[USN-5393-1] Thunderbird vulnerabilities
== Ubuntu Security Notice USN-5393-1 April 27, 2022 thunderbird vulnerabilities == A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 21.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in Thunderbird. Software Description: - thunderbird: Mozilla Open Source mail and newsgroup client Details: Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, conduct spoofing attacks, or execute arbitrary code. (CVE-2022-1097, CVE-2022-1196, CVE-2022-28281, CVE-2022-28282, CVE-2022-28285, CVE-2022-28286, CVE-2022-28289) It was discovered that Thunderbird ignored OpenPGP revocation when importing a revoked key in some circumstances. An attacker could potentially exploit this by tricking the user into trusting the authenticity of a message or tricking them into use a revoked key to send an encrypted message. (CVE-2022-1197) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 21.10: thunderbird 1:91.8.1+build1-0ubuntu0.21.10.1 Ubuntu 20.04 LTS: thunderbird 1:91.8.1+build1-0ubuntu0.20.04.1 Ubuntu 18.04 LTS: thunderbird 1:91.8.1+build1-0ubuntu0.18.04.1 After a standard system update you need to restart Thunderbird to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5393-1 CVE-2022-1097, CVE-2022-1196, CVE-2022-1197, CVE-2022-28281, CVE-2022-28282, CVE-2022-28285, CVE-2022-28286, CVE-2022-28289 Package Information: https://launchpad.net/ubuntu/+source/thunderbird/1:91.8.1+build1-0ubuntu0.21.10.1 https://launchpad.net/ubuntu/+source/thunderbird/1:91.8.1+build1-0ubuntu0.20.04.1 https://launchpad.net/ubuntu/+source/thunderbird/1:91.8.1+build1-0ubuntu0.18.04.1 OpenPGP_signature Description: OpenPGP digital signature
[USN-5366-2] FriBidi vulnerabilities
== Ubuntu Security Notice USN-5366-2 April 27, 2022 fribidi vulnerabilities == A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS Summary: Several security issues were fixed in fribidi. Software Description: - fribidi: Free Implementation of the Unicode BiDi algorithm (utility) Details: USN-5366-1 fixed several vulnerabilities in FriBidi. This update provides the corresponding updates for Ubuntu 22.04 LTS. Original advisory details: It was discovered that FriBidi incorrectly handled processing of input strings resulting in memory corruption. An attacker could use this issue to cause FriBidi to crash, resulting in a denial of service, or potentially execute arbitrary code. (CVE-2022-25308) It was discovered that FriBidi incorrectly validated input data to its CapRTL unicode encoder, resulting in memory corruption. An attacker could use this issue to cause FriBidi to crash, resulting in a denial of service, or potentially execute arbitrary code. (CVE-2022-25309) It was discovered that FriBidi incorrectly handled empty input when removing marks from unicode strings, resulting in a crash. An attacker could use this to cause FriBidi to crash, resulting in a denial of service, or potentially execute arbitrary code. (CVE-2022-25310) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS: libfribidi-bin 1.0.8-2ubuntu3.1 libfribidi-dev 1.0.8-2ubuntu3.1 libfribidi0 1.0.8-2ubuntu3.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5366-2 https://ubuntu.com/security/notices/USN-5366-1 CVE-2022-25308, CVE-2022-25309, CVE-2022-25310 Package Information: https://launchpad.net/ubuntu/+source/fribidi/1.0.8-2ubuntu3.1 OpenPGP_signature Description: OpenPGP digital signature
[USN-5391-1] libsepol vulnerabilities
== Ubuntu Security Notice USN-5391-1 April 27, 2022 libsepol vulnerabilities == A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 21.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 ESM Summary: Several security issues were fixed in libsepol. Software Description: - libsepol: SELinux library for manipulating binary security policies Details: Nicolas Iooss discovered that libsepol incorrectly handled memory when handling policies. An attacker could possibly use this issue to cause a crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-36084) It was discovered that libsepol incorrectly handled memory when handling policies. An attacker could possibly use this issue to cause a crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-36085) It was discovered that libsepol incorrectly handled memory when handling policies. An attacker could possibly use this issue to cause a crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affects Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 21.10. (CVE-2021-36086) It was discovered that libsepol incorrectly validated certain data, leading to a heap overflow. An attacker could possibly use this issue to cause a crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2021-36087) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 21.10: libsepol1 3.1-1ubuntu2.1 sepol-utils 3.1-1ubuntu2.1 Ubuntu 20.04 LTS: libsepol1 3.0-1ubuntu0.1 sepol-utils 3.0-1ubuntu0.1 Ubuntu 18.04 LTS: libsepol1 2.7-1ubuntu0.1 sepol-utils 2.7-1ubuntu0.1 Ubuntu 16.04 ESM: libsepol1 2.4-2ubuntu0.1~esm1 sepol-utils 2.4-2ubuntu0.1~esm1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5391-1 CVE-2021-36084, CVE-2021-36085, CVE-2021-36086, CVE-2021-36087 Package Information: https://launchpad.net/ubuntu/+source/libsepol/3.1-1ubuntu2.1 https://launchpad.net/ubuntu/+source/libsepol/3.0-1ubuntu0.1 https://launchpad.net/ubuntu/+source/libsepol/2.7-1ubuntu0.1 OpenPGP_0x196D412138F33F64.asc Description: OpenPGP public key OpenPGP_signature Description: OpenPGP digital signature
