==========================================================================
Ubuntu Security Notice USN-6995-1
September 09, 2024
thunderbird vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Thunderbird.
Software Description:
- thunderbird: Mozilla Open Source mail and newsgroup client
Details:
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2024-7521, CVE-2024-7526,
CVE-2024-7527, CVE-2024-7529, CVE-2024-8382)
It was discovered that Thunderbird did not properly manage certain memory
operations when processing graphics shared memory. An attacker could
potentially exploit this issue to escape the sandbox. (CVE-2024-7519)
Irvan Kurniawan discovered that Thunderbird did not properly check an
attribute value in the editor component, leading to an out-of-bounds read
vulnerability. An attacker could possibly use this issue to cause a denial
of service or expose sensitive information. (CVE-2024-7522)
Rob Wu discovered that Thunderbird did not properly check permissions when
creating a StreamFilter. An attacker could possibly use this issue to
modify response body of requests on any site using a web extension.
(CVE-2024-7525)
Nils Bars discovered that Thunderbird contained a type confusion
vulnerability when performing certain property name lookups. An attacker
could potentially exploit this issue to cause a denial of service, or
execute arbitrary code. (CVE-2024-8381)
It was discovered that Thunderbird did not properly manage memory during
garbage collection. An attacker could potentially exploit this issue to
cause a denial of service, or execute arbitrary code. (CVE-2024-8384)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
thunderbird 1:115.15.0+build1-0ubuntu0.22.04.1
Ubuntu 20.04 LTS
thunderbird 1:115.15.0+build1-0ubuntu0.20.04.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6995-1
CVE-2024-7519, CVE-2024-7521, CVE-2024-7522, CVE-2024-7525,
CVE-2024-7526, CVE-2024-7527, CVE-2024-7529, CVE-2024-8381,
CVE-2024-8382, CVE-2024-8384
Package Information:
https://launchpad.net/ubuntu/+source/thunderbird/1:115.15.0+build1-0ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/thunderbird/1:115.15.0+build1-0ubuntu0.20.04.1
Sunday, September 8, 2024
Thursday, September 5, 2024
[USN-6991-1] AIOHTTP vulnerability
==========================================================================
Ubuntu Security Notice USN-6991-1
September 05, 2024
Ubuntu Security Notice USN-6991-1
September 05, 2024
python-aiohttp vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
python-aiohttp would allow unintended access to files over the network.
Software Description:
- python-aiohttp: http client/server for asyncio
Details:
It was discovered that AIOHTTP did not properly restrict file access when
the 'follow_symlinks' option was set to True. A remote attacker could
possibly use this issue to access unauthorized files on the system.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
python-aiohttp-doc 3.9.1-1ubuntu0.1
python3-aiohttp 3.9.1-1ubuntu0.1
Ubuntu 22.04 LTS
python-aiohttp-doc 3.8.1-4ubuntu0.2
python3-aiohttp 3.8.1-4ubuntu0.2
Ubuntu 20.04 LTS
python3-aiohttp 3.6.2-1ubuntu1+esm3
Available with Ubuntu Pro
Ubuntu 18.04 LTS
python3-aiohttp 3.0.1-1ubuntu0.1~esm4
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6991-1
CVE-2024-23334
Package Information:
https://launchpad.net/ubuntu/+source/python-aiohttp/3.9.1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/python-aiohttp/3.8.1-4ubuntu0.2
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEETB/nIDy9nvCSgAUj3gXQmO/Tr3wFAmbaO5QACgkQ3gXQmO/T
r3w3hg/+Jd3vvi9UVfPnbSXnVWX6GJLLTHFdcXFH4RcQiPlFQM2iGRrQjNa5qXzK
hor5PKU+At52cq2YGGHbqUA0Zx0+iE/XGcqP/V3ke/cmGM8MAz0MdrKht8et6TcZ
yliGm2MLTg0zXGne90VjTxQ95WgDcftLiqpeRxiAMx5LCVXfW/YkmuA+AW+1GTVh
gu4eczV9S+HpF/MBRPGDe5Jb1VilW30ygiV9aeJWMRJfLUovnJeGY8RfCjUsF+rC
zBU5iDrY6/Fgdq6zp2uks/h5HOncs0OzT38F8L0fgiSWmDfxtBRXfg98Wd/xoo9/
BJizQWZpLn50AGmQ8+NwD7rMYGlgFtVhm5TOo4DPotOWiwpmpq41Z1Q8J+cK/Kmz
ZLNVO5s5yusyPkkDC07iIthPkG10O3vh7FM0bvNztxWUKf+K7MkG/kxm3TyHSF1a
p8oS15JLAlQzwElIf4JaQkeHedOOv4apfDyTDw44t+/gaP4PTJkHPvwlSGPwTcQn
6dg+i8udFDBoD8csZeFl7jLaJ7CuUnvhs1RIqjpKnMFL30kYWqXFtRPSEx/ObG8Q
H31sNb5U1KUDMqz7PivEJ/q4uHQLlGYNCyKpsHnzDg92zLgkshL5/r1pJYY9+PKL
Y5lFbZEeyMKvbeLGuhQwjjG0M4VhRYENQSJxxqWVCMLsJUdF/T0=
=sQ45
-----END PGP SIGNATURE-----
[USN-6993-1] Vim vulnerabilities
-----BEGIN PGP SIGNATURE-----
wsD5BAABCAAjFiEEkd98mdFcnQdP7vQkuGrtzot7pOcFAmbZPbAFAwAAAAAACgkQuGrtzot7pOct
ogwAr0vZs2OIX6XoIsKVPpz4J/EWIZybGSjQ6uWxHVgnM+y6SR9DHIJJadj4f6J5xsFmv1+SIv84
FGc5cJqKTrWLKY6dMQWkQJsWeYBcgv7EJD2U6aA7xmIqDSiPhN8y5/2MXUnPf1Ul2B3Q/i9NeKwK
JefIjx6rL19oGIGFQiEAZvXpydhBuKjfaZEzhyNBhCV78z1l1eXj4eKrHIq0K/Xm8nrF1R+m5gtw
kp+Y60y7FYJCx7c4SFlidIoRylH76SanDiy6e9PEZRvOR8wJs0jafmFlygcGtLYJBpRkS9iHupgd
uVaD57pd8aYHgQqqrKqQtHqt+5R/2qKDOjPfteRg4Ac6Lr4wwDPCGCLerUlodgphdT3XBtXw9VwA
WHfDxyGGephgsuYLX7y9U5BSPcdz+cI5AvhFLhSVYJhqCT3eQNnXMI7HYgAzHUGHzYcMEK24UJM5
NqbSjkq29bJ8x8r2DGqjXswm3z9e8OTazLJ+rQ1FLpA22Vp6EyvAkO0U0KJX
=OfVH
-----END PGP SIGNATURE-----
wsD5BAABCAAjFiEEkd98mdFcnQdP7vQkuGrtzot7pOcFAmbZPbAFAwAAAAAACgkQuGrtzot7pOct
ogwAr0vZs2OIX6XoIsKVPpz4J/EWIZybGSjQ6uWxHVgnM+y6SR9DHIJJadj4f6J5xsFmv1+SIv84
FGc5cJqKTrWLKY6dMQWkQJsWeYBcgv7EJD2U6aA7xmIqDSiPhN8y5/2MXUnPf1Ul2B3Q/i9NeKwK
JefIjx6rL19oGIGFQiEAZvXpydhBuKjfaZEzhyNBhCV78z1l1eXj4eKrHIq0K/Xm8nrF1R+m5gtw
kp+Y60y7FYJCx7c4SFlidIoRylH76SanDiy6e9PEZRvOR8wJs0jafmFlygcGtLYJBpRkS9iHupgd
uVaD57pd8aYHgQqqrKqQtHqt+5R/2qKDOjPfteRg4Ac6Lr4wwDPCGCLerUlodgphdT3XBtXw9VwA
WHfDxyGGephgsuYLX7y9U5BSPcdz+cI5AvhFLhSVYJhqCT3eQNnXMI7HYgAzHUGHzYcMEK24UJM5
NqbSjkq29bJ8x8r2DGqjXswm3z9e8OTazLJ+rQ1FLpA22Vp6EyvAkO0U0KJX
=OfVH
-----END PGP SIGNATURE-----
========================================================================== Ubuntu Security Notice USN-6993-1 September 05, 2024 vim vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Vim. Software Description: - vim: Vi IMproved - enhanced vi editor Details: It was discovered that Vim incorrectly handled memory when closing a window, leading to a double-free vulnerability. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2024-41957) It was discovered that Vim incorrectly handled memory when adding a new file to an argument list, leading to a use-after-free. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service. (CVE-2024-43374) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS vim 2:9.1.0016-1ubuntu7.2 Ubuntu 22.04 LTS vim 2:8.2.3995-1ubuntu2.18 Ubuntu 20.04 LTS vim 2:8.1.2269-1ubuntu5.24 Ubuntu 18.04 LTS vim 2:8.0.1453-1ubuntu1.13+esm9 Available with Ubuntu Pro Ubuntu 16.04 LTS vim 2:7.4.1689-3ubuntu1.5+esm24 Available with Ubuntu Pro Ubuntu 14.04 LTS vim 2:7.4.052-1ubuntu3.1+esm18 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6993-1 CVE-2024-41957, CVE-2024-43374 Package Information: https://launchpad.net/ubuntu/+source/vim/2:9.1.0016-1ubuntu7.2 https://launchpad.net/ubuntu/+source/vim/2:8.2.3995-1ubuntu2.18 https://launchpad.net/ubuntu/+source/vim/2:8.1.2269-1ubuntu5.24
Wednesday, September 4, 2024
[USN-6992-1] Firefox vulnerabilities
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmbZHiMFAwAAAAAACgkQWNrRIKaTkWfy
sxAAs26/bTI97cDeBXWl9KM3htIGMfY/U+JLRes2zpB/P599uuJdxbPyw/gg/jbnk43Yd+muc6P9
CF1Rcc/tLKG5rZT1MIihwVJxIM3F8i20NGmJg7g1KhGkdQKbjM5EHFDHStRP0XqDuGiY06jCdDyv
uUycOoJK7tYSjWDJszOK5g6NiyyQa99U7UXFf4Z0FP4etLCRvNYRK+yoLYgsTn07Ie08qA9LBdiw
nEjI2lApZZ/DcRIl6pLBItcxdwD9Qyo2gU0GoeqjIqf8ZLX7rPpOkVwsiaK/9vxttfNeQ0WKqw+g
flQ6LKYN0+OrCzDjEBm/FRQKXgxxV8k7bQHthi3hQHp18aYEE6ySSMqWzi+ak4j4fkPUmUS6s5MQ
2Yb9Hn0UOurB5XlFzHw/dT10xH+4eDu0tMiIRQbPWnP153JbVD2HXaHL/hMTW6x7+RL4zx7rteCW
5bdNG/DYlcDI3PsqK/JNf8DRGCAVSlW97xLsR13YwMNvHDs3eo8kxn9VcCIJqjZKoq+ZbeyzAKA8
mQRXgdnmNi++K8Jqy6hxF8g84KV19zoiaUJhI0NBu8QRjzEq18Y5V7HLFPiHDiYlWzVuken98HrX
YpbPFWhj5NK5xEKFl3DnLRiBRQdZFCJYkO1hII5uRvM5xnpIS7PO3AZEakYJpIAdB47eAe5KQXlw
gwM=
=xYKO
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6992-1
September 05, 2024
firefox vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Firefox.
