Unix News Tutorials Events and Stuff

Wednesday, October 2, 2024

[announce] NYC*BUG Tonight: EuroBSDCon Recap/BSD Fund

PLEASE RSVP by NOON EDT

EuroBSDCon Recap/*BSD Fund info session, Patrick McEvoy

2024-10-02 @ 18:45 EDT (22:45 UTC) - NYU Tandon Engineering Building
(new), 370 Jay St, 7th Floor kitchen area, Brooklyn (directly across Jay
St from National Grid office). Closest subway exits in order are Jay St
- MetroTech Station (A, C, R, & F Trains) Borough Hall (4 & 5 Trains).
RSVP: Those ethier considering or wishing to attend, a guest list is
required by the venue.

Please RVSP to rsvp at lists dot nycbug dot org no later than noon
localtime, day-of; an acknowledgement will be sent and the email address
will be used solely for the purpose of attendance to this meeting's venue.

Remote participation: Plans are to stream via NYC*BUG website. Q&A will
be via IRC on libera.chat channel #nycbug - please preface your
questions with '[Q]'.

EuroBSDCon Recap/*BSD Fund info session

During this talk, I will cover: - hardware we saw at EuroBSDCon, - the
hallway track - general community involvement post-pandemic growth. -
The NYC*BUG cabinet at NYI video repository

Because the community has been donating funds for hardware, I also
thought this would be a good time to cover how these funds are being
spent. We are shooting for the best bang for our Buck/Euro while growing
a reliable suite of hardware to use for community benefit and reduced
training time for volunteers.

Patrick McEvoy (BSDTV) has been streaming NYC*BSDCons since 2010 and
BSDCan since they lost their entire videoteam in a last minute staffing
emergency. He has been active with NYC*BUG for a number of years and
streams other tech / *BUG events when the schedule allows and releases
these videos on conference YouTube and Peertube under a number of
different umbrellas.
_______________________________________________
announce mailing list
announce@lists.nycbug.org
https://lists.nycbug.org:8443/mailman/listinfo/announce

[USN-7051-1] AsyncSSH vulnerability

-----BEGIN PGP SIGNATURE-----

wnsEABYIACMWIQSyA9nA4R5iZYAVzFrgLM9xllPy5AUCZv0SvwUDAAAAAAAKCRDgLM9xllPy5Kyi
AQD3OLKEHXYPVRvIy/E1Uet8QAyZgzrpp9xdFvGMQSClewD/WtKxLn8Kpiz/+911YwyUTngypYIx
g4APx+NTNbeE6QY=
=PugD
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7051-1
October 02, 2024

python-asyncssh vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

A protocol flaw was fixed in AsyncSSH.

Software Description:
- python-asyncssh: asyncio-based client and server implementation of SSHv2
protocol

Details:

Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH
protocol was vulnerable to a prefix truncation attack. If a remote attacker
was able to intercept SSH communications, extension negotiation messages
could be truncated, possibly leading to certain algorithms and features
being downgraded. This issue is known as the Terrapin attack. This update
adds protocol extensions to mitigate this issue.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
python3-asyncssh                2.10.1-2ubuntu0.1

Ubuntu 22.04 LTS
python3-asyncssh                2.5.0-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
python3-asyncssh                1.12.2-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-7051-1
CVE-2023-48795

Package Information:
https://launchpad.net/ubuntu/+source/python-asyncssh/2.10.1-2ubuntu0.1
https://launchpad.net/ubuntu/+source/python-asyncssh/1.12.2-1ubuntu0.1

