[USN-6944-2] curl vulnerability
== Ubuntu Security Notice USN-6944-2 August 20, 2024 curl vulnerability == A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: curl could be made to crash or expose information if it received specially crafted network traffic. Software Description: - curl: HTTP, HTTPS, and FTP client and client libraries Details: USN-6944-1 fixed CVE-2024-7264 for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. This update provides the corresponding fix for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. Original advisory details: Dov Murik discovered that curl incorrectly handled parsing ASN.1 Generalized Time fields. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly obtain sensitive memory contents. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS curl 7.58.0-2ubuntu3.24+esm5 Available with Ubuntu Pro libcurl3-gnutls 7.58.0-2ubuntu3.24+esm5 Available with Ubuntu Pro libcurl3-nss 7.58.0-2ubuntu3.24+esm5 Available with Ubuntu Pro libcurl4 7.58.0-2ubuntu3.24+esm5 Available with Ubuntu Pro Ubuntu 16.04 LTS curl 7.47.0-1ubuntu2.19+esm13 Available with Ubuntu Pro libcurl3 7.47.0-1ubuntu2.19+esm13 Available with Ubuntu Pro libcurl3-gnutls 7.47.0-1ubuntu2.19+esm13 Available with Ubuntu Pro libcurl3-nss 7.47.0-1ubuntu2.19+esm13 Available with Ubuntu Pro Ubuntu 14.04 LTS curl 7.35.0-1ubuntu2.20+esm18 Available with Ubuntu Pro libcurl3 7.35.0-1ubuntu2.20+esm18 Available with Ubuntu Pro libcurl3-gnutls 7.35.0-1ubuntu2.20+esm18 Available with Ubuntu Pro libcurl3-nss 7.35.0-1ubuntu2.20+esm18 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6944-2 https://ubuntu.com/security/notices/USN-6944-1 CVE-2024-7264 OpenPGP_0x703AAD91046CD76E.asc Description: OpenPGP public key OpenPGP_signature.asc Description: OpenPGP digital signature
[USN-6913-2] phpCAS vulnerability
== Ubuntu Security Notice USN-6913-2 July 31, 2024 php-cas vulnerability == A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: phpCAS was vulnerable to an authentication bypass. Software Description: - php-cas: Central Authentication Service client library in php Details: USN-6913-1 fixed CVE-2022-39369 for Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. This update provides the corresponding fix for Ubuntu 16.04 LTS. Original advisory details: Filip Hejsek discovered that phpCAS was using HTTP headers to determine the service URL used to validate tickets. A remote attacker could possibly use this issue to gain access to a victim's account on a vulnerable CASified service. This security update introduces an incompatible API change. After applying this update, third party applications need to be modified to pass in an additional service base URL argument when constructing the client class. For more information please refer to the section "Upgrading 1.5.0 -> 1.6.0" of the phpCAS upgrading document: https://github.com/apereo/phpCAS/blob/master/docs/Upgrading Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS php-cas 1.3.3-2ubuntu1+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6913-2 https://ubuntu.com/security/notices/USN-6913-1 CVE-2022-39369 OpenPGP_0x703AAD91046CD76E.asc Description: OpenPGP public key OpenPGP_signature.asc Description: OpenPGP digital signature
[USN-6914-1] OCS Inventory vulnerability
