c298PggN7Plt4KrfVlN1aqpXVPGMi+8/
PW6wNBJsi0EsXD+5SlHmWEGJKN6HQZZFwguPEcntfmIFbEf3eWm2n8GF8J3X06uAHxXYb8u8oSPp
Y8w=
=nk08
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6662-1
February 27, 2024
openjdk-21 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in OpenJDK 21.
Software Description:
- openjdk-21: Open Source Java implementation
Details:
Yi Yang discovered that the Hotspot component of OpenJDK 21 incorrectly
handled array accesses in the C1 compiler. An attacker could possibly
use this issue to cause a denial of service, execute arbitrary code or
bypass Java sandbox restrictions. (CVE-2024-20918)
It was discovered that the Hotspot component of OpenJDK 21 did not
properly verify bytecode in certain situations. An attacker could
possibly use this issue to bypass Java sandbox restrictions.
(CVE-2024-20919)
It was discovered that the Hotspot component of OpenJDK 21 had an
optimization flaw when generating range check loop predicates. An attacker
could possibly use this issue to cause a denial of service, execute
arbitrary code or bypass Java sandbox restrictions. (CVE-2024-20921)
It was discovered that OpenJDK 21 could produce debug logs that contained
private keys used for digital signatures. An attacker could possibly use
this issue to obtain sensitive information. (CVE-2024-20945)
Hubert Kario discovered that the TLS implementation in OpenJDK 21 had a
timing side-channel and incorrectly handled RSA padding. A remote attacker
could possibly use this issue to recover sensitive information.
(CVE-2024-20952)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
openjdk-21-jdk 21.0.2+13-1~23.10.1
openjdk-21-jdk-headless 21.0.2+13-1~23.10.1
openjdk-21-jre 21.0.2+13-1~23.10.1
openjdk-21-jre-headless 21.0.2+13-1~23.10.1
openjdk-21-jre-zero 21.0.2+13-1~23.10.1
Ubuntu 22.04 LTS:
openjdk-21-jdk 21.0.2+13-1~22.04.1
openjdk-21-jdk-headless 21.0.2+13-1~22.04.1
openjdk-21-jre 21.0.2+13-1~22.04.1
openjdk-21-jre-headless 21.0.2+13-1~22.04.1
openjdk-21-jre-zero 21.0.2+13-1~22.04.1
Ubuntu 20.04 LTS:
openjdk-21-jdk 21.0.2+13-1~20.04.1
openjdk-21-jdk-headless 21.0.2+13-1~20.04.1
openjdk-21-jre 21.0.2+13-1~20.04.1
openjdk-21-jre-headless 21.0.2+13-1~20.04.1
openjdk-21-jre-zero 21.0.2+13-1~20.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6662-1
CVE-2024-20918, CVE-2024-20919, CVE-2024-20921, CVE-2024-20945,
CVE-2024-20952
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-21/21.0.2+13-1~23.10.1
https://launchpad.net/ubuntu/+source/openjdk-21/21.0.2+13-1~22.04.1
https://launchpad.net/ubuntu/+source/openjdk-21/21.0.2+13-1~20.04.1
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmXdUzgFAwAAAAAACgkQWNrRIKaTkWdR
nRAAg4wfAZNPUGzd+kABf+tUMi5XSflWhBjuZbF7LK/WIcNJlDTqEticaTtJ8jv5RdShK7dia83d
CnlmSK32r3zfctpKOlHBnN5kFq3VhHgO2gciGAgpESLc960M9ophK1MKjI+p9oBXxhdyyeBNvaDU
tuUVurbsBGOaJSf1O4yXn7MEl/PAhgdUYppgkpobgjceaj8PLnzWanV4SwjxMIvkmRcuyc//lSGL
6w3yFMMv0AtFcD4b91vgWE72OdkueKzLLxqB03dW4tPgmE+cXj8dBAnx3tyfoI7+CvKLkQufJ/VN
cl90wOf59w3CDIqrIlsa4PvrPtuISDiUQYGimTr31qkFE7vZyWZPAxFS8XQsaV2Doi7jpvCI3Pii
mSYMnOTmng4bMYawLyQoeAeipsMSJO21RvzSBYAhrDeMkLbY6budfx57Z3aUEDFX2MReUUqm5B7A
Sf52nrzw8LDkYWtngdzki9GafjGm5c7H+2uVGDYhYrdo4wazmYjvIzlVeblwuhICHrVGEitmHf/E
dQgJ9oha3szU70ZpFqBg4na9ooxKQufwYvbtGPSaRgG4c298PggN7Plt4KrfVlN1aqpXVPGMi+8/
PW6wNBJsi0EsXD+5SlHmWEGJKN6HQZZFwguPEcntfmIFbEf3eWm2n8GF8J3X06uAHxXYb8u8oSPp
Y8w=
=nk08
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6662-1
February 27, 2024
openjdk-21 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in OpenJDK 21.
Software Description:
- openjdk-21: Open Source Java implementation
Details:
Yi Yang discovered that the Hotspot component of OpenJDK 21 incorrectly
handled array accesses in the C1 compiler. An attacker could possibly
use this issue to cause a denial of service, execute arbitrary code or
bypass Java sandbox restrictions. (CVE-2024-20918)
It was discovered that the Hotspot component of OpenJDK 21 did not
properly verify bytecode in certain situations. An attacker could
possibly use this issue to bypass Java sandbox restrictions.
(CVE-2024-20919)
It was discovered that the Hotspot component of OpenJDK 21 had an
optimization flaw when generating range check loop predicates. An attacker
could possibly use this issue to cause a denial of service, execute
arbitrary code or bypass Java sandbox restrictions. (CVE-2024-20921)
It was discovered that OpenJDK 21 could produce debug logs that contained
private keys used for digital signatures. An attacker could possibly use
this issue to obtain sensitive information. (CVE-2024-20945)
Hubert Kario discovered that the TLS implementation in OpenJDK 21 had a
timing side-channel and incorrectly handled RSA padding. A remote attacker
could possibly use this issue to recover sensitive information.
(CVE-2024-20952)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
openjdk-21-jdk 21.0.2+13-1~23.10.1
openjdk-21-jdk-headless 21.0.2+13-1~23.10.1
openjdk-21-jre 21.0.2+13-1~23.10.1
openjdk-21-jre-headless 21.0.2+13-1~23.10.1
openjdk-21-jre-zero 21.0.2+13-1~23.10.1
Ubuntu 22.04 LTS:
openjdk-21-jdk 21.0.2+13-1~22.04.1
openjdk-21-jdk-headless 21.0.2+13-1~22.04.1
openjdk-21-jre 21.0.2+13-1~22.04.1
openjdk-21-jre-headless 21.0.2+13-1~22.04.1
openjdk-21-jre-zero 21.0.2+13-1~22.04.1
Ubuntu 20.04 LTS:
openjdk-21-jdk 21.0.2+13-1~20.04.1
openjdk-21-jdk-headless 21.0.2+13-1~20.04.1
openjdk-21-jre 21.0.2+13-1~20.04.1
openjdk-21-jre-headless 21.0.2+13-1~20.04.1
openjdk-21-jre-zero 21.0.2+13-1~20.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6662-1
CVE-2024-20918, CVE-2024-20919, CVE-2024-20921, CVE-2024-20945,
CVE-2024-20952
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-21/21.0.2+13-1~23.10.1
https://launchpad.net/ubuntu/+source/openjdk-21/21.0.2+13-1~22.04.1
https://launchpad.net/ubuntu/+source/openjdk-21/21.0.2+13-1~20.04.1
[USN-6661-1] OpenJDK 17 vulnerabilities
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmXdUvYFAwAAAAAACgkQWNrRIKaTkWeI
Ng//bFV85JssXtt4XsCRXEv/JzwqMTy5GqMwIBEEVGSUILVE0Y6S+r7lf/z9dSeoAgtKEyXx/yqq
vRNWfGnBZvN0tfud7B9y/hn4fBHTMWdy8XAWXzRhOo3NjAfqHmlL+U9yREw27Wd+9FyKAs5Dp/rE
2Mqp9YY0vXWt6ykPbjlkwmQLYAu7X0pMzB34qab+MgbZJcVKrrMRnYuzkxBwYQQlat9NWQkD5oQJ
e6+SF5PbfwqoGcfeJwZes/kONvFMGKD9ueKHkR7oP8ezmvJ2rMJhtKT5EDJNdns9KvSyEDDIgtiZ
bnhEJjcbGTw1GzG53o/I/AVPNuSbF2EfTo+OdLAsduGirra7glLg77d/Z8ZbJetvaDp4C89SzHO/
eS9l1YKCHEAzycWeh98bnpMgBy3uXDrwiQT2eh0L+IFs8JI9Ibj2zGNqdBm8+jQL4nb414Nvm4Z1
7VOEGPrTEoNTVGBNQj6kqqOJWKlWzd+WNrJvqab16nqKa1hn+wHwqC1e25r+GlTLwcaGX+ctDBzk
9sz+F16at+mJd/KEz4JgZMAOBkq/TagdK96WtNAYlPl1ldiSijYQMZRfs467X2oSdvuMMJJtztrl
YL40k1mTG3JmFILe/MRT424Mfk2Cb3SM+66So5phZdrvTEka/C069s78yUMfw/T//0+JXQirVTNA
XLI=
=ZEzw
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6661-1
February 27, 2024
openjdk-17 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in OpenJDK 17.
Software Description:
- openjdk-17: Open Source Java implementation
Details:
Yi Yang discovered that the Hotspot component of OpenJDK 17 incorrectly
handled array accesses in the C1 compiler. An attacker could possibly
use this issue to cause a denial of service, execute arbitrary code or
bypass Java sandbox restrictions. (CVE-2024-20918)
It was discovered that the Hotspot component of OpenJDK 17 did not
properly verify bytecode in certain situations. An attacker could
possibly use this issue to bypass Java sandbox restrictions.
(CVE-2024-20919)
It was discovered that the Hotspot component of OpenJDK 17 had an
optimization flaw when generating range check loop predicates. An attacker
could possibly use this issue to cause a denial of service, execute
arbitrary code or bypass Java sandbox restrictions. (CVE-2024-20921)
Yakov Shafranovich discovered that OpenJDK 17 incorrectly handled ZIP
archives that have file and directory entries with the same name. An
attacker could possibly use this issue to bypass Java sandbox
restrictions. (CVE-2024-20932)
It was discovered that OpenJDK 17 could produce debug logs that contained
private keys used for digital signatures. An attacker could possibly use
this issue to obtain sensitive information. (CVE-2024-20945)
Hubert Kario discovered that the TLS implementation in OpenJDK 17 had a
timing side-channel and incorrectly handled RSA padding. A remote attacker
could possibly use this issue to recover sensitive information.
