[USN-7223-1] OpenJPEG vulnerabilities
[USN-7205-2] Django vulnerability
[USN-7227-1] PCL vulnerability
[USN-7225-1] HTMLDOC vulnerabilities
[USN-7224-1] Cyrus IMAP Server vulnerabilities
[USN-7223-1] OpenJPEG vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7223-1
January 22, 2025
openjpeg2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
OpenJPEG could be made to crash or run programs if it opened a specially
crafted file.
Software Description:
- openjpeg2: JPEG 2000 image compression/decompression library
Details:
Frank Zeng discovered that OpenJPEG incorrectly handled memory when using
the decompression utility. An attacker could possibly use this issue to
cause a denial of service or execute arbitrary code. (CVE-2024-56826,
CVE-2024-56827)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
libopenjp2-7 2.5.0-2ubuntu1.2
libopenjp2-tools 2.5.0-2ubuntu1.2
Ubuntu 24.04 LTS
libopenjp2-7 2.5.0-2ubuntu0.3
libopenjp2-tools 2.5.0-2ubuntu0.3
Ubuntu 22.04 LTS
libopenjp2-7 2.4.0-6ubuntu0.3
libopenjp2-tools 2.4.0-6ubuntu0.3
libopenjp3d-tools 2.4.0-6ubuntu0.3
libopenjp3d7 2.4.0-6ubuntu0.3
Ubuntu 20.04 LTS
libopenjp2-7 2.3.1-1ubuntu4.20.04.4
libopenjp2-tools 2.3.1-1ubuntu4.20.04.4
libopenjp3d-tools 2.3.1-1ubuntu4.20.04.4
libopenjp3d7 2.3.1-1ubuntu4.20.04.4
Ubuntu 18.04 LTS
libopenjp2-7 2.3.0-2+deb10u2ubuntu0.1~esm4
Available with Ubuntu Pro
libopenjp2-tools 2.3.0-2+deb10u2ubuntu0.1~esm4
Available with Ubuntu Pro
libopenjp3d-tools 2.3.0-2+deb10u2ubuntu0.1~esm4
Available with Ubuntu Pro
libopenjp3d7 2.3.0-2+deb10u2ubuntu0.1~esm4
Available with Ubuntu Pro
Ubuntu 16.04 LTS
libopenjp2-7 2.1.2-1.1+deb9u6ubuntu0.1~esm7
Available with Ubuntu Pro
libopenjp2-tools 2.1.2-1.1+deb9u6ubuntu0.1~esm7
Available with Ubuntu Pro
libopenjp3d-tools 2.1.2-1.1+deb9u6ubuntu0.1~esm7
Available with Ubuntu Pro
libopenjp3d7 2.1.2-1.1+deb9u6ubuntu0.1~esm7
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7223-1
CVE-2024-56826, CVE-2024-56827
Package Information:
https://launchpad.net/ubuntu/+source/openjpeg2/2.5.0-2ubuntu1.2
https://launchpad.net/ubuntu/+source/openjpeg2/2.5.0-2ubuntu0.3
https://launchpad.net/ubuntu/+source/openjpeg2/2.4.0-6ubuntu0.3
https://launchpad.net/ubuntu/+source/openjpeg2/2.3.1-1ubuntu4.20.04.4
[USN-7205-2] Django vulnerability
=========================================================================
Ubuntu Security Notice USN-7205-2
January 23, 2025
python-django vulnerability
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
Summary:
Django could be made to cause a denial of service if it received a
specially crafted IPv6 string.
Software Description:
- python-django: High-level Python web development framework
Details:
USN-7205-1 fixed a vulnerability in Django. This update provides
the corresponding update for Ubuntu 18.04 LTS.