Tuesday, October 1, 2024

[USN-7047-1] Knot Resolver vulnerabilities

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmb8oIcFAwAAAAAACgkQWNrRIKaTkWeY
bxAAnvdD8aZIWuY4dWORfPBtiETFnz7TnoYPuNEJitoSNlkell+Kfw3R+vi8X0dJNTeTlS4Hc23H
n4muhLcPUbqr5EiDcc4PT9ILyDMVXK8Jhez56RFZXCfl6BPb5djOZ4z2JylACZcxlSLkl8TnEJqb
0RMU2FLe1UJMj/1h2L5umHqEy7VTXK8T/NISGTp55cP1r9SrasqLlgbhfWXn0Z40hJ4iqyrkBmeF
PPyxzgqVaYRfwMuBNhPMljRjfAjzjAEfahlptgMtKG0OU9kSSZsADeTWoCWFBC3dtTl0JqA0sY1y
wgEUAicgFHBhkrp6KS8oHoKQ3kUcsKBhc4uVGSxfFDXoZmaee9p5n5cX+2kcKYBf6DLzKkzZ7Cik
p+YXRkuptlRF+mzLFJ6XeDTCqhePdLFTK+5owhIV0MU+7PxrobpLV8fYCU295CO2KPrssqYpicYX
K6Hq/6RMxhHbDBsqydK8Z5ay0AdZNJztMdt1NHpwASjNyW7lTnxQw7HD1F8ePQ2cn3ixdRjcH5KE
6qCg7WL+d+h5PyxTwUU/Cypqt6HrzfmxgFIMUcdrJj98CytIxCpyvHBW4ybBkZRi3g2UAoG5ii5K
SMzmHBaikYgWCjr+HXGo5bVcC6bDAaLtgRnb4bkHN42DmZncbjGt1s9KiH3YnUzhKaq1bH37+PQC
0CI=
=0Bta
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7047-1
October 01, 2024

knot-resolver vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in knot-resolver.

Software Description:
- knot-resolver: caching, DNSSEC-validating DNS resolver

Details:

Vladimír Čunát discovered that Knot Resolver incorrectly handled input
during DNSSEC validation. A remote attacker could possibly use this issue
to bypass certain validations. (CVE-2019-10190)

Vladimír Čunát discovered that Knot Resolver incorrectly handled input
during DNSSEC validation. A remote attacker could possibly use this issue
to downgrade DNSSEC-secure domains to a DNSSEC-insecure state, resulting
in a domain hijacking attack. (CVE-2019-10191)

Vladimír Čunát discovered that Knot Resolver incorrectly handled certain
DNS replies with many resource records. An attacker could possibly use
this issue to consume system resources, resulting in a denial of service.
(CVE-2019-19331)

Lior Shafir, Yehuda Afek, and Anat Bremler-Barr discovered that Knot
Resolver incorrectly handled certain queries. A remote attacker could
use this issue to perform an amplification attack directed at a target.
(CVE-2020-12667)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
knot-resolver 3.2.1-3ubuntu2.2

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-7047-1
CVE-2019-10190, CVE-2019-10191, CVE-2019-19331, CVE-2020-12667

Package Information:
https://launchpad.net/ubuntu/+source/knot-resolver/3.2.1-3ubuntu2.2

[USN-7050-1] Devise-Two-Factor vulnerabilities

==========================================================================

Ubuntu Security Notice USN-7050-1
October 01, 2024

ruby-devise-two-factor vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in Devise-Two-Factor.

Software Description:
- ruby-devise-two-factor: Barebones two-factor authentication with Devise

Details:

Benoit Côté-Jodoin and Michael Nipper discovered that Devise-Two-Factor
incorrectly handled one-time password validation. An attacker could
possibly use this issue to intercept and re-use a one-time password.
(CVE-2021-43177)

Garrett Rappaport discovered that Devise-Two-Factor incorrectly handled
generating multi-factor authentication codes. An attacker could possibly
use this issue to generate valid multi-factor authentication codes.
(CVE-2024-8796)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
ruby-devise-two-factor 4.0.0-2ubuntu0.1~esm1
Available with Ubuntu Pro

Ubuntu 20.04 LTS
ruby-devise-two-factor 3.1.0-2ubuntu0.1~esm1
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-7050-1
CVE-2021-43177, CVE-2024-8796

[USN-7043-2] cups-filters vulnerability

==========================================================================
Ubuntu Security Notice USN-7043-2
October 01, 2024

cups-filters vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS

Summary:

cups-filters could be made to run programs if it received specially crafted
network traffic.