(CVE-2024-20952)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
openjdk-17-jdk 17.0.10+7-1~23.10.1
openjdk-17-jdk-headless 17.0.10+7-1~23.10.1
openjdk-17-jre 17.0.10+7-1~23.10.1
openjdk-17-jre-headless 17.0.10+7-1~23.10.1
openjdk-17-jre-zero 17.0.10+7-1~23.10.1
Ubuntu 22.04 LTS:
openjdk-17-jdk 17.0.10+7-1~22.04.1
openjdk-17-jdk-headless 17.0.10+7-1~22.04.1
openjdk-17-jre 17.0.10+7-1~22.04.1
openjdk-17-jre-headless 17.0.10+7-1~22.04.1
openjdk-17-jre-zero 17.0.10+7-1~22.04.1
Ubuntu 20.04 LTS:
openjdk-17-jdk 17.0.10+7-1~20.04.1
openjdk-17-jdk-headless 17.0.10+7-1~20.04.1
openjdk-17-jre 17.0.10+7-1~20.04.1
openjdk-17-jre-headless 17.0.10+7-1~20.04.1
openjdk-17-jre-zero 17.0.10+7-1~20.04.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
openjdk-17-jdk 17.0.10+7-1~18.04.1
openjdk-17-jdk-headless 17.0.10+7-1~18.04.1
openjdk-17-jre 17.0.10+7-1~18.04.1
openjdk-17-jre-headless 17.0.10+7-1~18.04.1
openjdk-17-jre-zero 17.0.10+7-1~18.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6661-1
CVE-2024-20918, CVE-2024-20919, CVE-2024-20921, CVE-2024-20932,
CVE-2024-20945, CVE-2024-20952
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-17/17.0.10+7-1~23.10.1
https://launchpad.net/ubuntu/+source/openjdk-17/17.0.10+7-1~22.04.1
https://launchpad.net/ubuntu/+source/openjdk-17/17.0.10+7-1~20.04.1
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmXdUvYFAwAAAAAACgkQWNrRIKaTkWeI
Ng//bFV85JssXtt4XsCRXEv/JzwqMTy5GqMwIBEEVGSUILVE0Y6S+r7lf/z9dSeoAgtKEyXx/yqq
vRNWfGnBZvN0tfud7B9y/hn4fBHTMWdy8XAWXzRhOo3NjAfqHmlL+U9yREw27Wd+9FyKAs5Dp/rE
2Mqp9YY0vXWt6ykPbjlkwmQLYAu7X0pMzB34qab+MgbZJcVKrrMRnYuzkxBwYQQlat9NWQkD5oQJ
e6+SF5PbfwqoGcfeJwZes/kONvFMGKD9ueKHkR7oP8ezmvJ2rMJhtKT5EDJNdns9KvSyEDDIgtiZ
bnhEJjcbGTw1GzG53o/I/AVPNuSbF2EfTo+OdLAsduGirra7glLg77d/Z8ZbJetvaDp4C89SzHO/
eS9l1YKCHEAzycWeh98bnpMgBy3uXDrwiQT2eh0L+IFs8JI9Ibj2zGNqdBm8+jQL4nb414Nvm4Z1
7VOEGPrTEoNTVGBNQj6kqqOJWKlWzd+WNrJvqab16nqKa1hn+wHwqC1e25r+GlTLwcaGX+ctDBzk
9sz+F16at+mJd/KEz4JgZMAOBkq/TagdK96WtNAYlPl1ldiSijYQMZRfs467X2oSdvuMMJJtztrl
YL40k1mTG3JmFILe/MRT424Mfk2Cb3SM+66So5phZdrvTEka/C069s78yUMfw/T//0+JXQirVTNA
XLI=
=ZEzw
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6661-1
February 27, 2024
openjdk-17 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in OpenJDK 17.
Software Description:
- openjdk-17: Open Source Java implementation
Details:
Yi Yang discovered that the Hotspot component of OpenJDK 17 incorrectly
handled array accesses in the C1 compiler. An attacker could possibly
use this issue to cause a denial of service, execute arbitrary code or
bypass Java sandbox restrictions. (CVE-2024-20918)
It was discovered that the Hotspot component of OpenJDK 17 did not
properly verify bytecode in certain situations. An attacker could
possibly use this issue to bypass Java sandbox restrictions.
(CVE-2024-20919)
It was discovered that the Hotspot component of OpenJDK 17 had an
optimization flaw when generating range check loop predicates. An attacker
could possibly use this issue to cause a denial of service, execute
arbitrary code or bypass Java sandbox restrictions. (CVE-2024-20921)
Yakov Shafranovich discovered that OpenJDK 17 incorrectly handled ZIP
archives that have file and directory entries with the same name. An
attacker could possibly use this issue to bypass Java sandbox
restrictions. (CVE-2024-20932)
It was discovered that OpenJDK 17 could produce debug logs that contained
private keys used for digital signatures. An attacker could possibly use
this issue to obtain sensitive information. (CVE-2024-20945)
Hubert Kario discovered that the TLS implementation in OpenJDK 17 had a
timing side-channel and incorrectly handled RSA padding. A remote attacker
could possibly use this issue to recover sensitive information.
(CVE-2024-20952)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
openjdk-17-jdk 17.0.10+7-1~23.10.1
openjdk-17-jdk-headless 17.0.10+7-1~23.10.1
openjdk-17-jre 17.0.10+7-1~23.10.1
openjdk-17-jre-headless 17.0.10+7-1~23.10.1
openjdk-17-jre-zero 17.0.10+7-1~23.10.1
Ubuntu 22.04 LTS:
openjdk-17-jdk 17.0.10+7-1~22.04.1
openjdk-17-jdk-headless 17.0.10+7-1~22.04.1
openjdk-17-jre 17.0.10+7-1~22.04.1
openjdk-17-jre-headless 17.0.10+7-1~22.04.1
openjdk-17-jre-zero 17.0.10+7-1~22.04.1
Ubuntu 20.04 LTS:
openjdk-17-jdk 17.0.10+7-1~20.04.1
openjdk-17-jdk-headless 17.0.10+7-1~20.04.1
openjdk-17-jre 17.0.10+7-1~20.04.1
openjdk-17-jre-headless 17.0.10+7-1~20.04.1
openjdk-17-jre-zero 17.0.10+7-1~20.04.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
openjdk-17-jdk 17.0.10+7-1~18.04.1
openjdk-17-jdk-headless 17.0.10+7-1~18.04.1
openjdk-17-jre 17.0.10+7-1~18.04.1
openjdk-17-jre-headless 17.0.10+7-1~18.04.1
openjdk-17-jre-zero 17.0.10+7-1~18.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6661-1
CVE-2024-20918, CVE-2024-20919, CVE-2024-20921, CVE-2024-20932,
CVE-2024-20945, CVE-2024-20952
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-17/17.0.10+7-1~23.10.1
https://launchpad.net/ubuntu/+source/openjdk-17/17.0.10+7-1~22.04.1
https://launchpad.net/ubuntu/+source/openjdk-17/17.0.10+7-1~20.04.1
[USN-6660-1] OpenJDK 11 vulnerabilities
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmXdUqcFAwAAAAAACgkQWNrRIKaTkWeO
kBAAlw9hhJPdH9vIdzRo/V056Ykdg9pCx/wQTMflWP56Z1r6GyNfhdEsQJmtAWH/PaeB/6g8HLI/
AoRNXtrVAfg1oNBXbGNLJ1y4LGafq/Jg3KYYep88Qu/XFlfr4BlUAFTC2yxSU2KL7YPKVk0Bmv7x
vc4+fosqzDmAJLu483B3W3N3sj9h/Tx4e9xsEnnq3j3FLRAZwjA3sSg99b0pgR2tC+aA9A6y4ASd
HZMKd8G59IStepBrtoB2Zgn9WIm/FsEsSwZuEXm01yjpQwzmA3MjmCL7IGYkP8p98efnQnt6aZx0
mU5/hPjtebAOe9HPkGCcl13RWryuDxtdZyjr0mpvQDlC1KI50BrGNkZwludJq1cWNUwKNcOyyN3F
hy8vfLhpjhZaDU2u+89pYmWH9uDkJMwWwW+ekqhUnwR58KqIEp7D4Ul/j9W9zohGkSWnIh+MSqAf
XaI+xJ/RQIlCDF3ZeH/GhVQEF73cUiFXA4K8oirt6nTTVBljW6zjgnEVnOrEfThGidUZ1jz+fgdq
bM0S3XXBEWc3kPmDMV/UsfBYS9Vb+l39OEdv9FHp/iuwsycoBe0gDZ+0GZcrH8ba/wXq2YOvD4lg
4LD4150p7mrRCN37SdrF9vH2HwlfXGbA2ELgh4TqrN4Zs/qqfoxz8NDICfvaFXO37nsU9BBFqnvL
Er0=
=YVVY
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6660-1
February 27, 2024
openjdk-lts vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in OpenJDK 11.
Software Description:
- openjdk-lts: Open Source Java implementation
Details:
Yi Yang discovered that the Hotspot component of OpenJDK 11 incorrectly
handled array accesses in the C1 compiler. An attacker could possibly
use this issue to cause a denial of service, execute arbitrary code or
bypass Java sandbox restrictions. (CVE-2024-20918)
It was discovered that the Hotspot component of OpenJDK 11 did not
properly verify bytecode in certain situations. An attacker could
possibly use this issue to bypass Java sandbox restrictions.
(CVE-2024-20919)
It was discovered that the Hotspot component of OpenJDK 11 had an
optimization flaw when generating range check loop predicates. An attacker
could possibly use this issue to cause a denial of service, execute
arbitrary code or bypass Java sandbox restrictions. (CVE-2024-20921)
Valentin Eudeline discovered that OpenJDK 11 incorrectly handled certain
options in the Nashorn JavaScript subcomponent. An attacker could
possibly use this issue to execute arbitrary code. (CVE-2024-20926)
It was discovered that OpenJDK 11 could produce debug logs that contained
private keys used for digital signatures. An attacker could possibly use
this issue to obtain sensitive information. (CVE-2024-20945)
Hubert Kario discovered that the TLS implementation in OpenJDK 11 had a
timing side-channel and incorrectly handled RSA padding. A remote attacker
could possibly use this issue to recover sensitive information.
(CVE-2024-20952)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
openjdk-11-jdk 11.0.22+7-0ubuntu2~23.10.1
openjdk-11-jdk-headless 11.0.22+7-0ubuntu2~23.10.1
openjdk-11-jre 11.0.22+7-0ubuntu2~23.10.1
openjdk-11-jre-headless 11.0.22+7-0ubuntu2~23.10.1
openjdk-11-jre-zero 11.0.22+7-0ubuntu2~23.10.1
Ubuntu 22.04 LTS:
openjdk-11-jdk 11.0.22+7-0ubuntu2~22.04.1
openjdk-11-jdk-headless 11.0.22+7-0ubuntu2~22.04.1
openjdk-11-jre 11.0.22+7-0ubuntu2~22.04.1
openjdk-11-jre-headless 11.0.22+7-0ubuntu2~22.04.1
openjdk-11-jre-zero 11.0.22+7-0ubuntu2~22.04.1
Ubuntu 20.04 LTS:
openjdk-11-jdk 11.0.22+7-0ubuntu2~20.04.1
openjdk-11-jdk-headless 11.0.22+7-0ubuntu2~20.04.1
openjdk-11-jre 11.0.22+7-0ubuntu2~20.04.1
openjdk-11-jre-headless 11.0.22+7-0ubuntu2~20.04.1
openjdk-11-jre-zero 11.0.22+7-0ubuntu2~20.04.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
openjdk-11-jdk 11.0.22+7-0ubuntu2~18.04.1
openjdk-11-jdk-headless 11.0.22+7-0ubuntu2~18.04.1
openjdk-11-jre 11.0.22+7-0ubuntu2~18.04.1
openjdk-11-jre-headless 11.0.22+7-0ubuntu2~18.04.1
openjdk-11-jre-zero 11.0.22+7-0ubuntu2~18.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6660-1
CVE-2024-20918, CVE-2024-20919, CVE-2024-20921, CVE-2024-20926,
CVE-2024-20945, CVE-2024-20952
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.22+7-0ubuntu2~23.10.1
https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.22+7-0ubuntu2~22.04.1
https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.22+7-0ubuntu2~20.04.1
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmXdUqcFAwAAAAAACgkQWNrRIKaTkWeO
kBAAlw9hhJPdH9vIdzRo/V056Ykdg9pCx/wQTMflWP56Z1r6GyNfhdEsQJmtAWH/PaeB/6g8HLI/
AoRNXtrVAfg1oNBXbGNLJ1y4LGafq/Jg3KYYep88Qu/XFlfr4BlUAFTC2yxSU2KL7YPKVk0Bmv7x
vc4+fosqzDmAJLu483B3W3N3sj9h/Tx4e9xsEnnq3j3FLRAZwjA3sSg99b0pgR2tC+aA9A6y4ASd
HZMKd8G59IStepBrtoB2Zgn9WIm/FsEsSwZuEXm01yjpQwzmA3MjmCL7IGYkP8p98efnQnt6aZx0
mU5/hPjtebAOe9HPkGCcl13RWryuDxtdZyjr0mpvQDlC1KI50BrGNkZwludJq1cWNUwKNcOyyN3F
hy8vfLhpjhZaDU2u+89pYmWH9uDkJMwWwW+ekqhUnwR58KqIEp7D4Ul/j9W9zohGkSWnIh+MSqAf
XaI+xJ/RQIlCDF3ZeH/GhVQEF73cUiFXA4K8oirt6nTTVBljW6zjgnEVnOrEfThGidUZ1jz+fgdq
bM0S3XXBEWc3kPmDMV/UsfBYS9Vb+l39OEdv9FHp/iuwsycoBe0gDZ+0GZcrH8ba/wXq2YOvD4lg
4LD4150p7mrRCN37SdrF9vH2HwlfXGbA2ELgh4TqrN4Zs/qqfoxz8NDICfvaFXO37nsU9BBFqnvL
Er0=
=YVVY
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6660-1
February 27, 2024
openjdk-lts vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in OpenJDK 11.
