In accordance with FESCo's Inactive Packager Policy[1], packagers that have been identified as inactive have a ticket in the find-inactive-packagers repo[2]. One week after the final release, packagers who remain inactive will be removed from the packager group. (Note that pagure.io is one of the systems checked for activity, so commenting on your ticket that you're still around will prevent you from showing up in the second round.) If you have suggestions for improvement, look for the open feature issues[3] and file an issue in the find-inactive-packagers repo[4] if it's not there already. For the curious, here are the stats from today's run: ### Found 1486 users in the packager group. ### ### Found 635 users with no builds in Koji over the last year. ### ### Found 305 users with no activity in pagure/src.fp.org over the last year. ### ### Found 288 users which didn't post any message in Fedora Discussion over the last year. ### ### Found 252 users which also show no activity in Bodhi over the last year. ### ### Found 226 users which also show no activity in mailing lists over the last year. ### ### Found 160 users which also show no activity in Bugzilla over the last year. ### [1] https://docs.fedoraproject.org/en-US/fesco/Policy_for_inactive_packagers/ [2] https://pagure.io/find-inactive-packagers/issues?tags=inactive_packager&status=Open [3] https://pagure.io/find-inactive-packagers/issues?tags=feature [4] https://pagure.io/find-inactive-packagers/new_issue Here it's the full list of users detected as inactive: acui adobes affix aglitke airwave ajmitchell akasko alexlan alissonbruno alphacc als arnd arozansk aruiz astepano bcornec beldmit benesv bilelmoussaoui brendt brenton brouhaha bskeggs chedi chrissie cn137 cooperlees dachary damien-lemoal dang davanum davem davidx dcbw deekej dhat180 diaasami djuran dlehman dmurphy18 dprince dwysocha edward-evans-aiven ellio167 fenris02 fsimonce gholms gtiwari hanoglu hguemar hushan hvad ib54003 icon idiez ikedas imullins irina jbenc jfsaucier jkaluza jlanda jmarcin jmoyer joev jolsa jpechane jsafrane jschmidb juergh kanitha kasong kc8hfi ksiddiqu kumarpraveen labbott law laxathom lchilton lkiesow lucab lucarval lucilanga luigifab lulinqing lupinix major malmond mangelajo markuss martstyk matwey mcascella mcbeeffx mdcornu mhough michaelanguskelly mkosek mprivozn msk61 murphyp nickboldt nim niohiani nkondras nyoxi pbabinca pcolby phuzion pidgornyy plfiorini pmyers poros psalaba puiterwijk quintela ralphlange ravindrakumar rerickso reznik rlescak rpeterso rrendec saakla scoady sdyroff sfroemer shoracek siddharths siddharthvipul1 sinnykumari snecker snirkel spotlesstofu stbenjam szidek terrycloth thoger tlavocat torbuntu toshio totol tscherf u1f35c van vgoyal victortyau vishalvvr vmakarov vponcova xinghong yahmad yashn yizhengxie yonhan yunyings zaitcev zaitseff zkota zvetlik
Tuesday, February 18, 2025
Inactive Packagers Policy for the F42 cycle
[USN-7272-1] Symfony vulnerabilities
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEELOLXZEFYQHcSWEHiyfW2m9Ldu6sFAme0wxMFAwAAAAAACgkQyfW2m9Ldu6v1
5w/6AlRosCAUG4gB9vyQslp/QHv5Z5CK4aZSt9W5C5XqJ6F4GIlN3aMtBwD6Kzgv7zKad3qFL3NM
HBmrnQmKaDW0rwjZq1qheAP3pIzXmkM/iePx2PQIVRqmfwAvTG5whRCn6Wq3BKMUkzCZA0c8shuT
DRRQo75NrQ2h+eluM8KGUutSiuyb98Wofaif2YSxc0C4FZLnYQASBCeUjSCDPVuOsdcCuobNgSMj
aRpWVe9uTu0dgttpf4uDioB28IxSYGpY8EPVDr9/bx1yd7AQmaF69G2dqTGaXxwD4uChhZA2p15T
8eATVRY3V8HAimOKYgVj1KoANT1LUaXT3JwxOSuH+4Ou0fMnTn+pQUptrv5kCHlOqkhIzCMMl/Af
nQsEL5fdRrfuiDAbLwdJGUO2fgHE5A31YJHLwWTlu/hhP82qb6V63wyCYXyIqoQY9EqDhQDuK2DN
OFkaLmSG0hER5QrtNELOR/6MG50GBFpdC/G4rEA7/5UeQMyES8GfUISNDOchsROD1jPNQ+OFMQwt
o3MNW1koDrousYueA9fOSAXBovx0pOC76PL4b1zT9bEb0IOlp/FrsiFcWZ6QnIi0IRcVxjNzQ4OI
jLbvx0gpBxMjD+trd0c2RHPn0fC2BkOhdW8BfJS2pNH3kYCki5v27R2ZYZ0k3IVar+7Lng7/IqSL
z9g=
=dXhM
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7272-1
February 18, 2025
symfony vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Symfony.
Software Description:
- symfony: set of reusable components and framework for web projects
Details:
Soner Sayakci discovered that Symfony incorrectly handled cookie storage in
the web cache. An attacker could possibly use this issue to obtain
sensitive information and access unauthorized resources. (CVE-2022-24894)
Marco Squarcina discovered that Symfony incorrectly handled the storage of
user session information. An attacker could possibly use this issue to
perform a cross-site request forgery (CSRF) attack. (CVE-2022-24895)
Pierre Rudloff discovered that Symfony incorrectly checked HTML input. An
attacker could possibly use this issue to perform cross site scripting.
(CVE-2023-46734)
Vladimir Dusheyko discovered that Symfony incorrectly sanitized special
input with a PHP directive in URL query strings. An attacker could possibly
use this issue to expose sensitive information or cause a denial of
service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 22.04 LTS.
(CVE-2024-50340)
Oleg Andreyev, Antoine Makdessi, and Moritz Rauch discovered that Symfony
incorrectly handled user authentication. An attacker could possibly use
this issue to access unauthorized resources and expose sensitive
information. This issue was only addressed in Ubuntu 24.04 LTS.
(CVE-2024-50341, CVE-2024-51996)
Linus Karlsson and Chris Smith discovered that Symfony returned internal
host information during host resolution. An attacker could possibly use
this issue to obtain sensitive information. This issue only affected Ubuntu
24.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-50342)
It was discovered that Symfony incorrectly parsed user input through
regular expressions. An attacker could possibly use this issue to expose
sensitive information. (CVE-2024-50343)
Sam Mush discovered that Symfony incorrectly parsed URIs with special
characters. An attacker could possibly use this issue to perform phishing
attacks. (CVE-2024-50345)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
php-symfony 6.4.5+dfsg-3ubuntu3+esm1
Available with Ubuntu Pro
Ubuntu 22.04 LTS
php-symfony 5.4.4+dfsg-1ubuntu8+esm1
Available with Ubuntu Pro
Ubuntu 20.04 LTS
php-symfony 4.3.8+dfsg-1ubuntu1+esm2
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7272-1
CVE-2022-24894, CVE-2022-24895, CVE-2023-46734, CVE-2024-50340,
CVE-2024-50341, CVE-2024-50342, CVE-2024-50343, CVE-2024-50345,
CVE-2024-51996
wsF5BAABCAAjFiEELOLXZEFYQHcSWEHiyfW2m9Ldu6sFAme0wxMFAwAAAAAACgkQyfW2m9Ldu6v1
5w/6AlRosCAUG4gB9vyQslp/QHv5Z5CK4aZSt9W5C5XqJ6F4GIlN3aMtBwD6Kzgv7zKad3qFL3NM
HBmrnQmKaDW0rwjZq1qheAP3pIzXmkM/iePx2PQIVRqmfwAvTG5whRCn6Wq3BKMUkzCZA0c8shuT
DRRQo75NrQ2h+eluM8KGUutSiuyb98Wofaif2YSxc0C4FZLnYQASBCeUjSCDPVuOsdcCuobNgSMj
aRpWVe9uTu0dgttpf4uDioB28IxSYGpY8EPVDr9/bx1yd7AQmaF69G2dqTGaXxwD4uChhZA2p15T
8eATVRY3V8HAimOKYgVj1KoANT1LUaXT3JwxOSuH+4Ou0fMnTn+pQUptrv5kCHlOqkhIzCMMl/Af
nQsEL5fdRrfuiDAbLwdJGUO2fgHE5A31YJHLwWTlu/hhP82qb6V63wyCYXyIqoQY9EqDhQDuK2DN
OFkaLmSG0hER5QrtNELOR/6MG50GBFpdC/G4rEA7/5UeQMyES8GfUISNDOchsROD1jPNQ+OFMQwt
o3MNW1koDrousYueA9fOSAXBovx0pOC76PL4b1zT9bEb0IOlp/FrsiFcWZ6QnIi0IRcVxjNzQ4OI
jLbvx0gpBxMjD+trd0c2RHPn0fC2BkOhdW8BfJS2pNH3kYCki5v27R2ZYZ0k3IVar+7Lng7/IqSL
z9g=
=dXhM
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7272-1
February 18, 2025
symfony vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Symfony.
