-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEET5B4c0UgisHPJeML4cb9mBt1GIMFAl/AC1wACgkQ4cb9mBt1
GIPWBA//Rb6SANpLgwidHLF+pdmibf0wc6xA2Kb8Qtj9uDueKaqipHL1ZsMD+mSc
VRjm4dcdPryFLmke2yijLZsp1AZLdq2+xwgVZjHKOEw8fRyUNDw7RkFFGyYkGrgp
B+7Ter6wPgIwRWWIZ1OI5xQ0/YGgqoo3jAG8lhmuK9aIVZ1/EuK9hViZ3GJ17E4Y
YsVJPnnsAXJCu6BHcgz8WN4EjzSqFwx/Pjy+Iq3mwmq6nsBVuEpW8mTcOWdrA4jb
x4AJFvwqKZkjNWwQvOUKqpBN+C5YEphtRWVPLu4sjAdgqTRQxVidDEkiQyu8IRQ8
zn1VB1Es07XmS3pnnBzmyNYtAT3mxoXwuwBLkviPyJhd0LeaRfBApJhLjAzhaKGc
ZFRpbg2HRqDUfho8Oh04lauWfwfBW9R/qP/aihDkMXA5LLj3XaqvmMUk9Cvj7gue
39T3lafr/OGj6BNabQ1YmmaitD4qUV+fE2VNP5gOYaR2o28ANtlJQE78znbQ77cL
1taPGpc3fNt3KGjMr1N/UyINE1IOe8WPGldtaRzTvDVq5yxMTtEFIjNOomYukY6j
hV3pxWSw+cJ6Crv10mR24glyqM1gwOsGu7mrG6msuRke2WpTX7VVv1OwFwiY7HDo
/aoaw/gspFWLZiSxfdUzWpVRVMPxx1bJ8M9hnKtxGmJe8vfE/b4=
=NAF7
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-4382-2
November 26, 2020
freerdp vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in FreeRDP.
Software Description:
- freerdp: RDP client for Windows Terminal Services
Details:
It was discovered that FreeRDP incorrectly handled certain memory
operations. A remote attacker could use this issue to cause FreeRDP to
crash, resulting in a denial of service, or possibly execute arbitrary
code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
libfreerdp-client1.1
1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2
libfreerdp-common1.1.0
1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2
libfreerdp-core1.1
1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4382-2
https://usn.ubuntu.com/4382-1
CVE-2020-11042, CVE-2020-11045, CVE-2020-11046, CVE-2020-11048,
CVE-2020-11058, CVE-2020-11521, CVE-2020-11522, CVE-2020-11523,
CVE-2020-11525, CVE-2020-11526, CVE-2020-13396, CVE-2020-13397,
CVE-2020-13398
Package Information:
https://launchpad.net/ubuntu/+source/freerdp/1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2
Thursday, November 26, 2020
[USN-4646-2] poppler regression
==========================================================================
Ubuntu Security Notice USN-4646-2
November 26, 2020
poppler regression
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
USN-4646-1 introduced a regression in poppler.
Software Description:
- poppler: PDF rendering library
Details:
USN-4646-1 fixed vulnerabilities in poppler. The fix for CVE-2019-10871
introduced a regression causing certain applications linked against poppler
to fail. This update backs out the fix pending further investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Poppler incorrectly handled certain files. If a user
or automated system were tricked into opening a crafted PDF file, an
attacker could cause a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
libpoppler73 0.62.0-2ubuntu2.12
poppler-utils 0.62.0-2ubuntu2.12
Ubuntu 16.04 LTS:
libpoppler58 0.41.0-0ubuntu1.16
poppler-utils 0.41.0-0ubuntu1.16
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4646-2
https://usn.ubuntu.com/4646-1
https://launchpad.net/bugs/1905741
Package Information:
https://launchpad.net/ubuntu/+source/poppler/0.62.0-2ubuntu2.12
https://launchpad.net/ubuntu/+source/poppler/0.41.0-0ubuntu1.16
Ubuntu Security Notice USN-4646-2
November 26, 2020
poppler regression
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
USN-4646-1 introduced a regression in poppler.
Software Description:
- poppler: PDF rendering library
Details:
USN-4646-1 fixed vulnerabilities in poppler. The fix for CVE-2019-10871
introduced a regression causing certain applications linked against poppler
to fail. This update backs out the fix pending further investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Poppler incorrectly handled certain files. If a user
or automated system were tricked into opening a crafted PDF file, an
attacker could cause a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
libpoppler73 0.62.0-2ubuntu2.12
poppler-utils 0.62.0-2ubuntu2.12
Ubuntu 16.04 LTS:
libpoppler58 0.41.0-0ubuntu1.16
poppler-utils 0.41.0-0ubuntu1.16
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4646-2
https://usn.ubuntu.com/4646-1
https://launchpad.net/bugs/1905741
Package Information:
https://launchpad.net/ubuntu/+source/poppler/0.62.0-2ubuntu2.12
https://launchpad.net/ubuntu/+source/poppler/0.41.0-0ubuntu1.16
[USN-4649-1] xdg-utils vulnerability
==========================================================================
Ubuntu Security Notice USN-4649-1
November 26, 2020
xdg-utils vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
xdg-utils could be made to expose sensitive information.