Original advisory details:
It was discovered that Django incorrectly handled certain IPv6
strings. An attacker could possibly use this issue to cause a
denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS
python-django 1:1.11.11-1ubuntu1.21+esm9
Available with Ubuntu Pro
python3-django 1:1.11.11-1ubuntu1.21+esm9
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7205-2
https://ubuntu.com/security/notices/USN-7205-1
CVE-2024-56374
[USN-7227-1] PCL vulnerability
==========================================================================
Ubuntu Security Notice USN-7227-1
January 23, 2025
PCL vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
PCL could be made to crash if it received specially crafted input.
Software Description:
- pcl: Point Cloud Library for 2D/3D image and point cloud processing
Details:
It was discovered that PCL incorrectly handled certain malformed files.
If a user or automated system were tricked into opening a specially crafted
file, an attacker could possibly exploit this to cause a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
libpcl-io1.14 1.14.0+dfsg-3ubuntu0.2
libpcl-recognition1.14 1.14.0+dfsg-3ubuntu0.2
libpcl-visualization1.14 1.14.0+dfsg-3ubuntu0.2
pcl-tools 1.14.0+dfsg-3ubuntu0.2
Ubuntu 24.04 LTS
libpcl-io1.14 1.14.0+dfsg-1ubuntu0.1~esm1
Available with Ubuntu Pro
libpcl-recognition1.14 1.14.0+dfsg-1ubuntu0.1~esm1
Available with Ubuntu Pro
libpcl-visualization1.14 1.14.0+dfsg-1ubuntu0.1~esm1
Available with Ubuntu Pro
pcl-tools 1.14.0+dfsg-1ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 22.04 LTS
libpcl-io1.12 1.12.1+dfsg-3ubuntu0.1~esm2
Available with Ubuntu Pro
libpcl-recognition1.12 1.12.1+dfsg-3ubuntu0.1~esm2
Available with Ubuntu Pro
libpcl-visualization1.12 1.12.1+dfsg-3ubuntu0.1~esm2
Available with Ubuntu Pro
pcl-tools 1.12.1+dfsg-3ubuntu0.1~esm2
Available with Ubuntu Pro
Ubuntu 20.04 LTS
libpcl-io1.10 1.10.0+dfsg-5ubuntu1+esm2
Available with Ubuntu Pro
libpcl-recognition1.10 1.10.0+dfsg-5ubuntu1+esm2
Available with Ubuntu Pro
libpcl-visualization1.10 1.10.0+dfsg-5ubuntu1+esm2
Available with Ubuntu Pro
pcl-tools 1.10.0+dfsg-5ubuntu1+esm2
Available with Ubuntu Pro
Ubuntu 18.04 LTS
libpcl-io1.8 1.8.1+dfsg1-2ubuntu2.18.04.1+esm1
Available with Ubuntu Pro
libpcl-recognition1.8 1.8.1+dfsg1-2ubuntu2.18.04.1+esm1
Available with Ubuntu Pro
libpcl-visualization1.8 1.8.1+dfsg1-2ubuntu2.18.04.1+esm1
Available with Ubuntu Pro
pcl-tools 1.8.1+dfsg1-2ubuntu2.18.04.1+esm1
Available with Ubuntu Pro
Ubuntu 16.04 LTS
libpcl-io1.7 1.7.2-14ubuntu0.1+esm1
Available with Ubuntu Pro
libpcl-recognition1.7 1.7.2-14ubuntu0.1+esm1
Available with Ubuntu Pro
libpcl-visualization1.7 1.7.2-14ubuntu0.1+esm1
Available with Ubuntu Pro
pcl-tools 1.7.2-14ubuntu0.1+esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7227-1
CVE-2024-53432
Package Information:
https://launchpad.net/ubuntu/+source/pcl/1.14.0+dfsg-3ubuntu0.2
[USN-7225-1] HTMLDOC vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7225-1
January 22, 2025
HTMLDOC vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in htmldoc.