Software Description:
- firefox: Mozilla Open Source web browser
Details:
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-8382,
CVE-2024-8383, CVE-2024-8386, CVE-2024-8387, CVE-2024-8389)
Nils Bars discovered that Firefox contained a type confusion vulnerability
when performing certain property name lookups. An attacker could
potentially exploit this issue to cause a denial of service, or execute
arbitrary code. (CVE-2024-8381)
It was discovered that Firefox did not properly manage memory during
garbage collection. An attacker could potentially exploit this issue to
cause a denial of service, or execute arbitrary code. (CVE-2024-8384)
Seunghyun Lee discovered that Firefox contained a type confusion
vulnerability when handling certain ArrayTypes. An attacker could
potentially exploit this issue to cause a denial of service, or execute
arbitrary code. (CVE-2024-8385)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS
firefox 130.0+build2-0ubuntu0.20.04.1
After a standard system update you need to restart Firefox to make all the
necessary changes
References:
https://ubuntu.com/security/notices/USN-6992-1
CVE-2024-8381, CVE-2024-8382, CVE-2024-8383, CVE-2024-8384,
CVE-2024-8385, CVE-2024-8386, CVE-2024-8387, CVE-2024-8389
Package Information:
https://launchpad.net/ubuntu/+source/firefox/130.0+build2-0ubuntu0.20.04.1
wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmbZHiMFAwAAAAAACgkQWNrRIKaTkWfy
sxAAs26/bTI97cDeBXWl9KM3htIGMfY/U+JLRes2zpB/P599uuJdxbPyw/gg/jbnk43Yd+muc6P9
CF1Rcc/tLKG5rZT1MIihwVJxIM3F8i20NGmJg7g1KhGkdQKbjM5EHFDHStRP0XqDuGiY06jCdDyv
uUycOoJK7tYSjWDJszOK5g6NiyyQa99U7UXFf4Z0FP4etLCRvNYRK+yoLYgsTn07Ie08qA9LBdiw
nEjI2lApZZ/DcRIl6pLBItcxdwD9Qyo2gU0GoeqjIqf8ZLX7rPpOkVwsiaK/9vxttfNeQ0WKqw+g
flQ6LKYN0+OrCzDjEBm/FRQKXgxxV8k7bQHthi3hQHp18aYEE6ySSMqWzi+ak4j4fkPUmUS6s5MQ
2Yb9Hn0UOurB5XlFzHw/dT10xH+4eDu0tMiIRQbPWnP153JbVD2HXaHL/hMTW6x7+RL4zx7rteCW
5bdNG/DYlcDI3PsqK/JNf8DRGCAVSlW97xLsR13YwMNvHDs3eo8kxn9VcCIJqjZKoq+ZbeyzAKA8
mQRXgdnmNi++K8Jqy6hxF8g84KV19zoiaUJhI0NBu8QRjzEq18Y5V7HLFPiHDiYlWzVuken98HrX
YpbPFWhj5NK5xEKFl3DnLRiBRQdZFCJYkO1hII5uRvM5xnpIS7PO3AZEakYJpIAdB47eAe5KQXlw
gwM=
=xYKO
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6992-1
September 05, 2024
firefox vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Firefox.
Software Description:
- firefox: Mozilla Open Source web browser
Details:
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-8382,
CVE-2024-8383, CVE-2024-8386, CVE-2024-8387, CVE-2024-8389)
Nils Bars discovered that Firefox contained a type confusion vulnerability
when performing certain property name lookups. An attacker could
potentially exploit this issue to cause a denial of service, or execute
arbitrary code. (CVE-2024-8381)
It was discovered that Firefox did not properly manage memory during
garbage collection. An attacker could potentially exploit this issue to
cause a denial of service, or execute arbitrary code. (CVE-2024-8384)
Seunghyun Lee discovered that Firefox contained a type confusion
vulnerability when handling certain ArrayTypes. An attacker could
potentially exploit this issue to cause a denial of service, or execute
arbitrary code. (CVE-2024-8385)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS
firefox 130.0+build2-0ubuntu0.20.04.1
After a standard system update you need to restart Firefox to make all the
necessary changes
References:
https://ubuntu.com/security/notices/USN-6992-1
CVE-2024-8381, CVE-2024-8382, CVE-2024-8383, CVE-2024-8384,
CVE-2024-8385, CVE-2024-8386, CVE-2024-8387, CVE-2024-8389
Package Information:
https://launchpad.net/ubuntu/+source/firefox/130.0+build2-0ubuntu0.20.04.1
FreeBSD Security Advisory FreeBSD-SA-24:14.umtx
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-24:14.umtx Security Advisory
The FreeBSD Project
Topic: umtx Kernel panic or Use-After-Free
Category: core
Module: kern
Announced: 2024-09-04
Credits: Synacktiv
Sponsored by: The FreeBSD Foundation, The Alpha-Omega Project
Affects: All supported versions of FreeBSD.
Corrected: 2024-09-04 16:00:58 UTC (stable/14, 14.1-STABLE)
2024-09-04 21:07:40 UTC (releng/14.1, 14.1-RELEASE-p4)
2024-09-04 20:54:24 UTC (releng/14.0, 14.0-RELEASE-p10)
2024-09-04 16:05:17 UTC (stable/13, 13.4-STABLE)
2024-09-04 19:58:30 UTC (releng/13.4, 13.4-RC2-p1)
2024-09-04 20:29:50 UTC (releng/13.3, 13.3-RELEASE-p6)
CVE Name: CVE-2024-43102
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
The _umtx_op(2) system call provides support for the implementation of
synchronization primitives between threads, and is used by the 1:1 Threading
Library (libthr, -lthr) to implement IEEE Std 1003.1-2001 (“POSIX.1â€) pthread
locks, like mutexes, condition variables and so on.
In particular, its UMTX_OP_SHM operation provides support for anonymous shared
memory associated to a particular physical address, which is used to implement
process-shared mutexes (PTHREAD_PROCESS_SHARED).
II. Problem Description
Concurrent removals of such a mapping by using the UMTX_SHM_DESTROY sub-request
of UMTX_OP_SHM can lead to decreasing the reference count of the object
representing the mapping too many times, causing it to be freed too early.
III. Impact
A malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can
panic the kernel or enable further Use-After-Free attacks, potentially
including code execution or Capsicum sandbox escape.
IV. Workaround
No workaround is available.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-24:14/umtx.patch
# fetch https://security.FreeBSD.org/patches/SA-24:14/umtx.patch.asc
# gpg --verify umtx.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/14/ 4938f554469b stable/14-n268665
releng/14.1/ f4a2dbb81603 releng/14.1-n267707
releng/14.0/ 37823ca38148 releng/14.0-n265444
stable/13/ a73a70472c47 stable/13-n258319
releng/13.4/ 7739dab97433 releng/13.4-n258248
releng/13.3/ 8fd0fa88b5a6 releng/13.3-n257458
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43102>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-24:14.umtx.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbY55IACgkQbljekB8A
Gu9grQ/+J7wLENdAwj/vclXgEwiqMtVBud/oWWXL6/h8YzSCOGRW88NsGrhkS+I4
ykWVdCcTvOqP8FvArarQVTfmMD/dQvAZZciHMkYDrQhjd7BwBuWVkLe1YdA1VR0o
TT5gVclbJFJP3kvC+ivusN+hVn8Iacb0bvLn47/7pBKL96cCx1aTcP9XtHJqPZAr
W80C5+4Z6qE0bUcCZ5lT8/6XvBtQNiD7otA7h5vBGMoIlBHgrxvYIz+QxAoOJ9Ke
DvwNKjAm1nYrgiAzAF7lgPWLe6TxYxfYVcyEdm2UJnVpZqldnZevjIFD4DgaijKF
dPT99EJdgkDQMqaiRM4VqlkcQvzZC/MatV9ypcStoRvQhQZczemLZdEVcf2luEdo
r6RLvCGQPiSbeANc2DV/J35oX/Zwr9KN29ttkOqisVfadIba2LXANUiAF/x3SReo
B/Gyilla4SU42obSaDuOe7fuDxj1HS4vAcJ03BQP0VfMNFkUaqb6ZoXioWhgtHAO
E1zRIJcht1Ad2mEJtMid51co40g1Gd0lcxgEF0UOaIm5gTbYGKD+9tiOBaxvXlxC
eDiKChtB31XWmfnuK4fSKh28dfyu+ltRUVsmQbakpQyufWx/RhSk3neZs44SNrwq
SEX5SZ9Rt+E8uBZYU/rDzP2N6cd9ayMANCanuh2GPjorf15Em3g=
=/sml
-----END PGP SIGNATURE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-24:14.umtx Security Advisory
The FreeBSD Project
Topic: umtx Kernel panic or Use-After-Free
Category: core
Module: kern
Announced: 2024-09-04
Credits: Synacktiv
Sponsored by: The FreeBSD Foundation, The Alpha-Omega Project
Affects: All supported versions of FreeBSD.
Corrected: 2024-09-04 16:00:58 UTC (stable/14, 14.1-STABLE)
2024-09-04 21:07:40 UTC (releng/14.1, 14.1-RELEASE-p4)
2024-09-04 20:54:24 UTC (releng/14.0, 14.0-RELEASE-p10)
2024-09-04 16:05:17 UTC (stable/13, 13.4-STABLE)
2024-09-04 19:58:30 UTC (releng/13.4, 13.4-RC2-p1)
2024-09-04 20:29:50 UTC (releng/13.3, 13.3-RELEASE-p6)
CVE Name: CVE-2024-43102
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
The _umtx_op(2) system call provides support for the implementation of
synchronization primitives between threads, and is used by the 1:1 Threading
Library (libthr, -lthr) to implement IEEE Std 1003.1-2001 (“POSIX.1â€) pthread
locks, like mutexes, condition variables and so on.
In particular, its UMTX_OP_SHM operation provides support for anonymous shared
memory associated to a particular physical address, which is used to implement
process-shared mutexes (PTHREAD_PROCESS_SHARED).
II. Problem Description
Concurrent removals of such a mapping by using the UMTX_SHM_DESTROY sub-request
of UMTX_OP_SHM can lead to decreasing the reference count of the object
representing the mapping too many times, causing it to be freed too early.
III. Impact
A malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can
panic the kernel or enable further Use-After-Free attacks, potentially
including code execution or Capsicum sandbox escape.