Software Description:
- xdg-utils: desktop integration utilities from freedesktop.org
Details:
Jens Mueller discovered that xdg-utils incorrectly handled certain URI.
An attacker could possibly use this issue to expose sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
xdg-utils 1.1.3-2ubuntu1.20.10.1
Ubuntu 20.04 LTS:
xdg-utils 1.1.3-2ubuntu1.20.04.1
Ubuntu 18.04 LTS:
xdg-utils 1.1.2-1ubuntu2.4
Ubuntu 16.04 LTS:
xdg-utils 1.1.1-1ubuntu1.16.04.4
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4649-1
CVE-2020-27748
Package Information:
https://launchpad.net/ubuntu/+source/xdg-utils/1.1.3-2ubuntu1.20.10.1
https://launchpad.net/ubuntu/+source/xdg-utils/1.1.3-2ubuntu1.20.04.1
https://launchpad.net/ubuntu/+source/xdg-utils/1.1.2-1ubuntu2.4
https://launchpad.net/ubuntu/+source/xdg-utils/1.1.1-1ubuntu1.16.04.4
Ubuntu Security Notice USN-4649-1
November 26, 2020
xdg-utils vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
xdg-utils could be made to expose sensitive information.
Software Description:
- xdg-utils: desktop integration utilities from freedesktop.org
Details:
Jens Mueller discovered that xdg-utils incorrectly handled certain URI.
An attacker could possibly use this issue to expose sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
xdg-utils 1.1.3-2ubuntu1.20.10.1
Ubuntu 20.04 LTS:
xdg-utils 1.1.3-2ubuntu1.20.04.1
Ubuntu 18.04 LTS:
xdg-utils 1.1.2-1ubuntu2.4
Ubuntu 16.04 LTS:
xdg-utils 1.1.1-1ubuntu1.16.04.4
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4649-1
CVE-2020-27748
Package Information:
https://launchpad.net/ubuntu/+source/xdg-utils/1.1.3-2ubuntu1.20.10.1
https://launchpad.net/ubuntu/+source/xdg-utils/1.1.3-2ubuntu1.20.04.1
https://launchpad.net/ubuntu/+source/xdg-utils/1.1.2-1ubuntu2.4
https://launchpad.net/ubuntu/+source/xdg-utils/1.1.1-1ubuntu1.16.04.4
[USN-4648-1] WebKitGTK vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4648-1
November 26, 2020
webkit2gtk vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in WebKitGTK.
Software Description:
- webkit2gtk: Web content engine library for GTK+
Details:
A large number of security issues were discovered in the WebKitGTK Web and
JavaScript engines. If a user were tricked into viewing a malicious
website, a remote attacker could exploit a variety of issues related to web
browser security, including cross-site scripting attacks, denial of service
attacks, and arbitrary code execution.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
libjavascriptcoregtk-4.0-18 2.30.3-0ubuntu0.20.10.1
libwebkit2gtk-4.0-37 2.30.3-0ubuntu0.20.10.1
Ubuntu 20.04 LTS:
libjavascriptcoregtk-4.0-18 2.30.3-0ubuntu0.20.04.1
libwebkit2gtk-4.0-37 2.30.3-0ubuntu0.20.04.1
Ubuntu 18.04 LTS:
libjavascriptcoregtk-4.0-18 2.30.3-0ubuntu0.18.04.1
libwebkit2gtk-4.0-37 2.30.3-0ubuntu0.18.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use WebKitGTK, such as Epiphany, to make all the necessary changes.
References:
https://usn.ubuntu.com/4648-1
CVE-2020-13753, CVE-2020-9948, CVE-2020-9951, CVE-2020-9952,
CVE-2020-9983
Package Information:
https://launchpad.net/ubuntu/+source/webkit2gtk/2.30.3-0ubuntu0.20.10.1
https://launchpad.net/ubuntu/+source/webkit2gtk/2.30.3-0ubuntu0.20.04.1
https://launchpad.net/ubuntu/+source/webkit2gtk/2.30.3-0ubuntu0.18.04.1
Ubuntu Security Notice USN-4648-1
November 26, 2020
webkit2gtk vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in WebKitGTK.