Software Description:
- cups-filters: OpenPrinting CUPS Filters

Details:

USN-7043-1 fixed a vulnerability in cups-filters. This update provides
the corresponding update for Ubuntu 18.04 LTS.

Original advisory details:

Simone Margaritelli discovered that the cups-filters cups-browsed component
could be used to create arbitrary printers from outside the local network.
In combination with issues in other printing components, a remote attacker
could possibly use this issue to connect to a system, created manipulated
PPD files, and execute arbitrary code when a printer is used. This update
disables support for the legacy CUPS printer discovery protocol.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS
cups-browsed 1.20.2-0ubuntu3.3+esm1
Available with Ubuntu Pro
cups-filters 1.20.2-0ubuntu3.3+esm1
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-7043-2
https://ubuntu.com/security/notices/USN-7043-1
CVE-2024-47176

[USN-7049-1] PHP vulnerabilities

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmb8C0cACgkQZWnYVadE
vpNkmw//f14l9MVjft56fNjpr/DufncpCJIsTrxsAmCWjC1cGS1VgfM04rqdgmbx
Ek/YDR04V7vi/UQ5gO/8cphhzQu5Hag3fdbkH0RX212dHYHA9ky/8d+0QeF4bxyp
vq22wNDbx6Nf+ZDqx/kq930CXKwN/F6NQeV+7foxXgpX0HoDOISUEVu72d+ZOULE
5wj3R68Y5kzKak3JdxA9h9ccZr24cbBXpeUWiH9/aelenlJIWVt5rbj8MGweTdzB
s6HWHG4j9qJvtTAEIdoQs2hg/j+dvQGA4wLBRZyeDfCLcbQ/4jy0L4PW5KgTEMn1
w+ra9ZEiEKc3f8nD58jRhXPtZqvo9J43njbQgKQp2u7GWi5oXtyeqCX49LtkxpzG
RloBm86kziKwh+ZaR4fGnuqTZu2FgmDIY5kWnQcbr/mKFWIW3WgcMyB+6AzLv6e/
I/9SCJi8xaqOY7aobatDbO7EMtN68OFNrKOxwEHjKxRJZF83oj6zNwLbqLlBTAiT
mioi2nmarMVhw3RBL5f7e9mlmDrPsPrTFwkLeqFNRv1XVLHhZ7TWA9zGMslgzqHS
puuCmyTIns3TKo1hYouIKnBoBbdvenAVP8fse+CNnxzBnwn1LDdQGGeygxphh8o5
NgEQO9kg5o2whvu4kWnD7a3rzP34Mz/d/XnI2RbKOw/iEZh80qI=
=lyWq
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7049-1
October 01, 2024

php7.4, php8.1, php8.3 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in PHP.

Software Description:
- php8.3: HTML-embedded scripting language interpreter
- php8.1: HTML-embedded scripting language interpreter
- php7.4: HTML-embedded scripting language interpreter

Details:

It was discovered that PHP incorrectly handled parsing multipart form data.
A remote attacker could possibly use this issue to inject payloads and
cause PHP to ignore legitimate data. (CVE-2024-8925)

It was discovered that PHP incorrectly handled the cgi.force_redirect
configuration option due to environment variable collisions. In certain
configurations, an attacker could possibly use this issue bypass
force_redirect restrictions. (CVE-2024-8927)

It was discovered that PHP-FPM incorrectly handled logging. A remote
attacker could possibly use this issue to alter and inject arbitrary
contents into log files. This issue only affected Ubuntu 22.04 LTS, and
Ubuntu 24.04 LTS. (CVE-2024-9026)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
libapache2-mod-php8.3 8.3.6-0ubuntu0.24.04.2
php8.3-cgi 8.3.6-0ubuntu0.24.04.2
php8.3-cli 8.3.6-0ubuntu0.24.04.2
php8.3-fpm 8.3.6-0ubuntu0.24.04.2