Software Description:
- htmldoc: HTML processor that generates indexed HTML, PS, and PDF
Details:
It was discovered that HTMLDOC incorrectly handled memory in the
image_set_mask, git_read_lzw, write_header and write_node functions, which
could lead to a heap buffer overflow. An attacker could possibly use this
issue to cause a denial of service or execute arbitrary code. This issue
only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and
Ubuntu 20.04 LTS. (CVE-2022-0137, CVE-2022-24191, CVE-2022-34033,
CVE-2022-34035)
It was discovered that HTMLDOC incorrectly handled memory in the
gif_get_code function, which could lead to a segmentation fault. If a
user or application were tricked into opening a crafted GIF file, an
attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2022-0534)
It was discovered that HTMLDOC did not perform proper bounds checks on
image dimensions when loading JPEG images, which could lead to a buffer
overflow. If a user or application were tricked into opening a crafted
JPEG image, an attacker could possibly use this issue to cause a denial
of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-27114)
It was discovered that HTMLDOC incorrectly handled memory in the
pdf_write_names function, which could lead to a heap buffer overflow. If
a user or application were tricked into opening a specially crafted file,
an attacker could possibly use this issue to cause a denial of service or
leak sensitive information. This issue only affected Ubuntu 14.04 LTS,
Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-28085)
It was discovered that HTMLDOC could be made to write out of bounds when
attempting to strip whitespace. An attacker could use this issue to cause
a denial of service or execute arbitrary code. (CVE-2024-45508)
It was discovered that HTMLDOC incorrectly handled memory in the parse_pre
function, which could lead to a heap buffer overflow. If a user or
application were tricked into opening a specially crafted file, an attacker
could possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2024-46478)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
htmldoc 1.9.18-1ubuntu0.1
Ubuntu 24.04 LTS
htmldoc 1.9.17-1ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 22.04 LTS
htmldoc 1.9.15-1ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 20.04 LTS
htmldoc 1.9.7-1ubuntu0.3+esm2
Available with Ubuntu Pro
Ubuntu 18.04 LTS
htmldoc 1.9.2-1ubuntu0.2+esm2
Available with Ubuntu Pro
Ubuntu 16.04 LTS
htmldoc 1.8.27-8ubuntu1.1+esm3
Available with Ubuntu Pro
Ubuntu 14.04 LTS
htmldoc 1.8.27-8ubuntu1+esm4
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7225-1
CVE-2022-0137, CVE-2022-0534, CVE-2022-24191, CVE-2022-27114,
CVE-2022-28085, CVE-2022-34033, CVE-2022-34035, CVE-2024-45508,
CVE-2024-46478
Package Information:
https://launchpad.net/ubuntu/+source/htmldoc/1.9.18-1ubuntu0.1
[USN-7224-1] Cyrus IMAP Server vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7224-1
January 22, 2025
cyrus-imapd vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in Cyrus IMAP Server.
Software Description:
- cyrus-imapd: An IMAP server
Details:
It was discovered that non-authentication-related HTTP requests could be
interpreted in an authentication context by a Cyrus IMAP Server when
multiple requests arrived over the same connection. An unauthenticated
attacker could possibly use this issue to perform a privilege escalation
attack. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-18928)
Matthew Horsfall discovered that Cyrus IMAP Server utilized a poor string
hashing algorithm that could be abused to control where data was being
stored. An attacker could possibly use this issue to perform a denial of
service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2021-33582)
Damian Poddebniak discovered that Cyrus IMAP Server could interpret
specially crafted commands to exploit a memory issue. An authenticated
attacker could possibly use this issue to perform a denial of service.