IV. Workaround
No workaround is available.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-24:14/umtx.patch
# fetch https://security.FreeBSD.org/patches/SA-24:14/umtx.patch.asc
# gpg --verify umtx.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/14/ 4938f554469b stable/14-n268665
releng/14.1/ f4a2dbb81603 releng/14.1-n267707
releng/14.0/ 37823ca38148 releng/14.0-n265444
stable/13/ a73a70472c47 stable/13-n258319
releng/13.4/ 7739dab97433 releng/13.4-n258248
releng/13.3/ 8fd0fa88b5a6 releng/13.3-n257458
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43102>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-24:14.umtx.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbY55IACgkQbljekB8A
Gu9grQ/+J7wLENdAwj/vclXgEwiqMtVBud/oWWXL6/h8YzSCOGRW88NsGrhkS+I4
ykWVdCcTvOqP8FvArarQVTfmMD/dQvAZZciHMkYDrQhjd7BwBuWVkLe1YdA1VR0o
TT5gVclbJFJP3kvC+ivusN+hVn8Iacb0bvLn47/7pBKL96cCx1aTcP9XtHJqPZAr
W80C5+4Z6qE0bUcCZ5lT8/6XvBtQNiD7otA7h5vBGMoIlBHgrxvYIz+QxAoOJ9Ke
DvwNKjAm1nYrgiAzAF7lgPWLe6TxYxfYVcyEdm2UJnVpZqldnZevjIFD4DgaijKF
dPT99EJdgkDQMqaiRM4VqlkcQvzZC/MatV9ypcStoRvQhQZczemLZdEVcf2luEdo
r6RLvCGQPiSbeANc2DV/J35oX/Zwr9KN29ttkOqisVfadIba2LXANUiAF/x3SReo
B/Gyilla4SU42obSaDuOe7fuDxj1HS4vAcJ03BQP0VfMNFkUaqb6ZoXioWhgtHAO
E1zRIJcht1Ad2mEJtMid51co40g1Gd0lcxgEF0UOaIm5gTbYGKD+9tiOBaxvXlxC
eDiKChtB31XWmfnuK4fSKh28dfyu+ltRUVsmQbakpQyufWx/RhSk3neZs44SNrwq
SEX5SZ9Rt+E8uBZYU/rDzP2N6cd9ayMANCanuh2GPjorf15Em3g=
=/sml
-----END PGP SIGNATURE-----
FreeBSD Security Advisory FreeBSD-SA-24:13.openssl
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-24:13.openssl Security Advisory
The FreeBSD Project
Topic: Possible DoS in X.509 name checks in OpenSSL
Category: contrib
Module: openssl
Announced: 2024-09-03
Credits: David Benjamin (Google)
Affects: FreeBSD 14.x
Corrected: 2024-09-03 17:09:21 UTC (stable/14, 14.1-STABLE)
2024-09-04 21:07:35 UTC (releng/14.1, 14.1-RELEASE-p4)
2024-09-04 20:54:20 UTC (releng/14.0, 14.0-RELEASE-p10)
CVE Name: CVE-2024-6119
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
FreeBSD includes software from the OpenSSL Project. The OpenSSL Project is a
collaborative effort to develop a robust, commercial-grade, full-featured
Open Source toolkit for the Transport Layer Security (TLS) protocol. It is
also a general-purpose cryptography library.
II. Problem Description
Applications performing certificate name checks (e.g., TLS clients checking
server certificates) may attempt to read an invalid memory address when
comparing the expected name with an otherName subject alternative name of an
X.509 certificate.
Basic certificate chain validation is not affected. The issue only occurs
when an application also specifies an expected DNS name, Email address or IP
address.
III. Impact
Applications affected by the problem may result in a termination, leading to
a denial of service.
IV. Workaround
No workaround is available.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-24:13/openssl.patch
# fetch https://security.FreeBSD.org/patches/SA-24:13/openssl.patch.asc
# gpg --verify openssl.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart all daemons that use the library, or reboot the system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/14/ 5946b0c6cbc7 stable/14-n268645
releng/14.1/ 9a5a7c90d5e5 releng/14.1-n267703
releng/14.0/ abd3a7939117 releng/14.0-n265440
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
<URL:https://www.cve.org/CVERecord?id=CVE-2024-6119>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-24:13.openssl.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbY55AACgkQbljekB8A
Gu/qxQ/9H4Iaao+a5X4aXiV1iU+fT2KSli8fMZKeRw/OOIAztSOHZp7go0noAX65
SVwsb0fShwqAfDpeZhSjzMjpMmfkwQUkRbMK1SD+zLznSmC1McKF/EIAWrMwr78z
zDLv497wh26tY+3CUZJQPwkodTvkHnwU0jeUSTjHqC+lOQeOcQ9HwL0T4FsHw4HF
BJEX/k6uabpXsQe4H9U8C3MbUlOxiKfwFZAxDBhei2zZN/kfAY63iQhVH6/Ls5BG
ei7TcEF2e6ylhdaLcCxpArRrdql1VQ4SanAGVW4MQ/2s3YpxQYweKGMg4VSZvqXt
07mBlNHcLepsHK1/qXhDqO/UMO5QsSsH1trwiohmZRQZJp4wXFsGhc102dezDbun
TEJutKpNsojvWQ01IFcykCkvH2AAGXHJTB8H3jVXhBIU6DuqcmjVc8WXbrdN0vX8
KcZgI7S5PyQ0WF+ESqR5MHGXx7Qr9uZPKSMvPq0/g2d+6G52/Yw4oZ3rZtqU34iO
uLq+FApa0Ema3jzxhq89c9oybfADpBDmYsAfqfMqexS+nIuPjeUpcv9gCukr2Of3
rJDxx2hF/1c/hd83Pp7MKBT/x/4E3vombPjeNeP/sBLhXFSKiVxUDYGYgm6yw3GA
E7rv33ZJ09RaDGp9jbYaV5rOuEWAZpy42X/LsHjI9W3v0sGCJvU=
=JDHd
-----END PGP SIGNATURE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-24:13.openssl Security Advisory
The FreeBSD Project
Topic: Possible DoS in X.509 name checks in OpenSSL
Category: contrib
Module: openssl
Announced: 2024-09-03
Credits: David Benjamin (Google)
Affects: FreeBSD 14.x
Corrected: 2024-09-03 17:09:21 UTC (stable/14, 14.1-STABLE)
2024-09-04 21:07:35 UTC (releng/14.1, 14.1-RELEASE-p4)
2024-09-04 20:54:20 UTC (releng/14.0, 14.0-RELEASE-p10)
CVE Name: CVE-2024-6119
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
FreeBSD includes software from the OpenSSL Project. The OpenSSL Project is a
collaborative effort to develop a robust, commercial-grade, full-featured
Open Source toolkit for the Transport Layer Security (TLS) protocol. It is
also a general-purpose cryptography library.
II. Problem Description
Applications performing certificate name checks (e.g., TLS clients checking
server certificates) may attempt to read an invalid memory address when
comparing the expected name with an otherName subject alternative name of an
X.509 certificate.
Basic certificate chain validation is not affected. The issue only occurs
when an application also specifies an expected DNS name, Email address or IP
address.
III. Impact
Applications affected by the problem may result in a termination, leading to
a denial of service.
IV. Workaround
No workaround is available.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-24:13/openssl.patch
# fetch https://security.FreeBSD.org/patches/SA-24:13/openssl.patch.asc
# gpg --verify openssl.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart all daemons that use the library, or reboot the system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/14/ 5946b0c6cbc7 stable/14-n268645
releng/14.1/ 9a5a7c90d5e5 releng/14.1-n267703
releng/14.0/ abd3a7939117 releng/14.0-n265440
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
<URL:https://www.cve.org/CVERecord?id=CVE-2024-6119>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-24:13.openssl.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbY55AACgkQbljekB8A
Gu/qxQ/9H4Iaao+a5X4aXiV1iU+fT2KSli8fMZKeRw/OOIAztSOHZp7go0noAX65
SVwsb0fShwqAfDpeZhSjzMjpMmfkwQUkRbMK1SD+zLznSmC1McKF/EIAWrMwr78z
zDLv497wh26tY+3CUZJQPwkodTvkHnwU0jeUSTjHqC+lOQeOcQ9HwL0T4FsHw4HF
BJEX/k6uabpXsQe4H9U8C3MbUlOxiKfwFZAxDBhei2zZN/kfAY63iQhVH6/Ls5BG
ei7TcEF2e6ylhdaLcCxpArRrdql1VQ4SanAGVW4MQ/2s3YpxQYweKGMg4VSZvqXt
07mBlNHcLepsHK1/qXhDqO/UMO5QsSsH1trwiohmZRQZJp4wXFsGhc102dezDbun
TEJutKpNsojvWQ01IFcykCkvH2AAGXHJTB8H3jVXhBIU6DuqcmjVc8WXbrdN0vX8
KcZgI7S5PyQ0WF+ESqR5MHGXx7Qr9uZPKSMvPq0/g2d+6G52/Yw4oZ3rZtqU34iO
uLq+FApa0Ema3jzxhq89c9oybfADpBDmYsAfqfMqexS+nIuPjeUpcv9gCukr2Of3
rJDxx2hF/1c/hd83Pp7MKBT/x/4E3vombPjeNeP/sBLhXFSKiVxUDYGYgm6yw3GA
E7rv33ZJ09RaDGp9jbYaV5rOuEWAZpy42X/LsHjI9W3v0sGCJvU=
=JDHd
-----END PGP SIGNATURE-----
FreeBSD Security Advisory FreeBSD-SA-24:12.bhyve
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-24:12.bhyve Security Advisory
The FreeBSD Project
Topic: bhyve(8) privileged guest escape via USB controller
Category: core
Module: bhyve
Announced: 2024-09-04
Credits: Synacktiv
Sponsored by: The FreeBSD Foundation, The Alpha-Omega Project
Affects: All supported versions of FreeBSD.
Corrected: 2024-09-04 15:42:30 UTC (stable/14, 14.1-STABLE)
2024-09-04 21:07:34 UTC (releng/14.1, 14.1-RELEASE-p4)
2024-09-04 20:54:19 UTC (releng/14.0, 14.0-RELEASE-p10)
2024-09-04 15:45:38 UTC (stable/13, 13.4-STABLE)
2024-09-04 19:58:26 UTC (releng/13.4, 13.4-RC2-p1)
2024-09-04 20:29:46 UTC (releng/13.3, 13.3-RELEASE-p6)
CVE Name: CVE-2024-32668
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
bhyve(8) is a hypervisor that runs guest operating systems inside a virtual
machine.
II. Problem Description
bhyve can be configured to emulate devices on a virtual USB controller (XHCI),
such as USB tablet devices. An insufficient boundary validation in the USB code
could lead to an out-of-bounds write on the heap, with data controlled by the
caller.
III. Impact
A malicious, privileged software running in a guest VM can exploit the
vulnerability to achieve code execution on the host in the bhyve userspace
process, which typically runs as root. Note that bhyve runs in a Capsicum
sandbox, so malicious code is constrained by the capabilities available to the
bhyve process.
IV. Workaround
No workaround is available, but VMs that do not make the XHCI device
available to the guest (via `bhyve -s xhci,...`) are not impacted.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Guest operating systems emulating USB devices with XHCI need to be restarted for
the correction to be applied. (i.e., their corresponding bhyve process needs to
be terminated and started again)
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-24:12/bhyve.patch
# fetch https://security.FreeBSD.org/patches/SA-24:12/bhyve.patch.asc
# gpg --verify bhyve.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart the corresponding bhyve processes, or reboot the system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/14/ 90af1336ed5e stable/14-n268657
releng/14.1/ bb245c142075 releng/14.1-n267702
releng/14.0/ 1d01a6c11210 releng/14.0-n265439
stable/13/ 5920b7e6eea1 stable/13-n258311
releng/13.4/ b3f0e555781c releng/13.4-n258244
releng/13.3/ 5d6576f4f000 releng/13.3-n257454
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
The corresponding part of the security audit report as provided by Synacktiv
will be published in due course.
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32668>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-24:12.bhyve.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbY544ACgkQbljekB8A
Gu+rCw/9FKPcF1L1kRh6J9Y6TLEmMIQx95YwodI4O11KMjgEL3wnz36p/Mrkrj8Z
g8h2+OBmqdr8NegyKHIuOHo8j9M892dnZpGWjyCgtbpnc57rXZhm83DDzRQ2r9OP
7yOWftWjgje1cyTphlFAr2p6IWg6z+6UicGwmeV17FSaG5rPjWuYoOOt63kzk3NA
0viDPIgLpoyGRCaiXa/sdoM2YQH9FxzKEC2yeURF/mLSPEFhaMO6SS8nrxmRC9Wc
f8DP5G00I3RPjAQ5ehXc5n0z88SHGKJc/dstI4jSzguyBNO8HQtCD6HC6uEo0ACV
EEJ80FJ+TOfZ9fhHkyEpGfMxwsAjpzud0zZWKV8+4jeY3kIp94g8MCKrHkLr6hXL
0+DMBsdqNS3T7lPzIimhJ7cwk/fXVQvUWu3rGBO33l3IUK0BWz/o3cTARTPEl/Zi
MMBETwn+ga6JioRBTmmOMazufAyA3Nlf/eRzIc9RGTUBjoqnY0jHzdwfPI8hDKXR
1bi1Rii8IcAmaHvMkGww6PJOkRTV8uyuW6JZ2te8V8PC5ojdUniYq5JN6mbrkpOR
RIYt3f16o6ANZ9qgMqmq2gdBBnJ80LDkQa71FV1bDf9g/LEd5aDynloaZb5D3EMp
0J0ZIPKKy/qprhVzEjxROzhLzNH0bJy6yaQhoxPY3QLzU78qrE4=
=nYwM
-----END PGP SIGNATURE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-24:12.bhyve Security Advisory
The FreeBSD Project
Topic: bhyve(8) privileged guest escape via USB controller
Category: core
Module: bhyve
Announced: 2024-09-04
Credits: Synacktiv
Sponsored by: The FreeBSD Foundation, The Alpha-Omega Project
Affects: All supported versions of FreeBSD.