Software Description:
- openjdk-lts: Open Source Java implementation
Details:
Yi Yang discovered that the Hotspot component of OpenJDK 11 incorrectly
handled array accesses in the C1 compiler. An attacker could possibly
use this issue to cause a denial of service, execute arbitrary code or
bypass Java sandbox restrictions. (CVE-2024-20918)
It was discovered that the Hotspot component of OpenJDK 11 did not
properly verify bytecode in certain situations. An attacker could
possibly use this issue to bypass Java sandbox restrictions.
(CVE-2024-20919)
It was discovered that the Hotspot component of OpenJDK 11 had an
optimization flaw when generating range check loop predicates. An attacker
could possibly use this issue to cause a denial of service, execute
arbitrary code or bypass Java sandbox restrictions. (CVE-2024-20921)
Valentin Eudeline discovered that OpenJDK 11 incorrectly handled certain
options in the Nashorn JavaScript subcomponent. An attacker could
possibly use this issue to execute arbitrary code. (CVE-2024-20926)
It was discovered that OpenJDK 11 could produce debug logs that contained
private keys used for digital signatures. An attacker could possibly use
this issue to obtain sensitive information. (CVE-2024-20945)
Hubert Kario discovered that the TLS implementation in OpenJDK 11 had a
timing side-channel and incorrectly handled RSA padding. A remote attacker
could possibly use this issue to recover sensitive information.
(CVE-2024-20952)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
openjdk-11-jdk 11.0.22+7-0ubuntu2~23.10.1
openjdk-11-jdk-headless 11.0.22+7-0ubuntu2~23.10.1
openjdk-11-jre 11.0.22+7-0ubuntu2~23.10.1
openjdk-11-jre-headless 11.0.22+7-0ubuntu2~23.10.1
openjdk-11-jre-zero 11.0.22+7-0ubuntu2~23.10.1
Ubuntu 22.04 LTS:
openjdk-11-jdk 11.0.22+7-0ubuntu2~22.04.1
openjdk-11-jdk-headless 11.0.22+7-0ubuntu2~22.04.1
openjdk-11-jre 11.0.22+7-0ubuntu2~22.04.1
openjdk-11-jre-headless 11.0.22+7-0ubuntu2~22.04.1
openjdk-11-jre-zero 11.0.22+7-0ubuntu2~22.04.1
Ubuntu 20.04 LTS:
openjdk-11-jdk 11.0.22+7-0ubuntu2~20.04.1
openjdk-11-jdk-headless 11.0.22+7-0ubuntu2~20.04.1
openjdk-11-jre 11.0.22+7-0ubuntu2~20.04.1
openjdk-11-jre-headless 11.0.22+7-0ubuntu2~20.04.1
openjdk-11-jre-zero 11.0.22+7-0ubuntu2~20.04.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
openjdk-11-jdk 11.0.22+7-0ubuntu2~18.04.1
openjdk-11-jdk-headless 11.0.22+7-0ubuntu2~18.04.1
openjdk-11-jre 11.0.22+7-0ubuntu2~18.04.1
openjdk-11-jre-headless 11.0.22+7-0ubuntu2~18.04.1
openjdk-11-jre-zero 11.0.22+7-0ubuntu2~18.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any Java
applications to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6660-1
CVE-2024-20918, CVE-2024-20919, CVE-2024-20921, CVE-2024-20926,
CVE-2024-20945, CVE-2024-20952
Package Information:
https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.22+7-0ubuntu2~23.10.1
https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.22+7-0ubuntu2~22.04.1
https://launchpad.net/ubuntu/+source/openjdk-lts/11.0.22+7-0ubuntu2~20.04.1
[USN-6659-1] libde265 vulnerabilities
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEE2WgtvmwmcgaEBLlnCAvK1QvD6SAFAmXc+JcFAwAAAAAACgkQCAvK1QvD6SDY
mRAAqGkzJWTInYZwK03J2H+VEw4iOiXgnJKt+8lqhcGoGMZqtbhiiiFme3IBjbtxOxaBzIc743l6
QNoxNRBP7DjMDyuo0Yw9GAiW+srUrY40SFRAeTi5gkE3FwMYRgmCkHEYMAm+GN+APRN9W/al8e5u
o3sRX16BnRh4e/jUfouaC5i7jD7TNpFwcmJ368kCbB57u3PqJZx9gCb6v4FEl8AxSRd8dtCoIXht
JSlvKsQNqVy9HTDiyCUsioYo4siFmd9OMh2JrP15UArD3vBhCGNI+FpKNFeGzP7Hx8VTi9KkjVJZ
e9on25/auzIjQrAz3dp4k9eXausDSrpLVfBjupSRaVeYRHprsY/GibCNExDTKIcu5xACpWi1aY54
78rtWWQoeSsVIWh76x1WdeucokaMBr/wCqNOgNl8BG1YQp0+O53OvzybZhbwei3Q3woIsfd1Dx7C
GCcSu3mzZThfMZe6G7MYPZvWo0/uJjf4qzf4c8FWgSBPo3i2uRPKrL1JAULryRWm3Pz812ChdiAE
V7xMSeLckX9510F0CMHv45p6SxQbYyHEd1V3OmE8uUH10AvR2lFJH1kOroys6MUajIHilTPsy433
9aHSNoA5Kzns3l66uidyUz06IFD3rF/wZYa07NYkdhRCjjPiPoMLM8z3gGduA5j0xXa4v4V/NThQ
PPE=
=I4SF
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6659-1
February 26, 2024
libde265 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in libde265.
Software Description:
- libde265: Open H.265 video codec implementation
Details:
It was discovered that libde265 could be made to write out of bounds. If a
user or automated system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. (CVE-2022-43244, CVE-2022-43249,
CVE-2022-43250, CVE-2022-47665, CVE-2023-25221)
It was discovered that libde265 could be made to read out of bounds. If a
user or automated system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to cause a denial of
service. (CVE-2022-43245)
It was discovered that libde265 could be made to dereference invalid
memory. If a user or automated system were tricked into opening a specially
crafted file, an attacker could possibly use this issue to cause a denial
of service. (CVE-2023-24751, CVE-2023-24752, CVE-2023-24754,
CVE-2023-24755, CVE-2023-24756, CVE-2023-24757, CVE-2023-24758)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
libde265-0 1.0.8-1ubuntu0.2
Ubuntu 20.04 LTS:
libde265-0 1.0.4-1ubuntu0.3
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libde265-0 1.0.2-2ubuntu0.18.04.1~esm3
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libde265-0 1.0.2-2ubuntu0.16.04.1~esm3
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6659-1
CVE-2022-43244, CVE-2022-43245, CVE-2022-43249, CVE-2022-43250,
CVE-2022-47665, CVE-2023-24751, CVE-2023-24752, CVE-2023-24754,
CVE-2023-24755, CVE-2023-24756, CVE-2023-24757, CVE-2023-24758,
CVE-2023-25221
Package Information:
https://launchpad.net/ubuntu/+source/libde265/1.0.8-1ubuntu0.2
https://launchpad.net/ubuntu/+source/libde265/1.0.4-1ubuntu0.3
wsF5BAABCAAjFiEE2WgtvmwmcgaEBLlnCAvK1QvD6SAFAmXc+JcFAwAAAAAACgkQCAvK1QvD6SDY
mRAAqGkzJWTInYZwK03J2H+VEw4iOiXgnJKt+8lqhcGoGMZqtbhiiiFme3IBjbtxOxaBzIc743l6
QNoxNRBP7DjMDyuo0Yw9GAiW+srUrY40SFRAeTi5gkE3FwMYRgmCkHEYMAm+GN+APRN9W/al8e5u
o3sRX16BnRh4e/jUfouaC5i7jD7TNpFwcmJ368kCbB57u3PqJZx9gCb6v4FEl8AxSRd8dtCoIXht
JSlvKsQNqVy9HTDiyCUsioYo4siFmd9OMh2JrP15UArD3vBhCGNI+FpKNFeGzP7Hx8VTi9KkjVJZ
e9on25/auzIjQrAz3dp4k9eXausDSrpLVfBjupSRaVeYRHprsY/GibCNExDTKIcu5xACpWi1aY54
78rtWWQoeSsVIWh76x1WdeucokaMBr/wCqNOgNl8BG1YQp0+O53OvzybZhbwei3Q3woIsfd1Dx7C
GCcSu3mzZThfMZe6G7MYPZvWo0/uJjf4qzf4c8FWgSBPo3i2uRPKrL1JAULryRWm3Pz812ChdiAE
V7xMSeLckX9510F0CMHv45p6SxQbYyHEd1V3OmE8uUH10AvR2lFJH1kOroys6MUajIHilTPsy433
9aHSNoA5Kzns3l66uidyUz06IFD3rF/wZYa07NYkdhRCjjPiPoMLM8z3gGduA5j0xXa4v4V/NThQ
PPE=
=I4SF
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6659-1
February 26, 2024
libde265 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in libde265.