Ubuntu 22.04 LTS
libapache2-mod-php8.1 8.1.2-1ubuntu2.19
php8.1-cgi 8.1.2-1ubuntu2.19
php8.1-cli 8.1.2-1ubuntu2.19
php8.1-fpm 8.1.2-1ubuntu2.19

Ubuntu 20.04 LTS
libapache2-mod-php7.4 7.4.3-4ubuntu2.24
php7.4-cgi 7.4.3-4ubuntu2.24
php7.4-cli 7.4.3-4ubuntu2.24
php7.4-fpm 7.4.3-4ubuntu2.24

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-7049-1
CVE-2024-8925, CVE-2024-8927, CVE-2024-9026

Package Information:
https://launchpad.net/ubuntu/+source/php8.3/8.3.6-0ubuntu0.24.04.2
https://launchpad.net/ubuntu/+source/php8.1/8.1.2-1ubuntu2.19
https://launchpad.net/ubuntu/+source/php7.4/7.4.3-4ubuntu2.24

[USN-6964-2] ORC vulnerability

-----BEGIN PGP SIGNATURE-----

wsD5BAABCAAjFiEEcxdv4gCCE8W9nrt5a1+PL+d1/EgFAmb8AooFAwAAAAAACgkQa1+PL+d1/Eh3
EAv+Jq5FQ+QPeudDrqciaMK6UxMkc2NT4vKCQcP6KR9M+keR4wajtPV/qZIQVapRlfQj1x3HFASs
KPVhRr6Ut3Cb2jSBQ8BgSfBndc+MyXJ5DL1TLQhdxq/cgyFEwQT/uykGNfMhk7wrZRMkyKObZNCP
aekci49UhE0whZtin2MCFoXLNVSB2J5BIaHDg56mxLhpfIa5CyfPuTdf+VQBrZzBAAUf4RYzWTXX
wHevAvlZMGH37QmX9TkAEEw/+Cyt4YeGUjLeyeNbP+Fum0gJZst/SXDDellDDKH4RNYIT/5cJ+pc
JQmTz4v+MbiTlIpcSuZMHRBco7noCTGw8NRUcAzwB3kC+W+8d+lJu4jkruVGcYp7ePbIzWhEAxTM
Gco+aah7nwyZmHBhRbB7WAmEqVJ8K9BlbxiHmg7HIVyHUoZlE5mkKJ/9Pw9XHwf4BIqiTjPafL03
GTuhoaOGd5DnlCxrbm+EgsisekovcALJB0/SVStXXPBLXV7Ter4KVMbCaOBy
=dUIZ
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6964-2
October 01, 2024

orc vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

ORC could be made to crash or execute arbitrary code

Software Description:
- orc: Library of Optimized Inner Loops Runtime Compiler

Details:

USN-6964-1 fixed a vulnerability in ORC. This update provides the
corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

Noriko Totsuka discovered that ORC incorrectly handled certain
specially crafted files. An attacker could possibly use this issue
to execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS
liborc-0.4-0                    1:0.4.28-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro
liborc-0.4-dev                  1:0.4.28-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
liborc-0.4-0                    1:0.4.25-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro
liborc-0.4-dev                  1:0.4.25-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6964-2
https://ubuntu.com/security/notices/USN-6964-1
CVE-2024-40897

[USN-7022-2] Linux kernel vulnerabilities

==========================================================================
Ubuntu Security Notice USN-7022-2
October 01, 2024

linux-raspi vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
- linux-raspi: Linux kernel for Raspberry Pi systems

Details:

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Modular ISDN driver;
- MMC subsystem;
- SCSI drivers;
- F2FS file system;
- GFS2 file system;
- Netfilter;
- RxRPC session sockets;
- Integrity Measurement Architecture(IMA) framework;
(CVE-2021-47188, CVE-2024-42160, CVE-2024-42228, CVE-2022-48863,
CVE-2024-26677, CVE-2024-26787, CVE-2024-38570, CVE-2024-39494,
CVE-2022-48791, CVE-2024-27012)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
linux-image-5.4.0-1117-raspi 5.4.0-1117.129
linux-image-raspi 5.4.0.1117.147
linux-image-raspi2 5.4.0.1117.147