Corrected: 2024-09-04 15:42:30 UTC (stable/14, 14.1-STABLE)
2024-09-04 21:07:34 UTC (releng/14.1, 14.1-RELEASE-p4)
2024-09-04 20:54:19 UTC (releng/14.0, 14.0-RELEASE-p10)
2024-09-04 15:45:38 UTC (stable/13, 13.4-STABLE)
2024-09-04 19:58:26 UTC (releng/13.4, 13.4-RC2-p1)
2024-09-04 20:29:46 UTC (releng/13.3, 13.3-RELEASE-p6)
CVE Name: CVE-2024-32668
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
bhyve(8) is a hypervisor that runs guest operating systems inside a virtual
machine.
II. Problem Description
bhyve can be configured to emulate devices on a virtual USB controller (XHCI),
such as USB tablet devices. An insufficient boundary validation in the USB code
could lead to an out-of-bounds write on the heap, with data controlled by the
caller.
III. Impact
A malicious, privileged software running in a guest VM can exploit the
vulnerability to achieve code execution on the host in the bhyve userspace
process, which typically runs as root. Note that bhyve runs in a Capsicum
sandbox, so malicious code is constrained by the capabilities available to the
bhyve process.
IV. Workaround
No workaround is available, but VMs that do not make the XHCI device
available to the guest (via `bhyve -s xhci,...`) are not impacted.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Guest operating systems emulating USB devices with XHCI need to be restarted for
the correction to be applied. (i.e., their corresponding bhyve process needs to
be terminated and started again)
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-24:12/bhyve.patch
# fetch https://security.FreeBSD.org/patches/SA-24:12/bhyve.patch.asc
# gpg --verify bhyve.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart the corresponding bhyve processes, or reboot the system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/14/ 90af1336ed5e stable/14-n268657
releng/14.1/ bb245c142075 releng/14.1-n267702
releng/14.0/ 1d01a6c11210 releng/14.0-n265439
stable/13/ 5920b7e6eea1 stable/13-n258311
releng/13.4/ b3f0e555781c releng/13.4-n258244
releng/13.3/ 5d6576f4f000 releng/13.3-n257454
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
The corresponding part of the security audit report as provided by Synacktiv
will be published in due course.
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32668>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-24:12.bhyve.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbY544ACgkQbljekB8A
Gu+rCw/9FKPcF1L1kRh6J9Y6TLEmMIQx95YwodI4O11KMjgEL3wnz36p/Mrkrj8Z
g8h2+OBmqdr8NegyKHIuOHo8j9M892dnZpGWjyCgtbpnc57rXZhm83DDzRQ2r9OP
7yOWftWjgje1cyTphlFAr2p6IWg6z+6UicGwmeV17FSaG5rPjWuYoOOt63kzk3NA
0viDPIgLpoyGRCaiXa/sdoM2YQH9FxzKEC2yeURF/mLSPEFhaMO6SS8nrxmRC9Wc
f8DP5G00I3RPjAQ5ehXc5n0z88SHGKJc/dstI4jSzguyBNO8HQtCD6HC6uEo0ACV
EEJ80FJ+TOfZ9fhHkyEpGfMxwsAjpzud0zZWKV8+4jeY3kIp94g8MCKrHkLr6hXL
0+DMBsdqNS3T7lPzIimhJ7cwk/fXVQvUWu3rGBO33l3IUK0BWz/o3cTARTPEl/Zi
MMBETwn+ga6JioRBTmmOMazufAyA3Nlf/eRzIc9RGTUBjoqnY0jHzdwfPI8hDKXR
1bi1Rii8IcAmaHvMkGww6PJOkRTV8uyuW6JZ2te8V8PC5ojdUniYq5JN6mbrkpOR
RIYt3f16o6ANZ9qgMqmq2gdBBnJ80LDkQa71FV1bDf9g/LEd5aDynloaZb5D3EMp
0J0ZIPKKy/qprhVzEjxROzhLzNH0bJy6yaQhoxPY3QLzU78qrE4=
=nYwM
-----END PGP SIGNATURE-----
FreeBSD Security Advisory FreeBSD-SA-24:11.ctl
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-24:11.ctl Security Advisory
The FreeBSD Project
Topic: Multiple issues in ctl(4) CAM Target Layer
Category: core
Module: ctl
Announced: 2024-09-04
Credits: Synacktiv
Sponsored by: The FreeBSD Foundation, The Alpha-Omega Project
Affects: All supported versions of FreeBSD.
Corrected: 2024-09-04 15:51:07 UTC (stable/14, 14.1-STABLE)
2024-09-04 21:07:33 UTC (releng/14.1, 14.1-RELEASE-p4)
2024-09-04 20:54:18 UTC (releng/14.0, 14.0-RELEASE-p10)
2024-09-04 15:53:53 UTC (stable/13, 13.4-STABLE)
2024-09-04 19:58:25 UTC (releng/13.4, 13.4-RC2-p1)
2024-09-04 20:29:45 UTC (releng/13.3, 13.3-RELEASE-p6)
CVE Name: CVE-2024-8178, CVE-2024-42416, CVE-2024-43110,
CVE-2024-45063
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
The ctl subsystem provides SCSI target devices emulation. The bhyve(8)
hypervisor and ctld(8) iSCSI target daemon make use of ctl.
II. Problem Description
Several vulnerabilities were found in the ctl subsystem.
The function ctl_write_buffer incorrectly set a flag which resulted in a
kernel Use-After-Free when a command finished processing (CVE-2024-45063).
The ctl_write_buffer and ctl_read_buffer functions allocated memory to be
returned to userspace, without initializing it (CVE-2024-8178).
The ctl_report_supported_opcodes function did not sufficiently validate a
field provided by userspace, allowing an arbitrary write to a limited amount
of kernel help memory (CVE-2024-42416).
The ctl_request_sense function could expose up to three bytes of the kernel
heap to userspace (CVE-2024-43110).
Guest virtual machines in the bhyve hypervisor can send SCSI commands to the
corresponding kernel driver via the virtio_scsi interface. This provides
guests with direct access to the vulnerabilities covered by this advisory.
The CAM Target Layer iSCSI target daemon ctld(8) accepts incoming iSCSI
connections, performs authentication and passes connections to the kernel
ctl(4) target layer.
III. Impact
Malicious software running in a guest VM that exposes virtio_scsi can exploit
the vulnerabilities to achieve code execution on the host in the bhyve
userspace process, which typically runs as root. Note that bhyve runs in a
Capsicum sandbox, so malicious code is constrained by the capabilities
available to the bhyve process.
A malicious iSCSI initiator could achieve remote code execution on the iSCSI
target host.
IV. Workaround
No workaround is available.
bhyve VMs that do not make use of virtio_scsi (for instance, via
`bhyve -s NN,virtio-scsi,...`), and hosts that do not export iSCSI targets,
are not affected.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
The system should be rebooted in order to effectively mitigate the issue with
certainty.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 13.3, 14.0, 14.1]
# fetch https://security.FreeBSD.org/patches/SA-24:11/ctl.patch
# fetch https://security.FreeBSD.org/patches/SA-24:11/ctl.patch.asc
# gpg --verify ctl.patch.asc
[FreeBSD 13.4]
# fetch https://security.FreeBSD.org/patches/SA-24:11/ctl-13.4.patch
# fetch https://security.FreeBSD.org/patches/SA-24:11/ctl-13.4.patch.asc
# gpg --verify ctl-13.4.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/14/ 803e0c2ab29b stable/14-n268660
releng/14.1/ d30ffde0806e releng/14.1-n267701
releng/14.0/ 4c60b8289d0e releng/14.0-n265438
stable/13/ c8afc072690f stable/13-n258314
releng/13.4/ 004298792002 releng/13.4-n258243
releng/13.3/ 639494a3c1e6 releng/13.3-n257453
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
The corresponding part of the security audit report as provided by Synacktiv
will be published in due course.
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8178>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42416>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43110>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45063>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-24:11.ctl.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbY54sACgkQbljekB8A
Gu9gEBAArLEF2hSMAo63riezMWcREkF+3r7GfgOmKNq1CWFgfA/ikjZKxIxAojEj
il6LBgEPQl7jhcC/eG2/U80gze5AtSsQpdCN5DgaQa4rrq4C8dIu8Q8DI/ZGkkAD
1oFQ5iz9IW0fszjCgwvdnEZt0wEvcMi8d3GzJddouVVxPgcTatw0VbMZWH9ZrpFA
pwgybyntTE3IG1DqOmFWqjZmjV55BESlphp3LoheWYR21iGwuMsZWBWZ7+c9IK2j
6RP7ZBN6F/IEr0Np0G22iqUcgQOyA20zL1EJPq93Hp7OdxTMLSgggg1zq3GMEZi6
A8rjLHmiC6SIIjv7cFohU6vHHrUQkvkx1U0xmtI32StHowKf/Mn5wL8e+i+5g/JE
vPG6vmFRDUvMqWjB/GK0atyZ7pFHMX9s75NcI7q846Rg0IW9birlgFfqZEQOndH+
O4AM2oQWOENg9FavMkZ9ScaR2/m2wQR8c4H3BLmAz6Q4R2+QQAjlDu2DtsLWFEeW
3DNna0/Lw67yDXv2+hJcj+WwQxxWBW3yEz6OVVdszdOofLy8eyUXHo2XGUFJZQKG
ZpplFPuvq1ZEci544hRDmjGhdKH9h6UoUAOiZQz9vJbx0GyCnhiunyIcM9gN+Rmk
KGP0t+jEDaMjkAWsu5w0qju68cFMRwEP1E+fT5atsmvnzQR+Zqo=
=eocJ
-----END PGP SIGNATURE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-24:11.ctl Security Advisory
The FreeBSD Project
Topic: Multiple issues in ctl(4) CAM Target Layer
Category: core
Module: ctl
Announced: 2024-09-04
Credits: Synacktiv
Sponsored by: The FreeBSD Foundation, The Alpha-Omega Project
Affects: All supported versions of FreeBSD.
Corrected: 2024-09-04 15:51:07 UTC (stable/14, 14.1-STABLE)
2024-09-04 21:07:33 UTC (releng/14.1, 14.1-RELEASE-p4)
2024-09-04 20:54:18 UTC (releng/14.0, 14.0-RELEASE-p10)
2024-09-04 15:53:53 UTC (stable/13, 13.4-STABLE)
2024-09-04 19:58:25 UTC (releng/13.4, 13.4-RC2-p1)
2024-09-04 20:29:45 UTC (releng/13.3, 13.3-RELEASE-p6)
CVE Name: CVE-2024-8178, CVE-2024-42416, CVE-2024-43110,
CVE-2024-45063
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
The ctl subsystem provides SCSI target devices emulation. The bhyve(8)
hypervisor and ctld(8) iSCSI target daemon make use of ctl.
