The following updates has been released for Ubuntu Linux:
USN-4034-1: ImageMagick vulnerabilities
USN-4035-1: Ceph vulnerabilities
USN-4036-1: OpenStack Neutron vulnerability
USN-4037-1: policykit-desktop-privileges update
USN-4034-1: ImageMagick vulnerabilities
USN-4035-1: Ceph vulnerabilities
USN-4036-1: OpenStack Neutron vulnerability
USN-4037-1: policykit-desktop-privileges update
USN-4034-1: ImageMagick vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4034-1
June 25, 2019
imagemagick vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in ImageMagick.
Software Description:
- imagemagick: Image manipulation programs and library
Details:
It was discovered that ImageMagick incorrectly handled certain malformed
image files. If a user or automated system using ImageMagick were tricked
into opening a specially crafted image, an attacker could exploit this to
cause a denial of service or possibly execute code with the privileges of
the user invoking the program.
Due to a large number of issues discovered in GhostScript that prevent it
from being used by ImageMagick safely, the update for Ubuntu 18.10 and
Ubuntu 19.04 includes a default policy change that disables support for the
Postscript and PDF formats in ImageMagick. This policy can be overridden if
necessary by using an alternate ImageMagick policy configuration.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 19.04:
imagemagick 8:6.9.10.14+dfsg-7ubuntu2.2
imagemagick-6.q16 8:6.9.10.14+dfsg-7ubuntu2.2
libmagick++-6.q16-8 8:6.9.10.14+dfsg-7ubuntu2.2
libmagickcore-6.q16-6 8:6.9.10.14+dfsg-7ubuntu2.2
libmagickcore-6.q16-6-extra 8:6.9.10.14+dfsg-7ubuntu2.2
Ubuntu 18.10:
imagemagick 8:6.9.10.8+dfsg-1ubuntu2.2
imagemagick-6.q16 8:6.9.10.8+dfsg-1ubuntu2.2
libmagick++-6.q16-8 8:6.9.10.8+dfsg-1ubuntu2.2
libmagickcore-6.q16-6 8:6.9.10.8+dfsg-1ubuntu2.2
libmagickcore-6.q16-6-extra 8:6.9.10.8+dfsg-1ubuntu2.2
Ubuntu 18.04 LTS:
imagemagick 8:6.9.7.4+dfsg-16ubuntu6.7
imagemagick-6.q16 8:6.9.7.4+dfsg-16ubuntu6.7
libmagick++-6.q16-7 8:6.9.7.4+dfsg-16ubuntu6.7
libmagickcore-6.q16-3 8:6.9.7.4+dfsg-16ubuntu6.7
libmagickcore-6.q16-3-extra 8:6.9.7.4+dfsg-16ubuntu6.7
Ubuntu 16.04 LTS:
imagemagick 8:6.8.9.9-7ubuntu5.14
imagemagick-6.q16 8:6.8.9.9-7ubuntu5.14
libmagick++-6.q16-5v5 8:6.8.9.9-7ubuntu5.14
libmagickcore-6.q16-2 8:6.8.9.9-7ubuntu5.14
libmagickcore-6.q16-2-extra 8:6.8.9.9-7ubuntu5.14
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4034-1
CVE-2017-12805, CVE-2017-12806, CVE-2018-14434, CVE-2018-15607,
CVE-2018-16323, CVE-2018-16412, CVE-2018-16413, CVE-2018-16644,
CVE-2018-16645, CVE-2018-17965, CVE-2018-17966, CVE-2018-18016,
CVE-2018-18023, CVE-2018-18024, CVE-2018-18025, CVE-2018-18544,
CVE-2018-20467, CVE-2019-10131, CVE-2019-10649, CVE-2019-10650,
CVE-2019-11470, CVE-2019-11472, CVE-2019-11597, CVE-2019-11598,
CVE-2019-7175, CVE-2019-7395, CVE-2019-7396, CVE-2019-7397,
CVE-2019-7398, CVE-2019-9956
Package Information:
https://launchpad.net/ubuntu/+source/imagemagick/8:6.9.10.14+dfsg-7ubuntu2.2
https://launchpad.net/ubuntu/+source/imagemagick/8:6.9.10.8+dfsg-1ubuntu2.2
https://launchpad.net/ubuntu/+source/imagemagick/8:6.9.7.4+dfsg-16ubuntu6.7
https://launchpad.net/ubuntu/+source/imagemagick/8:6.8.9.9-7ubuntu5.14
USN-4035-1: Ceph vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4035-1
June 25, 2019
ceph vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in Ceph.