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://ubuntu.com/security/notices/USN-7022-2
https://ubuntu.com/security/notices/USN-7022-1
CVE-2021-47188, CVE-2022-48791, CVE-2022-48863, CVE-2024-26677,
CVE-2024-26787, CVE-2024-27012, CVE-2024-38570, CVE-2024-39494,
CVE-2024-42160, CVE-2024-42228

Package Information:
https://launchpad.net/ubuntu/+source/linux-raspi/5.4.0-1117.129

[USN-7041-2] CUPS vulnerability

==========================================================================
Ubuntu Security Notice USN-7041-2
October 01, 2024

cups vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS

Summary:

CUPS could be made to crash or run programs if it received specially
crafted network traffic.

Software Description:
- cups: Common UNIX Printing System(tm)

Details:

USN-7041-1 fixed a vulnerability in CUPS. This update provides
the corresponding update for Ubuntu 18.04 LTS.

Original advisory details:

Simone Margaritelli discovered that CUPS incorrectly sanitized IPP
data when creating PPD files. A remote attacker could possibly use this
issue to manipulate PPD files and execute arbitrary code when a printer is
used.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS
cups 2.2.7-1ubuntu2.10+esm6
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-7041-2
https://ubuntu.com/security/notices/USN-7041-1
CVE-2024-47175

[USN-7003-5] Linux kernel vulnerabilities

==========================================================================
Ubuntu Security Notice USN-7003-5
October 01, 2024

linux-raspi-5.4 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS

Summary:

Several security issues were fixed in the Linux kernel.

Software Description:
- linux-raspi-5.4: Linux kernel for Raspberry Pi systems

Details:

It was discovered that the JFS file system contained an out-of-bounds read
vulnerability when printing xattr debug information. A local attacker could
use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- ACPI drivers;
- Serial ATA and Parallel ATA drivers;
- Drivers core;
- GPIO subsystem;
- GPU drivers;
- Greybus drivers;
- HID subsystem;
- I2C subsystem;
- IIO subsystem;
- InfiniBand drivers;
- Media drivers;
- VMware VMCI Driver;
- Network drivers;
- Pin controllers subsystem;
- S/390 drivers;
- SCSI drivers;
- USB subsystem;
- JFFS2 file system;
- JFS file system;
- File systems infrastructure;
- NILFS2 file system;
- IOMMU subsystem;
- Sun RPC protocol;
- Netfilter;
- Memory management;
- B.A.T.M.A.N. meshing protocol;
- CAN network layer;
- Ceph Core library;
- Networking core;
- IPv4 networking;
- IPv6 networking;
- IUCV driver;
- MAC80211 subsystem;
- NET/ROM layer;
- Network traffic control;
- SoC Audio for Freescale CPUs drivers;
(CVE-2024-40916, CVE-2024-41035, CVE-2024-39469, CVE-2024-39499,
CVE-2024-36978, CVE-2024-42092, CVE-2024-42087, CVE-2024-42102,
CVE-2024-40978, CVE-2024-40902, CVE-2024-36974, CVE-2024-42096,
CVE-2024-40974, CVE-2024-40904, CVE-2024-40905, CVE-2024-42153,
CVE-2024-42106, CVE-2024-42070, CVE-2024-41097, CVE-2024-42090,
CVE-2024-42105, CVE-2024-42104, CVE-2024-39502, CVE-2024-41089,
CVE-2024-40945, CVE-2024-38619, CVE-2024-40961, CVE-2024-42127,
CVE-2024-39487, CVE-2024-40988, CVE-2024-41044, CVE-2024-42236,
CVE-2024-40942, CVE-2024-39506, CVE-2024-39509, CVE-2024-39503,
CVE-2024-40934, CVE-2024-40959, CVE-2024-42101, CVE-2024-40960,
CVE-2024-40968, CVE-2024-41087, CVE-2023-52803, CVE-2024-40987,
CVE-2024-40943, CVE-2024-42089, CVE-2023-52887, CVE-2024-37078,
CVE-2024-42148, CVE-2024-36894, CVE-2024-42097, CVE-2024-41006,
CVE-2024-40984, CVE-2024-40963, CVE-2024-42223, CVE-2024-40912,
CVE-2024-42086, CVE-2024-41049, CVE-2024-42157, CVE-2024-41034,
CVE-2024-42145, CVE-2024-42124, CVE-2024-40995, CVE-2024-42224,
CVE-2024-40981, CVE-2024-41095, CVE-2024-40901, CVE-2024-42115,
CVE-2024-41041, CVE-2024-41007, CVE-2024-39505, CVE-2024-40932,
CVE-2024-39495, CVE-2024-40980, CVE-2024-42084, CVE-2024-41046,
CVE-2024-42119, CVE-2024-42076, CVE-2024-42232, CVE-2024-39501,
CVE-2024-40958, CVE-2024-40941, CVE-2024-42093, CVE-2024-42094,
CVE-2024-42154)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS
linux-image-5.4.0-1116-raspi 5.4.0-1116.128~18.04.1
Available with Ubuntu Pro
linux-image-raspi-hwe-18.04 5.4.0.1116.128~18.04.1
Available with Ubuntu Pro