Software Description:
- webkit2gtk: Web content engine library for GTK+
Details:
A large number of security issues were discovered in the WebKitGTK Web and
JavaScript engines. If a user were tricked into viewing a malicious
website, a remote attacker could exploit a variety of issues related to web
browser security, including cross-site scripting attacks, denial of service
attacks, and arbitrary code execution.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
libjavascriptcoregtk-4.0-18 2.30.3-0ubuntu0.20.10.1
libwebkit2gtk-4.0-37 2.30.3-0ubuntu0.20.10.1
Ubuntu 20.04 LTS:
libjavascriptcoregtk-4.0-18 2.30.3-0ubuntu0.20.04.1
libwebkit2gtk-4.0-37 2.30.3-0ubuntu0.20.04.1
Ubuntu 18.04 LTS:
libjavascriptcoregtk-4.0-18 2.30.3-0ubuntu0.18.04.1
libwebkit2gtk-4.0-37 2.30.3-0ubuntu0.18.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use WebKitGTK, such as Epiphany, to make all the necessary changes.
References:
https://usn.ubuntu.com/4648-1
CVE-2020-13753, CVE-2020-9948, CVE-2020-9951, CVE-2020-9952,
CVE-2020-9983
Package Information:
https://launchpad.net/ubuntu/+source/webkit2gtk/2.30.3-0ubuntu0.20.10.1
https://launchpad.net/ubuntu/+source/webkit2gtk/2.30.3-0ubuntu0.20.04.1
https://launchpad.net/ubuntu/+source/webkit2gtk/2.30.3-0ubuntu0.18.04.1
Wednesday, November 25, 2020
[USN-4647-1] Thunderbird vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4647-1
November 25, 2020
thunderbird vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
Summary:
Several security issues were fixed in Thunderbird.
Software Description:
- thunderbird: Mozilla Open Source mail and newsgroup client
Details:
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
obtain sensitive information across origins, bypass security restrictions,
conduct phishing attacks, conduct cross-site scripting (XSS) attacks,
bypass Content Security Policy (CSP) restrictions, conduct DNS rebinding
attacks, or execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
thunderbird 1:78.5.0+build3-0ubuntu0.20.10.1
After a standard system update you need to restart Thunderbird to make
all the necessary changes.
References:
https://usn.ubuntu.com/4647-1
CVE-2020-15683, CVE-2020-15969, CVE-2020-16012, CVE-2020-26950,
CVE-2020-26951, CVE-2020-26953, CVE-2020-26956, CVE-2020-26958,
CVE-2020-26959, CVE-2020-26960, CVE-2020-26961, CVE-2020-26965,
CVE-2020-26968
Package Information:
https://launchpad.net/ubuntu/+source/thunderbird/1:78.5.0+build3-0ubuntu0.20.10.1
Ubuntu Security Notice USN-4647-1
November 25, 2020
thunderbird vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
Summary:
Several security issues were fixed in Thunderbird.
Software Description:
- thunderbird: Mozilla Open Source mail and newsgroup client
Details:
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
obtain sensitive information across origins, bypass security restrictions,
conduct phishing attacks, conduct cross-site scripting (XSS) attacks,
bypass Content Security Policy (CSP) restrictions, conduct DNS rebinding
attacks, or execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
thunderbird 1:78.5.0+build3-0ubuntu0.20.10.1
After a standard system update you need to restart Thunderbird to make
all the necessary changes.
References:
https://usn.ubuntu.com/4647-1
CVE-2020-15683, CVE-2020-15969, CVE-2020-16012, CVE-2020-26950,
CVE-2020-26951, CVE-2020-26953, CVE-2020-26956, CVE-2020-26958,
CVE-2020-26959, CVE-2020-26960, CVE-2020-26961, CVE-2020-26965,
CVE-2020-26968
Package Information:
https://launchpad.net/ubuntu/+source/thunderbird/1:78.5.0+build3-0ubuntu0.20.10.1
[USN-4646-1] poppler vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4646-1
November 25, 2020
poppler vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in poppler.
Software Description:
- poppler: PDF rendering library
Details:
It was discovered that Poppler incorrectly handled certain files. If a user
or automated system were tricked into opening a crafted PDF file, an
attacker could cause a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
libpoppler73 0.62.0-2ubuntu2.11
poppler-utils 0.62.0-2ubuntu2.11
Ubuntu 16.04 LTS:
libpoppler58 0.41.0-0ubuntu1.15
poppler-utils 0.41.0-0ubuntu1.15
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4646-1
CVE-2018-21009, CVE-2019-10871, CVE-2019-13283, CVE-2019-9959,
CVE-2020-27778
Package Information:
https://launchpad.net/ubuntu/+source/poppler/0.62.0-2ubuntu2.11
https://launchpad.net/ubuntu/+source/poppler/0.41.0-0ubuntu1.15
Ubuntu Security Notice USN-4646-1
November 25, 2020
poppler vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in poppler.