Software Description:
- libde265: Open H.265 video codec implementation
Details:
It was discovered that libde265 could be made to write out of bounds. If a
user or automated system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. (CVE-2022-43244, CVE-2022-43249,
CVE-2022-43250, CVE-2022-47665, CVE-2023-25221)
It was discovered that libde265 could be made to read out of bounds. If a
user or automated system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to cause a denial of
service. (CVE-2022-43245)
It was discovered that libde265 could be made to dereference invalid
memory. If a user or automated system were tricked into opening a specially
crafted file, an attacker could possibly use this issue to cause a denial
of service. (CVE-2023-24751, CVE-2023-24752, CVE-2023-24754,
CVE-2023-24755, CVE-2023-24756, CVE-2023-24757, CVE-2023-24758)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
libde265-0 1.0.8-1ubuntu0.2
Ubuntu 20.04 LTS:
libde265-0 1.0.4-1ubuntu0.3
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libde265-0 1.0.2-2ubuntu0.18.04.1~esm3
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libde265-0 1.0.2-2ubuntu0.16.04.1~esm3
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6659-1
CVE-2022-43244, CVE-2022-43245, CVE-2022-43249, CVE-2022-43250,
CVE-2022-47665, CVE-2023-24751, CVE-2023-24752, CVE-2023-24754,
CVE-2023-24755, CVE-2023-24756, CVE-2023-24757, CVE-2023-24758,
CVE-2023-25221
Package Information:
https://launchpad.net/ubuntu/+source/libde265/1.0.8-1ubuntu0.2
https://launchpad.net/ubuntu/+source/libde265/1.0.4-1ubuntu0.3
[USN-6658-1] libxml2 vulnerability
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmXcuoQACgkQZWnYVadE
vpNqlxAAjKrFQlaV5YvK7OOV5VjfzTyvPBhL+RBb8P6G4ZBv1s25IuTAMXar50mM
XwU5wdct4KSg5JMoFDclEjQFlAAoHf40oKERIbR7MwshXGsjJx8yej3K/Z56WO5f
nPfD/AIdewZNRxniyrY7L/RZlPRfpZtQ5q/CpLgS8W09NSziY92nnSdBzqg+haUi
CInSErX+YReSZRGzXzhk5bg92qDXY1q7SiqvgDple4UHhyrFFVo89pXPmZzQrK92
ROBS89DMPSFCUeCVlIJczvwlCR132ZMjuc8vEk86lkDs+4aEYAvSlYIXfHuIn6vg
jYrEwSbVT+oju2Ry4uKGViou5O4/lxAknDfrcOqorcyjcibgLewUT+DvQaPI0zt1
G/Xnwj/IpN2oxGWaBzbzTUeTOKsT5GpnYLTrYngu8YT+1nKz3SkQa2R6YdKvkBhG
8kct7QlcrwrXu7qr3Y52ezy0H0rYdTWj8FHUoJgJeEY74oqGqZS92RtZ8lL2L95N
h32zZfdpmLmjk0LeOw3zlN6QVt4YIQJ0KnIPQsUTBB0WN7tZMJDzzxShBz5mzDd0
Z8rUdHIP8uY3BMeZfKivoN2Lh6BFNgglxcX3eCy4mdPzLxO1X6Mv64ICFY9LQEDt
THq2LNFzG1qqMIBlG5beowe400/TqyBUXG7VScnkQirThrjyvmc=
=TRBy
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6658-1
February 26, 2024
libxml2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
libxml2 could be made to crash or run programs if it opened a specially
crafted file.
Software Description:
- libxml2: GNOME XML library
Details:
It was discovered that libxml2 incorrectly handled certain XML documents. A
remote attacker could possibly use this issue to cause libxml2 to crash,
resulting in a denial of service, or possibly execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
libxml2 2.9.14+dfsg-1.3ubuntu0.1
Ubuntu 22.04 LTS:
libxml2 2.9.13+dfsg-1ubuntu0.4
Ubuntu 20.04 LTS:
libxml2 2.9.10+dfsg-5ubuntu0.20.04.7
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6658-1
CVE-2024-25062
Package Information:
https://launchpad.net/ubuntu/+source/libxml2/2.9.14+dfsg-1.3ubuntu0.1
https://launchpad.net/ubuntu/+source/libxml2/2.9.13+dfsg-1ubuntu0.4
https://launchpad.net/ubuntu/+source/libxml2/2.9.10+dfsg-5ubuntu0.20.04.7
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmXcuoQACgkQZWnYVadE
vpNqlxAAjKrFQlaV5YvK7OOV5VjfzTyvPBhL+RBb8P6G4ZBv1s25IuTAMXar50mM
XwU5wdct4KSg5JMoFDclEjQFlAAoHf40oKERIbR7MwshXGsjJx8yej3K/Z56WO5f
nPfD/AIdewZNRxniyrY7L/RZlPRfpZtQ5q/CpLgS8W09NSziY92nnSdBzqg+haUi
CInSErX+YReSZRGzXzhk5bg92qDXY1q7SiqvgDple4UHhyrFFVo89pXPmZzQrK92
ROBS89DMPSFCUeCVlIJczvwlCR132ZMjuc8vEk86lkDs+4aEYAvSlYIXfHuIn6vg
jYrEwSbVT+oju2Ry4uKGViou5O4/lxAknDfrcOqorcyjcibgLewUT+DvQaPI0zt1
G/Xnwj/IpN2oxGWaBzbzTUeTOKsT5GpnYLTrYngu8YT+1nKz3SkQa2R6YdKvkBhG
8kct7QlcrwrXu7qr3Y52ezy0H0rYdTWj8FHUoJgJeEY74oqGqZS92RtZ8lL2L95N
h32zZfdpmLmjk0LeOw3zlN6QVt4YIQJ0KnIPQsUTBB0WN7tZMJDzzxShBz5mzDd0
Z8rUdHIP8uY3BMeZfKivoN2Lh6BFNgglxcX3eCy4mdPzLxO1X6Mv64ICFY9LQEDt
THq2LNFzG1qqMIBlG5beowe400/TqyBUXG7VScnkQirThrjyvmc=
=TRBy
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6658-1
February 26, 2024
libxml2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
libxml2 could be made to crash or run programs if it opened a specially
crafted file.
Software Description:
- libxml2: GNOME XML library
Details:
It was discovered that libxml2 incorrectly handled certain XML documents. A
remote attacker could possibly use this issue to cause libxml2 to crash,
resulting in a denial of service, or possibly execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
libxml2 2.9.14+dfsg-1.3ubuntu0.1
Ubuntu 22.04 LTS:
libxml2 2.9.13+dfsg-1ubuntu0.4
Ubuntu 20.04 LTS:
libxml2 2.9.10+dfsg-5ubuntu0.20.04.7
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6658-1
CVE-2024-25062
Package Information:
https://launchpad.net/ubuntu/+source/libxml2/2.9.14+dfsg-1.3ubuntu0.1
https://launchpad.net/ubuntu/+source/libxml2/2.9.13+dfsg-1ubuntu0.4
https://launchpad.net/ubuntu/+source/libxml2/2.9.10+dfsg-5ubuntu0.20.04.7
[USN-6657-1] Dnsmasq vulnerabilities
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmXcum8ACgkQZWnYVadE
vpMjSRAAuL0CXsU3i+Bw7kUS06As55XswZQ2Jb7IeppIrYQY8oHQWSy7xW0k9wsd
VoxXH7Sn/ifCQGgsEqcRUiU2aj/Gh0bLCg8Gn9qztyqq2VIUPL7Cgec75/Ptu9Iu
eUgUPKBwkn1Np9g6o8ocB5t0PtA4ArXJY4sx7AhCR7iLya+0D5k22/0W47SqtbCk
GEqrp0J+/Y6hrhoEY4F/WR81CI50anvYo1yBLP8oQpmTucEDYgHbT4QO6dgb8sLw
WFWlFCleTg4JJGBJvhsVp/cg853GLeHQ7EQdhnrb+EpyGpwK0FsH6sYWifOdCNxC
4wXDs+V3Yfn/Mi1HrS3OIsTlKjIXFLnBRZaII1YGpAjztm8Kn7Byl+DJYEH9ExNJ
Pjsv9dyLorxFYmpfW0zj44w2e204PSmWOpZ2DCEKckYKyIM0fw+626Js9bxfRdDQ
aOHkb6PcJ3LhHCVN9vFrV2OiF7J+Hn18qrNuAwN0VPdag9QGhtJtvS6s4VU095Yw
Ezr8xa2Kg2PirE1jhIkLeipZJDA6yHW/UTmmxfvcSmt1DUNGHzLXDfs/wY5fJsaz
wa2JgehCeNKjEY/xPKkDmdCAXdWnd2jDYcpQOmNJoaJ2oURrKFy5BnH+lNIbriqX
AyGQRuCNu1KV9FRIZzUbdqNPLYqrwABiw/Vopzy/o2iHJLhGCI4=
=UMSR
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6657-1
February 26, 2024
dnsmasq vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Dnsmasq.
Software Description:
- dnsmasq: Small caching DNS proxy and DHCP/TFTP server
Details:
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Dnsmasq icorrectly handled validating DNSSEC messages. A remote
attacker could possibly use this issue to cause Dnsmasq to consume
resources, leading to a denial of service. (CVE-2023-50387)
It was discovered that Dnsmasq incorrectly handled preparing an NSEC3
closest encloser proof. A remote attacker could possibly use this issue to
cause Dnsmasq to consume resources, leading to a denial of service.
(CVE-2023-50868)
It was discovered that Dnsmasq incorrectly set the maximum EDNS.0 UDP
packet size as required by DNS Flag Day 2020. This issue only affected
Ubuntu 23.10. (CVE-2023-28450)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
dnsmasq-base 2.90-0ubuntu0.23.10.1
Ubuntu 22.04 LTS:
dnsmasq-base 2.90-0ubuntu0.22.04.1
Ubuntu 20.04 LTS:
dnsmasq-base 2.90-0ubuntu0.20.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to reboot your computer to
make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6657-1
CVE-2023-28450, CVE-2023-50387, CVE-2023-50868
Package Information:
https://launchpad.net/ubuntu/+source/dnsmasq/2.90-0ubuntu0.23.10.1
https://launchpad.net/ubuntu/+source/dnsmasq/2.90-0ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/dnsmasq/2.90-0ubuntu0.20.04.1
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmXcum8ACgkQZWnYVadE
vpMjSRAAuL0CXsU3i+Bw7kUS06As55XswZQ2Jb7IeppIrYQY8oHQWSy7xW0k9wsd
VoxXH7Sn/ifCQGgsEqcRUiU2aj/Gh0bLCg8Gn9qztyqq2VIUPL7Cgec75/Ptu9Iu
eUgUPKBwkn1Np9g6o8ocB5t0PtA4ArXJY4sx7AhCR7iLya+0D5k22/0W47SqtbCk
GEqrp0J+/Y6hrhoEY4F/WR81CI50anvYo1yBLP8oQpmTucEDYgHbT4QO6dgb8sLw
WFWlFCleTg4JJGBJvhsVp/cg853GLeHQ7EQdhnrb+EpyGpwK0FsH6sYWifOdCNxC
4wXDs+V3Yfn/Mi1HrS3OIsTlKjIXFLnBRZaII1YGpAjztm8Kn7Byl+DJYEH9ExNJ
Pjsv9dyLorxFYmpfW0zj44w2e204PSmWOpZ2DCEKckYKyIM0fw+626Js9bxfRdDQ
aOHkb6PcJ3LhHCVN9vFrV2OiF7J+Hn18qrNuAwN0VPdag9QGhtJtvS6s4VU095Yw
Ezr8xa2Kg2PirE1jhIkLeipZJDA6yHW/UTmmxfvcSmt1DUNGHzLXDfs/wY5fJsaz
wa2JgehCeNKjEY/xPKkDmdCAXdWnd2jDYcpQOmNJoaJ2oURrKFy5BnH+lNIbriqX
AyGQRuCNu1KV9FRIZzUbdqNPLYqrwABiw/Vopzy/o2iHJLhGCI4=
=UMSR
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6657-1
February 26, 2024
dnsmasq vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Dnsmasq.