II. Problem Description
Several vulnerabilities were found in the ctl subsystem.
The function ctl_write_buffer incorrectly set a flag which resulted in a
kernel Use-After-Free when a command finished processing (CVE-2024-45063).
The ctl_write_buffer and ctl_read_buffer functions allocated memory to be
returned to userspace, without initializing it (CVE-2024-8178).
The ctl_report_supported_opcodes function did not sufficiently validate a
field provided by userspace, allowing an arbitrary write to a limited amount
of kernel help memory (CVE-2024-42416).
The ctl_request_sense function could expose up to three bytes of the kernel
heap to userspace (CVE-2024-43110).
Guest virtual machines in the bhyve hypervisor can send SCSI commands to the
corresponding kernel driver via the virtio_scsi interface. This provides
guests with direct access to the vulnerabilities covered by this advisory.
The CAM Target Layer iSCSI target daemon ctld(8) accepts incoming iSCSI
connections, performs authentication and passes connections to the kernel
ctl(4) target layer.
III. Impact
Malicious software running in a guest VM that exposes virtio_scsi can exploit
the vulnerabilities to achieve code execution on the host in the bhyve
userspace process, which typically runs as root. Note that bhyve runs in a
Capsicum sandbox, so malicious code is constrained by the capabilities
available to the bhyve process.
A malicious iSCSI initiator could achieve remote code execution on the iSCSI
target host.
IV. Workaround
No workaround is available.
bhyve VMs that do not make use of virtio_scsi (for instance, via
`bhyve -s NN,virtio-scsi,...`), and hosts that do not export iSCSI targets,
are not affected.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
The system should be rebooted in order to effectively mitigate the issue with
certainty.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 13.3, 14.0, 14.1]
# fetch https://security.FreeBSD.org/patches/SA-24:11/ctl.patch
# fetch https://security.FreeBSD.org/patches/SA-24:11/ctl.patch.asc
# gpg --verify ctl.patch.asc
[FreeBSD 13.4]
# fetch https://security.FreeBSD.org/patches/SA-24:11/ctl-13.4.patch
# fetch https://security.FreeBSD.org/patches/SA-24:11/ctl-13.4.patch.asc
# gpg --verify ctl-13.4.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/14/ 803e0c2ab29b stable/14-n268660
releng/14.1/ d30ffde0806e releng/14.1-n267701
releng/14.0/ 4c60b8289d0e releng/14.0-n265438
stable/13/ c8afc072690f stable/13-n258314
releng/13.4/ 004298792002 releng/13.4-n258243
releng/13.3/ 639494a3c1e6 releng/13.3-n257453
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
The corresponding part of the security audit report as provided by Synacktiv
will be published in due course.
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8178>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42416>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43110>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45063>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-24:11.ctl.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbY54sACgkQbljekB8A
Gu9gEBAArLEF2hSMAo63riezMWcREkF+3r7GfgOmKNq1CWFgfA/ikjZKxIxAojEj
il6LBgEPQl7jhcC/eG2/U80gze5AtSsQpdCN5DgaQa4rrq4C8dIu8Q8DI/ZGkkAD
1oFQ5iz9IW0fszjCgwvdnEZt0wEvcMi8d3GzJddouVVxPgcTatw0VbMZWH9ZrpFA
pwgybyntTE3IG1DqOmFWqjZmjV55BESlphp3LoheWYR21iGwuMsZWBWZ7+c9IK2j
6RP7ZBN6F/IEr0Np0G22iqUcgQOyA20zL1EJPq93Hp7OdxTMLSgggg1zq3GMEZi6
A8rjLHmiC6SIIjv7cFohU6vHHrUQkvkx1U0xmtI32StHowKf/Mn5wL8e+i+5g/JE
vPG6vmFRDUvMqWjB/GK0atyZ7pFHMX9s75NcI7q846Rg0IW9birlgFfqZEQOndH+
O4AM2oQWOENg9FavMkZ9ScaR2/m2wQR8c4H3BLmAz6Q4R2+QQAjlDu2DtsLWFEeW
3DNna0/Lw67yDXv2+hJcj+WwQxxWBW3yEz6OVVdszdOofLy8eyUXHo2XGUFJZQKG
ZpplFPuvq1ZEci544hRDmjGhdKH9h6UoUAOiZQz9vJbx0GyCnhiunyIcM9gN+Rmk
KGP0t+jEDaMjkAWsu5w0qju68cFMRwEP1E+fT5atsmvnzQR+Zqo=
=eocJ
-----END PGP SIGNATURE-----
FreeBSD Security Advisory FreeBSD-SA-24:10.bhyve
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-24:10.bhyve Security Advisory
The FreeBSD Project
Topic: bhyve(8) privileged guest escape via TPM device passthrough
Category: core
Module: bhyve
Announced: 2024-09-04
Credits: Synacktiv
Sponsored by: The FreeBSD Foundation, The Alpha-Omega Project
Affects: FreeBSD 14.x
Corrected: 2024-09-04 15:42:29 UTC (stable/14, 14.1-STABLE)
2024-09-04 21:07:28 UTC (releng/14.1, 14.1-RELEASE-p4)
2024-09-04 20:54:13 UTC (releng/14.0, 14.0-RELEASE-p10)
CVE Name: CVE-2024-41928
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
bhyve(8) is a hypervisor that runs guest operating systems inside a virtual
machine.
II. Problem Description
bhyve can be configured to provide access to the host's TPM device, where it
passes the communication through an emulated device provided to the guest. This
may be performed on the command-line by starting bhyve with the
`-l tpm,passthru,/dev/tpmX` parameters.
The MMIO handler for the emulated device did not validate the offset and size
of the memory access correctly, allowing guests to read and write memory
contents outside of the memory area effectively allocated.
III. Impact
Malicious software running in a guest VM can exploit the buffer overflow to
achieve code execution on the host in the bhyve userspace process, which
typically runs as root. Note that bhyve runs in a Capsicum sandbox, so
malicious code is constrained by the capabilities available to the bhyve
process.
IV. Workaround
No workaround is available, but guests that do not use TPM passthrough are
not impacted.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Guest operating systems exposing the TPM device need to be restarted for the
correction to be applied. (i.e., their corresponding bhyve process needs to be
terminated and started again)
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-24:10/bhyve.patch
# fetch https://security.FreeBSD.org/patches/SA-24:10/bhyve.patch.asc
# gpg --verify bhyve.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart the corresponding bhyve processes, or reboot the system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/14/ 6ce4821f0859 stable/14-n268656
releng/14.1/ eab723be7542 releng/14.1-n267697
releng/14.0/ 429f200688ca releng/14.0-n265434
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
The corresponding part of the security audit report as provided by Synacktiv
will be published in due course.
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41928>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-24:10.bhyve.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbY54kACgkQbljekB8A
Gu9vGg//YkEx8/3PWE8GUfdwfGrzMD+bpXoJViBIW+CX4tYYDU05CzF9i/FbB93B
629nWU4HMmTrQfARtpC/VCRASz+v6kSJvsOwt2120GVx5SUuFkP2nw3fCWdH5tqu
c/M4GRT2Brl4ZJFZGdfXCKYvGKnw68qhuX6CWFhXgAPAlj2VHNCluElriGMsuPs9
mmu6/YX5vwVps8dj1XJqx8TFv81PXyatBbzmDi4VMpeBkcM6RBjzDl3C9XVh2k9S
ahPVp9yW/bXLS2U5GA+rTK4PNIJukZ5tRb2DXH3g5Ku9l6s2l3b8oof6kNifhwf7
1L8QeTYabkeeGgCfpKmQb7ouZoAHw2fe6M64X/IAkWM46XejiV0mzRokjrG9VIPf
Ushi7hnEbI7Kzxw/H280R/lgsQh/o8+fF+3iFDij/GPKoWlLVy4WnLluihXkE2Xd
wlFxD80CKVxGi18JBjCIo7sFrLPuec1rGPn9sULCf2Yi5TnRnBYp9OzD7wSx5zIR
ohm6zKfajdyVlis9HLm1Xee4B7dEEbZWn6seo3DclCTIO22esN3Kjs8ovSyv1KFn
B0m0bR8YbJ0qVT/jDYdWkZmJW/EmmZpMMAN91G0q+M9m8Od4e81iQZknvujPsw+I
QjM5FlKvEuYXjt2tMxP35Dq8PXdl3jvY0fqTNrkCpuzKK0q76sM=
=VI0d
-----END PGP SIGNATURE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-24:10.bhyve Security Advisory
The FreeBSD Project
Topic: bhyve(8) privileged guest escape via TPM device passthrough
Category: core
Module: bhyve
Announced: 2024-09-04
Credits: Synacktiv
Sponsored by: The FreeBSD Foundation, The Alpha-Omega Project
Affects: FreeBSD 14.x
Corrected: 2024-09-04 15:42:29 UTC (stable/14, 14.1-STABLE)
2024-09-04 21:07:28 UTC (releng/14.1, 14.1-RELEASE-p4)
2024-09-04 20:54:13 UTC (releng/14.0, 14.0-RELEASE-p10)
CVE Name: CVE-2024-41928
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
bhyve(8) is a hypervisor that runs guest operating systems inside a virtual
machine.
II. Problem Description
bhyve can be configured to provide access to the host's TPM device, where it
passes the communication through an emulated device provided to the guest. This
may be performed on the command-line by starting bhyve with the
`-l tpm,passthru,/dev/tpmX` parameters.
The MMIO handler for the emulated device did not validate the offset and size
of the memory access correctly, allowing guests to read and write memory
contents outside of the memory area effectively allocated.
III. Impact
Malicious software running in a guest VM can exploit the buffer overflow to
achieve code execution on the host in the bhyve userspace process, which
typically runs as root. Note that bhyve runs in a Capsicum sandbox, so
malicious code is constrained by the capabilities available to the bhyve
process.
IV. Workaround
No workaround is available, but guests that do not use TPM passthrough are
not impacted.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
Guest operating systems exposing the TPM device need to be restarted for the
correction to be applied. (i.e., their corresponding bhyve process needs to be
terminated and started again)
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-24:10/bhyve.patch
# fetch https://security.FreeBSD.org/patches/SA-24:10/bhyve.patch.asc
# gpg --verify bhyve.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart the corresponding bhyve processes, or reboot the system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/14/ 6ce4821f0859 stable/14-n268656
releng/14.1/ eab723be7542 releng/14.1-n267697
releng/14.0/ 429f200688ca releng/14.0-n265434
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
The corresponding part of the security audit report as provided by Synacktiv
will be published in due course.
