[USN-7011-2] ClamAV vulnerabilities
[USN-7010-1] DCMTK vulnerabilities
[USN-7001-2] xmltok library vulnerabilities
[USN-7018-1] OpenSSL vulnerabilities
[USN-7000-2] Expat vulnerabilities
[USN-7016-1] FRR vulnerability
[USN-7017-1] Quagga vulnerability
[USN-7011-2] ClamAV vulnerabilities
=========================================================================
Ubuntu Security Notice USN-7011-2
September 17, 2024
clamav vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in ClamAV.
Software Description:
- clamav: Anti-virus utility for Unix
Details:
USN-7011-1 fixed several vulnerabilities in ClamAV. This update provides
the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
It was discovered that ClamAV incorrectly handled certain PDF files. A
remote attacker could possibly use this issue to cause ClamAV to crash,
resulting in a denial of service. (CVE-2024-20505)
It was discovered that ClamAV incorrectly handled logfile privileges. A
local attacker could use this issue to cause ClamAV to overwrite arbitrary
files, possibly leading to privilege escalation. (CVE-2024-20506)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS
clamav 0.103.12+dfsg-0ubuntu0.18.04.1+esm1
Available with Ubuntu Pro
Ubuntu 16.04 LTS
clamav 0.103.12+dfsg-0ubuntu0.16.04.1+esm1
Available with Ubuntu Pro
This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
References:
https://ubuntu.com/security/notices/USN-7011-2
https://ubuntu.com/security/notices/USN-7011-1
CVE-2024-20505, CVE-2024-20506
[USN-7010-1] DCMTK vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7010-1
September 17, 2024
dcmtk vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in DCMTK.
Software Description:
- dcmtk: OFFIS DICOM toolkit command line utilities
Details:
Jinsheng Ba discovered that DCMTK incorrectly handled certain requests. If
a user or an automated system were tricked into opening a certain specially
crafted input file, a remote attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 20.04 LTS.
(CVE-2021-41687, CVE-2021-41688, CVE-2021-41689, CVE-2021-41690)
Sharon Brizinov and Noam Moshe discovered that DCMTK incorrectly handled
pointers. If a user or an automated system were tricked into opening a
certain specially crafted input file, a remote attacker could possibly use
this issue to cause a denial of service. This issue only affected
Ubuntu 20.04 LTS. (CVE-2022-2121)
It was discovered that DCMTK incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a certain specially
crafted input file, a remote attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 20.04 LTS.
(CVE-2022-43272)
It was discovered that DCMTK incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a certain specially
crafted input file, a remote attacker could possibly use this issue to
execute arbitrary code. This issue was only addressed in Ubuntu 20.04 LTS
and Ubuntu 22.04 LTS. (CVE-2024-28130)
It was discovered that DCMTK incorrectly handled memory when processing an
invalid incoming DIMSE message. An attacker could possibly use this issue
to cause a denial of service. (CVE-2024-34508, CVE-2024-34509)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
dcmtk 3.6.7-9.1ubuntu0.1~esm1
Available with Ubuntu Pro
libdcmtk17t64 3.6.7-9.1ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 22.04 LTS
dcmtk 3.6.6-5ubuntu0.1~esm2
Available with Ubuntu Pro
libdcmtk16 3.6.6-5ubuntu0.1~esm2
Available with Ubuntu Pro
Ubuntu 20.04 LTS
dcmtk 3.6.4-2.1ubuntu0.1
libdcmtk14 3.6.4-2.1ubuntu0.1
Ubuntu 18.04 LTS
dcmtk 3.6.2-3ubuntu0.1~esm2
Available with Ubuntu Pro
libdcmtk12 3.6.2-3ubuntu0.1~esm2
Available with Ubuntu Pro
Ubuntu 16.04 LTS
dcmtk 3.6.1~20150924-5ubuntu0.1~esm2
Available with Ubuntu Pro
libdcmtk5 3.6.1~20150924-5ubuntu0.1~esm2
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7010-1
CVE-2021-41687, CVE-2021-41688, CVE-2021-41689, CVE-2021-41690,
CVE-2022-2121, CVE-2022-43272, CVE-2024-28130, CVE-2024-34508,
CVE-2024-34509
Package Information:
https://launchpad.net/ubuntu/+source/dcmtk/3.6.4-2.1ubuntu0.1
[USN-7001-2] xmltok library vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7001-2
September 17, 2024
libxmltok vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
Summary:
Several security issues were fixed in libxmltok.
Software Description:
- libxmltok: XML Parser Toolkit, developer libraries
Details:
USN-7001-1 fixed vulnerabilities in xmltol library. This update
provides the corresponding updates for Ubuntu 24.04 LTS.
