[USN-6580-1] w3m vulnerability
[USN-6581-1] GNU binutils vulnerabilities
[USN-6584-1] Libspf2 vulnerabilities
[USN-6583-1] MySQL vulnerabilities
[USN-6585-1] libssh2 vulnerability
[USN-6580-1] w3m vulnerability
=========================================================================
Ubuntu Security Notice USN-6580-1
January 15, 2024
w3m vulnerability
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
w3m could be made to crash or run programs as your login if it opened a malicious website.
Software Description:
- w3m: WWW browsable pager with excellent tables/frames support
Details:
It was discovered that w3m incorrectly handled certain HTML files.
An attacker could possibly use this issue to cause a crash or
execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
w3m 0.5.3+git20230121-2ubuntu0.23.10.1
Ubuntu 23.04:
w3m 0.5.3+git20230121-2ubuntu0.23.04.1
Ubuntu 22.04 LTS:
w3m 0.5.3+git20210102-6ubuntu0.2
Ubuntu 20.04 LTS:
w3m 0.5.3-37ubuntu0.2
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
w3m 0.5.3-36ubuntu0.1+esm1
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
w3m 0.5.3-15ubuntu0.2+esm2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6580-1
CVE-2023-4255
Package Information:
https://launchpad.net/ubuntu/+source/w3m/0.5.3+git20230121-2ubuntu0.23.10.1
https://launchpad.net/ubuntu/+source/w3m/0.5.3+git20230121-2ubuntu0.23.04.1
https://launchpad.net/ubuntu/+source/w3m/0.5.3+git20210102-6ubuntu0.2
https://launchpad.net/ubuntu/+source/w3m/0.5.3-37ubuntu0.2
[USN-6581-1] GNU binutils vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6581-1
January 15, 2024
binutils vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in GNU binutils.
Software Description:
- binutils: GNU assembler, linker and binary utilities
Details:
It was discovered that GNU binutils was not properly performing bounds
checks in several functions, which could lead to a buffer overflow. An
attacker could possibly use this issue to cause a denial of service,
expose sensitive information or execute arbitrary code.
(CVE-2022-44840, CVE-2022-45703)
It was discovered that GNU binutils incorrectly handled memory management
operations in several of its functions, which could lead to excessive
memory consumption due to memory leaks. An attacker could possibly use
these issues to cause a denial of service.
(CVE-2022-47007, CVE-2022-47008, CVE-2022-47010, CVE-2022-47011)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
binutils 2.38-4ubuntu2.5
binutils-multiarch 2.38-4ubuntu2.5
Ubuntu 20.04 LTS:
binutils 2.34-6ubuntu1.8
binutils-multiarch 2.34-6ubuntu1.8
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6581-1
CVE-2022-44840, CVE-2022-45703, CVE-2022-47007, CVE-2022-47008,
CVE-2022-47010, CVE-2022-47011
Package Information:
https://launchpad.net/ubuntu/+source/binutils/2.38-4ubuntu2.5
https://launchpad.net/ubuntu/+source/binutils/2.34-6ubuntu1.8
[USN-6584-1] Libspf2 vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6584-1
January 15, 2024
libspf2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in Libspf2.
Software Description:
- libspf2: Sender Policy Framework for SMTP authorization
Details:
Philipp Jeitner and Haya Shulman discovered that Libspf2 incorrectly handled
certain inputs. If a user or an automated system were tricked into opening a
specially crafted input file, a remote attacker could possibly use this issue
to cause a denial of service or execute arbitrary code. (CVE-2021-20314)
It was discovered that Libspf2 incorrectly handled certain inputs. If a user or
an automated system were tricked into opening a specially crafted input file, a
remote attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and
Ubuntu 20.04 LTS. (CVE-2021-33912, CVE-2021-33913)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
libmail-spf-xs-perl 1.2.10-7+deb9u2build0.20.04.1
libspf2-2 1.2.10-7+deb9u2build0.20.04.1
libspf2-dev 1.2.10-7+deb9u2build0.20.04.1
spfquery 1.2.10-7+deb9u2build0.20.04.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libmail-spf-xs-perl 1.2.10-7ubuntu0.18.04.1~esm1
libspf2-2 1.2.10-7ubuntu0.18.04.1~esm1
libspf2-dev 1.2.10-7ubuntu0.18.04.1~esm1
spfquery 1.2.10-7ubuntu0.18.04.1~esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libmail-spf-xs-perl 1.2.10-6ubuntu0.1~esm1
libspf2-2 1.2.10-6ubuntu0.1~esm1
libspf2-dev 1.2.10-6ubuntu0.1~esm1
spfquery 1.2.10-6ubuntu0.1~esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6584-1
CVE-2021-20314, CVE-2021-33912, CVE-2021-33913
Package Information:
https://launchpad.net/ubuntu/+source/libspf2/1.2.10-7+deb9u2build0.20.04.1
[USN-6583-1] MySQL vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6583-1
January 15, 2024
mysql-5.7 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in MySQL.
Software Description:
- mysql-5.7: MySQL database
Details:
Multiple security issues were discovered in MySQL and this update includes
new upstream MySQL versions to fix these issues.
MySQL has been updated to 5.7.44 in Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-44.html
https://www.oracle.com/security-alerts/cpuoct2023.html
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
mysql-server-5.7 5.7.44-0ubuntu0.18.04.1+esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
mysql-server-5.7 5.7.44-0ubuntu0.16.04.1+esm1
This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
References:
https://ubuntu.com/security/notices/USN-6583-1
CVE-2023-22028, CVE-2023-22084
[USN-6585-1] libssh2 vulnerability
==========================================================================
Ubuntu Security Notice USN-6585-1
January 15, 2024
libssh2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
Summary:
libssh2 could be made to expose sensitive information over the network.
Software Description:
- libssh2: Client-side C library implementing the SSH2 protocol
Details:
Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk discovered that the SSH
protocol was vulnerable to a prefix truncation attack. If a remote attacker
was able to intercept SSH communications, extension negotiation messages
could be truncated, possibly leading to certain algorithms and features
being downgraded. This issue is known as the Terrapin attack. This update
adds protocol extensions to mitigate this issue.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
libssh2-1 1.11.0-2ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6585-1
CVE-2023-48795
Package Information:
https://launchpad.net/ubuntu/+source/libssh2/1.11.0-2ubuntu0.1