Software Description:
- poppler: PDF rendering library
Details:
It was discovered that Poppler incorrectly handled certain files. If a user
or automated system were tricked into opening a crafted PDF file, an
attacker could cause a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
libpoppler73 0.62.0-2ubuntu2.11
poppler-utils 0.62.0-2ubuntu2.11
Ubuntu 16.04 LTS:
libpoppler58 0.41.0-0ubuntu1.15
poppler-utils 0.41.0-0ubuntu1.15
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4646-1
CVE-2018-21009, CVE-2019-10871, CVE-2019-13283, CVE-2019-9959,
CVE-2020-27778
Package Information:
https://launchpad.net/ubuntu/+source/poppler/0.62.0-2ubuntu2.11
https://launchpad.net/ubuntu/+source/poppler/0.41.0-0ubuntu1.15
[USN-4645-1] Mutt vulnerability
==========================================================================
Ubuntu Security Notice USN-4645-1
November 25, 2020
mutt vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 12.04 ESM
Summary:
Mutt could be made to expose sensitive information.
Software Description:
- mutt: text-based mailreader supporting MIME, GPG, PGP and threading
Details:
It was discovered that Mutt incorrectly handled certain connections.
An attacker could possibly use this issue to expose sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
mutt 1.14.6-1ubuntu0.1
Ubuntu 20.04 LTS:
mutt 1.13.2-1ubuntu0.3
Ubuntu 18.04 LTS:
mutt 1.9.4-3ubuntu0.4
Ubuntu 16.04 LTS:
mutt 1.5.24-1ubuntu0.5
Ubuntu 12.04 ESM:
mutt 1.5.21-5ubuntu2.6
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4645-1
CVE-2020-28896
Package Information:
https://launchpad.net/ubuntu/+source/mutt/1.14.6-1ubuntu0.1
https://launchpad.net/ubuntu/+source/mutt/1.13.2-1ubuntu0.3
https://launchpad.net/ubuntu/+source/mutt/1.9.4-3ubuntu0.4
https://launchpad.net/ubuntu/+source/mutt/1.5.24-1ubuntu0.5
Ubuntu Security Notice USN-4645-1
November 25, 2020
mutt vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 12.04 ESM
Summary:
Mutt could be made to expose sensitive information.
Software Description:
- mutt: text-based mailreader supporting MIME, GPG, PGP and threading
Details:
It was discovered that Mutt incorrectly handled certain connections.
An attacker could possibly use this issue to expose sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
mutt 1.14.6-1ubuntu0.1
Ubuntu 20.04 LTS:
mutt 1.13.2-1ubuntu0.3
Ubuntu 18.04 LTS:
mutt 1.9.4-3ubuntu0.4
Ubuntu 16.04 LTS:
mutt 1.5.24-1ubuntu0.5
Ubuntu 12.04 ESM:
mutt 1.5.21-5ubuntu2.6
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4645-1
CVE-2020-28896
Package Information:
https://launchpad.net/ubuntu/+source/mutt/1.14.6-1ubuntu0.1
https://launchpad.net/ubuntu/+source/mutt/1.13.2-1ubuntu0.3
https://launchpad.net/ubuntu/+source/mutt/1.9.4-3ubuntu0.4
https://launchpad.net/ubuntu/+source/mutt/1.5.24-1ubuntu0.5
Tuesday, November 24, 2020
[USN-4644-1] igraph vulnerability
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEwZbe96kJeWh2OITRdyg1Qz0oXX0FAl+9cDgACgkQdyg1Qz0o
XX0gZBAAlqxP1uO9GK14ZOAE3KzEZ/3Uc4Xm43AoINrt3qL8WOSuawZll9nxLNjC
mJN3DbhEIoN+7I0CYdjxTlov+PKQXx+VDKJk5diGobyJsjZcaXAf4Hqxnaw0uKQ7
hJ632RN/ysVSBTqKgHHMsTG7H3aDvAgrex5aCqsUUxkWCAmE2VnIVoRAKTZ52T5V
1RoZ2HJzSZS5XFmulAI6Xx+cgdqttsh3h5mTfj/D9AK+rUFngjwyVvRbhqKo/uT9
DYtlZlYBoHiMAedPF9AABkZW3inFk+yjT+wDe+iJWRJW8GbOo8BIsoLGeItwdoUi
Bq5zcWBRsCJAdOuLhiCOtxAdXnxwVVYJqa6JHUt62CQW+ZcDZAgHAw6P2uxPrXGd
a2EVk1m+i+vkCWX/88JhcQmKCNyu+zI/t3DSKWHp7pG6KPn9JBkqcR9cVBOPWZLz
Xk7tC2U4tlrIw3aJ+3LG0L11otfwXy052Nc2F71yWwJMKbq7H/JWP+M2lYTZFViD
SHoQFPPRpYV89bku+4rPoDJyMc5P36QWS3pAgTIWVhmigeblDhdsR8RIm9pdF2e5
XpEqnb/6zJrR5QynUftPfMUgA6tzjAxs1jlNngRZW2Jrlvr/mX3Me7byfD+cTyZM
AvQrOQfGUTCuiBFSlcsht4v0RMMiLH/LUPXg8mQq5vhVQvYCpdE=
=oPhb
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-4644-1
November 24, 2020
igraph vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
igraph could be made to crash if it opened a specially crafted file.