After a standard system update you need to reboot your computer to make
all the necessary changes.

ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.

References:
https://ubuntu.com/security/notices/USN-7003-5
https://ubuntu.com/security/notices/USN-7003-4
https://ubuntu.com/security/notices/USN-7003-3
https://ubuntu.com/security/notices/USN-7003-2
https://ubuntu.com/security/notices/USN-7003-1
CVE-2023-52803, CVE-2023-52887, CVE-2024-36894, CVE-2024-36974,
CVE-2024-36978, CVE-2024-37078, CVE-2024-38619, CVE-2024-39469,
CVE-2024-39487, CVE-2024-39495, CVE-2024-39499, CVE-2024-39501,
CVE-2024-39502, CVE-2024-39503, CVE-2024-39505, CVE-2024-39506,
CVE-2024-39509, CVE-2024-40901, CVE-2024-40902, CVE-2024-40904,
CVE-2024-40905, CVE-2024-40912, CVE-2024-40916, CVE-2024-40932,
CVE-2024-40934, CVE-2024-40941, CVE-2024-40942, CVE-2024-40943,
CVE-2024-40945, CVE-2024-40958, CVE-2024-40959, CVE-2024-40960,
CVE-2024-40961, CVE-2024-40963, CVE-2024-40968, CVE-2024-40974,
CVE-2024-40978, CVE-2024-40980, CVE-2024-40981, CVE-2024-40984,
CVE-2024-40987, CVE-2024-40988, CVE-2024-40995, CVE-2024-41006,
CVE-2024-41007, CVE-2024-41034, CVE-2024-41035, CVE-2024-41041,
CVE-2024-41044, CVE-2024-41046, CVE-2024-41049, CVE-2024-41087,
CVE-2024-41089, CVE-2024-41095, CVE-2024-41097, CVE-2024-42070,
CVE-2024-42076, CVE-2024-42084, CVE-2024-42086, CVE-2024-42087,
CVE-2024-42089, CVE-2024-42090, CVE-2024-42092, CVE-2024-42093,
CVE-2024-42094, CVE-2024-42096, CVE-2024-42097, CVE-2024-42101,
CVE-2024-42102, CVE-2024-42104, CVE-2024-42105, CVE-2024-42106,
CVE-2024-42115, CVE-2024-42119, CVE-2024-42124, CVE-2024-42127,
CVE-2024-42145, CVE-2024-42148, CVE-2024-42153, CVE-2024-42154,
CVE-2024-42157, CVE-2024-42223, CVE-2024-42224, CVE-2024-42232,
CVE-2024-42236

[USN-7048-1] Vim vulnerability

-----BEGIN PGP SIGNATURE-----

wnsEABYIACMWIQSV2d7RU755utSnx3O7Ba3EKYsoKQUCZvvuDgUDAAAAAAAKCRC7Ba3EKYsoKels
AP9q/Nu8HK03iResQkjhZ2/XIDvuOgbc3BdzsnWjEvZ3ggEAgdrhBKKbRUF5g4NVj0e0AkUqxSQN
v2eYXhwBfWyIIgg=
=/dVP
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7048-1
October 01, 2024

vim vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Vim could be made to crash if it received specially crafted input.