Software Description:
- symfony: set of reusable components and framework for web projects
Details:
Soner Sayakci discovered that Symfony incorrectly handled cookie storage in
the web cache. An attacker could possibly use this issue to obtain
sensitive information and access unauthorized resources. (CVE-2022-24894)
Marco Squarcina discovered that Symfony incorrectly handled the storage of
user session information. An attacker could possibly use this issue to
perform a cross-site request forgery (CSRF) attack. (CVE-2022-24895)
Pierre Rudloff discovered that Symfony incorrectly checked HTML input. An
attacker could possibly use this issue to perform cross site scripting.
(CVE-2023-46734)
Vladimir Dusheyko discovered that Symfony incorrectly sanitized special
input with a PHP directive in URL query strings. An attacker could possibly
use this issue to expose sensitive information or cause a denial of
service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 22.04 LTS.
(CVE-2024-50340)
Oleg Andreyev, Antoine Makdessi, and Moritz Rauch discovered that Symfony
incorrectly handled user authentication. An attacker could possibly use
this issue to access unauthorized resources and expose sensitive
information. This issue was only addressed in Ubuntu 24.04 LTS.
(CVE-2024-50341, CVE-2024-51996)
Linus Karlsson and Chris Smith discovered that Symfony returned internal
host information during host resolution. An attacker could possibly use
this issue to obtain sensitive information. This issue only affected Ubuntu
24.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-50342)
It was discovered that Symfony incorrectly parsed user input through
regular expressions. An attacker could possibly use this issue to expose
sensitive information. (CVE-2024-50343)
Sam Mush discovered that Symfony incorrectly parsed URIs with special
characters. An attacker could possibly use this issue to perform phishing
attacks. (CVE-2024-50345)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
php-symfony 6.4.5+dfsg-3ubuntu3+esm1
Available with Ubuntu Pro
Ubuntu 22.04 LTS
php-symfony 5.4.4+dfsg-1ubuntu8+esm1
Available with Ubuntu Pro
Ubuntu 20.04 LTS
php-symfony 4.3.8+dfsg-1ubuntu1+esm2
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7272-1
CVE-2022-24894, CVE-2022-24895, CVE-2023-46734, CVE-2024-50340,
CVE-2024-50341, CVE-2024-50342, CVE-2024-50343, CVE-2024-50345,
CVE-2024-51996
[USN-7271-1] virtualenv vulnerability
-----BEGIN PGP PUBLIC KEY BLOCK-----
xsFNBGZU5HkBEAC5gtbx2yg8wn9n1x0UKtCSpHCzCL/DDMi+ez8DqaDy2ym8waOh
X6ZeMYxEcRlZMEieo3VfpdioYr/reAs0XViMlSeM7DiMFN1Q6E3yDAaW8Ne/6OwU
6ID8AVV12dooWoa6Xa4hbLLLBMH0XRd8DVw4Zn6s+C18AMweC7Uf3ib62WI7jAxZ
vaRLV+1WWRBQlse5Of7hpvYsqbGuA4l/hzM2LYmWXXDOAsG2DhbSioQdSd89clH9
o1A/fCWNcVC80b7haAG96OaqXSaMny25Vdz5cGWj9SNOcVoXSoGdlu4JFQ/RQo/U
VRk2XTAKVJdIsVW5Fp/4O3z7nLzygDlC10YM0JAfNCuAgcr8pp14Tlz8ExMNqO7z
yhQt0iCn63UD5f/UB0oK2Ix8I5QK4JoHOeOUq8sDZez+bfX+D2KrYLQ4HONWNR2T
7XVnK9YNfWZyztZ7kVZlG3r/WSn1D6ZBj+Aolv2XtzweAn8HNxR3yZZe+1FoHLV3
JnNG1zaQs+WQJFGcQdjzdu5nvKXf4o0TJuakMbhcAh9DmhHGhRvesp9LOrDKxv7C
OXm8ER6G1wRyIh78bPTe6zRfMP49MX1LKUOHf+2T4IRt/7bz4OFXl5vfCWlAOUWN
i6EJ2qImw+2ouEKu9X/9p+I3FDALtOoys1MBKAdQsG/RhDfB2Bt/BRtZ7wARAQAB
zTZPY3RhdmlvIEFkb2xmbyBHYWxsYW5kIDxvY3RhdmlvLmdhbGxhbmRAY2Fub25p
Y2FsLmNvbT7CwZEEEwEKADsWIQRH8irnonVCkXIr8JD24UD22zWeWAUCZlTkeQIb
AwULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRD24UD22zWeWNDaEACJOesZ
823ro/m2o9PVvjyw0wKn1/beHamwJFpp1ciDwYTLemsGjJf1e5D2HBVNTGSqmmnh
IZVSeCq6Ni9PbJlGsxJrGlVpaJRS8LBD/3xQNg5KYyT5loSge53oFBZgTAIj2sNX
UmtWZagQlBPdOB982CHqO6+2J/Dbly6qSKp8UUgatUNzbvClVhJmxA9TpV2WumSA
e4zR1JirXZGGgCg5NLhFiGtySnyS4lcl+hjtdYsvD3FDOiAJaSMJfCagW1gmpjX2
znaDhexnT6rXvWeV8ZP5xbMJfS7UxeArdW09uBBohjFteHzaBnqppVxMOwMaId0w
/+TRFsT+sDPMsdMBakJ3Tw6WS4qbfY8pbJGuvKZ4x5ZJlZdXpx9wsVY7EsA2qRqb
GtEFsyy+7zQ4HUTTbSmUc9PATpmcyJpXGM47iaGmN735Qc2gcZZLHYfylEs8bxHo
DeDxnDSDZhw+0E2/ZRRLUOlUzsxxGWW5tsJ+GHe69eceiDQJOdAiomJkSJMXQStv
vfsDd5wmX8Z8Yf+NGwWK0X/KQXBo6a9/6aDRE9HwyadYF+3F87dbr8KY/GlhYn6i
s5YRgGEIynvOVvxfrb3EAXe0f6iJq1TCEyvKAn3zhaw070wZWsVploAPJ8y9PKwi
UaHfH6s9RVZ94Qtz4BwasdGo2mnHJP0NWQcsnc7BTQRmVOR5ARAAuVJlTQ0Me3Fo
N8cVaUnux5nFraEUdLdKM9iD8L5Pj+LCJGHWkb3yGfdcWHkV9eOKTuixSajdJEj7
EKdzYaLRyKItwT0PFPcgNV7C6OGZYGvOd+9jGxMH4P9ENf+3eNurt+Za8SPLboRZ
faprZhn2nIX8JWPqWDzV3YUkq4Oyxo7DJJenuDQLPnG3WtcKogOpIpbw2h0vm04E
O5honjtDY8iwyYabl17/bFmZowL2SOmAgohWsGgzC3+/Zoyr7n80Ayv1nl/6Tecg
hqrRNfWTG8Y2e25p90DSv6D+NUwLWTaFHP1OivVfnvTTyrtQUGrV2rRR5AYzmqaz
NjGlAZ0FzZdKVV1vjgFZNnHH2avyQUALz3miaB3h2GHJbhI9EjhOkv+jVzMR8Pok
w19kS0ewed+O8PG5CecJZfwgDNWaqLL3QGYMFVKC5n8Ekv+XfqNxcgT3un8Zles5
V3ejOhdjvQqvKuV4ey5nZ8he/kzZbW27oGiy58SxK9RMy57bs3ugm8wbKc1B/EOX
2LdLo1kdQqCa3lWDReyb0S2I14ml9qddc3UA/IBtZDy0AfOlNbwzV+V9SW8j8lXh
4KGGNfNfsuRsSoiYNyIzCQEtRCEm9c/SkTwhW2oNTdztRtageji91y9zOPRf3lN9
HpDR05a8AoC1YonHZxxNcxQMScIUHp8AEQEAAcLBdgQYAQoAIBYhBEfyKueidUKR
civwkPbhQPbbNZ5YBQJmVOR5AhsMAAoJEPbhQPbbNZ5Yef0P/AwNuhnujouSKmc/
Nov/pHkcujZaYsn1iIoYEqhmWjpnBQav+m63G+RZ5zjqu36G7uhZkpYILPihLOJZ
X2SuTIrVitnJ+ocXK2QFLbW8gUlvqRi4kP5XbUQ0yAVWzPFlY9BNK6DUrj0LeC5n
4i+llAI9d50MiqlUDp+pdCotsuyE0PuuGDkY943LXWnPRPnHCv96ocOglN/dyVCB
N1fjEStCG4q3xzYO1KX3WnPOdurPh/CDw6Uypfr6VOlU+3BN+7t2wCk2V7tDjaYH
8/pZCzHCH3FDzUdEuVRBE0eB73yNFv1/SgVstqvTUfcYnaOm2EgvtBB14gIC8qBO
GPSjlh/7kMmD7m8ZiJNknUOL04mOFkDufnbcNUxmYEbn33TCbSIWDjt3RxTHVnzB
UZjYdBkUNJU1JcxDRJzoILSMUSLSH69z90UaArMiKMGtRoIQj2vSSQzdUgeGBBKv
vqE74KMQ0kj/qLaX6cCLUBX2kBShMVbQ7igp3Jytqj8hRvpPVo+xoXd42UWmLTCa
