[USN-6614-1] amanda vulnerability
[USN-6587-3] X.Org X Server regression
[USN-6616-1] OpenLDAP vulnerability
[USN-6615-1] MySQL vulnerabilities
[USN-6609-2] Linux kernel (NVIDIA) vulnerabilities
[USN-6617-1] libde265 vulnerabilities
[USN-6618-1] Pillow vulnerabilities
[USN-6614-1] amanda vulnerability
==========================================================================
Ubuntu Security Notice USN-6614-1
January 30, 2024
amanda vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
Summary:
amanda could be used to escalate privilege if it was provided with specially crafted arguments.
Software Description:
- amanda: Advanced Maryland Automatic Network Disk Archiver (Client)
Details:
It was discovered that amanda did not properly check certain arguments. A
local unprivileged attacker could possibly use this issue to perform a
privilege escalation attack.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
amanda-client 1:3.5.1-11ubuntu0.23.10.1
Ubuntu 22.04 LTS:
amanda-client 1:3.5.1-8ubuntu1.4
Ubuntu 20.04 LTS:
amanda-client 1:3.5.1-2ubuntu0.4
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
amanda-client 1:3.5.1-1ubuntu0.3+esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6614-1
CVE-2023-30577
Package Information:
https://launchpad.net/ubuntu/+source/amanda/1:3.5.1-11ubuntu0.23.10.1
https://launchpad.net/ubuntu/+source/amanda/1:3.5.1-8ubuntu1.4
https://launchpad.net/ubuntu/+source/amanda/1:3.5.1-2ubuntu0.4
[USN-6587-3] X.Org X Server regression
==========================================================================
Ubuntu Security Notice USN-6587-3
January 30, 2024
xorg-server, xwayland regression
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
A regression was fixed in X.Org X Server
Software Description:
- xorg-server: X.Org X11 server
- xwayland: X server for running X clients under Wayland
Details:
USN-6587-1 fixed vulnerabilities in X.Org X Server. The fix was incomplete
resulting in a possible regression. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
memory when processing the DeviceFocusEvent and ProcXIQueryPointer APIs. An
attacker could possibly use this issue to cause the X Server to crash,
obtain sensitive information, or execute arbitrary code. (CVE-2023-6816)
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
reattaching to a different master device. An attacker could use this issue
to cause the X Server to crash, leading to a denial of service, or possibly
execute arbitrary code. (CVE-2024-0229)
Olivier Fourdan and Donn Seeley discovered that the X.Org X Server
incorrectly labeled GLX PBuffers when used with SELinux. An attacker could
use this issue to cause the X Server to crash, leading to a denial of
service. (CVE-2024-0408)
Olivier Fourdan discovered that the X.Org X Server incorrectly handled
the curser code when used with SELinux. An attacker could use this issue to
cause the X Server to crash, leading to a denial of service.
(CVE-2024-0409)
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
memory when processing the XISendDeviceHierarchyEvent API. An attacker
could possibly use this issue to cause the X Server to crash, or execute
arbitrary code. (CVE-2024-21885)
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
devices being disabled. An attacker could possibly use this issue to cause
the X Server to crash, or execute arbitrary code. (CVE-2024-21886)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
xserver-xorg-core 2:21.1.7-3ubuntu2.7
Ubuntu 22.04 LTS:
xserver-xorg-core 2:21.1.4-2ubuntu1.7~22.04.8
xwayland 2:22.1.1-1ubuntu0.11
Ubuntu 20.04 LTS:
xserver-xorg-core 2:1.20.13-1ubuntu1~20.04.15
xwayland 2:1.20.13-1ubuntu1~20.04.15
After a standard system update you need to reboot your computer to make all
the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6587-3
https://ubuntu.com/security/notices/USN-6587-1
https://launchpad.net/bugs/2051536
Package Information:
https://launchpad.net/ubuntu/+source/xorg-server/2:21.1.7-3ubuntu2.7
https://launchpad.net/ubuntu/+source/xorg-server/2:21.1.4-2ubuntu1.7~22.04.8
https://launchpad.net/ubuntu/+source/xwayland/2:22.1.1-1ubuntu0.11
https://launchpad.net/ubuntu/+source/xorg-server/2:1.20.13-1ubuntu1~20.04.15
[USN-6616-1] OpenLDAP vulnerability
==========================================================================
Ubuntu Security Notice USN-6616-1
January 30, 2024
openldap vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
OpenLDAP could be made to crash if it received specially crafted input.