== Ubuntu Security Notice USN-6914-1 July 24, 2024 ocsinventory-server vulnerability == A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS Summary: OCS Inventory was vulnerable to an authentication bypass if the selected authentication method was via CAS. Software Description: - ocsinventory-server: Hardware and software inventory tool Details: Filip Hejsek discovered that the phpCAS library included in OCS Inventory was using HTTP headers to determine the service URL used to validate tickets. A remote attacker could possibly use this issue to gain access to a victim's account. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS ocsinventory-reports 2.8.1+dfsg1-1ubuntu0.1 ocsinventory-server 2.8.1+dfsg1-1ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6914-1 CVE-2022-39369 Package Information: https://launchpad.net/ubuntu/+source/ocsinventory-server/2.8.1+dfsg1-1ubuntu0.1 OpenPGP_0x703AAD91046CD76E.asc Description: OpenPGP public key OpenPGP_signature.asc Description: OpenPGP digital signature
[USN-6913-1] phpCAS vulnerability
== Ubuntu Security Notice USN-6913-1 July 24, 2024 php-cas vulnerability == A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: phpCAS was vulnerable to an authentication bypass. Software Description: - php-cas: Central Authentication Service client library in php Details: Filip Hejsek discovered that phpCAS was using HTTP headers to determine the service URL used to validate tickets. A remote attacker could possibly use this issue to gain access to a victim's account on a vulnerable CASified service. This security update introduces an incompatible API change. After applying this update, third party applications need to be modified to pass in an additional service base URL argument when constructing the client class. For more information please refer to the section "Upgrading 1.5.0 -> 1.6.0" of the phpCAS upgrading document: https://github.com/apereo/phpCAS/blob/master/docs/Upgrading Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS php-cas 1.3.8-1ubuntu0.22.04.1 Ubuntu 20.04 LTS php-cas 1.3.8-1ubuntu0.20.04.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6913-1 CVE-2022-39369 Package Information: https://launchpad.net/ubuntu/+source/php-cas/1.3.8-1ubuntu0.22.04.1 https://launchpad.net/ubuntu/+source/php-cas/1.3.8-1ubuntu0.20.04.1 OpenPGP_0x703AAD91046CD76E.asc Description: OpenPGP public key OpenPGP_signature.asc Description: OpenPGP digital signature
[USN-6908-1] Tomcat vulnerabilities
== Ubuntu Security Notice USN-6908-1 July 23, 2024 tomcat vulnerabilities == A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Tomcat. Software Description: - tomcat7: Servlet 3.0 and JSP 2.2 Java API classes Details: It was discovered that the Tomcat SSI printenv command echoed user provided data without escaping it. An attacker could possibly use this issue to perform an XSS attack. (CVE-2019-0221) It was discovered that Tomcat incorrectly handled certain uncommon PersistenceManager with FileStore configurations. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2020-9484, CVE-2021-25329) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS libservlet3.0-java 7.0.78-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS libservlet3.0-java 7.0.68-1ubuntu0.4+esm2 Available with Ubuntu Pro libtomcat7-java 7.0.68-1ubuntu0.4+esm2 Available with Ubuntu Pro tomcat7 7.0.68-1ubuntu0.4+esm2 Available with Ubuntu Pro Ubuntu 14.04 LTS libservlet3.0-java 7.0.52-1ubuntu0.16+esm1 Available with Ubuntu Pro libtomcat7-java 7.0.52-1ubuntu0.16+esm1 Available with Ubuntu Pro tomcat7 7.0.52-1ubuntu0.16+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6908-1 CVE-2019-0221, CVE-2020-9484, CVE-2021-25329 OpenPGP_0x703AAD91046CD76E.asc Description: OpenPGP public key OpenPGP_signature.asc Description: OpenPGP digital signature
[USN-6825-1] ADOdb vulnerabilities