ISvwLtKvzrXYT80yYVUHhCx9keJ+zuOloshIPmvdVvfuoVaGVMpf6/gOJniRuUwA
ufUEKoy7Nl7w6e9pNIM7S5k7TqinqALWixkER9AfIOmEYYsmTVTBDLjsSEv0QWyJ
QGrNPtvSWtSzFkAmdaSP92Yi2kr2
=ZpuF
-----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEER/Iq56J1QpFyK/CQ9uFA9ts1nlgFAme0qQQFAwAAAAAACgkQ9uFA9ts1nliQ
/xAAjZ9zqfnSnNeml12zy308XBE4Crx2GpAVWI6McTbbjUaoEU0SMC5Ol1UDk2P+qqvQh6Gz0JN4
3XmAK1SM8Kfg+AI1xp4IMiZdg8ktEo8Fb2K7k7jMlzbo+UmTi0io2hSvHwhiNTHfaefuGP9SxOcf
wFHfc90tsDSxJZY4Vvotar/is1k8UE+TZVRDe0MmDZbvyRU9hIhK1Lo/mt/LlfnJlzUNeDDsCHSK
G7IvPY1MPdIAKkqb7Fqw+Km2+Nb6Ps5qc2AVOpmD8sGZMPH/awC7UA8hrXqUY/fNtTc6wY6ktJsr
jFVXV1e/AdZ7pl5HpbLt4/5Nu4K1dpS2fwOLKWIjejQl59qBxJanXIfXgruqG2a+Gud4H9XtFr5n
IoW4ELsKgXTl6YHPrrnBnrdEmeMz0+Ptqh3boIoYGKBWdarRtTplGIP/Ah3UghUH73DjP6ElS68b
3YRBbZZALX7gQETJHWEDDxlIfMwXOTs2qzY6NTMC594RUYzy5iEcnh1HRB6FfwyOElFdBcCFaddT
FWTFmOl/w07JeDeJr2vkYF7c4jDi9TjSveYKkXI7RdqA8TGqApu64D35J/Y6J1XV2W3VHEZ4+3Vm
kYvrZDdng/ktfzIJ0N9rFg+MhIpyvH3tIi7bkj5kOVMxdAZ9EZMSIFZCuE5hqW5b05dlTF1VqTSN
jd4=
=zeka
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7271-1
February 18, 2025
python-virtualenv vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
python-virtualenv could be made to crash or run programs as your login if it
opened a specially crafted file.
Software Description:
- python-virtualenv: Python virtual environment creator
Details:
It was discovered that virtualenv incorrectly handled paths when activating
virtual environments. An attacker could possibly use this issue to execute
arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
python3-virtualenv 20.13.0+ds-2ubuntu0.1~esm1
Available with Ubuntu Pro
virtualenv 20.13.0+ds-2ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 20.04 LTS
python3-virtualenv 20.0.17-1ubuntu0.4+esm1
Available with Ubuntu Pro
virtualenv 20.0.17-1ubuntu0.4+esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7271-1
CVE-2024-53899
xsFNBGZU5HkBEAC5gtbx2yg8wn9n1x0UKtCSpHCzCL/DDMi+ez8DqaDy2ym8waOh
X6ZeMYxEcRlZMEieo3VfpdioYr/reAs0XViMlSeM7DiMFN1Q6E3yDAaW8Ne/6OwU
6ID8AVV12dooWoa6Xa4hbLLLBMH0XRd8DVw4Zn6s+C18AMweC7Uf3ib62WI7jAxZ
vaRLV+1WWRBQlse5Of7hpvYsqbGuA4l/hzM2LYmWXXDOAsG2DhbSioQdSd89clH9
o1A/fCWNcVC80b7haAG96OaqXSaMny25Vdz5cGWj9SNOcVoXSoGdlu4JFQ/RQo/U
VRk2XTAKVJdIsVW5Fp/4O3z7nLzygDlC10YM0JAfNCuAgcr8pp14Tlz8ExMNqO7z
yhQt0iCn63UD5f/UB0oK2Ix8I5QK4JoHOeOUq8sDZez+bfX+D2KrYLQ4HONWNR2T
7XVnK9YNfWZyztZ7kVZlG3r/WSn1D6ZBj+Aolv2XtzweAn8HNxR3yZZe+1FoHLV3
JnNG1zaQs+WQJFGcQdjzdu5nvKXf4o0TJuakMbhcAh9DmhHGhRvesp9LOrDKxv7C
OXm8ER6G1wRyIh78bPTe6zRfMP49MX1LKUOHf+2T4IRt/7bz4OFXl5vfCWlAOUWN
i6EJ2qImw+2ouEKu9X/9p+I3FDALtOoys1MBKAdQsG/RhDfB2Bt/BRtZ7wARAQAB
zTZPY3RhdmlvIEFkb2xmbyBHYWxsYW5kIDxvY3RhdmlvLmdhbGxhbmRAY2Fub25p
Y2FsLmNvbT7CwZEEEwEKADsWIQRH8irnonVCkXIr8JD24UD22zWeWAUCZlTkeQIb
AwULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRD24UD22zWeWNDaEACJOesZ
823ro/m2o9PVvjyw0wKn1/beHamwJFpp1ciDwYTLemsGjJf1e5D2HBVNTGSqmmnh
IZVSeCq6Ni9PbJlGsxJrGlVpaJRS8LBD/3xQNg5KYyT5loSge53oFBZgTAIj2sNX
UmtWZagQlBPdOB982CHqO6+2J/Dbly6qSKp8UUgatUNzbvClVhJmxA9TpV2WumSA
e4zR1JirXZGGgCg5NLhFiGtySnyS4lcl+hjtdYsvD3FDOiAJaSMJfCagW1gmpjX2
znaDhexnT6rXvWeV8ZP5xbMJfS7UxeArdW09uBBohjFteHzaBnqppVxMOwMaId0w
/+TRFsT+sDPMsdMBakJ3Tw6WS4qbfY8pbJGuvKZ4x5ZJlZdXpx9wsVY7EsA2qRqb
GtEFsyy+7zQ4HUTTbSmUc9PATpmcyJpXGM47iaGmN735Qc2gcZZLHYfylEs8bxHo
DeDxnDSDZhw+0E2/ZRRLUOlUzsxxGWW5tsJ+GHe69eceiDQJOdAiomJkSJMXQStv
vfsDd5wmX8Z8Yf+NGwWK0X/KQXBo6a9/6aDRE9HwyadYF+3F87dbr8KY/GlhYn6i
s5YRgGEIynvOVvxfrb3EAXe0f6iJq1TCEyvKAn3zhaw070wZWsVploAPJ8y9PKwi
UaHfH6s9RVZ94Qtz4BwasdGo2mnHJP0NWQcsnc7BTQRmVOR5ARAAuVJlTQ0Me3Fo
N8cVaUnux5nFraEUdLdKM9iD8L5Pj+LCJGHWkb3yGfdcWHkV9eOKTuixSajdJEj7
EKdzYaLRyKItwT0PFPcgNV7C6OGZYGvOd+9jGxMH4P9ENf+3eNurt+Za8SPLboRZ
faprZhn2nIX8JWPqWDzV3YUkq4Oyxo7DJJenuDQLPnG3WtcKogOpIpbw2h0vm04E
O5honjtDY8iwyYabl17/bFmZowL2SOmAgohWsGgzC3+/Zoyr7n80Ayv1nl/6Tecg
hqrRNfWTG8Y2e25p90DSv6D+NUwLWTaFHP1OivVfnvTTyrtQUGrV2rRR5AYzmqaz
NjGlAZ0FzZdKVV1vjgFZNnHH2avyQUALz3miaB3h2GHJbhI9EjhOkv+jVzMR8Pok
w19kS0ewed+O8PG5CecJZfwgDNWaqLL3QGYMFVKC5n8Ekv+XfqNxcgT3un8Zles5
V3ejOhdjvQqvKuV4ey5nZ8he/kzZbW27oGiy58SxK9RMy57bs3ugm8wbKc1B/EOX
2LdLo1kdQqCa3lWDReyb0S2I14ml9qddc3UA/IBtZDy0AfOlNbwzV+V9SW8j8lXh
4KGGNfNfsuRsSoiYNyIzCQEtRCEm9c/SkTwhW2oNTdztRtageji91y9zOPRf3lN9
HpDR05a8AoC1YonHZxxNcxQMScIUHp8AEQEAAcLBdgQYAQoAIBYhBEfyKueidUKR
civwkPbhQPbbNZ5YBQJmVOR5AhsMAAoJEPbhQPbbNZ5Yef0P/AwNuhnujouSKmc/
Nov/pHkcujZaYsn1iIoYEqhmWjpnBQav+m63G+RZ5zjqu36G7uhZkpYILPihLOJZ
X2SuTIrVitnJ+ocXK2QFLbW8gUlvqRi4kP5XbUQ0yAVWzPFlY9BNK6DUrj0LeC5n
4i+llAI9d50MiqlUDp+pdCotsuyE0PuuGDkY943LXWnPRPnHCv96ocOglN/dyVCB
N1fjEStCG4q3xzYO1KX3WnPOdurPh/CDw6Uypfr6VOlU+3BN+7t2wCk2V7tDjaYH
8/pZCzHCH3FDzUdEuVRBE0eB73yNFv1/SgVstqvTUfcYnaOm2EgvtBB14gIC8qBO
GPSjlh/7kMmD7m8ZiJNknUOL04mOFkDufnbcNUxmYEbn33TCbSIWDjt3RxTHVnzB
UZjYdBkUNJU1JcxDRJzoILSMUSLSH69z90UaArMiKMGtRoIQj2vSSQzdUgeGBBKv
vqE74KMQ0kj/qLaX6cCLUBX2kBShMVbQ7igp3Jytqj8hRvpPVo+xoXd42UWmLTCa
ISvwLtKvzrXYT80yYVUHhCx9keJ+zuOloshIPmvdVvfuoVaGVMpf6/gOJniRuUwA
ufUEKoy7Nl7w6e9pNIM7S5k7TqinqALWixkER9AfIOmEYYsmTVTBDLjsSEv0QWyJ
QGrNPtvSWtSzFkAmdaSP92Yi2kr2
=ZpuF
-----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEER/Iq56J1QpFyK/CQ9uFA9ts1nlgFAme0qQQFAwAAAAAACgkQ9uFA9ts1nliQ
/xAAjZ9zqfnSnNeml12zy308XBE4Crx2GpAVWI6McTbbjUaoEU0SMC5Ol1UDk2P+qqvQh6Gz0JN4
3XmAK1SM8Kfg+AI1xp4IMiZdg8ktEo8Fb2K7k7jMlzbo+UmTi0io2hSvHwhiNTHfaefuGP9SxOcf
wFHfc90tsDSxJZY4Vvotar/is1k8UE+TZVRDe0MmDZbvyRU9hIhK1Lo/mt/LlfnJlzUNeDDsCHSK
G7IvPY1MPdIAKkqb7Fqw+Km2+Nb6Ps5qc2AVOpmD8sGZMPH/awC7UA8hrXqUY/fNtTc6wY6ktJsr