Software Description:
- igraph: None
Details:
It was discovered that igraph mishandled certain malformed XML. An attacker
could use this vulnerability to cause a denial of service (crash).
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
libigraph0v5 0.7.1-2.1+deb9u1build0.18.04.1
Ubuntu 16.04 LTS:
libigraph0v5 0.7.1-2.1+deb9u1build0.16.04.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4644-1
CVE-2018-20349
Package Information:
https://launchpad.net/ubuntu/+source/igraph/0.7.1-2.1+deb9u1build0.18.04.1
https://launchpad.net/ubuntu/+source/igraph/0.7.1-2.1+deb9u1build0.16.04.1
iQIzBAEBCgAdFiEEwZbe96kJeWh2OITRdyg1Qz0oXX0FAl+9cDgACgkQdyg1Qz0o
XX0gZBAAlqxP1uO9GK14ZOAE3KzEZ/3Uc4Xm43AoINrt3qL8WOSuawZll9nxLNjC
mJN3DbhEIoN+7I0CYdjxTlov+PKQXx+VDKJk5diGobyJsjZcaXAf4Hqxnaw0uKQ7
hJ632RN/ysVSBTqKgHHMsTG7H3aDvAgrex5aCqsUUxkWCAmE2VnIVoRAKTZ52T5V
1RoZ2HJzSZS5XFmulAI6Xx+cgdqttsh3h5mTfj/D9AK+rUFngjwyVvRbhqKo/uT9
DYtlZlYBoHiMAedPF9AABkZW3inFk+yjT+wDe+iJWRJW8GbOo8BIsoLGeItwdoUi
Bq5zcWBRsCJAdOuLhiCOtxAdXnxwVVYJqa6JHUt62CQW+ZcDZAgHAw6P2uxPrXGd
a2EVk1m+i+vkCWX/88JhcQmKCNyu+zI/t3DSKWHp7pG6KPn9JBkqcR9cVBOPWZLz
Xk7tC2U4tlrIw3aJ+3LG0L11otfwXy052Nc2F71yWwJMKbq7H/JWP+M2lYTZFViD
SHoQFPPRpYV89bku+4rPoDJyMc5P36QWS3pAgTIWVhmigeblDhdsR8RIm9pdF2e5
XpEqnb/6zJrR5QynUftPfMUgA6tzjAxs1jlNngRZW2Jrlvr/mX3Me7byfD+cTyZM
AvQrOQfGUTCuiBFSlcsht4v0RMMiLH/LUPXg8mQq5vhVQvYCpdE=
=oPhb
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-4644-1
November 24, 2020
igraph vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
igraph could be made to crash if it opened a specially crafted file.
Software Description:
- igraph: None
Details:
It was discovered that igraph mishandled certain malformed XML. An attacker
could use this vulnerability to cause a denial of service (crash).
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
libigraph0v5 0.7.1-2.1+deb9u1build0.18.04.1
Ubuntu 16.04 LTS:
libigraph0v5 0.7.1-2.1+deb9u1build0.16.04.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4644-1
CVE-2018-20349
Package Information:
https://launchpad.net/ubuntu/+source/igraph/0.7.1-2.1+deb9u1build0.18.04.1
https://launchpad.net/ubuntu/+source/igraph/0.7.1-2.1+deb9u1build0.16.04.1
Re: Fedora 31 End Of Life
Hello all,
As of the 24th of November 2020, Fedora 31 has reached its end of life
for updates and support. No further updates, including security
updates, will be available for Fedora 31. All the updates that are
currently in testing won't get pushed to stable. Fedora 32 will
continue to receive updates until approximately one month after the
release of Fedora 34. The maintenance schedule of Fedora releases is
documented on the Fedora Project wiki [0]. The Fedora Project wiki
also contains instructions [1] on how to upgrade from a previous
release of Fedora to a version receiving updates.
Mohan Boddu.
