The following updates has been released for Ubuntu Linux:
LSN-0055-1: Linux kernel vulnerability
USN-4125-1: Memcached vulnerability
USN-4126-1: FreeType vulnerability
USN-4126-2: FreeType vulnerabilities
USN-4127-1: Python vulnerabilities
LSN-0055-1: Linux kernel vulnerability
USN-4125-1: Memcached vulnerability
USN-4126-1: FreeType vulnerability
USN-4126-2: FreeType vulnerabilities
USN-4127-1: Python vulnerabilities
LSN-0055-1: Linux kernel vulnerability
==========================================================================
Kernel Live Patch Security Notice 0055-1
September 06, 2019
linux vulnerability
==========================================================================
A security issue affects these releases of Ubuntu:
| Series | Base kernel | Arch | flavors |
|------------------+--------------+----------+------------------|
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | generic |
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | lowlatency |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | generic |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | lowlatency |
| Ubuntu 16.04 LTS | 4.15.0 | amd64 | generic |
| Ubuntu 16.04 LTS | 4.15.0 | amd64 | lowlatency |
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux: Linux kernel
Details:
It was discovered that a use-after-free error existed in the block layer
subsystem of the Linux kernel when certain failure conditions occurred. A
local attacker could possibly use this to cause a denial of service (system
crash) or possibly execute arbitrary code. (CVE-2018-20856)
It was discovered that the Bluetooth UART implementation in the Linux
kernel did not properly check for missing tty operations. A local attacker
could use this to cause a denial of service. (CVE-2019-10207)
Jonathan Looney discovered that the TCP retransmission queue implementation
in the Linux kernel could be fragmented when handling certain TCP Selective
Acknowledgment (SACK) sequences. A remote attacker could use this to cause
a denial of service. (CVE-2019-11478)
Jann Horn discovered a use-after-free vulnerability in the Linux kernel
when accessing LDT entries in some situations. A local attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2019-13233)
It was discovered that the floppy driver in the Linux kernel did not
properly validate meta data, leading to a buffer overread. A local attacker
could use this to cause a denial of service (system crash).
(CVE-2019-14283)
It was discovered that the floppy driver in the Linux kernel did not
properly validate ioctl() calls, leading to a division-by-zero. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2019-14284)
Update instructions:
The problem can be corrected by updating your livepatches to the following
versions:
| Kernel | Version | flavors |
|--------------------------+----------+--------------------------|
| 4.4.0-148.174 | 55.1 | lowlatency, generic |
| 4.4.0-150.176 | 55.1 | generic, lowlatency |
| 4.4.0-151.178 | 55.1 | lowlatency, generic |
| 4.4.0-154.181 | 55.1 | lowlatency, generic |
| 4.4.0-157.185 | 55.1 | lowlatency |
| 4.4.0-159.187 | 55.1 | lowlatency, generic |
| 4.15.0-50.54 | 55.1 | generic, lowlatency |
| 4.15.0-50.54~16.04.1 | 55.1 | generic, lowlatency |
| 4.15.0-51.55 | 55.1 | generic, lowlatency |
| 4.15.0-51.55~16.04.1 | 55.2 | generic, lowlatency |
| 4.15.0-52.56 | 55.1 | lowlatency, generic |
| 4.15.0-52.56~16.04.1 | 55.1 | generic, lowlatency |
| 4.15.0-54.58 | 55.1 | generic, lowlatency |
| 4.15.0-54.58~16.04.1 | 55.1 | generic, lowlatency |
| 4.15.0-55.60 | 55.1 | generic, lowlatency |
| 4.15.0-58.64 | 55.1 | generic, lowlatency |
| 4.15.0-58.64~16.04.1 | 55.1 | lowlatency, generic |
Support Information:
Kernels older than the levels listed below do not receive livepatch
updates. Please upgrade your kernel as soon as possible.
| Series | Version | Flavors |
|------------------+------------------+--------------------------|
| Ubuntu 18.04 LTS | 4.15.0-50 | generic lowlatency |
| Ubuntu 16.04 LTS | 4.15.0-50 | generic lowlatency |
| Ubuntu 16.04 LTS | 4.4.0-148 | generic lowlatency |
| Ubuntu 14.04 LTS | 4.4.0-148 | generic lowlatency |
References:
CVE-2018-20856, CVE-2019-10207, CVE-2019-11478, CVE-2019-13233,
CVE-2019-14283, CVE-2019-14284
USN-4125-1: Memcached vulnerability
=========================================================================
Ubuntu Security Notice USN-4125-1
September 09, 2019
memcached vulnerability
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Memcached could be made to expose sensitive information if it
received a specially crafted UNIX socket.
Software Description:
- memcached: high-performance memory object caching system
Details:
It was discovered that Memcached incorrectly handled certain UNIX sockets.
An attacker could possibly use this issue to access sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 19.04:
memcached 1.5.10-0ubuntu1.19.04.2
Ubuntu 18.04 LTS:
memcached 1.5.6-0ubuntu1.2
Ubuntu 16.04 LTS:
memcached 1.4.25-2ubuntu1.5
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4125-1
CVE-2019-15026
Package Information:
https://launchpad.net/ubuntu/+source/memcached/1.5.10-0ubuntu1.19.04.2
https://launchpad.net/ubuntu/+source/memcached/1.5.6-0ubuntu1.2
https://launchpad.net/ubuntu/+source/memcached/1.4.25-2ubuntu1.5
USN-4126-1: FreeType vulnerability
=========================================================================
Ubuntu Security Notice USN-4126-1
September 09, 2019
freetype vulnerability
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
FreeType could be made to expose sensitive information if
if it opened a specially crafted font file.