jFVXV1e/AdZ7pl5HpbLt4/5Nu4K1dpS2fwOLKWIjejQl59qBxJanXIfXgruqG2a+Gud4H9XtFr5n
IoW4ELsKgXTl6YHPrrnBnrdEmeMz0+Ptqh3boIoYGKBWdarRtTplGIP/Ah3UghUH73DjP6ElS68b
3YRBbZZALX7gQETJHWEDDxlIfMwXOTs2qzY6NTMC594RUYzy5iEcnh1HRB6FfwyOElFdBcCFaddT
FWTFmOl/w07JeDeJr2vkYF7c4jDi9TjSveYKkXI7RdqA8TGqApu64D35J/Y6J1XV2W3VHEZ4+3Vm
kYvrZDdng/ktfzIJ0N9rFg+MhIpyvH3tIi7bkj5kOVMxdAZ9EZMSIFZCuE5hqW5b05dlTF1VqTSN
jd4=
=zeka
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7271-1
February 18, 2025
python-virtualenv vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
python-virtualenv could be made to crash or run programs as your login if it
opened a specially crafted file.
Software Description:
- python-virtualenv: Python virtual environment creator
Details:
It was discovered that virtualenv incorrectly handled paths when activating
virtual environments. An attacker could possibly use this issue to execute
arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
python3-virtualenv 20.13.0+ds-2ubuntu0.1~esm1
Available with Ubuntu Pro
virtualenv 20.13.0+ds-2ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 20.04 LTS
python3-virtualenv 20.0.17-1ubuntu0.4+esm1
Available with Ubuntu Pro
virtualenv 20.0.17-1ubuntu0.4+esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7271-1
CVE-2024-53899
Fedora 42 Beta Freeze and Bodhi updates-testing activation point
Hi all,
Today's an important day on the Fedora Linux 42 schedule [1], with
several significant cut-offs. First of all, today is the Bodhi
updates-testing activation point [2]. That means that from now all
Fedora Linux 42 packages must be submitted to updates-testing and pass
the relevant requirements [3] before they will be marked as 'stable'
and moved to the Fedora Repository.
Today is also the Beta freeze [4]. This means that only packages which
fix accepted blocker or freeze exception bugs [5][6] will be marked as
'stable' and included in the Beta composes. Other builds will remain
in updates-testing until the Beta release is approved, at which point
the Beta freeze is lifted and packages can move to 'stable' as usual
until the Final freeze.
Today is also the Software String freeze [7], which means that strings
marked for translation in Fedora-translated projects should not now be
changed for Fedora Linux 42. Finally, today is the 'completion
deadline' Change Checkpoint [8], meaning that Fedora Linux 42 Changes
must now be 'feature complete or close enough to completion that a
majority of its functionality can be tested'. All tracking bugs should
be on ON_QA state or later to reflect this.
Regards,
Samyak Jain
Fedora Release Engineering
[1] https://fedorapeople.org/groups/schedule/f-42/f-42-key-tasks.html
[2] https://fedoraproject.org/wiki/Updates_Policy#Bodhi_enabling
[3] https://fedoraproject.org/wiki/Updates_Policy#Branched_release
[4] https://fedoraproject.org/wiki/Milestone_freezes
[5] https://fedoraproject.org/wiki/QA:SOP_blocker_bug_process
[6] https://fedoraproject.org/wiki/QA:SOP_freeze_exception_bug_process
[7] https://fedoraproject.org/wiki/ReleaseEngineering/StringFreezePolicy
[8] https://fedoraproject.org/wiki/Changes/Policy
--
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Today's an important day on the Fedora Linux 42 schedule [1], with
several significant cut-offs. First of all, today is the Bodhi
updates-testing activation point [2]. That means that from now all
Fedora Linux 42 packages must be submitted to updates-testing and pass
the relevant requirements [3] before they will be marked as 'stable'
and moved to the Fedora Repository.
Today is also the Beta freeze [4]. This means that only packages which
fix accepted blocker or freeze exception bugs [5][6] will be marked as
'stable' and included in the Beta composes. Other builds will remain
in updates-testing until the Beta release is approved, at which point
the Beta freeze is lifted and packages can move to 'stable' as usual
until the Final freeze.
Today is also the Software String freeze [7], which means that strings
marked for translation in Fedora-translated projects should not now be
changed for Fedora Linux 42. Finally, today is the 'completion
deadline' Change Checkpoint [8], meaning that Fedora Linux 42 Changes
must now be 'feature complete or close enough to completion that a
majority of its functionality can be tested'. All tracking bugs should
be on ON_QA state or later to reflect this.
Regards,
Samyak Jain
Fedora Release Engineering
[1] https://fedorapeople.org/groups/schedule/f-42/f-42-key-tasks.html
[2] https://fedoraproject.org/wiki/Updates_Policy#Bodhi_enabling
[3] https://fedoraproject.org/wiki/Updates_Policy#Branched_release
[4] https://fedoraproject.org/wiki/Milestone_freezes
[5] https://fedoraproject.org/wiki/QA:SOP_blocker_bug_process
[6] https://fedoraproject.org/wiki/QA:SOP_freeze_exception_bug_process
[7] https://fedoraproject.org/wiki/ReleaseEngineering/StringFreezePolicy
[8] https://fedoraproject.org/wiki/Changes/Policy
--
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
[USN-7161-2] Docker vulnerabilities
-----BEGIN PGP SIGNATURE-----
wnsEABYIACMWIQSV2d7RU755utSnx3O7Ba3EKYsoKQUCZ7Rg/wUDAAAAAAAKCRC7Ba3EKYsoKcJt
AP9e7iamyIKQF+kffv1TW4lYXQX+4L3901NDi+7d/NnvXgD+Jbs/KCcLR29Ujam4qr2aPt+PO8Vh
o6SVgvhSFwdOjws=
=bn0u
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7161-2
February 18, 2025
Docker vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in Docker.