Software Description:
- dnsmasq: Small caching DNS proxy and DHCP/TFTP server
Details:
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Dnsmasq icorrectly handled validating DNSSEC messages. A remote
attacker could possibly use this issue to cause Dnsmasq to consume
resources, leading to a denial of service. (CVE-2023-50387)
It was discovered that Dnsmasq incorrectly handled preparing an NSEC3
closest encloser proof. A remote attacker could possibly use this issue to
cause Dnsmasq to consume resources, leading to a denial of service.
(CVE-2023-50868)
It was discovered that Dnsmasq incorrectly set the maximum EDNS.0 UDP
packet size as required by DNS Flag Day 2020. This issue only affected
Ubuntu 23.10. (CVE-2023-28450)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
dnsmasq-base 2.90-0ubuntu0.23.10.1
Ubuntu 22.04 LTS:
dnsmasq-base 2.90-0ubuntu0.22.04.1
Ubuntu 20.04 LTS:
dnsmasq-base 2.90-0ubuntu0.20.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to reboot your computer to
make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6657-1
CVE-2023-28450, CVE-2023-50387, CVE-2023-50868
Package Information:
https://launchpad.net/ubuntu/+source/dnsmasq/2.90-0ubuntu0.23.10.1
https://launchpad.net/ubuntu/+source/dnsmasq/2.90-0ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/dnsmasq/2.90-0ubuntu0.20.04.1
[USN-6656-1] PostgreSQL vulnerability
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmXculAACgkQZWnYVadE
vpOc0g//Z7Y2kGNIUBQBoBikQo8JMvPAczbCyWSf0mtDp/MYw4FHLpL/mIz+wVYr
TiT0ubJqPGYasbAC6vlF7xOInBwyiFF0ZUqWEHibnAwfA/4kLoIfDgfqV7UhrOFI
Twiof5IX5AxeEP+9SLBFtxCROKkYSv8dUzZLUf/DjrZQreqvgoi/+J8Hfz1mLtZ0
vCuSLZe0qRO3T+rzF4uaOEqVIfZSOmaHjTqacvIvBTsEM1RZhP4UVfnXWScIaJsa
jKG0GTNFw0Xh9mD4jz1ZV3xOhXFjgTZ1rWEjeYOTaKmIawNJ0OvPcRo+Yn9dcQ7k
wMtxiZOFv0j+n+HMGxZVqkFFM4w81lpMo1L4gPVNbft2wx4nAr/V35LhusD11EZa
xUpHMJpKDWnuPeyxKYg/tbDeoOVc7vEQNjlmxHgip/BPU3Tm7B5HMGyyfMHmSiz8
wwIE+mKR9jQ2pceR9kErmcFKrslBf+y2FsafPaQlkPcMbZUDrQ9TmtU+z9VQPTDd
aQ4c2RSTnDHBlcubZxh6c/YAZKsBGPuRCPXPppdqhDG3iuRqywz7pNc40oFdfuRK
TiQeSwRiXI4sgDVWDimjlHG88xMF1j3v2bq6gzQd7SU51+Y0P93SUxOZ/hJsjqOR
SJ49TsCXUkGu/DdV7ucdgAQ7YouCtLewY4mPpo2sq/hNpehSdU0=
=sXT4
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6656-1
February 26, 2024
postgresql-12, postgresql-14, postgresql-15 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
PostgreSQL could be made to run arbitrary SQL.
Software Description:
- postgresql-15: Object-relational SQL database
- postgresql-14: Object-relational SQL database
- postgresql-12: Object-relational SQL database
Details:
It was discovered that PostgreSQL incorrectly handled dropping privileges
when handling REFRESH MATERIALIZED VIEW CONCURRENTLY commands. If a user or
automatic system were tricked into running a specially crafted command, a
remote attacker could possibly use this issue to execute arbitrary SQL
functions.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
postgresql-15 15.6-0ubuntu0.23.10.1
postgresql-client-15 15.6-0ubuntu0.23.10.1
Ubuntu 22.04 LTS:
postgresql-14 14.11-0ubuntu0.22.04.1
postgresql-client-14 14.11-0ubuntu0.22.04.1
Ubuntu 20.04 LTS:
postgresql-12 12.18-0ubuntu0.20.04.1
postgresql-client-12 12.18-0ubuntu0.20.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6656-1
CVE-2024-0985
Package Information:
https://launchpad.net/ubuntu/+source/postgresql-15/15.6-0ubuntu0.23.10.1
https://launchpad.net/ubuntu/+source/postgresql-14/14.11-0ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/postgresql-12/12.18-0ubuntu0.20.04.1
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmXculAACgkQZWnYVadE
vpOc0g//Z7Y2kGNIUBQBoBikQo8JMvPAczbCyWSf0mtDp/MYw4FHLpL/mIz+wVYr
TiT0ubJqPGYasbAC6vlF7xOInBwyiFF0ZUqWEHibnAwfA/4kLoIfDgfqV7UhrOFI
Twiof5IX5AxeEP+9SLBFtxCROKkYSv8dUzZLUf/DjrZQreqvgoi/+J8Hfz1mLtZ0
vCuSLZe0qRO3T+rzF4uaOEqVIfZSOmaHjTqacvIvBTsEM1RZhP4UVfnXWScIaJsa
jKG0GTNFw0Xh9mD4jz1ZV3xOhXFjgTZ1rWEjeYOTaKmIawNJ0OvPcRo+Yn9dcQ7k
wMtxiZOFv0j+n+HMGxZVqkFFM4w81lpMo1L4gPVNbft2wx4nAr/V35LhusD11EZa
xUpHMJpKDWnuPeyxKYg/tbDeoOVc7vEQNjlmxHgip/BPU3Tm7B5HMGyyfMHmSiz8
wwIE+mKR9jQ2pceR9kErmcFKrslBf+y2FsafPaQlkPcMbZUDrQ9TmtU+z9VQPTDd
aQ4c2RSTnDHBlcubZxh6c/YAZKsBGPuRCPXPppdqhDG3iuRqywz7pNc40oFdfuRK
TiQeSwRiXI4sgDVWDimjlHG88xMF1j3v2bq6gzQd7SU51+Y0P93SUxOZ/hJsjqOR
SJ49TsCXUkGu/DdV7ucdgAQ7YouCtLewY4mPpo2sq/hNpehSdU0=
=sXT4
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6656-1
February 26, 2024
postgresql-12, postgresql-14, postgresql-15 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
PostgreSQL could be made to run arbitrary SQL.
Software Description:
- postgresql-15: Object-relational SQL database
- postgresql-14: Object-relational SQL database
- postgresql-12: Object-relational SQL database
Details:
It was discovered that PostgreSQL incorrectly handled dropping privileges
when handling REFRESH MATERIALIZED VIEW CONCURRENTLY commands. If a user or
automatic system were tricked into running a specially crafted command, a
remote attacker could possibly use this issue to execute arbitrary SQL
functions.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
postgresql-15 15.6-0ubuntu0.23.10.1
postgresql-client-15 15.6-0ubuntu0.23.10.1
Ubuntu 22.04 LTS:
postgresql-14 14.11-0ubuntu0.22.04.1
postgresql-client-14 14.11-0ubuntu0.22.04.1
Ubuntu 20.04 LTS:
postgresql-12 12.18-0ubuntu0.20.04.1
postgresql-client-12 12.18-0ubuntu0.20.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6656-1
CVE-2024-0985
Package Information:
https://launchpad.net/ubuntu/+source/postgresql-15/15.6-0ubuntu0.23.10.1
https://launchpad.net/ubuntu/+source/postgresql-14/14.11-0ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/postgresql-12/12.18-0ubuntu0.20.04.1
[USN-6651-1] Linux kernel vulnerabilities
-----BEGIN PGP SIGNATURE-----
wsB5BAABCAAjFiEEYrygdx1GDec9TV8EZ0GeRcM5nt0FAmXchqAFAwAAAAAACgkQZ0GeRcM5nt30
QAf+PTOgXu4qd/mztMmDjI+T0+8bIMvPhC0dvWnbt1qpfQ1rEpsewpl4Z0HlKaQSxguLfkEUkE0w
1RUz6A0/3TlCgYT2HBTRmQGezDim1zArNIMzaDG34F6mmkMTc/wrUe+nr3XW1UtpPWX7aqJW++VD
UKRYhQpeBIwhZm88wW0DSrDyYbhkjNR+NodUqI/n2c1rK3f1peWJjsPBbKPzbG4fZoWtJMS7HKmS
xgAAvthiMiqRRsAL6B1q1LHXeBhT8h/Vt2IiJAvQwgxuN/qoKVbzlxJaQsCGUy/tMfBfvQ7GuNRD
5NXUy6p50qIymfD2Qfz5r8df3y1gbeOe3vJtAkeVnw==
=veFW
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6651-1
February 23, 2024
linux, linux-aws, linux-gcp, linux-hwe-6.5, linux-laptop, linux-oracle,
linux-raspi, linux-starfive vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-laptop: Linux kernel for Lenovo X13s ARM laptops
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-raspi: Linux kernel for Raspberry Pi systems
- linux-starfive: Linux kernel for StarFive processors
- linux-hwe-6.5: Linux hardware enablement (HWE) kernel
Details:
It was discovered that a race condition existed in the ATM (Asynchronous
Transfer Mode) subsystem of the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-51780)
It was discovered that a race condition existed in the AppleTalk networking
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-51781)
Zhenghan Wang discovered that the generic ID allocator implementation in
the Linux kernel did not properly check for null bitmap when releasing IDs.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2023-6915)
Robert Morris discovered that the CIFS network file system implementation
in the Linux kernel did not properly validate certain server commands
fields, leading to an out-of-bounds read vulnerability. An attacker could
use this to cause a denial of service (system crash) or possibly expose
sensitive information. (CVE-2024-0565)
Jann Horn discovered that the io_uring subsystem in the Linux kernel did
not properly handle the release of certain buffer rings. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2024-0582)
Jann Horn discovered that the TLS subsystem in the Linux kernel did not
properly handle spliced messages, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2024-0646)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
linux-image-6.5.0-1008-starfive 6.5.0-1008.9
linux-image-6.5.0-1010-laptop 6.5.0-1010.13
linux-image-6.5.0-1011-raspi 6.5.0-1011.14
linux-image-6.5.0-1014-aws 6.5.0-1014.14
linux-image-6.5.0-1014-gcp 6.5.0-1014.14
linux-image-6.5.0-1016-oracle 6.5.0-1016.16
linux-image-6.5.0-21-generic 6.5.0-21.21
linux-image-6.5.0-21-generic-64k 6.5.0-21.21
linux-image-aws 6.5.0.1014.14
linux-image-gcp 6.5.0.1014.14
linux-image-generic 6.5.0.21.20
linux-image-generic-64k 6.5.0.21.20
linux-image-generic-lpae 6.5.0.21.20
linux-image-kvm 6.5.0.21.20
linux-image-laptop-23.10 6.5.0.1010.13
linux-image-oracle 6.5.0.1016.16
linux-image-raspi 6.5.0.1011.12
linux-image-raspi-nolpae 6.5.0.1011.12
linux-image-starfive 6.5.0.1008.10
linux-image-virtual 6.5.0.21.20
Ubuntu 22.04 LTS:
linux-image-6.5.0-21-generic 6.5.0-21.21~22.04.1
linux-image-6.5.0-21-generic-64k 6.5.0-21.21~22.04.1
linux-image-generic-64k-hwe-22.04 6.5.0.21.21~22.04.11
linux-image-generic-hwe-22.04 6.5.0.21.21~22.04.11
linux-image-virtual-hwe-22.04 6.5.0.21.21~22.04.11
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6651-1
CVE-2023-51780, CVE-2023-51781, CVE-2023-6915, CVE-2024-0565,
CVE-2024-0582, CVE-2024-0646
Package Information:
https://launchpad.net/ubuntu/+source/linux/6.5.0-21.21
https://launchpad.net/ubuntu/+source/linux-aws/6.5.0-1014.14
https://launchpad.net/ubuntu/+source/linux-gcp/6.5.0-1014.14
https://launchpad.net/ubuntu/+source/linux-laptop/6.5.0-1010.13
https://launchpad.net/ubuntu/+source/linux-oracle/6.5.0-1016.16
https://launchpad.net/ubuntu/+source/linux-raspi/6.5.0-1011.14
https://launchpad.net/ubuntu/+source/linux-starfive/6.5.0-1008.9
https://launchpad.net/ubuntu/+source/linux-hwe-6.5/6.5.0-21.21~22.04.1
wsB5BAABCAAjFiEEYrygdx1GDec9TV8EZ0GeRcM5nt0FAmXchqAFAwAAAAAACgkQZ0GeRcM5nt30
QAf+PTOgXu4qd/mztMmDjI+T0+8bIMvPhC0dvWnbt1qpfQ1rEpsewpl4Z0HlKaQSxguLfkEUkE0w
1RUz6A0/3TlCgYT2HBTRmQGezDim1zArNIMzaDG34F6mmkMTc/wrUe+nr3XW1UtpPWX7aqJW++VD
UKRYhQpeBIwhZm88wW0DSrDyYbhkjNR+NodUqI/n2c1rK3f1peWJjsPBbKPzbG4fZoWtJMS7HKmS
xgAAvthiMiqRRsAL6B1q1LHXeBhT8h/Vt2IiJAvQwgxuN/qoKVbzlxJaQsCGUy/tMfBfvQ7GuNRD
