[USN-7137-1] recutils vulnerabilities
[USN-7136-1] Django vulnerabilities
[USN-7137-1] recutils vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7137-1
December 04, 2024
recutils vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
recutils could be made to crash or run programs as a login user if a
specially crafted file was opened.
Software Description:
- recutils: text-based databases called recfiles
Details:
It was discovered that recutils incorrectly handled memory when parsing
comments with the recparser utility. An attacker could possibly use this
issue to cause a denial of service or run arbitrary commands.
(CVE-2021-46019, CVE-2021-46021, CVE-2021-46022)
It was discovered that recutils incorrectly handled memory when parsing CSV
files. An attacker could possibly use this issue to cause a denial of
service or run arbitrary commands. (CVE-2019-11637, CVE-2019-11638,
CVE-2019-11639, CVE-2019-11640)
It was discovered that recutils incorrectly handled memory when parsing
maliciously crafted recfiles. An attacker could possibly use this issue to
cause a denial of service. (CVE-2019-6455, CVE-2019-6456, CVE-2019-6457,
CVE-2019-6458, CVE-2019-6459, CVE-2019-6460)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
librec1 1.8-1ubuntu0.22.04.1~esm1
Available with Ubuntu Pro
recutils 1.8-1ubuntu0.22.04.1~esm1
Available with Ubuntu Pro
Ubuntu 20.04 LTS
librec1 1.8-1ubuntu0.20.04.1~esm1
Available with Ubuntu Pro
recutils 1.8-1ubuntu0.20.04.1~esm1
Available with Ubuntu Pro
Ubuntu 18.04 LTS
librec1 1.7-2ubuntu0.1~esm1
Available with Ubuntu Pro
recutils 1.7-2ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 16.04 LTS
librec1 1.7-1ubuntu0.1~esm1
Available with Ubuntu Pro
recutils 1.7-1ubuntu0.1~esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7137-1
CVE-2019-11637, CVE-2019-11638, CVE-2019-11639, CVE-2019-11640,
CVE-2019-6455, CVE-2019-6456, CVE-2019-6457, CVE-2019-6458,
CVE-2019-6459, CVE-2019-6460, CVE-2021-46019, CVE-2021-46021,
CVE-2021-46022
[USN-7136-1] Django vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7136-1
December 04, 2024
python-django vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in Django.
Software Description:
- python-django: High-level Python web development framework
Details:
jiangniao discovered that Django incorrectly handled the API to strip tags.
A remote attacker could possibly use this issue to cause Django to
consume resources, leading to a denial of service. (CVE-2024-53907)
Seokchan Yoon discovered that Django incorrectly handled HasKey lookups
when using Oracle. A remote attacker could possibly use this issue to
inject arbitrary SQL code. This issue only affected Ubuntu 24.04 LTS and
Ubuntu 24.10. (CVE-2024-53908)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
python3-django 3:4.2.15-1ubuntu1.1
Ubuntu 24.04 LTS
python3-django 3:4.2.11-1ubuntu1.4
Ubuntu 22.04 LTS
python3-django 2:3.2.12-2ubuntu1.15
Ubuntu 20.04 LTS
python3-django 2:2.2.12-1ubuntu0.26
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7136-1
CVE-2024-53907, CVE-2024-53908
Package Information:
https://launchpad.net/ubuntu/+source/python-django/3:4.2.15-1ubuntu1.1
https://launchpad.net/ubuntu/+source/python-django/3:4.2.11-1ubuntu1.4
https://launchpad.net/ubuntu/+source/python-django/2:3.2.12-2ubuntu1.15
https://launchpad.net/ubuntu/+source/python-django/2:2.2.12-1ubuntu0.26