Software Description:
- docker.io-app: Linux container runtime
- docker.io: Linux container runtime
Details:
USN-7161-1 fixed CVE-2024-29018 in Ubuntu 24.04 LTS. This update fixes it
in Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
USN-7161-1 fixed CVE-2024-41110 in Ubuntu 24.10, Ubuntu 24.04 LTS, and
Ubuntu 18.04 LTS. This updates fixes it in Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS.
Original advisory details:
Yair Zak discovered that Docker could unexpectedly forward DNS requests
from internal networks in an unexpected manner. An attacker could possibly
use this issue to exfiltrate data by encoding information in DNS queries
to controlled nameservers. This issue was only addressed in
Ubuntu 24.04 LTS. (CVE-2024-29018)
Cory Snider discovered that Docker did not properly handle authorization
plugin request processing. An attacker could possibly use this issue to
bypass authorization controls by forwarding API requests without their
full body, leading to unauthorized actions. (CVE-2024-41110)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
docker.io 26.1.3-0ubuntu1~22.04.1+esm1
Available with Ubuntu Pro
Ubuntu 20.04 LTS
docker.io 26.1.3-0ubuntu1~20.04.1+esm1
Available with Ubuntu Pro
Ubuntu 18.04 LTS
docker.io 20.10.21-0ubuntu1~18.04.3+esm2
Available with Ubuntu Pro
Ubuntu 16.04 LTS
docker.io 18.09.7-0ubuntu1~16.04.9+esm2
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7161-2
https://ubuntu.com/security/notices/USN-7161-1
CVE-2024-29018, CVE-2024-41110
wnsEABYIACMWIQSV2d7RU755utSnx3O7Ba3EKYsoKQUCZ7Rg/wUDAAAAAAAKCRC7Ba3EKYsoKcJt
AP9e7iamyIKQF+kffv1TW4lYXQX+4L3901NDi+7d/NnvXgD+Jbs/KCcLR29Ujam4qr2aPt+PO8Vh
o6SVgvhSFwdOjws=
=bn0u
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7161-2
February 18, 2025
Docker vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in Docker.
Software Description:
- docker.io-app: Linux container runtime
- docker.io: Linux container runtime
Details:
USN-7161-1 fixed CVE-2024-29018 in Ubuntu 24.04 LTS. This update fixes it
in Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
USN-7161-1 fixed CVE-2024-41110 in Ubuntu 24.10, Ubuntu 24.04 LTS, and
Ubuntu 18.04 LTS. This updates fixes it in Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS.
Original advisory details:
Yair Zak discovered that Docker could unexpectedly forward DNS requests
from internal networks in an unexpected manner. An attacker could possibly
use this issue to exfiltrate data by encoding information in DNS queries
to controlled nameservers. This issue was only addressed in
Ubuntu 24.04 LTS. (CVE-2024-29018)
Cory Snider discovered that Docker did not properly handle authorization
plugin request processing. An attacker could possibly use this issue to
bypass authorization controls by forwarding API requests without their
full body, leading to unauthorized actions. (CVE-2024-41110)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
docker.io 26.1.3-0ubuntu1~22.04.1+esm1
Available with Ubuntu Pro
Ubuntu 20.04 LTS
docker.io 26.1.3-0ubuntu1~20.04.1+esm1
Available with Ubuntu Pro
Ubuntu 18.04 LTS
docker.io 20.10.21-0ubuntu1~18.04.3+esm2
Available with Ubuntu Pro
Ubuntu 16.04 LTS
docker.io 18.09.7-0ubuntu1~16.04.9+esm2
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7161-2
https://ubuntu.com/security/notices/USN-7161-1
CVE-2024-29018, CVE-2024-41110
OpenBSD Errata: February 18, 2025 (ssh)
Errata patches for sshd(8) and ssh(1) have been released for
OpenBSD 7.6 and 7.5.
Binary updates for the amd64, arm64 and i386 platform are available
via the syspatch utility. Source code patches can be found on the
respective errata page:
https://www.openbsd.org/errata75.html
https://www.openbsd.org/errata76.html
OpenBSD 7.6 and 7.5.
Binary updates for the amd64, arm64 and i386 platform are available
via the syspatch utility. Source code patches can be found on the
respective errata page:
https://www.openbsd.org/errata75.html
https://www.openbsd.org/errata76.html
Monday, February 17, 2025
Inactive provenpackagers for the F42 cycle
In accordance with FESCo policy[1], the following provenpackagers will be submitted for removal in two weeks based on a lack of Koji builds submitted in the last six months. If you received this directly, you can reply off-list to indicate you should still be in the provenpackager group. Note that removal from this group is not a "punishment" or a lack of appreciation for the work you have done. The intent of the process is to ensure contributors with distro-wide package privileges are still active and responsive. This process is done regularly at the branch point in each release. [1] https://docs.fedoraproject.org/en-US/fesco/Provenpackager_policy/#_maintaining_provenpackager_status Checked 123 provenpackagers The following 9 provenpackagers have not submitted a Koji build since at least 2024-08-12 00:00:00: mohanboddu jerboaa rmattes pbrady pmikova dwmw2 otaylor mgieseki wtogami
[USN-7269-1] Intel Microcode vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7269-1
February 17, 2025
intel-microcode vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in Intel Microcode.
Software Description:
- intel-microcode: Processor microcode for Intel CPUs
Details:
Ke Sun, Paul Grosen and Alyssa Milburn discovered that some Intel®
Processors did not properly implement Finite State Machines (FSMs) in
Hardware Logic. A local privileged attacker could use this issue to cause a
denial of service. (CVE-2024-31068)
It was discovered that some Intel® Processors with Intel® SGX did not
properly restrict access to the EDECCSSA user leaf function. A local
authenticated attacker could use this issue to cause a denial of
service. (CVE-2024-36293)
Ke Sun, Alyssa Milburn, Benoit Morgan, and Erik Bjorge discovered that the
UEFI firmware for some Intel® processors did not properly restrict
access. An authenticated local attacker could use this issue to cause a
denial of service. (CVE-2024-39279)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
intel-microcode 3.20250211.0ubuntu0.24.10.1
Ubuntu 22.04 LTS
intel-microcode 3.20250211.0ubuntu0.22.04.1
Ubuntu 20.04 LTS
intel-microcode 3.20250211.0ubuntu0.20.04.1
Ubuntu 18.04 LTS
intel-microcode 3.20250211.0ubuntu0.18.04.1+esm1
Available with Ubuntu Pro
Ubuntu 16.04 LTS
intel-microcode 3.20250211.0ubuntu0.16.04.1+esm1
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7269-1
CVE-2024-31068, CVE-2024-36293, CVE-2024-39279
Package Information:
https://launchpad.net/ubuntu/+source/intel-microcode/3.20250211.0ubuntu0.24.10.1
https://launchpad.net/ubuntu/+source/intel-microcode/3.20250211.0ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/intel-microcode/3.20250211.0ubuntu0.20.04.1
Ubuntu Security Notice USN-7269-1
February 17, 2025
intel-microcode vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in Intel Microcode.
Software Description:
- intel-microcode: Processor microcode for Intel CPUs
Details:
Ke Sun, Paul Grosen and Alyssa Milburn discovered that some Intel®
Processors did not properly implement Finite State Machines (FSMs) in
Hardware Logic. A local privileged attacker could use this issue to cause a
denial of service. (CVE-2024-31068)
It was discovered that some Intel® Processors with Intel® SGX did not
properly restrict access to the EDECCSSA user leaf function. A local
authenticated attacker could use this issue to cause a denial of
service. (CVE-2024-36293)
Ke Sun, Alyssa Milburn, Benoit Morgan, and Erik Bjorge discovered that the
UEFI firmware for some Intel® processors did not properly restrict
access. An authenticated local attacker could use this issue to cause a
denial of service. (CVE-2024-39279)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
intel-microcode 3.20250211.0ubuntu0.24.10.1
Ubuntu 22.04 LTS
intel-microcode 3.20250211.0ubuntu0.22.04.1
Ubuntu 20.04 LTS
intel-microcode 3.20250211.0ubuntu0.20.04.1
Ubuntu 18.04 LTS
intel-microcode 3.20250211.0ubuntu0.18.04.1+esm1
Available with Ubuntu Pro
Ubuntu 16.04 LTS
intel-microcode 3.20250211.0ubuntu0.16.04.1+esm1
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7269-1
CVE-2024-31068, CVE-2024-36293, CVE-2024-39279
Package Information:
https://launchpad.net/ubuntu/+source/intel-microcode/3.20250211.0ubuntu0.24.10.1
https://launchpad.net/ubuntu/+source/intel-microcode/3.20250211.0ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/intel-microcode/3.20250211.0ubuntu0.20.04.1
Sunday, February 16, 2025
[arch-announce] Cleaning up old repositories
Around two years ago, we've merged the `[community]` repository into `[extra]` as part of the [git migration](https://archlinux.org/news/git-migration-completed/).
In order to not break user setups,
we kept these repositories around in an unused and empty state.
We're going to clean up these old repositories on **2025-03-01**.