Software Description:
- openldap: Lightweight Directory Access Protocol
Details:
It was discovered that OpenLDAP was not properly performing bounds checks
when executing functions related to LDAP URLs. An attacker could possibly
use this issue to cause a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
slapd 2.5.16+dfsg-0ubuntu0.22.04.2
Ubuntu 20.04 LTS:
slapd 2.4.49+dfsg-2ubuntu1.10
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6616-1
CVE-2023-2953
Package Information:
https://launchpad.net/ubuntu/+source/openldap/2.5.16+dfsg-0ubuntu0.22.04.2
https://launchpad.net/ubuntu/+source/openldap/2.4.49+dfsg-2ubuntu1.10
[USN-6615-1] MySQL vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6615-1
January 30, 2024
mysql-8.0 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in MySQL.
Software Description:
- mysql-8.0: MySQL database
Details:
Multiple security issues were discovered in MySQL and this update includes
new upstream MySQL versions to fix these issues.
MySQL has been updated to 8.0.36 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
and Ubuntu 23.10.
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-36.html
https://www.oracle.com/security-alerts/cpujan2024.html
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
mysql-server-8.0 8.0.36-0ubuntu0.23.10.1
Ubuntu 22.04 LTS:
mysql-server-8.0 8.0.36-0ubuntu0.22.04.1
Ubuntu 20.04 LTS:
mysql-server-8.0 8.0.36-0ubuntu0.20.04.1
This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
References:
https://ubuntu.com/security/notices/USN-6615-1
CVE-2024-20960, CVE-2024-20961, CVE-2024-20962, CVE-2024-20963,
CVE-2024-20964, CVE-2024-20965, CVE-2024-20966, CVE-2024-20967,
CVE-2024-20969, CVE-2024-20970, CVE-2024-20971, CVE-2024-20972,
CVE-2024-20973, CVE-2024-20974, CVE-2024-20976, CVE-2024-20977,
CVE-2024-20978, CVE-2024-20981, CVE-2024-20982, CVE-2024-20983,
CVE-2024-20984, CVE-2024-20985
Package Information:
https://launchpad.net/ubuntu/+source/mysql-8.0/8.0.36-0ubuntu0.23.10.1
https://launchpad.net/ubuntu/+source/mysql-8.0/8.0.36-0ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/mysql-8.0/8.0.36-0ubuntu0.20.04.1
[USN-6609-2] Linux kernel (NVIDIA) vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6609-2
January 30, 2024
linux-nvidia vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-nvidia: Linux kernel for NVIDIA systems
Details:
Lin Ma discovered that the netfilter subsystem in the Linux kernel did not
properly validate network family support while creating a new netfilter
table. A local attacker could use this to cause a denial of service or
possibly execute arbitrary code. (CVE-2023-6040)
It was discovered that the CIFS network file system implementation in the
Linux kernel did not properly validate the server frame size in certain
situation, leading to an out-of-bounds read vulnerability. An attacker
could use this to construct a malicious CIFS image that, when operated on,
could cause a denial of service (system crash) or possibly expose sensitive
information. (CVE-2023-6606)
Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did
not properly handle inactive elements in its PIPAPO data structure, leading
to a use-after-free vulnerability. A local attacker could use this to cause
a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2023-6817)
Budimir Markovic, Lucas De Marchi, and Pengfei Xu discovered that the perf
subsystem in the Linux kernel did not properly validate all event sizes
when attaching new events, leading to an out-of-bounds write vulnerability.
