[USN-6746-1] Google Guest Agent and Google OS Config Agent vulnerability
[USN-6728-3] Squid vulnerability
[USN-6742-2] Linux kernel vulnerabilities
[USN-6746-1] Google Guest Agent and Google OS Config Agent vulnerability
==========================================================================
Ubuntu Security Notice USN-6746-1
April 23, 2024
google-guest-agent, google-osconfig-agent vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
Summary:
Google Guest Agent and OS Config Agent could be made to crash
if it open a specially crafted JSON.
Software Description:
- google-guest-agent: Google Compute Engine Guest Agent
- google-osconfig-agent: Google OS Config Agent
Details:
It was discovered that Google Guest Agent and Google OS Config Agent incorrectly
handled certain JSON files. An attacker could possibly use this issue to
cause a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
google-guest-agent 20231004.02-0ubuntu1~23.10.3
google-osconfig-agent 20230504.00-0ubuntu2.2
Ubuntu 22.04 LTS:
google-guest-agent 20231004.02-0ubuntu1~22.04.4
google-osconfig-agent 20230504.00-0ubuntu1~22.04.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6746-1
CVE-2024-24786
Package Information:
https://launchpad.net/ubuntu/+source/google-guest-agent/20231004.02-0ubuntu1~23.10.3
https://launchpad.net/ubuntu/+source/google-osconfig-agent/20230504.00-0ubuntu2.2
https://launchpad.net/ubuntu/+source/google-guest-agent/20231004.02-0ubuntu1~22.04.4
https://launchpad.net/ubuntu/+source/google-osconfig-agent/20230504.00-0ubuntu1~22.04.1
[USN-6728-3] Squid vulnerability
==========================================================================
Ubuntu Security Notice USN-6728-3
April 23, 2024
squid vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
Summary:
Squid could be made to crash if it received specially crafted network
traffic.
Software Description:
- squid: Web proxy cache server
Details:
USN-6728-1 fixed vulnerabilities in Squid. The fix for CVE-2023-5824 caused
Squid to crash in certain environments on Ubuntu 20.04 LTS and was disabled
in USN-6728-2. The problematic fix for CVE-2023-5824 has now been corrected
and reinstated in this update.
We apologize for the inconvenience.
Original advisory details:
Joshua Rogers discovered that Squid incorrectly handled collapsed
forwarding. A remote attacker could possibly use this issue to cause Squid
to crash, resulting in a denial of service. This issue only affected Ubuntu
20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-49288)
Joshua Rogers discovered that Squid incorrectly handled certain structural
elements. A remote attacker could possibly use this issue to cause Squid to
crash, resulting in a denial of service. (CVE-2023-5824)
Joshua Rogers discovered that Squid incorrectly handled Cache Manager error
responses. A remote trusted client can possibly use this issue to cause
Squid to crash, resulting in a denial of service. (CVE-2024-23638)
Joshua Rogers discovered that Squid incorrectly handled the HTTP Chunked
decoder. A remote attacker could possibly use this issue to cause Squid to
stop responding, resulting in a denial of service. (CVE-2024-25111)
Joshua Rogers discovered that Squid incorrectly handled HTTP header
parsing. A remote trusted client can possibly use this issue to cause
Squid to crash, resulting in a denial of service. (CVE-2024-25617)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
squid 4.10-1ubuntu1.12
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6728-3
https://ubuntu.com/security/notices/USN-6728-1
CVE-2023-49288, CVE-2023-5824, https://launchpad.net/bugs/2060880
Package Information:
https://launchpad.net/ubuntu/+source/squid/4.10-1ubuntu1.12
[USN-6742-2] Linux kernel vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6742-2
April 23, 2024
linux-azure, linux-lowlatency, linux-nvidia vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in the Linux kernel.
Software Description:
- linux-azure: Linux kernel for Microsoft Azure Cloud systems
- linux-lowlatency: Linux low latency kernel
- linux-nvidia: Linux kernel for NVIDIA systems
Details:
Daniele Antonioli discovered that the Secure Simple Pairing and Secure
Connections pairing in the Bluetooth protocol could allow an
unauthenticated user to complete authentication without pairing
credentials. A physically proximate attacker placed between two Bluetooth
devices could use this to subsequently impersonate one of the paired
devices. (CVE-2023-24023)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- JFS file system;
- Netfilter;
(CVE-2024-26581, CVE-2023-52600, CVE-2023-52603)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
linux-image-5.15.0-105-lowlatency 5.15.0-105.115
linux-image-5.15.0-105-lowlatency-64k 5.15.0-105.115
linux-image-5.15.0-1053-nvidia 5.15.0-1053.54
linux-image-5.15.0-1053-nvidia-lowlatency 5.15.0-1053.54
linux-image-5.15.0-1061-azure 5.15.0-1061.70
linux-image-azure-lts-22.04 5.15.0.1061.59
linux-image-lowlatency 5.15.0.105.100
linux-image-lowlatency-64k 5.15.0.105.100
linux-image-nvidia 5.15.0.1053.53
linux-image-nvidia-lowlatency 5.15.0.1053.53
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well.
References:
https://ubuntu.com/security/notices/USN-6742-2
https://ubuntu.com/security/notices/USN-6742-1
CVE-2023-24023, CVE-2023-52600, CVE-2023-52603, CVE-2024-26581
Package Information:
https://launchpad.net/ubuntu/+source/linux-azure/5.15.0-1061.70
https://launchpad.net/ubuntu/+source/linux-lowlatency/5.15.0-105.115
https://launchpad.net/ubuntu/+source/linux-nvidia/5.15.0-1053.54