[0] https://fedoraproject.org/wiki/Fedora_Release_Life_Cycle#Maintenance_Schedule
[1] https://docs.fedoraproject.org/en-US/quick-docs/dnf-system-upgrade/
On Fri, Nov 20, 2020 at 10:26 AM Mohan Boddu <mboddu@bhujji.com> wrote:
>
> Hello all,
>
> Fedora 31 will go end of life for updates and support on 24th of
> November 2020. No further updates, including security updates, will be
> available for Fedora 31 after the said date. All the updates of Fedora
> 31 being pushed to stable will be stopped as well.
>
> Fedora 32 will continue to receive updates until approximately one
> month after the release of Fedora 34. The maintenance schedule of
> Fedora releases is documented on the Fedora Project wiki [0]. The
> fedora Project wiki also contains instructions [1] on how to upgrade
> from a previous release of Fedora to a version receiving updates.
>
> Regards,
> Mohan Boddu.
>
> [0]https://fedoraproject.org/wiki/Fedora_Release_Life_Cycle#Maintenance_Schedule
> [1]https://fedoraproject.org/wiki/Upgrading?rd=DistributionUpgrades
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
As of the 24th of November 2020, Fedora 31 has reached its end of life
for updates and support. No further updates, including security
updates, will be available for Fedora 31. All the updates that are
currently in testing won't get pushed to stable. Fedora 32 will
continue to receive updates until approximately one month after the
release of Fedora 34. The maintenance schedule of Fedora releases is
documented on the Fedora Project wiki [0]. The Fedora Project wiki
also contains instructions [1] on how to upgrade from a previous
release of Fedora to a version receiving updates.
Mohan Boddu.
[0] https://fedoraproject.org/wiki/Fedora_Release_Life_Cycle#Maintenance_Schedule
[1] https://docs.fedoraproject.org/en-US/quick-docs/dnf-system-upgrade/
On Fri, Nov 20, 2020 at 10:26 AM Mohan Boddu <mboddu@bhujji.com> wrote:
>
> Hello all,
>
> Fedora 31 will go end of life for updates and support on 24th of
> November 2020. No further updates, including security updates, will be
> available for Fedora 31 after the said date. All the updates of Fedora
> 31 being pushed to stable will be stopped as well.
>
> Fedora 32 will continue to receive updates until approximately one
> month after the release of Fedora 34. The maintenance schedule of
> Fedora releases is documented on the Fedora Project wiki [0]. The
> fedora Project wiki also contains instructions [1] on how to upgrade
> from a previous release of Fedora to a version receiving updates.
>
> Regards,
> Mohan Boddu.
>
> [0]https://fedoraproject.org/wiki/Fedora_Release_Life_Cycle#Maintenance_Schedule
> [1]https://fedoraproject.org/wiki/Upgrading?rd=DistributionUpgrades
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Fedora 34 Change: kasumi-unicode (Self-Contained Change)
https://fedoraproject.org/wiki/Changes/kasumi_unicode
== Summary ==
kasumi-unicode will be generated newly with kasumi.spec in
[https://src.fedoraproject.org/rpms/kasumi kasumi] project.
== Owner ==
* Name: [[User:Fujiwara|Takao Fujiwara]]
* Email: fujiwara [at] redhat [dot] com
== Detailed Description ==
[https://src.fedoraproject.org/rpms/anthy-unicode anthy-unicode] has
been forked from [https://src.fedoraproject.org/rpms/anthy anthy]
since anthy was no longer maintained in upstream.
[https://src.fedoraproject.org/rpms/kasumi kasumi] is one of the
applications which link to the libraries of anthy. In case kasumi
links to anthy, the private dictionary is located in `$HOME/.anthy`
directory. In case kasumi links to anthy-unicode, the private
dictionary is located at `$XDG_CONFIG_HOME/anthy`.
I wish kasumi links to anthy-unicode newly but some other applications
still use anthy.
E.g. ibus-anthy uses anthy-unicode and `$XDG_CONFIG_HOME/anthy`.
fcitx-anthy, scim-anthy, uim-anthy, gcim-anthy uses anthy and
`$HOME/.anthy`.
To keep the back compatibility while *-anthy will migrate to use
anthy-unicode, kasumi.spec is going to generate kasumi twice to
generate two kasumi binaries with different CFLAGS and LDFLAGS between
anthy and anthy-unicode.
kasumi-unicode will be generated to link to anthy-unicode.
anthy-unicode enhances anthy for:
# internal data EUC-JP to UTF-8
# user dic in $HOME/.anthy to $XDG_CONFIG_HOME/anthy
== Benefit to Fedora ==
anthy-unicode saves the user dictionaries in the Freedesktop
configuration directory $XDG_CONFIG_HOME.
Contributers can develop anthy-unicode with UTF-8 words internally.