On systems where `/etc/pacman.conf` still references the old
`[community]` repository, `pacman -Sy` will return an error on trying to
sync repository metadata.
The following deprecated repositories will be removed: `[community]`,
`[community-testing]`, `[testing]`, `[testing-debug]`, `[staging]`,
`[staging-debug]`.
Please make sure to remove all use of the aforementioned repositories from your `/etc/pacman.conf` (for which a `.pacnew` was shipped with `pacman>=6.0.2-7`)!
URL: https://archlinux.org/news/cleaning-up-old-repositories/
In order to not break user setups,
we kept these repositories around in an unused and empty state.
We're going to clean up these old repositories on **2025-03-01**.
On systems where `/etc/pacman.conf` still references the old
`[community]` repository, `pacman -Sy` will return an error on trying to
sync repository metadata.
The following deprecated repositories will be removed: `[community]`,
`[community-testing]`, `[testing]`, `[testing-debug]`, `[staging]`,
`[staging-debug]`.
Please make sure to remove all use of the aforementioned repositories from your `/etc/pacman.conf` (for which a `.pacnew` was shipped with `pacman>=6.0.2-7`)!
URL: https://archlinux.org/news/cleaning-up-old-repositories/
Friday, February 14, 2025
[USN-7268-1] Apache ActiveMQ vulnerabilities
-----BEGIN PGP PUBLIC KEY BLOCK-----
xsFNBGcM+UsBEACnxIX3dF12qyB4OKisrt1o7TWw/2QPjdzEQCyPhg4EI0SQocv1
A9HjQChQzbXVzEWPNStrsp3NqGv/GPgiICCRCR+wZbWMMKVz5QhEuVtm18399ERz
GAZ6L+2//ZQfUrTIJF9edZpK+KysNGag5qyUFTOu9auDqIJ/PJPkX/tEL2vx3DE0
OtQZmBxmKinOdzAA+kct3xf2FaAIQoSq/gRIeFS3zCQgOvncIs8WGcS/ZOQNhrLq
ULFIayVOjmx0GEjvOWe9Fp883v20p2Fxf9qDPpyX5lVE2/Uu/GOhK5IPQH5ls688
E/KjXgi1Kw1SLcrAIjOk3JjWXzcV5og/flNqaKkqnSpRQ/up2NeQukSTkqLSZvyK
hjnpyGjosbjdIVQ2lqjz2S94pDHaOCjROpS9WDXAhQscL07xa1ld5d0E2BCAD3YO
d+Q6zVGrWAh3GhBBQm9XWCBJlrXHO03dHI4VXgnYC3zHyW6BSMhmEH4aepcCK/NA
U7WCvf8QcLiWwy2qVwlgrVr2GfjP1HG16UZlWXQD6Ooxbrmw7nZr/LAk6bSEjNzV
O3vROUk7drdmq4VN+2tZHnsnGFXzIwLvHNbwVSzv3FfRLt6uLC8EifrFysJ4yJIz
3C80qa1i1VfSAjw1uVe4sTBKXo4Ap1BFia+S07EMgSWdkV5oQz2b3Jr9cQARAQAB
zTZOb2FtIE5lZGVsZWMtU2FsbW9uIDxub2FtLm5lZGVsZWNzYWxtb25AY2Fub25p
Y2FsLmNvbT7CwZEEEwEKADsWIQSKjhLfH3pjEbIqx+Q1/Mid/TeRwQUCZwz5SwIb
AwULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRA1/Mid/TeRwU2rEACFY4wW
Q2gXo1Hw/wkMsjVD1HqUqtPB9KBs+1+nvGOXjmgsszaRSNAlYUAQElRDYyBON2PB
O34TPV9e7KdW4vJSWFgP8En2kA613W/MJsW7hwH3M5cqBJucwyfCqFryzk0vJ6Jr
ZNjUlRr3dPYQ5calEdn5aQBD4AkY58liC2kOYC1DTe4iA1Zqxu+kapN36PwEPT7u
QQ22ssqKtR2DzGj7erZpfGfkEBI142FUfPtbfYu4UbGcXi86Tvf19Qc/GivLDuTJ
aNYrIQNDk7I4vwXpl2TvK6u5u+2PX0MGRQ8HNztieB5FiXtkoG8/fVoTlmySK6yq
4qq4Kv4HuKVd+1YAXFGMdyAc1fruXDeO4Ne/06yLEfXZUSAV/It4Rk38ad4gwRsb
eCS0C3/DXNXw9W2Dd4cOmn9YQx3QXynVrKOHi05IZUryCRyrhPfD/gJq0BtWc7PZ
gOPTMbCZuaDnT4kQso2OPunL3QKqgCRa1JnRV11JQ344jZYMqf/C7opH/v+QBAVg
V2XCfkcyVk8Ikiyr8FRA24noAYCPqgovrhabpLVcKpQ0ulcTiwIiIBkA8OfZV9cG
9pEmHiaEsHiUm/yoJ5j/zWytM8jyoZdfKjt76gIpIOwx90okD2qNU4I9GC6LtnX6
hA6TCRBVnv9kmMuhv0dmiiQqX4aAj9J8W2xLHc7BTQRnDPlLARAAyfXjcjkjx/FM
13ptrTyqajvVAmkidTo0PhJgl0boDB5TGSIfGY9+ta2z8Awqb3xtwZ2L5GLdJXQq
LV3/VGK0D++X/icGNT+7xgynmUEHmneEHBXlGUcOr3SU8kcd6OV2CNu8AmrCvktP
1zqYBbJ5hFyuaZvTGeM9AHMhyHJddd5vDVBJN8geVHUDuyzAIk31l+m0LWPGR3TA
/WtqMQOpfYVDbh7r1p9SkTcjJLEIeuo4Whrn7Y5QRkF2KXvj/F5xWyCQtYEqSyGF
o9XLXqhb7sxCYEzBQc/7wrXh84dU+Rd3FgKKeOxX2HVchauJgX8fsbS6NaMfvkVJ
fzTzHKfJ8NtqmxA6yMpMdfrS+mFSIxm/Nb7N3VmWNZhbWbp4ueUXd1YHyhy+Xkad
ti/E/GyVBACOZKTKT7pYk088heDpz6TVafWa2keC5VJq2htgKr4yyXTp/9PyN8Mx
jmbqcwApEHUmata4PSWk3XvdKCo+742fIJQGV/pel+V0/iyqwg/Gcv/sek3gCK1X
NLWp9ZJBmIVNXtKpaAq/R04v7AIm2O/LQ5b/0m4KTzRJwgO8hDU25DTqOjbZbumo
qI3H8w+pTM4Jm9zwoN6fsoZN3oRLjh+6BFeD77C6sAK87TAIrgywvRcWjm4OeOwL
dUoApFez6mF4ebHUtsjNWSo2Xun27q0AEQEAAcLBdgQYAQoAIBYhBIqOEt8femMR
sirH5DX8yJ39N5HBBQJnDPlLAhsMAAoJEDX8yJ39N5HBqEkQAJAxb5ecILu4MXww
Wg7qyMNFmXd2fU3rfDzUyN8gPCLjbloc6GAi/IgeSx3HMI0igeuX5zTwu2cOdnmY
4nFn4Ochi5ln+Uotc6cNJPhHkdIq/Xwyx7tEtXDn/KNZay7T3g8mci2cFKtQQuLZ
Fmkp7E5ADKfHa6IfhOzUFJAk0sH9dxyIZuvUCCY2Ib89fy8/wDcUglsLHzir1pIX
FFTTmIzu6bnjUDrGNR8kIq8qVuAM0rOqUHc8nLbyHEhNvdxNDAAT7zm4Oz2oELZs
Oua49hJ6YW74gtBeizQR6WM1tD7BJbUrvWfw6j+vifYmkzeoZpIA6/qtLje1ytia
HJHknvXuim5MzF7IO0xgm1/zXEhVvQkV1PxXsIccKtV3cMZ7tqHu+9u6+MVRKvG2
UdhdKHJOLnHZTfcx6eUWr5wvVtJHrHg2WpczbxRIv5FM4MAhiuk22eKqyQ+57092
oQzTH3cUb8kfgzC8zONMg3aMkiUmoGjvG81CJ5CZLmsMJTnlDvnb4rJ4jeU8HVf4
/hXJxBJnz9OEamU0w0qr57p1oRj22bt+wNlTE63A13YNznxinJ48Fa4nXZQZEyJi
BFcZwfRKMHtbX/pQc07XJuCqF+AAEC23yxDz5WRncN3EVBmII0SCOaZGQ4mIdh0H
i20vXIyHZEv45UkTIVnfRvrbetiE
=uUCC
-----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEEio4S3x96YxGyKsfkNfzInf03kcEFAmevI1cFAwAAAAAACgkQNfzInf03kcF4
oRAAjIB+N8agxHo4w6N/+YzwQENMSscHeCRP9WmBqOuaQLHJpJ4jv5veXHFaHM8VbFIqypNHSDSU
v5wF+EV9KN+gf4wpzWDwbledU1/cAhmRLLsg4r3auITzb02HJ1asWs5IYpcBhmB28B3/OXRnnp3R
ErU1Kf443bAvmPtnEs8wBALoXuim/D2epjhxyunY6a8lS39FNhWrVQZTElJo/vvOuL9Rxs3rJm/j
iYr1ZvLJynuRNqsTgmfthzANIPJ9yAC68KvEyRpJh6Ozxwxhv+FhPclxaCp3B9A7gJDw5yCVONUZ
4DvE3U0FWbOLl4Z3/3YKEDQ7+bblrZLeTrmnkfg+9l/yeN1is0kNbCd0Z81Y5pxGYZj2VCOxAShM
LDYBh5FZBf4gMm/ZSXV3NE3wo6J97PczvWQbByBAyvLCPzd1mlAhNJwxN0Fz4ef49stvuag/h29y
2lKYYcSj5eqwSmhIk50SfJRGbn3sH2blJyjXzvLi5ztNEu7F+61M0V++d+rBWaVl9L4v8l4k5Qx2
