[USN-5837-2] Django vulnerability
== Ubuntu Security Notice USN-5837-2 February 01, 2023 python-django vulnerability == A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 ESM Summary: Django could be made to consume memory if it received specially crafted network traffic. Software Description: - python-django: High-level Python web development framework Details: USN-5837-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Nick Pope discovered that Django incorrectly handled certain Accept-Language headers. A remote attacker could possibly use this issue to cause Django to consume memory, leading to a denial of service. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 ESM: python-django 1.8.7-1ubuntu5.15+esm6 python3-django 1.8.7-1ubuntu5.15+esm6 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5837-2 https://ubuntu.com/security/notices/USN-5837-1 CVE-2023-23969 signature.asc Description: PGP signature
[USN-5838-1] AdvanceCOMP vulnerabilities
== Ubuntu Security Notice USN-5838-1 February 01, 2023 advancecomp vulnerabilities == A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 ESM Summary: Several security issues were fixed in AdvanceCOMP. Software Description: - advancecomp: collection of recompression utilities Details: It was discovered that AdvanceCOMP did not properly manage memory while performing read operations on MNG file. If a user were tricked into opening a specially crafted MNG file, a remote attacker could possibly use this issue to cause AdvanceCOMP to crash, resulting in a denial of service. (CVE-2022-35014, CVE-2022-35017, CVE-2022-35018, CVE-2022-35019, CVE-2022-35020) It was discovered that AdvanceCOMP did not properly manage memory while performing read operations on ZIP file. If a user were tricked into opening a specially crafted ZIP file, a remote attacker could possibly use this issue to cause AdvanceCOMP to crash, resulting in a denial of service. (CVE-2022-35015, CVE-2022-35016) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.10: advancecomp 2.3-1ubuntu0.22.10.1 Ubuntu 22.04 LTS: advancecomp 2.1-2.1ubuntu2.1 Ubuntu 20.04 LTS: advancecomp 2.1-2.1ubuntu0.20.04.1 Ubuntu 18.04 LTS: advancecomp 2.1-1ubuntu0.18.04.3 Ubuntu 16.04 ESM: advancecomp 1.20-1ubuntu0.2+esm2 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5838-1 CVE-2022-35014, CVE-2022-35015, CVE-2022-35016, CVE-2022-35017, CVE-2022-35018, CVE-2022-35019, CVE-2022-35020 Package Information: https://launchpad.net/ubuntu/+source/advancecomp/2.3-1ubuntu0.22.10.1 https://launchpad.net/ubuntu/+source/advancecomp/2.1-2.1ubuntu2.1 https://launchpad.net/ubuntu/+source/advancecomp/2.1-2.1ubuntu0.20.04.1 https://launchpad.net/ubuntu/+source/advancecomp/2.1-1ubuntu0.18.04.3 signature.asc Description: PGP signature
[USN-5839-1] Apache HTTP Server vulnerabilities
== Ubuntu Security Notice USN-5839-1 February 01, 2023 apache2 vulnerabilities == A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in Apache HTTP Server. Software Description: - apache2: Apache HTTP server Details: It was discovered that the Apache HTTP Server mod_dav module incorrectly handled certain If: request headers. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. (CVE-2006-20001) ZeddYu_Lu discovered that the Apache HTTP Server mod_proxy_ajp module incorrectly interpreted certain HTTP Requests. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. (CVE-2022-36760) Dimas Fariski Setyawan Putra discovered that the Apache HTTP Server mod_proxy module incorrectly truncated certain response headers. This may result in later headers not being interpreted by the client. (CVE-2022-37436) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.10: apache2 2.4.54-2ubuntu1.1 Ubuntu 22.04 LTS: apache2 2.4.52-1ubuntu4.3 Ubuntu 20.04 LTS: apache2 2.4.41-4ubuntu3.13 Ubuntu 18.04 LTS: apache2 2.4.29-1ubuntu4.26 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5839-1 CVE-2006-20001, CVE-2022-36760, CVE-2022-37436 Package Information: https://launchpad.net/ubuntu/+source/apache2/2.4.54-2ubuntu1.1 https://launchpad.net/ubuntu/+source/apache2/2.4.52-1ubuntu4.3 https://launchpad.net/ubuntu/+source/apache2/2.4.41-4ubuntu3.13 https://launchpad.net/ubuntu/+source/apache2/2.4.29-1ubuntu4.26 OpenPGP_signature Description: OpenPGP digital signature
