The following updates has been released for Ubuntu Linux:
LSN-0040-1: Linux kernel vulnerability
USN-3702-1: PHP vulnerability
USN-3703-1: Archive Zip
USN-3703-2: Archive Zip vulnerability
LSN-0040-1: Linux kernel vulnerability
USN-3702-1: PHP vulnerability
USN-3703-1: Archive Zip
USN-3703-2: Archive Zip vulnerability
LSN-0040-1: Linux kernel vulnerability
==========================================================================
Kernel Live Patch Security Notice 0040-1
July 03, 2018
linux vulnerability
==========================================================================
A security issue affects these releases of Ubuntu:
| Series | Base kernel | Arch | flavors |
|------------------+--------------+----------+------------------|
| Ubuntu 14.04 LTS | 4.4.0 | amd64 | generic |
| Ubuntu 14.04 LTS | 4.4.0 | amd64 | lowlatency |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | generic |
| Ubuntu 16.04 LTS | 4.4.0 | amd64 | lowlatency |
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | generic |
| Ubuntu 18.04 LTS | 4.15.0 | amd64 | lowlatency |
Summary:
Several security issues were fixed in the kernel.
Software Description:
- linux: Linux kernel
Details:
Wen Xu discovered that the ext4 filesystem implementation in the Linux
kernel did not properly handle corrupted meta data in some situations. An
attacker could use this to specially craft an ext4 file system that caused
a denial of service (system crash) when mounted. (CVE-2018-1093)
Wen Xu discovered that the ext4 filesystem implementation in the Linux
kernel did not properly handle corrupted meta data in some situations. An
attacker could use this to specially craft an ext4 file system that caused
a denial of service (system crash) when mounted. (CVE-2018-1092)
It was discovered that an information leak vulnerability existed in the
floppy driver in the Linux kernel. A local attacker could use this to
expose sensitive information (kernel memory). (CVE-2018-7755)
Julian Stecklina and Thomas Prescher discovered that FPU register states
(such as MMX, SSE, and AVX registers) which are lazy restored are
potentially vulnerable to a side channel attack. A local attacker could use
this to expose sensitive information. (CVE-2018-3665)
Update instructions:
The problem can be corrected by updating your livepatches to the following
versions:
| Kernel | Version | flavors |
|--------------------------+----------+--------------------------|
| 4.4.0-124.148 | 40.6 | lowlatency, generic |
| 4.4.0-124.148~14.04.1 | 40.6 | generic, lowlatency |
| 4.4.0-127.153 | 40.6 | lowlatency, generic |
| 4.4.0-127.153~14.04.1 | 40.6 | lowlatency, generic |
| 4.4.0-128.154 | 40.6 | generic, lowlatency |
| 4.4.0-128.154~14.04.1 | 40.6 | generic, lowlatency |
| 4.15.0-20.21 | 40.7 | generic, lowlatency |
| 4.15.0-22.24 | 40.7 | lowlatency, generic |
| 4.15.0-23.25 | 40.7 | lowlatency, generic |
References:
CVE-2018-1093, CVE-2018-1092, CVE-2018-7755, CVE-2018-3665
--
USN-3702-1: PHP vulnerability
==========================================================================
Ubuntu Security Notice USN-3702-1
July 04, 2018
php7.2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
Summary:
PHP could be made to crash or run programs if it opened a specially crafted
file.
Software Description:
- php7.2: HTML-embedded scripting language interpreter
Details:
It was discovered that PHP incorrectly handled exif tags in certain images.
A remote attacker could use this issue to cause PHP to crash, resulting in
a denial of service, or possibly execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
libapache2-mod-php7.2 7.2.7-0ubuntu0.18.04.1
php7.2-cgi 7.2.7-0ubuntu0.18.04.1
php7.2-cli 7.2.7-0ubuntu0.18.04.1
php7.2-fpm 7.2.7-0ubuntu0.18.04.1
This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
References:
https://usn.ubuntu.com/usn/usn-3702-1
CVE-2018-12882
Package Information:
https://launchpad.net/ubuntu/+source/php7.2/7.2.7-0ubuntu0.18.04.1
USN-3703-1: Archive Zip
==========================================================================
Ubuntu Security Notice USN-3703-1
July 04, 2018
libarchive-zip-perl vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 17.10
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Archive Zip module could be made to expose sensitive information
if it received a specially crafted input.
Software Description:
- libarchive-zip-perl: Perl module for manipulation of ZIP archives
Details:
It was discovered that the Archive Zip module incorrectly handled
certain inputs. An attacker could possibly use this to access sensitive
information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
libarchive-zip-perl 1.60-1ubuntu0.1
Ubuntu 17.10:
libarchive-zip-perl 1.59-1ubuntu0.1
Ubuntu 16.04 LTS:
libarchive-zip-perl 1.56-2ubuntu0.1
Ubuntu 14.04 LTS:
libarchive-zip-perl 1.30-7ubuntu0.1
In general, a standard system update will make all the necessary
changes.
References:
https://usn.ubuntu.com/usn/usn-3703-1
CVE-2018-10860
Package Information:
https://launchpad.net/ubuntu/+source/libarchive-zip-perl/1.60-1ubuntu0.1
https://launchpad.net/ubuntu/+source/libarchive-zip-perl/1.59-1ubuntu0.1
https://launchpad.net/ubuntu/+source/libarchive-zip-perl/1.56-2ubuntu0.1
https://launchpad.net/ubuntu/+source/libarchive-zip-perl/1.30-7ubuntu0.1
USN-3703-2: Archive Zip vulnerability
==========================================================================
Ubuntu Security Notice USN-3703-2
July 04, 2018
libarchive-zip-perl vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Archive Zip module could be made to expose sensitive information
if it received a specially crafted input.
Software Description:
- libarchive-zip-perl: Perl module for manipulation of ZIP archives
Details:
USN-3703-1 fixed a vulnerability in Archive Zip module. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
It was discovered that the Archive Zip module incorrectly handled
certain inputs.
An attacker could possibly use this to access sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
libarchive-zip-perl 1.30-6ubuntu0.1
In general, a standard system update will make all the necessary
changes.
References:
https://usn.ubuntu.com/usn/usn-3703-2
https://usn.ubuntu.com/usn/usn-3703-1
CVE-2018-10860