5NXUy6p50qIymfD2Qfz5r8df3y1gbeOe3vJtAkeVnw==
=veFW
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6651-1
February 23, 2024
linux, linux-aws, linux-gcp, linux-hwe-6.5, linux-laptop, linux-oracle,
linux-raspi, linux-starfive vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-aws: Linux kernel for Amazon Web Services (AWS) systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-laptop: Linux kernel for Lenovo X13s ARM laptops
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-raspi: Linux kernel for Raspberry Pi systems
- linux-starfive: Linux kernel for StarFive processors
- linux-hwe-6.5: Linux hardware enablement (HWE) kernel
Details:
It was discovered that a race condition existed in the ATM (Asynchronous
Transfer Mode) subsystem of the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-51780)
It was discovered that a race condition existed in the AppleTalk networking
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-51781)
Zhenghan Wang discovered that the generic ID allocator implementation in
the Linux kernel did not properly check for null bitmap when releasing IDs.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2023-6915)
Robert Morris discovered that the CIFS network file system implementation
in the Linux kernel did not properly validate certain server commands
fields, leading to an out-of-bounds read vulnerability. An attacker could
use this to cause a denial of service (system crash) or possibly expose
sensitive information. (CVE-2024-0565)
Jann Horn discovered that the io_uring subsystem in the Linux kernel did
not properly handle the release of certain buffer rings. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2024-0582)
Jann Horn discovered that the TLS subsystem in the Linux kernel did not
properly handle spliced messages, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2024-0646)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
linux-image-6.5.0-1008-starfive 6.5.0-1008.9
linux-image-6.5.0-1010-laptop 6.5.0-1010.13
linux-image-6.5.0-1011-raspi 6.5.0-1011.14
linux-image-6.5.0-1014-aws 6.5.0-1014.14
linux-image-6.5.0-1014-gcp 6.5.0-1014.14
linux-image-6.5.0-1016-oracle 6.5.0-1016.16
linux-image-6.5.0-21-generic 6.5.0-21.21
linux-image-6.5.0-21-generic-64k 6.5.0-21.21
linux-image-aws 6.5.0.1014.14
linux-image-gcp 6.5.0.1014.14
linux-image-generic 6.5.0.21.20
linux-image-generic-64k 6.5.0.21.20
linux-image-generic-lpae 6.5.0.21.20
linux-image-kvm 6.5.0.21.20
linux-image-laptop-23.10 6.5.0.1010.13
linux-image-oracle 6.5.0.1016.16
linux-image-raspi 6.5.0.1011.12
linux-image-raspi-nolpae 6.5.0.1011.12
linux-image-starfive 6.5.0.1008.10
linux-image-virtual 6.5.0.21.20
Ubuntu 22.04 LTS:
linux-image-6.5.0-21-generic 6.5.0-21.21~22.04.1
linux-image-6.5.0-21-generic-64k 6.5.0-21.21~22.04.1
linux-image-generic-64k-hwe-22.04 6.5.0.21.21~22.04.11
linux-image-generic-hwe-22.04 6.5.0.21.21~22.04.11
linux-image-virtual-hwe-22.04 6.5.0.21.21~22.04.11
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6651-1
CVE-2023-51780, CVE-2023-51781, CVE-2023-6915, CVE-2024-0565,
CVE-2024-0582, CVE-2024-0646
Package Information:
https://launchpad.net/ubuntu/+source/linux/6.5.0-21.21
https://launchpad.net/ubuntu/+source/linux-aws/6.5.0-1014.14
https://launchpad.net/ubuntu/+source/linux-gcp/6.5.0-1014.14
https://launchpad.net/ubuntu/+source/linux-laptop/6.5.0-1010.13
https://launchpad.net/ubuntu/+source/linux-oracle/6.5.0-1016.16
https://launchpad.net/ubuntu/+source/linux-raspi/6.5.0-1011.14
https://launchpad.net/ubuntu/+source/linux-starfive/6.5.0-1008.9
https://launchpad.net/ubuntu/+source/linux-hwe-6.5/6.5.0-21.21~22.04.1
[USN-6652-1] Linux kernel (Azure) vulnerabilities
-----BEGIN PGP SIGNATURE-----
wsB5BAABCAAjFiEEYrygdx1GDec9TV8EZ0GeRcM5nt0FAmXchrYFAwAAAAAACgkQZ0GeRcM5nt2K
rQf8CNFzAT2fDWmX59qz3CFgCJMGt5xbIBtxGo/Qc8pLNH9jvKXN8JBlBEjDkzAkO7VO0ve0aTnc
RtRWMUS5EllBAvQFL3JuKRIrjO6PlgjWdU9IOPVDnhMo1icqlBU6aKZdX8KNqRNXu+VrN0dWa8NQ
sLGAuVb5xh0oBzeVXo2gwm8wcv3x5hl1rg1yzl1CLXOf5hl1g9ZHBDvDR8j3cxoZL2LYbdhq2acb
e03ALvecNLNM2Vs/VCfBFMz6+IifcZGjRGwaRHiUbH09Ci/J8uryBxKYziMTKQuBg+WNsiW8PgJC
igoYU2TXVXJReFEmXZuSHujIOSvNA8oFjeiLf5b9Qw==
=vnHI
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6652-1
February 23, 2024
linux-azure vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
Details:
Marek Marczykowski-Górecki discovered that the Xen event channel
infrastructure implementation in the Linux kernel contained a race
condition. An attacker in a guest VM could possibly use this to cause a
denial of service (paravirtualized device unavailability). (CVE-2023-34324)
Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver
in the Linux kernel during device removal. A privileged attacker could use
this to cause a denial of service (system crash). (CVE-2023-35827)
Tom Dohrmann discovered that the Secure Encrypted Virtualization (SEV)
implementation for AMD processors in the Linux kernel contained a race
condition when accessing MMIO registers. A local attacker in a SEV guest VM
could possibly use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2023-46813)
It was discovered that the io_uring subsystem in the Linux kernel contained
a race condition, leading to a null pointer dereference vulnerability. A
local attacker could use this to cause a denial of service (system crash).
(CVE-2023-46862)
It was discovered that a race condition existed in the ATM (Asynchronous
Transfer Mode) subsystem of the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-51780)
It was discovered that a race condition existed in the AppleTalk networking
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-51781)
It was discovered that the netfilter subsystem in the Linux kernel did not
properly validate inner tunnel netlink attributes, leading to a null
pointer dereference vulnerability. A local attacker could use this to cause
a denial of service (system crash). (CVE-2023-5972)
It was discovered that the TLS subsystem in the Linux kernel did not
properly perform cryptographic operations in some situations, leading to a
null pointer dereference vulnerability. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2023-6176)
Jann Horn discovered that a race condition existed in the Linux kernel when
handling io_uring over sockets, leading to a use-after-free vulnerability.
A local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-6531)
Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did
not properly handle dynset expressions passed from userspace, leading to a
null pointer dereference vulnerability. A local attacker could use this to
cause a denial of service (system crash). (CVE-2023-6622)
Zhenghan Wang discovered that the generic ID allocator implementation in
the Linux kernel did not properly check for null bitmap when releasing IDs.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2023-6915)
Robert Morris discovered that the CIFS network file system implementation
in the Linux kernel did not properly validate certain server commands
fields, leading to an out-of-bounds read vulnerability. An attacker could
use this to cause a denial of service (system crash) or possibly expose
sensitive information. (CVE-2024-0565)
Jann Horn discovered that the io_uring subsystem in the Linux kernel did
not properly handle the release of certain buffer rings. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2024-0582)
It was discovered that the TIPC protocol implementation in the Linux kernel
did not properly handle locking during tipc_crypto_key_revoke() operations.
A local attacker could use this to cause a denial of service (kernel
deadlock). (CVE-2024-0641)
Jann Horn discovered that the TLS subsystem in the Linux kernel did not
properly handle spliced messages, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2024-0646)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
linux-image-6.5.0-1015-azure 6.5.0-1015.15
linux-image-6.5.0-1015-azure-fde 6.5.0-1015.15
linux-image-azure 6.5.0.1015.17
linux-image-azure-fde 6.5.0.1015.17
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6652-1
CVE-2023-34324, CVE-2023-35827, CVE-2023-46813, CVE-2023-46862,
CVE-2023-51780, CVE-2023-51781, CVE-2023-5972, CVE-2023-6176,
CVE-2023-6531, CVE-2023-6622, CVE-2023-6915, CVE-2024-0565,
CVE-2024-0582, CVE-2024-0641, CVE-2024-0646
Package Information:
https://launchpad.net/ubuntu/+source/linux-azure/6.5.0-1015.15
wsB5BAABCAAjFiEEYrygdx1GDec9TV8EZ0GeRcM5nt0FAmXchrYFAwAAAAAACgkQZ0GeRcM5nt2K
rQf8CNFzAT2fDWmX59qz3CFgCJMGt5xbIBtxGo/Qc8pLNH9jvKXN8JBlBEjDkzAkO7VO0ve0aTnc
RtRWMUS5EllBAvQFL3JuKRIrjO6PlgjWdU9IOPVDnhMo1icqlBU6aKZdX8KNqRNXu+VrN0dWa8NQ
sLGAuVb5xh0oBzeVXo2gwm8wcv3x5hl1rg1yzl1CLXOf5hl1g9ZHBDvDR8j3cxoZL2LYbdhq2acb
e03ALvecNLNM2Vs/VCfBFMz6+IifcZGjRGwaRHiUbH09Ci/J8uryBxKYziMTKQuBg+WNsiW8PgJC
igoYU2TXVXJReFEmXZuSHujIOSvNA8oFjeiLf5b9Qw==
=vnHI
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6652-1
February 23, 2024
linux-azure vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
Details:
Marek Marczykowski-Górecki discovered that the Xen event channel
infrastructure implementation in the Linux kernel contained a race
condition. An attacker in a guest VM could possibly use this to cause a
denial of service (paravirtualized device unavailability). (CVE-2023-34324)
Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver
in the Linux kernel during device removal. A privileged attacker could use
this to cause a denial of service (system crash). (CVE-2023-35827)
Tom Dohrmann discovered that the Secure Encrypted Virtualization (SEV)
implementation for AMD processors in the Linux kernel contained a race
condition when accessing MMIO registers. A local attacker in a SEV guest VM
could possibly use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2023-46813)
It was discovered that the io_uring subsystem in the Linux kernel contained
a race condition, leading to a null pointer dereference vulnerability. A
local attacker could use this to cause a denial of service (system crash).