== Ubuntu Security Notice USN-6825-1 June 10, 2024 libphp-adodb vulnerabilities == A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in ADOdb. Software Description: - libphp-adodb: ADOdb is a PHP database abstraction layer library Details: It was discovered that the PDO driver in ADOdb was incorrectly handling string quotes. A remote attacker could possibly use this issue to perform SQL injection attacks. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-7405) It was discovered that ADOdb was incorrectly handling GET parameters in test.php. A remote attacker could possibly use this issue to execute cross-site scripting (XSS) attacks. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4855) Emmet Leahy discovered that ADOdb was incorrectly handling string quotes in PostgreSQL connections. A remote attacker could possibly use this issue to bypass authentication. (CVE-2021-3850) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS libphp-adodb 5.20.19-1ubuntu0.1 Ubuntu 20.04 LTS libphp-adodb 5.20.16-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS libphp-adodb 5.20.9-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS libphp-adodb 5.20.3-1ubuntu1+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6825-1 CVE-2016-4855, CVE-2016-7405, CVE-2021-3850 Package Information: https://launchpad.net/ubuntu/+source/libphp-adodb/5.20.19-1ubuntu0.1 OpenPGP_0x703AAD91046CD76E.asc Description: OpenPGP public key OpenPGP_signature.asc Description: OpenPGP digital signature
[USN-6796-1] TPM2 Software Stack vulnerabilities
== Ubuntu Security Notice USN-6796-1 May 29, 2024 tpm2-tss vulnerabilities == A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 23.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Several security issues were fixed in TPM2 Software Stack. Software Description: - tpm2-tss: TPM2 Software Stack library Details: Fergus Dall discovered that TPM2 Software Stack did not properly handle layer arrays. An attacker could possibly use this issue to cause TPM2 Software Stack to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2023-22745) Jurgen Repp and Andreas Fuchs discovered that TPM2 Software Stack did not validate the quote data after deserialization. An attacker could generate an arbitrary quote and cause TPM2 Software Stack to have unknown behavior. (CVE-2024-29040) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS libtss2-esys-3.0.2-0t64 4.0.1-7.1ubuntu5.1 libtss2-fapi1t644.0.1-7.1ubuntu5.1 libtss2-mu-4.0.1-0t64 4.0.1-7.1ubuntu5.1 libtss2-policy0t64 4.0.1-7.1ubuntu5.1 libtss2-rc0t64 4.0.1-7.1ubuntu5.1 libtss2-sys1t64 4.0.1-7.1ubuntu5.1 libtss2-tcti-cmd0t644.0.1-7.1ubuntu5.1 libtss2-tcti-device0t64 4.0.1-7.1ubuntu5.1 libtss2-tcti-libtpms0t644.0.1-7.1ubuntu5.1 libtss2-tcti-mssim0t64 4.0.1-7.1ubuntu5.1 libtss2-tcti-pcap0t64 4.0.1-7.1ubuntu5.1 libtss2-tcti-spi-helper0t64 4.0.1-7.1ubuntu5.1 libtss2-tcti-swtpm0t64 4.0.1-7.1ubuntu5.1 libtss2-tctildr0t64 4.0.1-7.1ubuntu5.1 Ubuntu 23.10 libtss2-esys-3.0.2-04.0.1-3ubuntu1.1 libtss2-fapi1 4.0.1-3ubuntu1.1 libtss2-mu0 4.0.1-3ubuntu1.1 libtss2-policy0 4.0.1-3ubuntu1.1 libtss2-rc0 4.0.1-3ubuntu1.1 libtss2-sys14.0.1-3ubuntu1.1 libtss2-tcti-cmd0 4.0.1-3ubuntu1.1 libtss2-tcti-device04.0.1-3ubuntu1.1 libtss2-tcti-libtpms0 4.0.1-3ubuntu1.1 libtss2-tcti-mssim0 4.0.1-3ubuntu1.1 libtss2-tcti-pcap0 4.0.1-3ubuntu1.1 libtss2-tcti-spi-helper04.0.1-3ubuntu1.1 libtss2-tcti-swtpm0 4.0.1-3ubuntu1.1 libtss2-tctildr04.0.1-3ubuntu1.1 Ubuntu 22.04 LTS libtss2-esys-3.0.2-03.2.0-1ubuntu1.1 libtss2-fapi1 3.2.0-1ubuntu1.1 libtss2-mu0 