This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2024-34055)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
cyrus-admin 3.8.2-1ubuntu0.1~esm1
Available with Ubuntu Pro
cyrus-caldav 3.8.2-1ubuntu0.1~esm1
Available with Ubuntu Pro
cyrus-clients 3.8.2-1ubuntu0.1~esm1
Available with Ubuntu Pro
cyrus-common 3.8.2-1ubuntu0.1~esm1
Available with Ubuntu Pro
cyrus-dev 3.8.2-1ubuntu0.1~esm1
Available with Ubuntu Pro
cyrus-imapd 3.8.2-1ubuntu0.1~esm1
Available with Ubuntu Pro
cyrus-murder 3.8.2-1ubuntu0.1~esm1
Available with Ubuntu Pro
cyrus-nntpd 3.8.2-1ubuntu0.1~esm1
Available with Ubuntu Pro
cyrus-pop3d 3.8.2-1ubuntu0.1~esm1
Available with Ubuntu Pro
cyrus-replication 3.8.2-1ubuntu0.1~esm1
Available with Ubuntu Pro
libcyrus-imap-perl 3.8.2-1ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 22.04 LTS
cyrus-admin 3.4.3-3ubuntu0.1+esm1
Available with Ubuntu Pro
cyrus-caldav 3.4.3-3ubuntu0.1+esm1
Available with Ubuntu Pro
cyrus-clients 3.4.3-3ubuntu0.1+esm1
Available with Ubuntu Pro
cyrus-common 3.4.3-3ubuntu0.1+esm1
Available with Ubuntu Pro
cyrus-dev 3.4.3-3ubuntu0.1+esm1
Available with Ubuntu Pro
cyrus-imapd 3.4.3-3ubuntu0.1+esm1
Available with Ubuntu Pro
cyrus-murder 3.4.3-3ubuntu0.1+esm1
Available with Ubuntu Pro
cyrus-nntpd 3.4.3-3ubuntu0.1+esm1
Available with Ubuntu Pro
cyrus-pop3d 3.4.3-3ubuntu0.1+esm1
Available with Ubuntu Pro
cyrus-replication 3.4.3-3ubuntu0.1+esm1
Available with Ubuntu Pro
libcyrus-imap-perl 3.4.3-3ubuntu0.1+esm1
Available with Ubuntu Pro
Ubuntu 20.04 LTS
cyrus-caldav 3.0.13-5ubuntu0.1~esm1
Available with Ubuntu Pro
cyrus-clients 3.0.13-5ubuntu0.1~esm1
Available with Ubuntu Pro
cyrus-common 3.0.13-5ubuntu0.1~esm1
Available with Ubuntu Pro
cyrus-dev 3.0.13-5ubuntu0.1~esm1
Available with Ubuntu Pro
cyrus-imapd 3.0.13-5ubuntu0.1~esm1
Available with Ubuntu Pro
cyrus-murder 3.0.13-5ubuntu0.1~esm1
Available with Ubuntu Pro
cyrus-nntpd 3.0.13-5ubuntu0.1~esm1
Available with Ubuntu Pro
cyrus-pop3d 3.0.13-5ubuntu0.1~esm1
Available with Ubuntu Pro
cyrus-replication 3.0.13-5ubuntu0.1~esm1
Available with Ubuntu Pro
libcyrus-imap-perl 3.0.13-5ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 18.04 LTS
cyrus-caldav 2.5.10-3ubuntu1.1+esm1
Available with Ubuntu Pro
cyrus-clients 2.5.10-3ubuntu1.1+esm1
Available with Ubuntu Pro
cyrus-common 2.5.10-3ubuntu1.1+esm1
Available with Ubuntu Pro
cyrus-dev 2.5.10-3ubuntu1.1+esm1
Available with Ubuntu Pro
cyrus-imapd 2.5.10-3ubuntu1.1+esm1
Available with Ubuntu Pro
cyrus-murder 2.5.10-3ubuntu1.1+esm1
Available with Ubuntu Pro
cyrus-nntpd 2.5.10-3ubuntu1.1+esm1
Available with Ubuntu Pro
cyrus-pop3d 2.5.10-3ubuntu1.1+esm1
Available with Ubuntu Pro
cyrus-replication 2.5.10-3ubuntu1.1+esm1
Available with Ubuntu Pro
libcyrus-imap-perl 2.5.10-3ubuntu1.1+esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7224-1
CVE-2019-18928, CVE-2021-33582, CVE-2024-34055