(CVE-2023-46862)
It was discovered that a race condition existed in the ATM (Asynchronous
Transfer Mode) subsystem of the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-51780)
It was discovered that a race condition existed in the AppleTalk networking
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-51781)
It was discovered that the netfilter subsystem in the Linux kernel did not
properly validate inner tunnel netlink attributes, leading to a null
pointer dereference vulnerability. A local attacker could use this to cause
a denial of service (system crash). (CVE-2023-5972)
It was discovered that the TLS subsystem in the Linux kernel did not
properly perform cryptographic operations in some situations, leading to a
null pointer dereference vulnerability. A local attacker could use this to
cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2023-6176)
Jann Horn discovered that a race condition existed in the Linux kernel when
handling io_uring over sockets, leading to a use-after-free vulnerability.
A local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-6531)
Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did
not properly handle dynset expressions passed from userspace, leading to a
null pointer dereference vulnerability. A local attacker could use this to
cause a denial of service (system crash). (CVE-2023-6622)
Zhenghan Wang discovered that the generic ID allocator implementation in
the Linux kernel did not properly check for null bitmap when releasing IDs.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2023-6915)
Robert Morris discovered that the CIFS network file system implementation
in the Linux kernel did not properly validate certain server commands
fields, leading to an out-of-bounds read vulnerability. An attacker could
use this to cause a denial of service (system crash) or possibly expose
sensitive information. (CVE-2024-0565)
Jann Horn discovered that the io_uring subsystem in the Linux kernel did
not properly handle the release of certain buffer rings. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2024-0582)
It was discovered that the TIPC protocol implementation in the Linux kernel
did not properly handle locking during tipc_crypto_key_revoke() operations.
A local attacker could use this to cause a denial of service (kernel
deadlock). (CVE-2024-0641)
Jann Horn discovered that the TLS subsystem in the Linux kernel did not
properly handle spliced messages, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2024-0646)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
linux-image-6.5.0-1015-azure 6.5.0-1015.15
linux-image-6.5.0-1015-azure-fde 6.5.0-1015.15
linux-image-azure 6.5.0.1015.17
linux-image-azure-fde 6.5.0.1015.17
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6652-1
CVE-2023-34324, CVE-2023-35827, CVE-2023-46813, CVE-2023-46862,
CVE-2023-51780, CVE-2023-51781, CVE-2023-5972, CVE-2023-6176,
CVE-2023-6531, CVE-2023-6622, CVE-2023-6915, CVE-2024-0565,
CVE-2024-0582, CVE-2024-0641, CVE-2024-0646
Package Information:
https://launchpad.net/ubuntu/+source/linux-azure/6.5.0-1015.15
[USN-6653-1] Linux kernel vulnerabilities
-----BEGIN PGP SIGNATURE-----
wsB5BAABCAAjFiEEYrygdx1GDec9TV8EZ0GeRcM5nt0FAmXchr4FAwAAAAAACgkQZ0GeRcM5nt2+
hQgAlnH9f4mYpTCsPnT4N3FqykvijPeu54ahq06jFX9osr2GtRB48GmfxER5+o/C2wM0l7Qg9vC6
9N+Pvfy3IPsI+QvC6jfVu1Xu9Z/K/nLNtyujOsulookh6Wl/iPJRECwQZJh4lhmfKbdI11Tdw0tv
yu53O9yJAX6R15J6R+BEe/1VPc//eDacJtGBaIei3DZPiwRRAOkKagB7iJT8ef2jGvn0Olj/1n6P
ZgGVuw24PNLQ1eR0At50+808xV5zEwF7nUb+HUa7wPx5x3Bv94GAeUJcfW+sHBFIOoN9h+hlqclB
5OcFVgoCrU5WXtnElS6ufZON1wh09HVBKNc412Uj/g==
=NLsI
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6653-1
February 23, 2024
linux, linux-azure, linux-azure-5.15, linux-azure-fde, linux-gcp,
linux-gcp-5.15, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm,
linux-ibm-5.15, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm,
linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15,
linux-raspi vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-azure-fde: Linux kernel for Microsoft Azure CVM cloud systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-gkeop: Linux kernel for Google Container Engine (GKE) systems
- linux-ibm: Linux kernel for IBM cloud systems
- linux-intel-iotg: Linux kernel for Intel IoT platforms
- linux-kvm: Linux kernel for cloud environments
- linux-nvidia: Linux kernel for NVIDIA systems
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-raspi: Linux kernel for Raspberry Pi systems
- linux-azure-5.15: Linux kernel for Microsoft Azure cloud systems
- linux-gcp-5.15: Linux kernel for Google Cloud Platform (GCP) systems
- linux-gkeop-5.15: Linux kernel for Google Container Engine (GKE) systems
- linux-hwe-5.15: Linux hardware enablement (HWE) kernel
- linux-ibm-5.15: Linux kernel for IBM cloud systems
- linux-intel-iotg-5.15: Linux kernel for Intel IoT platforms
- linux-lowlatency-hwe-5.15: Linux low latency kernel
- linux-oracle-5.15: Linux kernel for Oracle Cloud systems
Details:
It was discovered that a race condition existed in the ATM (Asynchronous
Transfer Mode) subsystem of the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-51780)
It was discovered that a race condition existed in the AppleTalk networking
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-51781)
Zhenghan Wang discovered that the generic ID allocator implementation in
the Linux kernel did not properly check for null bitmap when releasing IDs.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2023-6915)
Robert Morris discovered that the CIFS network file system implementation
in the Linux kernel did not properly validate certain server commands
fields, leading to an out-of-bounds read vulnerability. An attacker could
use this to cause a denial of service (system crash) or possibly expose
sensitive information. (CVE-2024-0565)
Jann Horn discovered that the TLS subsystem in the Linux kernel did not
properly handle spliced messages, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2024-0646)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
linux-image-5.15.0-1037-gkeop 5.15.0-1037.43
linux-image-5.15.0-1045-nvidia 5.15.0-1045.45
linux-image-5.15.0-1045-nvidia-lowlatency 5.15.0-1045.45
linux-image-5.15.0-1047-ibm 5.15.0-1047.50
linux-image-5.15.0-1047-raspi 5.15.0-1047.50
linux-image-5.15.0-1049-intel-iotg 5.15.0-1049.55
linux-image-5.15.0-1051-kvm 5.15.0-1051.56
linux-image-5.15.0-1052-gcp 5.15.0-1052.60
linux-image-5.15.0-1052-oracle 5.15.0-1052.58
linux-image-5.15.0-1057-azure 5.15.0-1057.65
linux-image-5.15.0-1057-azure-fde 5.15.0-1057.65.1
linux-image-5.15.0-97-generic 5.15.0-97.107
linux-image-5.15.0-97-generic-64k 5.15.0-97.107
linux-image-5.15.0-97-generic-lpae 5.15.0-97.107
linux-image-azure-fde-lts-22.04 5.15.0.1057.65.35
linux-image-azure-lts-22.04 5.15.0.1057.53
linux-image-gcp-lts-22.04 5.15.0.1052.48
linux-image-generic 5.15.0.97.92
linux-image-generic-64k 5.15.0.97.92
linux-image-generic-lpae 5.15.0.97.92
linux-image-gkeop 5.15.0.1037.36
linux-image-gkeop-5.15 5.15.0.1037.36
linux-image-ibm 5.15.0.1047.43
linux-image-intel-iotg 5.15.0.1049.49
linux-image-kvm 5.15.0.1051.47
linux-image-nvidia 5.15.0.1045.45
linux-image-nvidia-lowlatency 5.15.0.1045.45
linux-image-oracle 5.15.0.1052.47
linux-image-oracle-lts-22.04 5.15.0.1052.47
linux-image-raspi 5.15.0.1047.45
linux-image-raspi-nolpae 5.15.0.1047.45
linux-image-virtual 5.15.0.97.92
Ubuntu 20.04 LTS:
linux-image-5.15.0-1037-gkeop 5.15.0-1037.43~20.04.1
linux-image-5.15.0-1047-ibm 5.15.0-1047.50~20.04.1
linux-image-5.15.0-1049-intel-iotg 5.15.0-1049.55~20.04.1
linux-image-5.15.0-1052-gcp 5.15.0-1052.60~20.04.1
linux-image-5.15.0-1052-oracle 5.15.0-1052.58~20.04.1
linux-image-5.15.0-1057-azure 5.15.0-1057.65~20.04.1
linux-image-5.15.0-97-generic 5.15.0-97.107~20.04.1
linux-image-5.15.0-97-generic-64k 5.15.0-97.107~20.04.1
linux-image-5.15.0-97-generic-lpae 5.15.0-97.107~20.04.1
linux-image-5.15.0-97-lowlatency 5.15.0-97.107~20.04.1
linux-image-5.15.0-97-lowlatency-64k 5.15.0-97.107~20.04.1
linux-image-azure 5.15.0.1057.65~20.04.46
linux-image-azure-cvm 5.15.0.1057.65~20.04.46
linux-image-gcp 5.15.0.1052.60~20.04.1
linux-image-generic-64k-hwe-20.04 5.15.0.97.107~20.04.51
linux-image-generic-hwe-20.04 5.15.0.97.107~20.04.51
linux-image-generic-lpae-hwe-20.04 5.15.0.97.107~20.04.51
linux-image-gkeop-5.15 5.15.0.1037.43~20.04.33
linux-image-ibm 5.15.0.1047.50~20.04.19
linux-image-intel 5.15.0.1049.55~20.04.39
linux-image-intel-iotg 5.15.0.1049.55~20.04.39
linux-image-lowlatency-64k-hwe-20.04 5.15.0.97.107~20.04.48
linux-image-lowlatency-hwe-20.04 5.15.0.97.107~20.04.48
linux-image-oem-20.04 5.15.0.97.107~20.04.51
linux-image-oem-20.04b 5.15.0.97.107~20.04.51
linux-image-oem-20.04c 5.15.0.97.107~20.04.51
linux-image-oem-20.04d 5.15.0.97.107~20.04.51
linux-image-oracle 5.15.0.1052.58~20.04.1
linux-image-virtual-hwe-20.04 5.15.0.97.107~20.04.51