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41928>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-24:10.bhyve.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbY54kACgkQbljekB8A
Gu9vGg//YkEx8/3PWE8GUfdwfGrzMD+bpXoJViBIW+CX4tYYDU05CzF9i/FbB93B
629nWU4HMmTrQfARtpC/VCRASz+v6kSJvsOwt2120GVx5SUuFkP2nw3fCWdH5tqu
c/M4GRT2Brl4ZJFZGdfXCKYvGKnw68qhuX6CWFhXgAPAlj2VHNCluElriGMsuPs9
mmu6/YX5vwVps8dj1XJqx8TFv81PXyatBbzmDi4VMpeBkcM6RBjzDl3C9XVh2k9S
ahPVp9yW/bXLS2U5GA+rTK4PNIJukZ5tRb2DXH3g5Ku9l6s2l3b8oof6kNifhwf7
1L8QeTYabkeeGgCfpKmQb7ouZoAHw2fe6M64X/IAkWM46XejiV0mzRokjrG9VIPf
Ushi7hnEbI7Kzxw/H280R/lgsQh/o8+fF+3iFDij/GPKoWlLVy4WnLluihXkE2Xd
wlFxD80CKVxGi18JBjCIo7sFrLPuec1rGPn9sULCf2Yi5TnRnBYp9OzD7wSx5zIR
ohm6zKfajdyVlis9HLm1Xee4B7dEEbZWn6seo3DclCTIO22esN3Kjs8ovSyv1KFn
B0m0bR8YbJ0qVT/jDYdWkZmJW/EmmZpMMAN91G0q+M9m8Od4e81iQZknvujPsw+I
QjM5FlKvEuYXjt2tMxP35Dq8PXdl3jvY0fqTNrkCpuzKK0q76sM=
=VI0d
-----END PGP SIGNATURE-----
FreeBSD Security Advisory FreeBSD-SA-24:09.libnv
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-24:09.libnv Security Advisory
The FreeBSD Project
Topic: Multiple vulnerabilities in libnv
Category: core
Module: libnv
Announced: 2024-09-04
Credits: Taylor R Campbell (NetBSD, CVE-2024-45287)
Synacktiv (CVE-2024-45287, CVE-2024-45288)
Sponsored by: The FreeBSD Foundation, The Alpha-Omega Project
Affects: All supported versions of FreeBSD.
Corrected: 2024-09-04 12:24:56 UTC (stable/14, 14.1-STABLE)
2024-09-04 21:07:27 UTC (releng/14.1, 14.1-RELEASE-p4)
2024-09-04 20:54:12 UTC (releng/14.0, 14.0-RELEASE-p10)
2024-09-04 12:24:12 UTC (stable/13, 13.4-STABLE)
2024-09-04 19:13:10 UTC (releng/13.4, 13.4-RC2-p1)
2024-09-04 20:29:40 UTC (releng/13.3, 13.3-RELEASE-p6)
CVE Name: CVE-2024-45287, CVE-2024-45288
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
libnv (also called nvlist) is a general-purpose library designed for storing
name-value pairs. This library can serve as an Inter-Process Communication
(IPC) framework, enabling processes to exchange data. For example, it is
used in libcasper to communicate between privileged and unprivileged
processes. Additionally, libnv can function as an interface for communication
between userland and kernel.
Originally, libnv was inspired by OpenZFS nvlist. However, the
implementations are separate. This advisory is only about base system
implementation of libnv, not a OpenZFS one.
II. Problem Description
CVE-2024-45287 is a vulnerability that affects both the kernel and userland.
A malicious value of size in a structure of packed libnv can cause an integer
overflow, leading to the allocation of a smaller buffer than required for the
parsed data.
CVE-2024-45288 is a vulnerability that affects both the kernel and userland.
A missing null-termination character in the last element of an nvlist array
string can lead to writing outside the allocated buffer.
III. Impact
It is possible for an attacker to overwrite portions of memory (in userland
or the kernel) as the allocated buffer might be smaller than the data
received from a malicious process. This vulnerability could result in
privilege escalation or cause a system panic.
IV. Workaround
No workaround is available.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date
and reboot.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-24:09/libnv.patch
# fetch https://security.FreeBSD.org/patches/SA-24:09/libnv.patch.asc
# gpg --verify libnv.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
d) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/14/ 9c2ef102166e stable/14-n268655
releng/14.1/ d87f821959fb releng/14.1-n267696
releng/14.0/ b219ce1c5a93 releng/14.0-n265433
stable/13/ 03bef9971d73 stable/13-n258309
releng/13.4/ 3aa9be7e3334 releng/13.4-n258240
releng/13.3/ 33b4e2361c82 releng/13.3-n257449
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45287>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45288>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-24:09.libnv.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbY54cACgkQbljekB8A
Gu8YLRAAmpVVVib8RgEj0bKS5qNLwujEssMIO96LS73txcFGm/Iy+QJA/N/SRtDL
lnKRi0ya90pBmXXhX03Uei+O/nBAFxkCxCukuQ36bauJrA74RFgn/8ZK63RbvdDE
K+xAyK71FXLTr+wGqyzv0xOxNA60dl14WiyaLCUX++0DU3EesmVD508wIL7Ls/bS
5g5vllxmELV2zXYXY/DbEVHS/i2YRCs8ftasa92uXVgOibODVpL/GSXy1QHyykNQ
ODAmGjs+p0xf2JDJa2qvokMh4WS4HkGe4W/TcJueTiSbsdOrDDhOV/n0QTgwt1rQ
zq2QQU3tk2unYjhQrR6ZvHTbFCKc7G3BVFCPAZ6fSthq834EoCr2LUGyYhU+bLZ6
SweQfCP48ExjIqvDzQqMOlvp9rMiLbxpjkdDcsml4zhD2GE+byuT6RSRBqq3tBvT
893YoIiW1m069DnAQxh1Zlewsk/BZFeeXBHZdk4Ik5KYFCwCabV3HLFa9hA1/iKx
5ITULL0gZgZKBQ9IbpkL45q9mcDHXrVuMPfA0a3bb38rpoK5uof25+oKSGGvWyDA
plGXuEh5Sltmx0lOdY2O70j8pLh7bVJCyo5rYDhObzQlWiajUx1pH3M9DePbI+Rk
Z+Gby0zKpXzgSfHSiSyfVPgDMa83yDpiozRMszjpvApB7h/hekQ=
=yX5r
-----END PGP SIGNATURE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-24:09.libnv Security Advisory
The FreeBSD Project
Topic: Multiple vulnerabilities in libnv
Category: core
Module: libnv
Announced: 2024-09-04
Credits: Taylor R Campbell (NetBSD, CVE-2024-45287)
Synacktiv (CVE-2024-45287, CVE-2024-45288)
Sponsored by: The FreeBSD Foundation, The Alpha-Omega Project
Affects: All supported versions of FreeBSD.
Corrected: 2024-09-04 12:24:56 UTC (stable/14, 14.1-STABLE)
2024-09-04 21:07:27 UTC (releng/14.1, 14.1-RELEASE-p4)
2024-09-04 20:54:12 UTC (releng/14.0, 14.0-RELEASE-p10)
2024-09-04 12:24:12 UTC (stable/13, 13.4-STABLE)
2024-09-04 19:13:10 UTC (releng/13.4, 13.4-RC2-p1)
2024-09-04 20:29:40 UTC (releng/13.3, 13.3-RELEASE-p6)
CVE Name: CVE-2024-45287, CVE-2024-45288
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
libnv (also called nvlist) is a general-purpose library designed for storing
name-value pairs. This library can serve as an Inter-Process Communication
(IPC) framework, enabling processes to exchange data. For example, it is
used in libcasper to communicate between privileged and unprivileged
processes. Additionally, libnv can function as an interface for communication
between userland and kernel.
Originally, libnv was inspired by OpenZFS nvlist. However, the
implementations are separate. This advisory is only about base system
implementation of libnv, not a OpenZFS one.
II. Problem Description
CVE-2024-45287 is a vulnerability that affects both the kernel and userland.
A malicious value of size in a structure of packed libnv can cause an integer
overflow, leading to the allocation of a smaller buffer than required for the
parsed data.
CVE-2024-45288 is a vulnerability that affects both the kernel and userland.
A missing null-termination character in the last element of an nvlist array
string can lead to writing outside the allocated buffer.
III. Impact
It is possible for an attacker to overwrite portions of memory (in userland
or the kernel) as the allocated buffer might be smaller than the data
received from a malicious process. This vulnerability could result in
privilege escalation or cause a system panic.
IV. Workaround
No workaround is available.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date
and reboot.
Perform one of the following:
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for a security update"
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-24:09/libnv.patch
# fetch https://security.FreeBSD.org/patches/SA-24:09/libnv.patch.asc
# gpg --verify libnv.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
d) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/14/ 9c2ef102166e stable/14-n268655
releng/14.1/ d87f821959fb releng/14.1-n267696
releng/14.0/ b219ce1c5a93 releng/14.0-n265433
stable/13/ 03bef9971d73 stable/13-n258309
releng/13.4/ 3aa9be7e3334 releng/13.4-n258240
releng/13.3/ 33b4e2361c82 releng/13.3-n257449
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45287>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45288>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-24:09.libnv.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbY54cACgkQbljekB8A
Gu8YLRAAmpVVVib8RgEj0bKS5qNLwujEssMIO96LS73txcFGm/Iy+QJA/N/SRtDL
lnKRi0ya90pBmXXhX03Uei+O/nBAFxkCxCukuQ36bauJrA74RFgn/8ZK63RbvdDE
K+xAyK71FXLTr+wGqyzv0xOxNA60dl14WiyaLCUX++0DU3EesmVD508wIL7Ls/bS
5g5vllxmELV2zXYXY/DbEVHS/i2YRCs8ftasa92uXVgOibODVpL/GSXy1QHyykNQ
ODAmGjs+p0xf2JDJa2qvokMh4WS4HkGe4W/TcJueTiSbsdOrDDhOV/n0QTgwt1rQ
zq2QQU3tk2unYjhQrR6ZvHTbFCKc7G3BVFCPAZ6fSthq834EoCr2LUGyYhU+bLZ6
SweQfCP48ExjIqvDzQqMOlvp9rMiLbxpjkdDcsml4zhD2GE+byuT6RSRBqq3tBvT
893YoIiW1m069DnAQxh1Zlewsk/BZFeeXBHZdk4Ik5KYFCwCabV3HLFa9hA1/iKx
5ITULL0gZgZKBQ9IbpkL45q9mcDHXrVuMPfA0a3bb38rpoK5uof25+oKSGGvWyDA
plGXuEh5Sltmx0lOdY2O70j8pLh7bVJCyo5rYDhObzQlWiajUx1pH3M9DePbI+Rk
Z+Gby0zKpXzgSfHSiSyfVPgDMa83yDpiozRMszjpvApB7h/hekQ=
=yX5r
-----END PGP SIGNATURE-----
FreeBSD Errata Notice FreeBSD-EN-24:15.calendar
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-EN-24:15.calendar Errata Notice
The FreeBSD Project
Topic: cron(8) / periodic(8) session login
Category: core
Module: periodic
Announced: 2024-09-04
Affects: All supported versions of FreeBSD.
Corrected: 2024-08-08 20:07:04 UTC (stable/14, 14.1-STABLE)
2024-09-04 21:34:23 UTC (releng/14.1, 14.1-RELEASE-p4)
2024-09-04 20:54:10 UTC (releng/14.0, 14.0-RELEASE-p10)
2024-08-08 20:07:07 UTC (stable/13, 13.4-STABLE)
2024-08-14 03:37:16 UTC (releng/13.4, 13.4-BETA3)
2024-09-04 20:29:38 UTC (releng/13.3, 13.3-RELEASE-p6)
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.FreeBSD.org/>.
I. Background
periodic(8) is run via cron(8) as root to perform periodic system functions to
be executed on a daily, weekly, or monthly basis.
II. Problem Description
periodic(8) jobs are typically run in a context as the `root` user, but an
erratum in calendar(1) may clobber the login session of both cron(8) and
periodic(8) to a non-`root` user if the daily calendar job is enabled with
`daily_calendar_enable=YES`.
III. Impact
Mail sent after calendar(1) has run in the daily periodic run will have a
non-root sender on the envelope. This includes security jobs as well as other
cron jobs that may be run after the daily job has concluded.
IV. Workaround
No workaround is available. Systems that have not explicitly enabled the daily
calendar job are not affected.
V. Solution
Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date.