Original advisory details:
Shang-Hung Wan discovered that Expat, contained within the xmltok library,
did not properly handle certain function calls when a negative input
length was provided. An attacker could use this issue to cause a denial of
service or possibly execute arbitrary code. (CVE-2024-45490)
Shang-Hung Wan discovered that Expat, contained within the xmltok library,
did not properly handle the potential for an integer overflow on 32-bit
platforms. An attacker could use this issue to cause a denial of service
or possibly execute arbitrary code. (CVE-2024-45491)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
libxmltok1t64 1.2-4.1ubuntu2.24.0.4.1+esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7001-2
https://ubuntu.com/security/notices/USN-7001-1
CVE-2024-45490, CVE-2024-45491
[USN-7018-1] OpenSSL vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7018-1
September 18, 2024
openssl vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in OpenSSL.
Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools
Details:
Robert Merget, Marcus Brinkmann, Nimrod Aviram, and Juraj Somorovsky
discovered that certain Diffie-Hellman ciphersuites in the TLS
specification and implemented by OpenSSL contained a flaw. A remote
attacker could possibly use this issue to eavesdrop on encrypted
communications. This was fixed in this update by removing the insecure
ciphersuites from OpenSSL. (CVE-2020-1968)
Paul Kehrer discovered that OpenSSL incorrectly handled certain input
lengths in EVP functions. A remote attacker could possibly use this issue
to cause OpenSSL to crash, resulting in a denial of service.
(CVE-2021-23840)
Elison Niven discovered that OpenSSL incorrectly handled the c_rehash
script. A local attacker could possibly use this issue to execute arbitrary
commands when c_rehash is run. (CVE-2022-1292)
Chancen and Daniel Fiala discovered that OpenSSL incorrectly handled the
c_rehash script. A local attacker could possibly use this issue to execute
arbitrary commands when c_rehash is run. (CVE-2022-2068)
It was discovered that OpenSSL incorrectly handled excessively large
Diffie-Hellman parameters. An attacker could possibly use this issue
to cause a denial of service. (CVE-2023-3446)
Bahaa Naamneh discovered that OpenSSL incorrectly handled certain malformed
PKCS12 files. A remote attacker could possibly use this issue to cause
OpenSSL to crash, resulting in a denial of service. (CVE-2024-0727)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS
libssl1.0.0 1.0.1f-1ubuntu2.27+esm10
Available with Ubuntu Pro
openssl 1.0.1f-1ubuntu2.27+esm10
Available with Ubuntu Pro
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7018-1
CVE-2020-1968, CVE-2021-23840, CVE-2022-1292, CVE-2022-2068,
CVE-2023-3446, CVE-2024-0727
[USN-7000-2] Expat vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7000-2
September 17, 2024
expat vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in Expat.
Software Description:
- expat: XML parsing C library
Details:
USN-7000-1 fixed vulnerabilities in Expat. This update
provides the corresponding updates for Ubuntu 22.04 LTS.
Original advisory details:
Shang-Hung Wan discovered that Expat did not properly handle certain
function calls when a negative input length was provided. An attacker
could use this issue to cause a denial of service or possibly execute
arbitrary code. (CVE-2024-45490)
Shang-Hung Wan discovered that Expat did not properly handle the
potential for an integer overflow on 32-bit platforms. An attacker
could use this issue to cause a denial of service or possibly execute
arbitrary code. (CVE-2024-45491, CVE-2024-45492)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
expat 2.4.7-1ubuntu0.4
libexpat1 2.4.7-1ubuntu0.4
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7000-2
https://ubuntu.com/security/notices/USN-7000-1
CVE-2024-45490, CVE-2024-45491, CVE-2024-45492
Package Information:
https://launchpad.net/ubuntu/+source/expat/2.4.7-1ubuntu0.4
[USN-7016-1] FRR vulnerability
==========================================================================
Ubuntu Security Notice USN-7016-1
September 17, 2024
frr vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
Summary:
FRR could be made to crash if it received specially crafted network
traffic.
Software Description:
- frr: FRRouting suite of internet protocols
Details:
Iggy Frankovic discovered that FRR incorrectly handled certain BGP
messages. A remote attacker could possibly use this issue to cause FRR to
crash, resulting in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
frr 8.4.4-1.1ubuntu6.2
Ubuntu 22.04 LTS
frr 8.1-1ubuntu1.11
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7016-1
CVE-2024-44070
Package Information:
https://launchpad.net/ubuntu/+source/frr/8.4.4-1.1ubuntu6.2
https://launchpad.net/ubuntu/+source/frr/8.1-1ubuntu1.11
[USN-7017-1] Quagga vulnerability
==========================================================================
Ubuntu Security Notice USN-7017-1
September 17, 2024
quagga vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Quagga could be made to crash if it received specially crafted network
traffic.
Software Description:
- quagga: BGP/OSPF/RIP routing daemon
Details:
Iggy Frankovic discovered that Quagga incorrectly handled certain BGP
messages. A remote attacker could possibly use this issue to cause Quagga
to crash, resulting in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS
quagga 1.2.4-4ubuntu0.5
quagga-bgpd 1.2.4-4ubuntu0.5
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7017-1
CVE-2024-44070
Package Information:
https://launchpad.net/ubuntu/+source/quagga/1.2.4-4ubuntu0.5