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6653-1
CVE-2023-51780, CVE-2023-51781, CVE-2023-6915, CVE-2024-0565,
CVE-2024-0646
Package Information:
https://launchpad.net/ubuntu/+source/linux/5.15.0-97.107
https://launchpad.net/ubuntu/+source/linux-azure/5.15.0-1057.65
https://launchpad.net/ubuntu/+source/linux-azure-fde/5.15.0-1057.65.1
https://launchpad.net/ubuntu/+source/linux-gcp/5.15.0-1052.60
https://launchpad.net/ubuntu/+source/linux-gkeop/5.15.0-1037.43
https://launchpad.net/ubuntu/+source/linux-ibm/5.15.0-1047.50
https://launchpad.net/ubuntu/+source/linux-intel-iotg/5.15.0-1049.55
https://launchpad.net/ubuntu/+source/linux-kvm/5.15.0-1051.56
https://launchpad.net/ubuntu/+source/linux-nvidia/5.15.0-1045.45
https://launchpad.net/ubuntu/+source/linux-oracle/5.15.0-1052.58
https://launchpad.net/ubuntu/+source/linux-raspi/5.15.0-1047.50
https://launchpad.net/ubuntu/+source/linux-azure-5.15/5.15.0-1057.65~20.04.1
https://launchpad.net/ubuntu/+source/linux-gcp-5.15/5.15.0-1052.60~20.04.1
https://launchpad.net/ubuntu/+source/linux-gkeop-5.15/5.15.0-1037.43~20.04.1
https://launchpad.net/ubuntu/+source/linux-hwe-5.15/5.15.0-97.107~20.04.1
https://launchpad.net/ubuntu/+source/linux-ibm-5.15/5.15.0-1047.50~20.04.1
https://launchpad.net/ubuntu/+source/linux-intel-iotg-5.15/5.15.0-1049.55~20.04.1
https://launchpad.net/ubuntu/+source/linux-lowlatency-hwe-5.15/5.15.0-97.107~20.04.1
https://launchpad.net/ubuntu/+source/linux-oracle-5.15/5.15.0-1052.58~20.04.1
wsB5BAABCAAjFiEEYrygdx1GDec9TV8EZ0GeRcM5nt0FAmXchr4FAwAAAAAACgkQZ0GeRcM5nt2+
hQgAlnH9f4mYpTCsPnT4N3FqykvijPeu54ahq06jFX9osr2GtRB48GmfxER5+o/C2wM0l7Qg9vC6
9N+Pvfy3IPsI+QvC6jfVu1Xu9Z/K/nLNtyujOsulookh6Wl/iPJRECwQZJh4lhmfKbdI11Tdw0tv
yu53O9yJAX6R15J6R+BEe/1VPc//eDacJtGBaIei3DZPiwRRAOkKagB7iJT8ef2jGvn0Olj/1n6P
ZgGVuw24PNLQ1eR0At50+808xV5zEwF7nUb+HUa7wPx5x3Bv94GAeUJcfW+sHBFIOoN9h+hlqclB
5OcFVgoCrU5WXtnElS6ufZON1wh09HVBKNc412Uj/g==
=NLsI
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6653-1
February 23, 2024
linux, linux-azure, linux-azure-5.15, linux-azure-fde, linux-gcp,
linux-gcp-5.15, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm,
linux-ibm-5.15, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm,
linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15,
linux-raspi vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux: Linux kernel
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-azure-fde: Linux kernel for Microsoft Azure CVM cloud systems
- linux-gcp: Linux kernel for Google Cloud Platform (GCP) systems
- linux-gkeop: Linux kernel for Google Container Engine (GKE) systems
- linux-ibm: Linux kernel for IBM cloud systems
- linux-intel-iotg: Linux kernel for Intel IoT platforms
- linux-kvm: Linux kernel for cloud environments
- linux-nvidia: Linux kernel for NVIDIA systems
- linux-oracle: Linux kernel for Oracle Cloud systems
- linux-raspi: Linux kernel for Raspberry Pi systems
- linux-azure-5.15: Linux kernel for Microsoft Azure cloud systems
- linux-gcp-5.15: Linux kernel for Google Cloud Platform (GCP) systems
- linux-gkeop-5.15: Linux kernel for Google Container Engine (GKE) systems
- linux-hwe-5.15: Linux hardware enablement (HWE) kernel
- linux-ibm-5.15: Linux kernel for IBM cloud systems
- linux-intel-iotg-5.15: Linux kernel for Intel IoT platforms
- linux-lowlatency-hwe-5.15: Linux low latency kernel
- linux-oracle-5.15: Linux kernel for Oracle Cloud systems
Details:
It was discovered that a race condition existed in the ATM (Asynchronous
Transfer Mode) subsystem of the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-51780)
It was discovered that a race condition existed in the AppleTalk networking
subsystem of the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-51781)
Zhenghan Wang discovered that the generic ID allocator implementation in
the Linux kernel did not properly check for null bitmap when releasing IDs.
A local attacker could use this to cause a denial of service (system
crash). (CVE-2023-6915)
Robert Morris discovered that the CIFS network file system implementation
in the Linux kernel did not properly validate certain server commands
fields, leading to an out-of-bounds read vulnerability. An attacker could
use this to cause a denial of service (system crash) or possibly expose
sensitive information. (CVE-2024-0565)
Jann Horn discovered that the TLS subsystem in the Linux kernel did not
properly handle spliced messages, leading to an out-of-bounds write
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2024-0646)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
linux-image-5.15.0-1037-gkeop 5.15.0-1037.43
linux-image-5.15.0-1045-nvidia 5.15.0-1045.45
linux-image-5.15.0-1045-nvidia-lowlatency 5.15.0-1045.45
linux-image-5.15.0-1047-ibm 5.15.0-1047.50
linux-image-5.15.0-1047-raspi 5.15.0-1047.50
linux-image-5.15.0-1049-intel-iotg 5.15.0-1049.55
linux-image-5.15.0-1051-kvm 5.15.0-1051.56
linux-image-5.15.0-1052-gcp 5.15.0-1052.60
linux-image-5.15.0-1052-oracle 5.15.0-1052.58
linux-image-5.15.0-1057-azure 5.15.0-1057.65
linux-image-5.15.0-1057-azure-fde 5.15.0-1057.65.1
linux-image-5.15.0-97-generic 5.15.0-97.107
linux-image-5.15.0-97-generic-64k 5.15.0-97.107
linux-image-5.15.0-97-generic-lpae 5.15.0-97.107
linux-image-azure-fde-lts-22.04 5.15.0.1057.65.35
linux-image-azure-lts-22.04 5.15.0.1057.53
linux-image-gcp-lts-22.04 5.15.0.1052.48
linux-image-generic 5.15.0.97.92
linux-image-generic-64k 5.15.0.97.92
linux-image-generic-lpae 5.15.0.97.92
linux-image-gkeop 5.15.0.1037.36
linux-image-gkeop-5.15 5.15.0.1037.36
linux-image-ibm 5.15.0.1047.43
linux-image-intel-iotg 5.15.0.1049.49
linux-image-kvm 5.15.0.1051.47
linux-image-nvidia 5.15.0.1045.45
linux-image-nvidia-lowlatency 5.15.0.1045.45
linux-image-oracle 5.15.0.1052.47
linux-image-oracle-lts-22.04 5.15.0.1052.47
linux-image-raspi 5.15.0.1047.45
linux-image-raspi-nolpae 5.15.0.1047.45
linux-image-virtual 5.15.0.97.92
Ubuntu 20.04 LTS:
linux-image-5.15.0-1037-gkeop 5.15.0-1037.43~20.04.1
linux-image-5.15.0-1047-ibm 5.15.0-1047.50~20.04.1
linux-image-5.15.0-1049-intel-iotg 5.15.0-1049.55~20.04.1
linux-image-5.15.0-1052-gcp 5.15.0-1052.60~20.04.1
linux-image-5.15.0-1052-oracle 5.15.0-1052.58~20.04.1
linux-image-5.15.0-1057-azure 5.15.0-1057.65~20.04.1
linux-image-5.15.0-97-generic 5.15.0-97.107~20.04.1
linux-image-5.15.0-97-generic-64k 5.15.0-97.107~20.04.1
linux-image-5.15.0-97-generic-lpae 5.15.0-97.107~20.04.1
linux-image-5.15.0-97-lowlatency 5.15.0-97.107~20.04.1
linux-image-5.15.0-97-lowlatency-64k 5.15.0-97.107~20.04.1
linux-image-azure 5.15.0.1057.65~20.04.46
linux-image-azure-cvm 5.15.0.1057.65~20.04.46
linux-image-gcp 5.15.0.1052.60~20.04.1
linux-image-generic-64k-hwe-20.04 5.15.0.97.107~20.04.51
linux-image-generic-hwe-20.04 5.15.0.97.107~20.04.51
linux-image-generic-lpae-hwe-20.04 5.15.0.97.107~20.04.51
linux-image-gkeop-5.15 5.15.0.1037.43~20.04.33
linux-image-ibm 5.15.0.1047.50~20.04.19
linux-image-intel 5.15.0.1049.55~20.04.39
linux-image-intel-iotg 5.15.0.1049.55~20.04.39
linux-image-lowlatency-64k-hwe-20.04 5.15.0.97.107~20.04.48
linux-image-lowlatency-hwe-20.04 5.15.0.97.107~20.04.48
linux-image-oem-20.04 5.15.0.97.107~20.04.51
linux-image-oem-20.04b 5.15.0.97.107~20.04.51
linux-image-oem-20.04c 5.15.0.97.107~20.04.51
linux-image-oem-20.04d 5.15.0.97.107~20.04.51
linux-image-oracle 5.15.0.1052.58~20.04.1
linux-image-virtual-hwe-20.04 5.15.0.97.107~20.04.51
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6653-1
CVE-2023-51780, CVE-2023-51781, CVE-2023-6915, CVE-2024-0565,
CVE-2024-0646
Package Information:
https://launchpad.net/ubuntu/+source/linux/5.15.0-97.107
https://launchpad.net/ubuntu/+source/linux-azure/5.15.0-1057.65
https://launchpad.net/ubuntu/+source/linux-azure-fde/5.15.0-1057.65.1
https://launchpad.net/ubuntu/+source/linux-gcp/5.15.0-1052.60
https://launchpad.net/ubuntu/+source/linux-gkeop/5.15.0-1037.43
https://launchpad.net/ubuntu/+source/linux-ibm/5.15.0-1047.50
https://launchpad.net/ubuntu/+source/linux-intel-iotg/5.15.0-1049.55
https://launchpad.net/ubuntu/+source/linux-kvm/5.15.0-1051.56
https://launchpad.net/ubuntu/+source/linux-nvidia/5.15.0-1045.45
https://launchpad.net/ubuntu/+source/linux-oracle/5.15.0-1052.58
https://launchpad.net/ubuntu/+source/linux-raspi/5.15.0-1047.50
https://launchpad.net/ubuntu/+source/linux-azure-5.15/5.15.0-1057.65~20.04.1
https://launchpad.net/ubuntu/+source/linux-gcp-5.15/5.15.0-1052.60~20.04.1
https://launchpad.net/ubuntu/+source/linux-gkeop-5.15/5.15.0-1037.43~20.04.1
https://launchpad.net/ubuntu/+source/linux-hwe-5.15/5.15.0-97.107~20.04.1
https://launchpad.net/ubuntu/+source/linux-ibm-5.15/5.15.0-1047.50~20.04.1
https://launchpad.net/ubuntu/+source/linux-intel-iotg-5.15/5.15.0-1049.55~20.04.1
https://launchpad.net/ubuntu/+source/linux-lowlatency-hwe-5.15/5.15.0-97.107~20.04.1
https://launchpad.net/ubuntu/+source/linux-oracle-5.15/5.15.0-1052.58~20.04.1
Subscribe to:
Posts (Atom)