/SPn+Lnk8CzusOEO87z5IZGRs6N53cqkTfnlT44+ls53SPRKerdaHS3PvG0jYGAz48+HCaTWE2Yw
qEVBpCFPU9CSFJhRCL3hEjmgK4cFmiwXoXroQ6Cu3zA/rtRUWfWNPgo5yFJOenD09pFEW+F6k3ab
PgI=
=qFVw
-----END PGP SIGNATURE-----
xsFNBGcM+UsBEACnxIX3dF12qyB4OKisrt1o7TWw/2QPjdzEQCyPhg4EI0SQocv1
A9HjQChQzbXVzEWPNStrsp3NqGv/GPgiICCRCR+wZbWMMKVz5QhEuVtm18399ERz
GAZ6L+2//ZQfUrTIJF9edZpK+KysNGag5qyUFTOu9auDqIJ/PJPkX/tEL2vx3DE0
OtQZmBxmKinOdzAA+kct3xf2FaAIQoSq/gRIeFS3zCQgOvncIs8WGcS/ZOQNhrLq
ULFIayVOjmx0GEjvOWe9Fp883v20p2Fxf9qDPpyX5lVE2/Uu/GOhK5IPQH5ls688
E/KjXgi1Kw1SLcrAIjOk3JjWXzcV5og/flNqaKkqnSpRQ/up2NeQukSTkqLSZvyK
hjnpyGjosbjdIVQ2lqjz2S94pDHaOCjROpS9WDXAhQscL07xa1ld5d0E2BCAD3YO
d+Q6zVGrWAh3GhBBQm9XWCBJlrXHO03dHI4VXgnYC3zHyW6BSMhmEH4aepcCK/NA
U7WCvf8QcLiWwy2qVwlgrVr2GfjP1HG16UZlWXQD6Ooxbrmw7nZr/LAk6bSEjNzV
O3vROUk7drdmq4VN+2tZHnsnGFXzIwLvHNbwVSzv3FfRLt6uLC8EifrFysJ4yJIz
3C80qa1i1VfSAjw1uVe4sTBKXo4Ap1BFia+S07EMgSWdkV5oQz2b3Jr9cQARAQAB
zTZOb2FtIE5lZGVsZWMtU2FsbW9uIDxub2FtLm5lZGVsZWNzYWxtb25AY2Fub25p
Y2FsLmNvbT7CwZEEEwEKADsWIQSKjhLfH3pjEbIqx+Q1/Mid/TeRwQUCZwz5SwIb
AwULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRA1/Mid/TeRwU2rEACFY4wW
Q2gXo1Hw/wkMsjVD1HqUqtPB9KBs+1+nvGOXjmgsszaRSNAlYUAQElRDYyBON2PB
O34TPV9e7KdW4vJSWFgP8En2kA613W/MJsW7hwH3M5cqBJucwyfCqFryzk0vJ6Jr
ZNjUlRr3dPYQ5calEdn5aQBD4AkY58liC2kOYC1DTe4iA1Zqxu+kapN36PwEPT7u
QQ22ssqKtR2DzGj7erZpfGfkEBI142FUfPtbfYu4UbGcXi86Tvf19Qc/GivLDuTJ
aNYrIQNDk7I4vwXpl2TvK6u5u+2PX0MGRQ8HNztieB5FiXtkoG8/fVoTlmySK6yq
4qq4Kv4HuKVd+1YAXFGMdyAc1fruXDeO4Ne/06yLEfXZUSAV/It4Rk38ad4gwRsb
eCS0C3/DXNXw9W2Dd4cOmn9YQx3QXynVrKOHi05IZUryCRyrhPfD/gJq0BtWc7PZ
gOPTMbCZuaDnT4kQso2OPunL3QKqgCRa1JnRV11JQ344jZYMqf/C7opH/v+QBAVg
V2XCfkcyVk8Ikiyr8FRA24noAYCPqgovrhabpLVcKpQ0ulcTiwIiIBkA8OfZV9cG
9pEmHiaEsHiUm/yoJ5j/zWytM8jyoZdfKjt76gIpIOwx90okD2qNU4I9GC6LtnX6
hA6TCRBVnv9kmMuhv0dmiiQqX4aAj9J8W2xLHc7BTQRnDPlLARAAyfXjcjkjx/FM
13ptrTyqajvVAmkidTo0PhJgl0boDB5TGSIfGY9+ta2z8Awqb3xtwZ2L5GLdJXQq
LV3/VGK0D++X/icGNT+7xgynmUEHmneEHBXlGUcOr3SU8kcd6OV2CNu8AmrCvktP
1zqYBbJ5hFyuaZvTGeM9AHMhyHJddd5vDVBJN8geVHUDuyzAIk31l+m0LWPGR3TA
/WtqMQOpfYVDbh7r1p9SkTcjJLEIeuo4Whrn7Y5QRkF2KXvj/F5xWyCQtYEqSyGF
o9XLXqhb7sxCYEzBQc/7wrXh84dU+Rd3FgKKeOxX2HVchauJgX8fsbS6NaMfvkVJ
fzTzHKfJ8NtqmxA6yMpMdfrS+mFSIxm/Nb7N3VmWNZhbWbp4ueUXd1YHyhy+Xkad
ti/E/GyVBACOZKTKT7pYk088heDpz6TVafWa2keC5VJq2htgKr4yyXTp/9PyN8Mx
jmbqcwApEHUmata4PSWk3XvdKCo+742fIJQGV/pel+V0/iyqwg/Gcv/sek3gCK1X
NLWp9ZJBmIVNXtKpaAq/R04v7AIm2O/LQ5b/0m4KTzRJwgO8hDU25DTqOjbZbumo
qI3H8w+pTM4Jm9zwoN6fsoZN3oRLjh+6BFeD77C6sAK87TAIrgywvRcWjm4OeOwL
dUoApFez6mF4ebHUtsjNWSo2Xun27q0AEQEAAcLBdgQYAQoAIBYhBIqOEt8femMR
sirH5DX8yJ39N5HBBQJnDPlLAhsMAAoJEDX8yJ39N5HBqEkQAJAxb5ecILu4MXww
Wg7qyMNFmXd2fU3rfDzUyN8gPCLjbloc6GAi/IgeSx3HMI0igeuX5zTwu2cOdnmY
4nFn4Ochi5ln+Uotc6cNJPhHkdIq/Xwyx7tEtXDn/KNZay7T3g8mci2cFKtQQuLZ
Fmkp7E5ADKfHa6IfhOzUFJAk0sH9dxyIZuvUCCY2Ib89fy8/wDcUglsLHzir1pIX
FFTTmIzu6bnjUDrGNR8kIq8qVuAM0rOqUHc8nLbyHEhNvdxNDAAT7zm4Oz2oELZs
Oua49hJ6YW74gtBeizQR6WM1tD7BJbUrvWfw6j+vifYmkzeoZpIA6/qtLje1ytia
HJHknvXuim5MzF7IO0xgm1/zXEhVvQkV1PxXsIccKtV3cMZ7tqHu+9u6+MVRKvG2
UdhdKHJOLnHZTfcx6eUWr5wvVtJHrHg2WpczbxRIv5FM4MAhiuk22eKqyQ+57092
oQzTH3cUb8kfgzC8zONMg3aMkiUmoGjvG81CJ5CZLmsMJTnlDvnb4rJ4jeU8HVf4
/hXJxBJnz9OEamU0w0qr57p1oRj22bt+wNlTE63A13YNznxinJ48Fa4nXZQZEyJi
BFcZwfRKMHtbX/pQc07XJuCqF+AAEC23yxDz5WRncN3EVBmII0SCOaZGQ4mIdh0H
i20vXIyHZEv45UkTIVnfRvrbetiE
=uUCC
-----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
wsF5BAABCAAjFiEEio4S3x96YxGyKsfkNfzInf03kcEFAmevI1cFAwAAAAAACgkQNfzInf03kcF4
oRAAjIB+N8agxHo4w6N/+YzwQENMSscHeCRP9WmBqOuaQLHJpJ4jv5veXHFaHM8VbFIqypNHSDSU
v5wF+EV9KN+gf4wpzWDwbledU1/cAhmRLLsg4r3auITzb02HJ1asWs5IYpcBhmB28B3/OXRnnp3R
ErU1Kf443bAvmPtnEs8wBALoXuim/D2epjhxyunY6a8lS39FNhWrVQZTElJo/vvOuL9Rxs3rJm/j
iYr1ZvLJynuRNqsTgmfthzANIPJ9yAC68KvEyRpJh6Ozxwxhv+FhPclxaCp3B9A7gJDw5yCVONUZ
4DvE3U0FWbOLl4Z3/3YKEDQ7+bblrZLeTrmnkfg+9l/yeN1is0kNbCd0Z81Y5pxGYZj2VCOxAShM
LDYBh5FZBf4gMm/ZSXV3NE3wo6J97PczvWQbByBAyvLCPzd1mlAhNJwxN0Fz4ef49stvuag/h29y
2lKYYcSj5eqwSmhIk50SfJRGbn3sH2blJyjXzvLi5ztNEu7F+61M0V++d+rBWaVl9L4v8l4k5Qx2
/SPn+Lnk8CzusOEO87z5IZGRs6N53cqkTfnlT44+ls53SPRKerdaHS3PvG0jYGAz48+HCaTWE2Yw
qEVBpCFPU9CSFJhRCL3hEjmgK4cFmiwXoXroQ6Cu3zA/rtRUWfWNPgo5yFJOenD09pFEW+F6k3ab
PgI=
=qFVw
-----END PGP SIGNATURE-----
========================================================================== Ubuntu Security Notice USN-7268-1 February 14, 2025 activemq vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS Summary: Several security issues were fixed in Apache ActiveMQ. Software Description: - activemq: Java message broker - server Details: It was discovered that Apache ActiveMQ incorrectly handled authentication. A remote attacker could possibly use this issue to run arbitrary code. (CVE-2022-41678) It was discovered that Apache ActiveMQ incorrectly handled deserialization. A remote attacker could possibly use this issue to run arbitrary shell commands. (CVE-2023-46604) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS activemq 5.16.1-1ubuntu0.1 libactivemq-java 5.16.1-1ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7268-1 CVE-2022-41678, CVE-2023-46604 Package Information: https://launchpad.net/ubuntu/+source/activemq/5.16.1-1ubuntu0.1