Software Description:
- vim: Vi IMproved - enhanced vi editor

Details:

Suyue Guo discovered that Vim incorrectly handled memory when flushing the
typeahead buffer, leading to heap-buffer-overflow. An attacker could
possibly use this issue to cause a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
vim                             2:9.1.0016-1ubuntu7.3

Ubuntu 22.04 LTS
vim                             2:8.2.3995-1ubuntu2.19

Ubuntu 20.04 LTS
vim                             2:8.1.2269-1ubuntu5.25

Ubuntu 18.04 LTS
vim                             2:8.0.1453-1ubuntu1.13+esm10
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
vim                             2:7.4.1689-3ubuntu1.5+esm25
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-7048-1
CVE-2024-43802

Package Information:
https://launchpad.net/ubuntu/+source/vim/2:9.1.0016-1ubuntu7.3
https://launchpad.net/ubuntu/+source/vim/2:8.2.3995-1ubuntu2.19
https://launchpad.net/ubuntu/+source/vim/2:8.1.2269-1ubuntu5.25

[USN-7015-3] Python vulnerability

==========================================================================
Ubuntu Security Notice USN-7015-3
October 01, 2024

python2.7, python3.5 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Python could be made to bypass some restrictions if it received specially
crafted input.

Software Description:
- python2.7: An interactive high-level object-oriented language
- python3.5: An interactive high-level object-oriented language

Details:

USN-7015-1 fixed several vulnerabilities in Python. This update provides
the corresponding updates for CVE-2023-27043 for python2.7 in Ubuntu 16.04
LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS, and for
python3.5 in Ubuntu 16.04 LTS.

Original advisory details:

It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)

It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)

It was discovered that the Python email module incorrectly quoted newlines
for email headers. A remote attacker could possibly use this issue to
perform header injection. (CVE-2024-6923)

It was discovered that the Python http.cookies module incorrectly handled
parsing cookies that contained backslashes for quoted characters. A remote
attacker could possibly use this issue to cause Python to consume
resources, leading to a denial of service. (CVE-2024-7592)

It was discovered that the Python zipfile module incorrectly handled
certain malformed zip files. A remote attacker could possibly use this
issue to cause Python to stop responding, resulting in a denial of
service. (CVE-2024-8088)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
python2.7 2.7.18-13ubuntu1.2+esm3
Available with Ubuntu Pro
python2.7-minimal 2.7.18-13ubuntu1.2+esm3
Available with Ubuntu Pro

Ubuntu 20.04 LTS
python2.7 2.7.18-1~20.04.4+esm3
Available with Ubuntu Pro
python2.7-minimal 2.7.18-1~20.04.4+esm3
Available with Ubuntu Pro

Ubuntu 18.04 LTS
python2.7 2.7.17-1~18.04ubuntu1.13+esm6
Available with Ubuntu Pro
python2.7-minimal 2.7.17-1~18.04ubuntu1.13+esm6
Available with Ubuntu Pro

Ubuntu 16.04 LTS
python2.7 2.7.12-1ubuntu0~16.04.18+esm11
Available with Ubuntu Pro
python2.7-minimal 2.7.12-1ubuntu0~16.04.18+esm11
Available with Ubuntu Pro
python3.5 3.5.2-2ubuntu0~16.04.13+esm15
Available with Ubuntu Pro
python3.5-minimal 3.5.2-2ubuntu0~16.04.13+esm15
Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-7015-3
https://ubuntu.com/security/notices/USN-7015-2
https://ubuntu.com/security/notices/USN-7015-1
CVE-2023-27043