The following updates has been released for Ubuntu Linux:
USN-3688-1: Spidermonkey vulnerabilities
Multiple memory safety issues were fixed in Spidermonkey. An attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. Available for Ubuntu 18.04 LTS and 17-10
USN-3689-1: Libgcrypt vulnerability
USN-3689-2: Libgcrypt vulnerability
Keegan Ryan discovered that Libgcrypt was susceptible to a side-channel attack. A local attacker could possibly use this attack to recover ECDSA private keys. Available for Ubuntu 18.04 LTS, 16.04 LTS, 17.10, 14.04 LTS, and 12.04 ESM
USN-3688-1: Spidermonkey vulnerabilities
Multiple memory safety issues were fixed in Spidermonkey. An attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. Available for Ubuntu 18.04 LTS and 17-10
USN-3689-1: Libgcrypt vulnerability
USN-3689-2: Libgcrypt vulnerability
Keegan Ryan discovered that Libgcrypt was susceptible to a side-channel attack. A local attacker could possibly use this attack to recover ECDSA private keys. Available for Ubuntu 18.04 LTS, 16.04 LTS, 17.10, 14.04 LTS, and 12.04 ESM
USN-3688-1: Spidermonkey vulnerabilities
==========================================================================
Ubuntu Security Notice USN-3688-1
June 19, 2018
mozjs52 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 17.10
Summary:
Several security issues were fixed in Spidermonkey.
Software Description:
- mozjs52: SpiderMonkey JavaScript library
Details:
Multiple memory safety issues were fixed in Spidermonkey. An attacker
could potentially exploit these to cause a denial of service, or execute
arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
libmozjs-52-0 52.8.1-0ubuntu0.18.04.1
Ubuntu 17.10:
libmozjs-52-0 52.8.1-0ubuntu0.17.10.1
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3688-1
CVE-2017-7810, CVE-2017-7826, CVE-2018-5089, CVE-2018-5125,
CVE-2018-5150
Package Information:
https://launchpad.net/ubuntu/+source/mozjs52/52.8.1-0ubuntu0.18.04.1
https://launchpad.net/ubuntu/+source/mozjs52/52.8.1-0ubuntu0.17.10.1
USN-3689-1: Libgcrypt vulnerability
==========================================================================
Ubuntu Security Notice USN-3689-1
June 19, 2018
libgcrypt11, libgcrypt20 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 17.10
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Libgcrypt could be made to expose sensitive information.
Software Description:
- libgcrypt20: LGPL Crypto library
- libgcrypt11: LGPL Crypto library
Details:
Keegan Ryan discovered that Libgcrypt was susceptible to a side-channel
attack. A local attacker could possibly use this attack to recover ECDSA
private keys.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
libgcrypt20 1.8.1-4ubuntu1.1
Ubuntu 17.10:
libgcrypt20 1.7.8-2ubuntu1.1
Ubuntu 16.04 LTS:
libgcrypt20 1.6.5-2ubuntu0.5
Ubuntu 14.04 LTS:
libgcrypt11 1.5.3-2ubuntu4.6
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3689-1
CVE-2018-0495
Package Information:
https://launchpad.net/ubuntu/+source/libgcrypt20/1.8.1-4ubuntu1.1
https://launchpad.net/ubuntu/+source/libgcrypt20/1.7.8-2ubuntu1.1
https://launchpad.net/ubuntu/+source/libgcrypt20/1.6.5-2ubuntu0.5
https://launchpad.net/ubuntu/+source/libgcrypt11/1.5.3-2ubuntu4.6
USN-3689-2: Libgcrypt vulnerability
==========================================================================
Ubuntu Security Notice USN-3689-2
June 19, 2018
libgcrypt11 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Libgcrypt could be made to expose sensitive information.
Software Description:
- libgcrypt11: LGPL Crypto library
Details:
USN-3689-1 fixed a vulnerability in Libgcrypt. This update provides
the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Keegan Ryan discovered that Libgcrypt was susceptible to a side-
channel attack. A local attacker could possibly use this attack to
recover ECDSA private keys.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
libgcrypt11 1.5.0-3ubuntu0.8
In general, a standard system update will make all the necessary
changes.
References:
https://usn.ubuntu.com/usn/usn-3689-2
https://usn.ubuntu.com/usn/usn-3689-1
CVE-2018-0495