Thursday, February 13, 2025
[lfs-announce] LFS-12.3-rc1 is released
The Linux From Scratch community announces the release of LFS Version 12.3-rc1. It is
a preliminary release of LFS-12.3.
Major changes include tool chain updates to binutils-2.44 and glibc-2.41. In total,
45 different packages were updated since the last release. Changes to the text have
also been made throughout the book. The Linux kernel has also been updated to version
6.13.2.
We encourage all users to read through this release of the book and test
the instructions so that we can make the final release as good as possible.
You can read the book online [0], or download [1] to read locally.
In coordination with this release, a new version of LFS using the systemd package is
also being released. This package implements the newer systemd style of system
initialization and control and is consistent with LFS in most packages.
>
> You can read the systemd version of the book online [2], or download [3]
> to read locally.
>
> -- Bruce
>
> [0] http://www.linuxfromscratch.org/lfs/view/12.3-rc1/
> [1] http://www.linuxfromscratch.org/lfs/downloads/12.3-rc1/
> [2] http://www.linuxfromscratch.org/lfs/view/12.3-systemd-rc1/
> [3] http://www.linuxfromscratch.org/lfs/downloads/12.3-systemd-rc1/
a preliminary release of LFS-12.3.
Major changes include tool chain updates to binutils-2.44 and glibc-2.41. In total,
45 different packages were updated since the last release. Changes to the text have
also been made throughout the book. The Linux kernel has also been updated to version
6.13.2.
We encourage all users to read through this release of the book and test
the instructions so that we can make the final release as good as possible.
You can read the book online [0], or download [1] to read locally.
In coordination with this release, a new version of LFS using the systemd package is
also being released. This package implements the newer systemd style of system
initialization and control and is consistent with LFS in most packages.
>
> You can read the systemd version of the book online [2], or download [3]
> to read locally.
>
> -- Bruce
>
> [0] http://www.linuxfromscratch.org/lfs/view/12.3-rc1/
> [1] http://www.linuxfromscratch.org/lfs/downloads/12.3-rc1/
> [2] http://www.linuxfromscratch.org/lfs/view/12.3-systemd-rc1/
> [3] http://www.linuxfromscratch.org/lfs/downloads/12.3-systemd-rc1/
[USN-7267-1] libsndfile vulnerability
-----BEGIN PGP SIGNATURE-----
wsD5BAABCAAjFiEEcxdv4gCCE8W9nrt5a1+PL+d1/EgFAmeuGjUFAwAAAAAACgkQa1+PL+d1/Ejv
twv/ULR3+trdnnJCaIejSne3JRg3LJnVVCMJccHcPFFgdtvu8N4qQ+9RwCkJds/uinqacrVKsJ3X
CMkCZM4scPx4GKf7Hm9tsIz7+ffrQ30DabEJC/m1e4E7swKrL3jET33Lud1T3kWHoir7e+3XAt4T
kpaLof9miXF7J0DKHNa0bcZVpoqQqPFc4PzifnHjD/FpLUwTsuLraXmKH0C9b9wm6G3t+5qY38v9
kta+v5w1uUsOo5Wr4NJasGy5rI+2JYTHvriVNopDKQBmY2XVCLbvOVs+zJYUBaZAqqr7ENw9RmgM
Kem42sYU5SuSgX6JpxmIWaFakTVs2XGa9xN5deqIB+WqyJErcGwIMvrh4DQfJ3Ot2hObqYpQcvtL
cdPW1fDUCqm9Qs8FFzWJZIFtMMgNTSpDzQzmLTvanpm2BsFdqVRv0ubjuzojjSlQuarVzy9CWYIB
FdzrtjpfMCgkFT7f5Hvsyh2xZ6ban3W+mDoWR1y9fnqu5gR2R2zCSoX8LNPz
=wpZH
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7267-1
February 13, 2025
libsndfile vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
libsndfile could be made to crash if it opened a specially crafted file.
Software Description:
- libsndfile: Library for reading/writing audio files
Details:
It was discovered that libsndfile incorrectly handled certain malformed
OggVorbis files. An attacker could possibly use this issue to cause
libsndfile to crash, resulting in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS
libsndfile1 1.0.25-10ubuntu0.16.04.3+esm4
Available with Ubuntu Pro
sndfile-programs 1.0.25-10ubuntu0.16.04.3+esm4
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7267-1
CVE-2024-50612
wsD5BAABCAAjFiEEcxdv4gCCE8W9nrt5a1+PL+d1/EgFAmeuGjUFAwAAAAAACgkQa1+PL+d1/Ejv
twv/ULR3+trdnnJCaIejSne3JRg3LJnVVCMJccHcPFFgdtvu8N4qQ+9RwCkJds/uinqacrVKsJ3X
CMkCZM4scPx4GKf7Hm9tsIz7+ffrQ30DabEJC/m1e4E7swKrL3jET33Lud1T3kWHoir7e+3XAt4T
kpaLof9miXF7J0DKHNa0bcZVpoqQqPFc4PzifnHjD/FpLUwTsuLraXmKH0C9b9wm6G3t+5qY38v9
kta+v5w1uUsOo5Wr4NJasGy5rI+2JYTHvriVNopDKQBmY2XVCLbvOVs+zJYUBaZAqqr7ENw9RmgM
Kem42sYU5SuSgX6JpxmIWaFakTVs2XGa9xN5deqIB+WqyJErcGwIMvrh4DQfJ3Ot2hObqYpQcvtL
cdPW1fDUCqm9Qs8FFzWJZIFtMMgNTSpDzQzmLTvanpm2BsFdqVRv0ubjuzojjSlQuarVzy9CWYIB
FdzrtjpfMCgkFT7f5Hvsyh2xZ6ban3W+mDoWR1y9fnqu5gR2R2zCSoX8LNPz
=wpZH
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-7267-1
February 13, 2025
libsndfile vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
libsndfile could be made to crash if it opened a specially crafted file.
Software Description:
- libsndfile: Library for reading/writing audio files
Details:
It was discovered that libsndfile incorrectly handled certain malformed
OggVorbis files. An attacker could possibly use this issue to cause
libsndfile to crash, resulting in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS
libsndfile1 1.0.25-10ubuntu0.16.04.3+esm4
Available with Ubuntu Pro
sndfile-programs 1.0.25-10ubuntu0.16.04.3+esm4
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7267-1
CVE-2024-50612
Subscribe to:
Posts (Atom)