3.2.0-1ubuntu1.1 libtss2-rc0 3.2.0-1ubuntu1.1 libtss2-sys13.2.0-1ubuntu1.1 libtss2-tcti-cmd0 3.2.0-1ubuntu1.1 libtss2-tcti-device03.2.0-1ubuntu1.1 libtss2-tcti-mssim0 3.2.0-1ubuntu1.1 libtss2-tcti-swtpm0 3.2.0-1ubuntu1.1 libtss2-tctildr03.2.0-1ubuntu1.1 Ubuntu 20.04 LTS libtss2-esys0 2.3.2-1ubuntu0.20.04.2 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6796-1 CVE-2023-22745, CVE-2024-29040 Package Information: https://launchpad.net/ubuntu/+source/tpm2-tss/4.0.1-7.1ubuntu5.1 https://launchpad.net/ubuntu/+source/tpm2-tss/4.0.1-3ubuntu1.1 https://launchpad.net/ubuntu/+source/tpm2-tss/3.2.0-1ubuntu1.1 https://launchpad.net/ubuntu/+source/tpm2-tss/2.3.2-1ubuntu0.20.04.2 OpenPGP_0x703AAD91046CD76E.asc Description: OpenPGP public key OpenPGP_signature.asc Description: OpenPGP digital signature
[USN-6781-1] Spreadsheet::ParseExcel vulnerability
== Ubuntu Security Notice USN-6781-1 May 21, 2024 libspreadsheet-parseexcel-perl vulnerability == A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Spreadsheet::ParseExcel could possibly run commands if it processed a specially crafted file. Software Description: - libspreadsheet-parseexcel-perl: Perl module to access information from Excel Spreadsheets Details: Le Dinh Hai discovered that Spreadsheet::ParseExcel was passing unvalidated input from a file into a string-type "eval". An attacker could craft a malicious file to achieve arbitrary code execution. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS libspreadsheet-parseexcel-perl 0.6500-1.1ubuntu0.1 Ubuntu 20.04 LTS libspreadsheet-parseexcel-perl 0.6500-1ubuntu0.20.04.1 Ubuntu 18.04 LTS libspreadsheet-parseexcel-perl 0.6500-1ubuntu0.18.04.1~esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS libspreadsheet-parseexcel-perl 0.6500-1ubuntu0.16.04.1~esm1 Available with Ubuntu Pro Ubuntu 14.04 LTS libspreadsheet-parseexcel-perl 0.5800-1ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6781-1 CVE-2023-7101 Package Information: https://launchpad.net/ubuntu/+source/libspreadsheet-parseexcel-perl/0.6500-1.1ubuntu0.1 https://launchpad.net/ubuntu/+source/libspreadsheet-parseexcel-perl/0.6500-1ubuntu0.20.04.1 OpenPGP_0x703AAD91046CD76E.asc Description: OpenPGP public key OpenPGP_signature.asc Description: OpenPGP digital signature
[USN-6753-1] CryptoJS vulnerability
== Ubuntu Security Notice USN-6753-1 April 25, 2024 cryptojs vulnerability == A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS (Available with Ubuntu Pro) - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) Summary: CryptoJS could be made to expose sensitive information. Software Description: - cryptojs: collection of cryptographic algorithms implemented in JavaScript Details: Thomas Neil James Shadwell discovered that CryptoJS was using an insecure cryptographic default configuration. A remote attacker could possibly use this issue to expose sensitive information. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS (Available with Ubuntu Pro): libjs-cryptojs 3.1.2+dfsg-3ubuntu0.22.04.1~esm1 Ubuntu 20.04 LTS: libjs-cryptojs 3.1.2+dfsg-2ubuntu0.20.04.1 Ubuntu 18.04 LTS (Available with Ubuntu Pro): libjs-cryptojs 3.1.2+dfsg-2ubuntu0.18.04.1~esm1 Ubuntu 16.04 LTS (Available with Ubuntu Pro): libjs-cryptojs 3.1.2+dfsg-2ubuntu0.16.04.1~esm1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6753-1 CVE-2023-46233 Package Information: https://launchpad.net/ubuntu/+source/cryptojs/3.1.2+dfsg-2ubuntu0.20.04.1 OpenPGP_0x703AAD91046CD76E.asc Description: OpenPGP public key OpenPGP_signature.asc Description: OpenPGP digital signature