== Scope ==
* Proposal owners:
* Other developers: [[AkiraTagoh]] (Fedora maintaier of kasumi)
* Release engineering: N/A
* Policies and guidelines: N/A (not a System Wide Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives:
== Upgrade/compatibility impact ==
ibus-anthy will depend on anthy-unicode and kasumi-unicode instead of kasumi.
== How To Test ==
# Enable ibus-anthy in your desktop
# Run /usr/libexec/ibus-setup-anthy
# Run kasumi-unicode from "Dictionary" tab in the dialog
# Register some words with kasumi-unicode
The user dictionary is saved in $XDG_CONFIG_HOME/anthy and ibus-anthy
can use it.
== User Experience ==
Users will run `anthy-unicode-dic-tool --migrate` in case that users
need to migrate the user dictionary in $HOME/.anthy with one in
$XDG_CONFIG_HOME/anthy.
== Dependencies ==
ibus-anthy
== Contingency Plan ==
* Contingency mechanism: Revert the change of kasumi.spec and
ibus-anthy will depends on kasumi.
* Contingency deadline: Beta freeze
* Blocks release? No
* Blocks product? No
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
== Summary ==
kasumi-unicode will be generated newly with kasumi.spec in
[https://src.fedoraproject.org/rpms/kasumi kasumi] project.
== Owner ==
* Name: [[User:Fujiwara|Takao Fujiwara]]
* Email: fujiwara [at] redhat [dot] com
== Detailed Description ==
[https://src.fedoraproject.org/rpms/anthy-unicode anthy-unicode] has
been forked from [https://src.fedoraproject.org/rpms/anthy anthy]
since anthy was no longer maintained in upstream.
[https://src.fedoraproject.org/rpms/kasumi kasumi] is one of the
applications which link to the libraries of anthy. In case kasumi
links to anthy, the private dictionary is located in `$HOME/.anthy`
directory. In case kasumi links to anthy-unicode, the private
dictionary is located at `$XDG_CONFIG_HOME/anthy`.
I wish kasumi links to anthy-unicode newly but some other applications
still use anthy.
E.g. ibus-anthy uses anthy-unicode and `$XDG_CONFIG_HOME/anthy`.
fcitx-anthy, scim-anthy, uim-anthy, gcim-anthy uses anthy and
`$HOME/.anthy`.
To keep the back compatibility while *-anthy will migrate to use
anthy-unicode, kasumi.spec is going to generate kasumi twice to
generate two kasumi binaries with different CFLAGS and LDFLAGS between
anthy and anthy-unicode.
kasumi-unicode will be generated to link to anthy-unicode.
anthy-unicode enhances anthy for:
# internal data EUC-JP to UTF-8
# user dic in $HOME/.anthy to $XDG_CONFIG_HOME/anthy
== Benefit to Fedora ==
anthy-unicode saves the user dictionaries in the Freedesktop
configuration directory $XDG_CONFIG_HOME.
Contributers can develop anthy-unicode with UTF-8 words internally.
== Scope ==
* Proposal owners:
* Other developers: [[AkiraTagoh]] (Fedora maintaier of kasumi)
* Release engineering: N/A
* Policies and guidelines: N/A (not a System Wide Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives:
== Upgrade/compatibility impact ==
ibus-anthy will depend on anthy-unicode and kasumi-unicode instead of kasumi.
== How To Test ==
# Enable ibus-anthy in your desktop
# Run /usr/libexec/ibus-setup-anthy
# Run kasumi-unicode from "Dictionary" tab in the dialog
# Register some words with kasumi-unicode
The user dictionary is saved in $XDG_CONFIG_HOME/anthy and ibus-anthy
can use it.
== User Experience ==
Users will run `anthy-unicode-dic-tool --migrate` in case that users
need to migrate the user dictionary in $HOME/.anthy with one in
$XDG_CONFIG_HOME/anthy.
== Dependencies ==
ibus-anthy
== Contingency Plan ==
* Contingency mechanism: Revert the change of kasumi.spec and
ibus-anthy will depends on kasumi.
* Contingency deadline: Beta freeze
* Blocks release? No
* Blocks product? No
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Fedora 34 Change: Rename libusb packages and deprecated old API (Self-Contained Change)
https://fedoraproject.org/wiki/Changes/Rename_libusb_packages_and_deprecated_old_api
== Summary ==
Rename `libusb` to `libusb-compat` and `libusbx` to `libusb1`. Do
'''not''' provide an automated update path for the old `libusb` build
dependency as packages should–and likely can–be updated to use
`libusb1`.