Perform one of the following:
1) To update your system via a binary patch:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
2) To update your system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/EN-24:15/calendar.patch
# fetch https://security.FreeBSD.org/patches/EN-24:15/calendar.patch.asc
# gpg --verify calendar.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart the applicable daemons, or reboot the system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/14/ 33708452aaab stable/14-n268432
releng/14.1/ 86d01789bf41 releng/14.1-n267709
releng/14.0/ d94dbaa516e0 releng/14.0-n265431
stable/13/ 3a9010c98b3d stable/13-n258228
releng/13.4/ 7088bf662d46 releng/13.4-n258220
releng/13.3/ eab94c0fbb78 releng/13.3-n257447
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280418>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-24:15.calendar.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbY53AACgkQbljekB8A
Gu+FxA/+JUfcaaoOhPcS8VabJS4UKYKH3S703qTSqaR1KsHj+nKXj5eSWCyGA4KI
C4p+9C4H7shzgO4SF18+HR679i+y0QNayEpEv9MkUsuYfevx3t8+E7joOH10usi1
g92EPpAUYM5Cb0NpsjFS8gQk18qRlY76asdQlA+b8RDB0gU7lJkDTxrT4TUtJqKP
ysAa2ZruGuJbZpZlVPY/JLA9/liwBZcq6fij1g4dyQke6PbvTkoWxFD/3+/ufKXu
mWW+VsYxldNQRIJF9+8SuIcGTkDUr4HAP7EPYYKU8prX39lsAN0fA7oQO0ohvQ1b
20Oglq4PYQTEzv16KbAGZdByEzH2Tnzoz8jkaUeIfgnQrHEZbiaqckixi3bUOzPV
SJ037qikttpxVXrs6qxehl1f9tMLXFlbRSOrVrxg+YSb8Xy0nxRvdNwuJ+1OS2bD
DoPDXs3BVtecKrArDrZcbFcvzNbNiESZGRlFBI7hiy8DQFNFT755n1NnIDxjDerW
Qo9MELlWerWyP2djzS+C5YeTe3HPMw8dRbPORRKBD65+dXDn+W53TeJdVY/uwN/O
B9l/RRehDTB4pj79J6689h3mPSBgMC0tS33Nv1Xm42+58JPb9hP+RzHQkNVJcrxk
RDpKKxgJjTm5hQ+U8TMN+YOfWJnrEGk+mSWK8Vk96C0JQJSd0lI=
=Z1hr
-----END PGP SIGNATURE-----
Hash: SHA512
=============================================================================
FreeBSD-EN-24:15.calendar Errata Notice
The FreeBSD Project
Topic: cron(8) / periodic(8) session login
Category: core
Module: periodic
Announced: 2024-09-04
Affects: All supported versions of FreeBSD.
Corrected: 2024-08-08 20:07:04 UTC (stable/14, 14.1-STABLE)
2024-09-04 21:34:23 UTC (releng/14.1, 14.1-RELEASE-p4)
2024-09-04 20:54:10 UTC (releng/14.0, 14.0-RELEASE-p10)
2024-08-08 20:07:07 UTC (stable/13, 13.4-STABLE)
2024-08-14 03:37:16 UTC (releng/13.4, 13.4-BETA3)
2024-09-04 20:29:38 UTC (releng/13.3, 13.3-RELEASE-p6)
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.FreeBSD.org/>.
I. Background
periodic(8) is run via cron(8) as root to perform periodic system functions to
be executed on a daily, weekly, or monthly basis.
II. Problem Description
periodic(8) jobs are typically run in a context as the `root` user, but an
erratum in calendar(1) may clobber the login session of both cron(8) and
periodic(8) to a non-`root` user if the daily calendar job is enabled with
`daily_calendar_enable=YES`.
III. Impact
Mail sent after calendar(1) has run in the daily periodic run will have a
non-root sender on the envelope. This includes security jobs as well as other
cron jobs that may be run after the daily job has concluded.
IV. Workaround
No workaround is available. Systems that have not explicitly enabled the daily
calendar job are not affected.
V. Solution
Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date.
Perform one of the following:
1) To update your system via a binary patch:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platform on FreeBSD 13, can be updated via the freebsd-update(8)
utility:
# freebsd-update fetch
# freebsd-update install
2) To update your system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/EN-24:15/calendar.patch
# fetch https://security.FreeBSD.org/patches/EN-24:15/calendar.patch.asc
# gpg --verify calendar.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart the applicable daemons, or reboot the system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/14/ 33708452aaab stable/14-n268432
releng/14.1/ 86d01789bf41 releng/14.1-n267709
releng/14.0/ d94dbaa516e0 releng/14.0-n265431
stable/13/ 3a9010c98b3d stable/13-n258228
releng/13.4/ 7088bf662d46 releng/13.4-n258220
releng/13.3/ eab94c0fbb78 releng/13.3-n257447
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat <commit hash>
Or visit the following URL, replacing NNNNNN with the hash:
<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280418>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-24:15.calendar.asc>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmbY53AACgkQbljekB8A
Gu+FxA/+JUfcaaoOhPcS8VabJS4UKYKH3S703qTSqaR1KsHj+nKXj5eSWCyGA4KI
C4p+9C4H7shzgO4SF18+HR679i+y0QNayEpEv9MkUsuYfevx3t8+E7joOH10usi1
g92EPpAUYM5Cb0NpsjFS8gQk18qRlY76asdQlA+b8RDB0gU7lJkDTxrT4TUtJqKP
ysAa2ZruGuJbZpZlVPY/JLA9/liwBZcq6fij1g4dyQke6PbvTkoWxFD/3+/ufKXu
mWW+VsYxldNQRIJF9+8SuIcGTkDUr4HAP7EPYYKU8prX39lsAN0fA7oQO0ohvQ1b
20Oglq4PYQTEzv16KbAGZdByEzH2Tnzoz8jkaUeIfgnQrHEZbiaqckixi3bUOzPV
SJ037qikttpxVXrs6qxehl1f9tMLXFlbRSOrVrxg+YSb8Xy0nxRvdNwuJ+1OS2bD
DoPDXs3BVtecKrArDrZcbFcvzNbNiESZGRlFBI7hiy8DQFNFT755n1NnIDxjDerW
Qo9MELlWerWyP2djzS+C5YeTe3HPMw8dRbPORRKBD65+dXDn+W53TeJdVY/uwN/O
B9l/RRehDTB4pj79J6689h3mPSBgMC0tS33Nv1Xm42+58JPb9hP+RzHQkNVJcrxk
RDpKKxgJjTm5hQ+U8TMN+YOfWJnrEGk+mSWK8Vk96C0JQJSd0lI=
=Z1hr
-----END PGP SIGNATURE-----
[USN-6990-1] znc vulnerability
-----BEGIN PGP PUBLIC KEY BLOCK-----
xsBNBGao8McBCAD/mTHpWpp0rMyhX+xQYmuj1DoCiadFZysyAyKIFXODXRSOAQ58
YTf6BEuhPtEamZq+aJEGOTBJmUZxvGMv0Fo5yBN+OGoMA2CJQwxWQCZCptfivOCI
D5p2eANebDVXpZHHgpNwCyFVZR/UfSLMqX/y2wEi1AC4CKc3ihFBWdMJVdDk6zz0
4g/x4w76CZczUpe17QWD1XuAWUxmaVGM/TiKjktq3Lp6yZrb0QSYjCovXAGwfBmz
beludDi+EMDmh76PeKWfqQ38QSPEvN+Lv6OTjPWDfilfuOPpDZA2gsjNj3TaBllL
k9YW98OrqsbegQ0BhPgoPYQ3S15ikv53M8o/ABEBAAHNKUp1bGlhIFNhcnJpcyA8
anVsaWEuc2FycmlzQGNhbm9uaWNhbC5jb20+wsCRBBMBCgA7FiEEOMd9M4Vpc6WH
Yvv+QB78vNoP8b0FAmao8McCGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AA
CgkQQB78vNoP8b3fXQf6Awx8Nd5FkMMGdrWqBjIPZv1Ogkka2+PiIqwqcIeQGvam
V/bpIKOCb4QOS4kgQ+hNS1mmK+T/aWXRCYhiBIPAOIbo7jcMGxNz7V3+43RxlNVl
zt3feYM/QAJmgK8bjdCzI5ZQHiyX8pgOieCylRrcjroQHa9CxHej4aJGCaPGLFGo
81lYWJm21NP4LJTLk03ncJT8Ss64R28cOWUHujysxftAPHVYpPLdlwuJ3lgC8M5n
eq0qwsv22j62ldd/J7u2psRSczaU1ve/TfX71ZCyZZiw2Tm5HvaskD+CilXOaL2H
+KediuEtkQk5KKQikg2XtjbqCYyIxQT50v1TIu86ss7ATQRmqPDHAQgA5zGDufJq
9MhhDPJqM3Qz4kQXLKDXz2l5EovU5olrYerGmskpUBUSwfgAeBu9gMP5Y24spir3
eMm6O7m8EJsihMPCw4Iblzi9YZZX1TY3wegRXFIiaqW5kELnjhVnRpS9WQi9FDd9
gGPp7X3iQ8/B6+nyHitqhcj2A+Vpk5HaguY8zl3yEOwFnud5TEbSb/xYz7DhX5uv
B/FZ9rgn+j2N0hC/RVN1MpSRHZEbOCfpaYr/teiQexOWBlVVnZgCkHb9F0NiNImv
dXVZ18jY5wfgxemfgm8l4nDUlSMUIMiwGYekPMEuYvoDNPwfzzlYHKrVoqp54KMd
JALMUar1bVZtxQARAQABwsB2BBgBCgAgFiEEOMd9M4Vpc6WHYvv+QB78vNoP8b0F
Amao8McCGwwACgkQQB78vNoP8b10+ggA8nW+R2g9BDvkpurM0lwpaCtgKbaENIGg
lpxNXEEUEW7AaR4Mme+4PA/SdpWrFzVa0OGhqtZxkovUZXpgiLlx5/eR1Bl+TUuO
rjZkjGBy3r2Ce1JLwKilSZk7Bk45L7QDxA+NOLSFS7ADqzv37J2jhpfczqrYdpSj
kHgUvkapbuB0ONpQ/mhH9UDquY3eMGv3GSrvggVS0mKjR6bMl1plBWcfJ+Y//xQc
6S1bBdjbmwKMZjYbvhTpPbVeUOUdOg/0mYC/3rjSO+2OEn1Q+YIdfGqbLpDAbruG
m7XHtUOXesWorhDMzQGRpj7R+ed/9uJs0Nvg5FqAKTrzh+90ngEGuA==
=Qkbp
-----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
wsB5BAABCAAjFiEEOMd9M4Vpc6WHYvv+QB78vNoP8b0FAmbYuwUFAwAAAAAACgkQQB78vNoP8b0r
fwf/VZjbRhkwVLd1sNCf+xvEQVyBAEWWPLpArcu5FbOJB6vMPYbbEVbhwCmRB4cvmFG7pgZoimG0
Z4UXGzYihyU9DzVqxbWY5/SAynr64nqMF2/k/jscdQvU+4XV3V6waR2pkMBNX3fJ7ong1VaWp0W5
j5GrFZZGHL3l6f8/+C/5tTYDwojSVGVjIfFU0+mI69OKXH0tumEAUdiLi0C8jfAm4y8xOMr4dTr1
PTI+J35TaGUkWn1g7TyTqFRItrjUQQ1Hcg4DeqKgs44XRy2X+r5sZDM+0T0kLgitiEjo3rU4UwmO
QVBAqE9XMJpx5p4YJ0I2I2nEiZCUfxPzBbImpwhxoA==
=uUEe
-----END PGP SIGNATURE-----
============================================
Ubuntu Security Notice USN-6990-1
September 04, 2024
znc vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
znc could be made to execute arbitrary code on a user's system if
they were persuaded to join a malicious server.