Software Description:
- ceph: distributed storage and file system
Details:
It was discovered that Ceph incorrectly handled read only permissions. An
authenticated attacker could use this issue to obtain dm-crypt encryption
keys. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-14662)
It was discovered that Ceph incorrectly handled certain OMAPs holding
bucket indices. An authenticated attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 16.04 LTS.
(CVE-2018-16846)
It was discovered that Ceph incorrectly sanitized certain debug logs. A
local attacker could possibly use this issue to obtain encryption key
information. This issue was only addressed in Ubuntu 18.10 and Ubuntu
19.04. (CVE-2018-16889)
It was discovered that Ceph incorrectly handled certain civetweb requests.
A remote attacker could possibly use this issue to consume resources,
leading to a denial of service. This issue only affected Ubuntu 18.10 and
Ubuntu 19.04. (CVE-2019-3821)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 19.04:
ceph 13.2.4+dfsg1-0ubuntu2.1
ceph-common 13.2.4+dfsg1-0ubuntu2.1
Ubuntu 18.10:
ceph 13.2.4+dfsg1-0ubuntu0.18.10.2
ceph-common 13.2.4+dfsg1-0ubuntu0.18.10.2
Ubuntu 16.04 LTS:
ceph 10.2.11-0ubuntu0.16.04.2
ceph-common 10.2.11-0ubuntu0.16.04.2
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4035-1
CVE-2018-14662, CVE-2018-16846, CVE-2018-16889, CVE-2019-3821
Package Information:
https://launchpad.net/ubuntu/+source/ceph/13.2.4+dfsg1-0ubuntu2.1
https://launchpad.net/ubuntu/+source/ceph/13.2.4+dfsg1-0ubuntu0.18.10.2
https://launchpad.net/ubuntu/+source/ceph/10.2.11-0ubuntu0.16.04.2
USN-4036-1: OpenStack Neutron vulnerability
==========================================================================
Ubuntu Security Notice USN-4036-1
June 25, 2019
neutron vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.10
- Ubuntu 16.04 LTS
Summary:
A system hardening measure could be bypassed.
Software Description:
- neutron: OpenStack Virtual Network Service
Details:
Erik Olof Gunnar Andersson discovered that OpenStack Neutron incorrectly
handled certain security group rules in the iptables firewall module. An
authenticated attacker could possibly use this issue to block further
application of security group rules for other instances.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.10:
python-neutron 2:13.0.2-0ubuntu3.4
python3-neutron 2:13.0.2-0ubuntu3.4
Ubuntu 16.04 LTS:
python-neutron 2:8.4.0-0ubuntu7.4
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4036-1
CVE-2019-9735
Package Information:
https://launchpad.net/ubuntu/+source/neutron/2:13.0.2-0ubuntu3.4
https://launchpad.net/ubuntu/+source/neutron/2:8.4.0-0ubuntu7.4
USN-4037-1: policykit-desktop-privileges update
==========================================================================
Ubuntu Security Notice USN-4037-1
June 25, 2019
policykit-desktop-privileges update
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
A security improvement has been made to policykit-desktop-privileges.
Software Description:
- policykit-desktop-privileges: run common desktop actions without password
Details:
The policykit-desktop-privileges Startup Disk Creator policy allowed
administrative users to overwrite disks. As a security improvement, this
operation now requires authentication.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 19.04:
policykit-desktop-privileges 0.20ubuntu19.04.1
Ubuntu 18.10:
policykit-desktop-privileges 0.20ubuntu18.10.1
Ubuntu 18.04 LTS:
policykit-desktop-privileges 0.20ubuntu18.04.1
Ubuntu 16.04 LTS:
policykit-desktop-privileges 0.20ubuntu16.04.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4037-1
https://launchpad.net/bugs/1832337
Package Information:
https://launchpad.net/ubuntu/+source/policykit-desktop-privileges/0.20ubuntu19.04.1
https://launchpad.net/ubuntu/+source/policykit-desktop-privileges/0.20ubuntu18.10.1
https://launchpad.net/ubuntu/+source/policykit-desktop-privileges/0.20ubuntu18.04.1
https://launchpad.net/ubuntu/+source/policykit-desktop-privileges/0.20ubuntu16.04.1