== Owner ==
* Name: [[User:benzea|Benjamin Berg]]
* Email: bberg@redhat.com
== Detailed Description ==
Currently we have two related packages:
* libusb: Containing a compatibility layer of the 0.1 API for libusb 1.0
* libusbx: Containing the libusb 1.0 API, where the name "libusbx"
derives from a fork that existed for a while
To make it clear that "libusb" should not be used anymore and as
"libusbx" does not exist anymore, it makes sense to rename the
packages as follows:
* libusb-compat
* libusb1
In order to ensure that no package is depending on the old `libusb`
(i.e. `libusb-compat`) without a good reason, the plan is to '''not'''
add the corresponding `Provides:` line for the `libusb-compat-devel`
rename.
== Benefit to Fedora ==
* We adhere more closely to the upstream naming scheme for libusb.
* We begin sunsetting `libusb-compat` (i.e. current `libusb`).
== Scope ==
* Proposal owners:
Create new `libusb-compat` and `libusb1` packages based on the current ones.
* Other developers:
Review any package that uses `BuildRequires: libusb-devel`. Many of
them will be able to switch to `libusb1-devel` but some may still
require the compatibility layer, i.e. `libusb-compat-devel`.
* Release engineering: N/A
* Policies and guidelines: N/A (not needed for this change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives: N/A
== Upgrade/compatibility impact ==
No impact is expected.
== How To Test ==
No further testing is needed.
== User Experience ==
[not provided]
== Dependencies ==
[not provided]
== Contingency Plan ==
Add `Provides: libusb-devel` to `libusb-compat-devel` if too many
packages are not updated.
* Contingency mechanism: (What to do? Who will do it?) N/A (not a
System Wide Change)
* Contingency deadline: N/A (not a System Wide Change)
* Blocks release? N/A (not a System Wide Change)
== Documentation ==
N/A (not a System Wide Change)
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
== Summary ==
Rename `libusb` to `libusb-compat` and `libusbx` to `libusb1`. Do
'''not''' provide an automated update path for the old `libusb` build
dependency as packages should–and likely can–be updated to use
`libusb1`.
== Owner ==
* Name: [[User:benzea|Benjamin Berg]]
* Email: bberg@redhat.com
== Detailed Description ==
Currently we have two related packages:
* libusb: Containing a compatibility layer of the 0.1 API for libusb 1.0
* libusbx: Containing the libusb 1.0 API, where the name "libusbx"
derives from a fork that existed for a while
To make it clear that "libusb" should not be used anymore and as
"libusbx" does not exist anymore, it makes sense to rename the
packages as follows:
* libusb-compat
* libusb1
In order to ensure that no package is depending on the old `libusb`
(i.e. `libusb-compat`) without a good reason, the plan is to '''not'''
add the corresponding `Provides:` line for the `libusb-compat-devel`
rename.
== Benefit to Fedora ==
* We adhere more closely to the upstream naming scheme for libusb.
* We begin sunsetting `libusb-compat` (i.e. current `libusb`).
== Scope ==
* Proposal owners:
Create new `libusb-compat` and `libusb1` packages based on the current ones.
* Other developers:
Review any package that uses `BuildRequires: libusb-devel`. Many of
them will be able to switch to `libusb1-devel` but some may still
require the compatibility layer, i.e. `libusb-compat-devel`.
* Release engineering: N/A
* Policies and guidelines: N/A (not needed for this change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives: N/A
== Upgrade/compatibility impact ==
No impact is expected.
== How To Test ==
No further testing is needed.
== User Experience ==
[not provided]
== Dependencies ==
[not provided]
== Contingency Plan ==
Add `Provides: libusb-devel` to `libusb-compat-devel` if too many
packages are not updated.
* Contingency mechanism: (What to do? Who will do it?) N/A (not a
System Wide Change)
* Contingency deadline: N/A (not a System Wide Change)
* Blocks release? N/A (not a System Wide Change)
== Documentation ==
N/A (not a System Wide Change)
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
[USN-4643-1] atftp vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4643-1
November 24, 2020
Ubuntu Security Notice USN-4643-1
November 24, 2020
atftp vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
atftp could be made to crash or run programs if it received
specially crafted network traffic.
Software Description:
- atftp: Advanced TFTP Server and Client
Details:
It was discovered that atftp's FTP server did not properly handler certain
input. An attacker could use this to to cause a denial of service (crash)
or possibly execute arbitrary code. (CVE-2019-11365)
It was discovered that atftp's FTP server did not make proper use of
mutexes when locking certain data structures. An attacker could use this to
cause a denial of service via a NULL pointer dereference. (CVE-2019-11366)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
atftp 0.7.git20120829-3.1~0.16.04.1
atftpd 0.7.git20120829-3.1~0.16.04.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4643-1
CVE-2019-11365, CVE-2019-11366
Package Information:
https://launchpad.net/ubuntu/+source/atftp/0.7.git20120829-3.1~0.16.04.1
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
Subscribe to:
Posts (Atom)