A local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-6931)
It was discovered that the IGMP protocol implementation in the Linux kernel
contained a race condition, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-6932)
Kevin Rich discovered that the netfilter subsystem in the Linux kernel did
not properly check deactivated elements in certain situations, leading to a
use-after-free vulnerability. A local attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2024-0193)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
linux-image-5.15.0-1043-nvidia 5.15.0-1043.43
linux-image-5.15.0-1043-nvidia-lowlatency 5.15.0-1043.43
linux-image-nvidia 5.15.0.1043.43
linux-image-nvidia-lowlatency 5.15.0.1043.43
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6609-2
https://ubuntu.com/security/notices/USN-6609-1
CVE-2023-6040, CVE-2023-6606, CVE-2023-6817, CVE-2023-6931,
CVE-2023-6932, CVE-2024-0193
Package Information:
https://launchpad.net/ubuntu/+source/linux-nvidia/5.15.0-1043.43
[USN-6617-1] libde265 vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6617-1
January 30, 2024
libde265 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in libde265.
Software Description:
- libde265: Open H.265 video codec implementation
Details:
It was discovered that libde265 could be made to write out of bounds. If a
user or automated system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. This issue only affected Ubuntu 16.04
LTS and Ubuntu 18.04 LTS. (CVE-2020-21594)
It was discovered that libde265 could be made to write out of bounds. If a
user or automated system were tricked into opening a specially crafted
file, an attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. (CVE-2020-21595, CVE-2020-21596,
CVE-2020-21599, CVE-2020-21600, CVE-2020-21601, CVE-2020-21602,
CVE-2020-21603, CVE-2020-21604, CVE-2020-21605)
It was discovered that libde265 did not properly manage memory. If a user
or automated system were tricked into opening a specially crafted file, an
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 20.04 LTS.
(CVE-2020-21597, CVE-2020-21598, CVE-2020-21606, CVE-2021-36408)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
libde265-0 1.0.4-1ubuntu0.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libde265-0 1.0.2-2ubuntu0.18.04.1~esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libde265-0 1.0.2-2ubuntu0.16.04.1~esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6617-1
CVE-2020-21594, CVE-2020-21595, CVE-2020-21596, CVE-2020-21597,
CVE-2020-21598, CVE-2020-21599, CVE-2020-21600, CVE-2020-21601,
CVE-2020-21602, CVE-2020-21603, CVE-2020-21604, CVE-2020-21605,
CVE-2020-21606, CVE-2021-36408
Package Information:
https://launchpad.net/ubuntu/+source/libde265/1.0.4-1ubuntu0.1
[USN-6618-1] Pillow vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6618-1
January 30, 2024
pillow vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Pillow.
Software Description:
- pillow: Python Imaging Library
Details:
It was discovered that Pillow incorrectly handled certain long text
arguments. An attacker could possibly use this issue to cause Pillow to
consume resources, leading to a denial of service. This issue only affected
Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-44271)
Duarte Santos discovered that Pillow incorrectly handled the environment
parameter to PIL.ImageMath.eval. An attacker could possibly use this issue
to execute arbitrary code. (CVE-2023-50447)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
python3-pil 10.0.0-1ubuntu0.1
Ubuntu 22.04 LTS:
python3-pil 9.0.1-1ubuntu0.2
Ubuntu 20.04 LTS:
python3-pil 7.0.0-4ubuntu0.8
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6618-1
CVE-2023-44271, CVE-2023-50447
Package Information:
https://launchpad.net/ubuntu/+source/pillow/10.0.0-1ubuntu0.1
https://launchpad.net/ubuntu/+source/pillow/9.0.1-1ubuntu0.2
https://launchpad.net/ubuntu/+source/pillow/7.0.0-4ubuntu0.8