Software Description:
- freetype: FreeType 2 is a font engine library
Details:
It was discovered that FreeType incorrectly handled certain font files.
An attacker could possibly use this issue to access sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
libfreetype6 2.6.1-0.1ubuntu2.4
After a standard system update you need to restart your session to make
all the necessary changes.
References:
https://usn.ubuntu.com/4126-1
CVE-2015-9383
Package Information:
https://launchpad.net/ubuntu/+source/freetype/2.6.1-0.1ubuntu2.4
USN-4126-2: FreeType vulnerabilities
=========================================================================
Ubuntu Security Notice USN-4126-2
September 09, 2019
freetype vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 ESM
- Ubuntu 12.04 ESM
Summary:
FreeType could be made to expose sensitive information if it opened a
specially crafted font file.
Software Description:
- freetype: FreeType 2 is a font engine library
Details:
USN-4126-1 fixed a vulnerability in FreeType. This update provides
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
It was discovered that FreeType incorrectly handled certain font files.
An attacker could possibly use this issue to access sensitive information.
(CVE-2015-9381, CVE-2015-9382)
Original advisory details:
It was discovered that FreeType incorrectly handled certain font files.
An attacker could possibly use this issue to access sensitive information.
(CVE-2015-9383)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 ESM:
libfreetype6 2.5.2-1ubuntu2.8+esm1
Ubuntu 12.04 ESM:
libfreetype6 2.4.8-1ubuntu2.7
After a standard system update you need to restart your session to make
all the necessary changes.
References:
https://usn.ubuntu.com/4126-2
https://usn.ubuntu.com/4126-1
CVE-2015-9381, CVE-2015-9382, CVE-2015-9383
USN-4127-1: Python vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4127-1
September 09, 2019
python2.7, python3.5, python3.6, python3.7 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in Python.
Software Description:
- python2.7: An interactive high-level object-oriented language
- python3.7: An interactive high-level object-oriented language
- python3.6: An interactive high-level object-oriented language
- python3.5: An interactive high-level object-oriented language
Details:
It was discovered that Python incorrectly handled certain pickle files. An
attacker could possibly use this issue to consume memory, leading to a
denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu
18.04 LTS. (CVE-2018-20406)
It was discovered that Python incorrectly validated the domain when
handling cookies. An attacker could possibly trick Python into sending
cookies to the wrong domain. (CVE-2018-20852)
Jonathan Birch and Panayiotis Panayiotou discovered that Python incorrectly
handled Unicode encoding during NFKC normalization. An attacker could
possibly use this issue to obtain sensitive information. (CVE-2019-9636,
CVE-2019-10160)
Colin Read and Nicolas Edet discovered that Python incorrectly handled
parsing certain X509 certificates. An attacker could possibly use this
issue to cause Python to crash, resulting in a denial of service. This
issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-5010)
It was discovered that Python incorrectly handled certain urls. A remote
attacker could possibly use this issue to perform CRLF injection attacks.
(CVE-2019-9740, CVE-2019-9947)
Sihoon Lee discovered that Python incorrectly handled the local_file:
scheme. A remote attacker could possibly use this issue to bypass blacklist
meschanisms. (CVE-2019-9948)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 19.04:
python2.7 2.7.16-2ubuntu0.1
python2.7-minimal 2.7.16-2ubuntu0.1
python3.7 3.7.3-2ubuntu0.1
python3.7-minimal 3.7.3-2ubuntu0.1
Ubuntu 18.04 LTS:
python2.7 2.7.15-4ubuntu4~18.04.1
python2.7-minimal 2.7.15-4ubuntu4~18.04.1
python3.6 3.6.8-1~18.04.2
python3.6-minimal 3.6.8-1~18.04.2
Ubuntu 16.04 LTS:
python2.7 2.7.12-1ubuntu0~16.04.8
python2.7-minimal 2.7.12-1ubuntu0~16.04.8
python3.5 3.5.2-2ubuntu0~16.04.8
python3.5-minimal 3.5.2-2ubuntu0~16.04.8
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4127-1
CVE-2018-20406, CVE-2018-20852, CVE-2019-10160, CVE-2019-5010,
CVE-2019-9636, CVE-2019-9740, CVE-2019-9947, CVE-2019-9948
Package Information:
https://launchpad.net/ubuntu/+source/python2.7/2.7.16-2ubuntu0.1
https://launchpad.net/ubuntu/+source/python3.7/3.7.3-2ubuntu0.1
https://launchpad.net/ubuntu/+source/python2.7/2.7.15-4ubuntu4~18.04.1
https://launchpad.net/ubuntu/+source/python3.6/3.6.8-1~18.04.2
https://launchpad.net/ubuntu/+source/python2.7/2.7.12-1ubuntu0~16.04.8
https://launchpad.net/ubuntu/+source/python3.5/3.5.2-2ubuntu0~16.04.8