Software Description:
- znc: advanced modular IRC bouncer
Details:
Johannes Kuhn (DasBrain) discovered that znc incorrectly handled
user input under certain operations. An attacker could possibly
use this issue to execute arbitrary code on a user's system if
the user was tricked into joining a malicious server.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
znc 1.9.0-2ubuntu0.1~esm2
Available with Ubuntu Pro
znc-dev 1.9.0-2ubuntu0.1~esm2
Available with Ubuntu Pro
znc-perl 1.9.0-2ubuntu0.1~esm2
Available with Ubuntu Pro
znc-python 1.9.0-2ubuntu0.1~esm2
Available with Ubuntu Pro
znc-tcl 1.9.0-2ubuntu0.1~esm2
Available with Ubuntu Pro
Ubuntu 22.04 LTS
znc 1.8.2-2ubuntu0.1
znc-dev 1.8.2-2ubuntu0.1
znc-perl 1.8.2-2ubuntu0.1
znc-python 1.8.2-2ubuntu0.1
znc-tcl 1.8.2-2ubuntu0.1
Ubuntu 20.04 LTS
znc 1.7.5-4ubuntu0.1~esm2
Available with Ubuntu Pro
znc-dev 1.7.5-4ubuntu0.1~esm2
Available with Ubuntu Pro
znc-perl 1.7.5-4ubuntu0.1~esm2
Available with Ubuntu Pro
znc-python 1.7.5-4ubuntu0.1~esm2
Available with Ubuntu Pro
znc-tcl 1.7.5-4ubuntu0.1~esm2
Available with Ubuntu Pro
Ubuntu 18.04 LTS
znc 1.6.6-1ubuntu0.2+esm2
Available with Ubuntu Pro
znc-dev 1.6.6-1ubuntu0.2+esm2
Available with Ubuntu Pro
znc-perl 1.6.6-1ubuntu0.2+esm2
Available with Ubuntu Pro
znc-python 1.6.6-1ubuntu0.2+esm2
Available with Ubuntu Pro
znc-tcl 1.6.6-1ubuntu0.2+esm2
Available with Ubuntu Pro
Ubuntu 16.04 LTS
znc 1.6.3-1ubuntu0.2+esm2
Available with Ubuntu Pro
znc-dev 1.6.3-1ubuntu0.2+esm2
Available with Ubuntu Pro
znc-perl 1.6.3-1ubuntu0.2+esm2
Available with Ubuntu Pro
znc-python 1.6.3-1ubuntu0.2+esm2
Available with Ubuntu Pro
znc-tcl 1.6.3-1ubuntu0.2+esm2
Available with Ubuntu Pro
Ubuntu 14.04 LTS
znc 1.2-3ubuntu0.1+esm3
Available with Ubuntu Pro
znc-dev 1.2-3ubuntu0.1+esm3
Available with Ubuntu Pro
znc-perl 1.2-3ubuntu0.1+esm3
Available with Ubuntu Pro
znc-python 1.2-3ubuntu0.1+esm3
Available with Ubuntu Pro
znc-tcl 1.2-3ubuntu0.1+esm3
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6990-1
CVE-2024-39844
Package Information:
https://launchpad.net/ubuntu/+source/znc/1.8.2-2ubuntu0.1
xsBNBGao8McBCAD/mTHpWpp0rMyhX+xQYmuj1DoCiadFZysyAyKIFXODXRSOAQ58
YTf6BEuhPtEamZq+aJEGOTBJmUZxvGMv0Fo5yBN+OGoMA2CJQwxWQCZCptfivOCI
D5p2eANebDVXpZHHgpNwCyFVZR/UfSLMqX/y2wEi1AC4CKc3ihFBWdMJVdDk6zz0
4g/x4w76CZczUpe17QWD1XuAWUxmaVGM/TiKjktq3Lp6yZrb0QSYjCovXAGwfBmz
beludDi+EMDmh76PeKWfqQ38QSPEvN+Lv6OTjPWDfilfuOPpDZA2gsjNj3TaBllL
k9YW98OrqsbegQ0BhPgoPYQ3S15ikv53M8o/ABEBAAHNKUp1bGlhIFNhcnJpcyA8
anVsaWEuc2FycmlzQGNhbm9uaWNhbC5jb20+wsCRBBMBCgA7FiEEOMd9M4Vpc6WH
Yvv+QB78vNoP8b0FAmao8McCGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AA
CgkQQB78vNoP8b3fXQf6Awx8Nd5FkMMGdrWqBjIPZv1Ogkka2+PiIqwqcIeQGvam
V/bpIKOCb4QOS4kgQ+hNS1mmK+T/aWXRCYhiBIPAOIbo7jcMGxNz7V3+43RxlNVl
zt3feYM/QAJmgK8bjdCzI5ZQHiyX8pgOieCylRrcjroQHa9CxHej4aJGCaPGLFGo
81lYWJm21NP4LJTLk03ncJT8Ss64R28cOWUHujysxftAPHVYpPLdlwuJ3lgC8M5n
eq0qwsv22j62ldd/J7u2psRSczaU1ve/TfX71ZCyZZiw2Tm5HvaskD+CilXOaL2H
+KediuEtkQk5KKQikg2XtjbqCYyIxQT50v1TIu86ss7ATQRmqPDHAQgA5zGDufJq
9MhhDPJqM3Qz4kQXLKDXz2l5EovU5olrYerGmskpUBUSwfgAeBu9gMP5Y24spir3
eMm6O7m8EJsihMPCw4Iblzi9YZZX1TY3wegRXFIiaqW5kELnjhVnRpS9WQi9FDd9
gGPp7X3iQ8/B6+nyHitqhcj2A+Vpk5HaguY8zl3yEOwFnud5TEbSb/xYz7DhX5uv
B/FZ9rgn+j2N0hC/RVN1MpSRHZEbOCfpaYr/teiQexOWBlVVnZgCkHb9F0NiNImv
dXVZ18jY5wfgxemfgm8l4nDUlSMUIMiwGYekPMEuYvoDNPwfzzlYHKrVoqp54KMd
JALMUar1bVZtxQARAQABwsB2BBgBCgAgFiEEOMd9M4Vpc6WHYvv+QB78vNoP8b0F
Amao8McCGwwACgkQQB78vNoP8b10+ggA8nW+R2g9BDvkpurM0lwpaCtgKbaENIGg
lpxNXEEUEW7AaR4Mme+4PA/SdpWrFzVa0OGhqtZxkovUZXpgiLlx5/eR1Bl+TUuO
rjZkjGBy3r2Ce1JLwKilSZk7Bk45L7QDxA+NOLSFS7ADqzv37J2jhpfczqrYdpSj
kHgUvkapbuB0ONpQ/mhH9UDquY3eMGv3GSrvggVS0mKjR6bMl1plBWcfJ+Y//xQc
6S1bBdjbmwKMZjYbvhTpPbVeUOUdOg/0mYC/3rjSO+2OEn1Q+YIdfGqbLpDAbruG
m7XHtUOXesWorhDMzQGRpj7R+ed/9uJs0Nvg5FqAKTrzh+90ngEGuA==
=Qkbp
-----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
wsB5BAABCAAjFiEEOMd9M4Vpc6WHYvv+QB78vNoP8b0FAmbYuwUFAwAAAAAACgkQQB78vNoP8b0r
fwf/VZjbRhkwVLd1sNCf+xvEQVyBAEWWPLpArcu5FbOJB6vMPYbbEVbhwCmRB4cvmFG7pgZoimG0
Z4UXGzYihyU9DzVqxbWY5/SAynr64nqMF2/k/jscdQvU+4XV3V6waR2pkMBNX3fJ7ong1VaWp0W5
j5GrFZZGHL3l6f8/+C/5tTYDwojSVGVjIfFU0+mI69OKXH0tumEAUdiLi0C8jfAm4y8xOMr4dTr1
PTI+J35TaGUkWn1g7TyTqFRItrjUQQ1Hcg4DeqKgs44XRy2X+r5sZDM+0T0kLgitiEjo3rU4UwmO
QVBAqE9XMJpx5p4YJ0I2I2nEiZCUfxPzBbImpwhxoA==
=uUEe
-----END PGP SIGNATURE-----
==============================
Ubuntu Security Notice USN-6990-1
September 04, 2024
znc vulnerability
==============================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
znc could be made to execute arbitrary code on a user's system if
they were persuaded to join a malicious server.
Software Description:
- znc: advanced modular IRC bouncer
Details:
Johannes Kuhn (DasBrain) discovered that znc incorrectly handled
user input under certain operations. An attacker could possibly
use this issue to execute arbitrary code on a user's system if
the user was tricked into joining a malicious server.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
znc 1.9.0-2ubuntu0.1~esm2
Available with Ubuntu Pro
znc-dev 1.9.0-2ubuntu0.1~esm2
Available with Ubuntu Pro
znc-perl 1.9.0-2ubuntu0.1~esm2
Available with Ubuntu Pro
znc-python 1.9.0-2ubuntu0.1~esm2
Available with Ubuntu Pro
znc-tcl 1.9.0-2ubuntu0.1~esm2
Available with Ubuntu Pro
Ubuntu 22.04 LTS
znc 1.8.2-2ubuntu0.1
znc-dev 1.8.2-2ubuntu0.1
znc-perl 1.8.2-2ubuntu0.1
znc-python 1.8.2-2ubuntu0.1
znc-tcl 1.8.2-2ubuntu0.1
Ubuntu 20.04 LTS
znc 1.7.5-4ubuntu0.1~esm2
Available with Ubuntu Pro
znc-dev 1.7.5-4ubuntu0.1~esm2
Available with Ubuntu Pro
znc-perl 1.7.5-4ubuntu0.1~esm2
Available with Ubuntu Pro
znc-python 1.7.5-4ubuntu0.1~esm2
Available with Ubuntu Pro
znc-tcl 1.7.5-4ubuntu0.1~esm2
Available with Ubuntu Pro
Ubuntu 18.04 LTS
znc 1.6.6-1ubuntu0.2+esm2
Available with Ubuntu Pro
znc-dev 1.6.6-1ubuntu0.2+esm2
Available with Ubuntu Pro
znc-perl 1.6.6-1ubuntu0.2+esm2
Available with Ubuntu Pro
znc-python 1.6.6-1ubuntu0.2+esm2
Available with Ubuntu Pro
znc-tcl 1.6.6-1ubuntu0.2+esm2
Available with Ubuntu Pro
Ubuntu 16.04 LTS
znc 1.6.3-1ubuntu0.2+esm2
Available with Ubuntu Pro
znc-dev 1.6.3-1ubuntu0.2+esm2
Available with Ubuntu Pro
znc-perl 1.6.3-1ubuntu0.2+esm2
Available with Ubuntu Pro
znc-python 1.6.3-1ubuntu0.2+esm2
Available with Ubuntu Pro
znc-tcl 1.6.3-1ubuntu0.2+esm2
Available with Ubuntu Pro
Ubuntu 14.04 LTS
znc 1.2-3ubuntu0.1+esm3
Available with Ubuntu Pro
znc-dev 1.2-3ubuntu0.1+esm3
Available with Ubuntu Pro
znc-perl 1.2-3ubuntu0.1+esm3
Available with Ubuntu Pro
znc-python 1.2-3ubuntu0.1+esm3
Available with Ubuntu Pro
znc-tcl 1.2-3ubuntu0.1+esm3
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/no
CVE-2024-39844
Package Information:
https://launchpad.net/ubuntu/+
Subscribe to:
Posts (Atom)