[USN-4781-2] Slurm vulnerabilities
== Ubuntu Security Notice USN-4781-2 February 01, 2023 slurm-llnl vulnerabilities == A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 ESM - Ubuntu 14.04 ESM Summary: Several security issues were fixed in Slurm. Software Description: - slurm-llnl: Simple Linux Utility for Resource Management Details: USN-4781-1 fixed several vulnerabilities in Slurm. This update provides the corresponding updates for Ubuntu 14.04 ESM (CVE-2016-10030) and Ubuntu 16.04 ESM (CVE-2018-10995). Original advisory details: It was discovered that Slurm incorrectly handled certain messages between the daemon and the user. An attacker could possibly use this issue to assume control of an arbitrary file on the system. This issue only affected Ubuntu 16.04 ESM. (CVE-2016-10030) It was discovered that Slurm mishandled SPANK environment variables. An attacker could possibly use this issue to gain elevated privileges. This issue only affected Ubuntu 16.04 ESM. (CVE-2017-15566) It was discovered that Slurm mishandled certain SQL queries. A local attacker could use this issue to gain elevated privileges. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-7033) It was discovered that Slurm mishandled user names and group ids. A local attacker could use this issue to gain administrative privileges. This issue only affected Ubuntu 14.04 ESM and Ubuntu 18.04 ESM. (CVE-2018-10995) It was discovered that Slurm mishandled 23-bit systems. A local attacker could use this to gain administrative privileges. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2019-6438) It was discovered that Slurm incorrectly handled certain inputs when Message Aggregation is enabled. An attacker could possibly use this issue to launch a process as an arbitrary user. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12693) It was discovered that Slurm incorrectly handled certain RPC inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-27745) Jonas Stare discovered that Slurm exposes sensitive information related to the X protocol. An attacker could possibly use this issue to obtain a graphical session from an arbitrary user. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-27746) It was discovered that Slurm incorrectly handled environment parameters. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-31215) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 ESM: libpam-slurm 15.08.7-1ubuntu0.1~esm5 libpmi0 15.08.7-1ubuntu0.1~esm5 libslurm-perl 15.08.7-1ubuntu0.1~esm5 libslurm29 15.08.7-1ubuntu0.1~esm5 libslurmdb-perl 15.08.7-1ubuntu0.1~esm5 libslurmdb29 15.08.7-1ubuntu0.1~esm5 slurm-client 15.08.7-1ubuntu0.1~esm5 slurm-client-emulator 15.08.7-1ubuntu0.1~esm5 slurm-llnl 15.08.7-1ubuntu0.1~esm5 slurm-llnl-slurmdbd 15.08.7-1ubuntu0.1~esm5 slurm-wlm 15.08.7-1ubuntu0.1~esm5 slurm-wlm-basic-plugins 15.08.7-1ubuntu0.1~esm5 slurm-wlm-emulator 15.08.7-1ubuntu0.1~esm5 slurm-wlm-torque 15.08.7-1ubuntu0.1~esm5 slurmctld 15.08.7-1ubuntu0.1~esm5 slurmd 15.08.7-1ubuntu0.1~esm5 slurmdbd 15.08.7-1ubuntu0.1~esm5 sview 15.08.7-1ubuntu0.1~esm5 Ubuntu 14.04 ESM: libpam-slurm 2.6.5-1ubuntu0.1~esm6 libpmi0 2.6.5-1ubuntu0.1~esm6 libslurm-perl 2.6.5-1ubuntu0.1~esm6 libslurm26 2.6.5-1ubuntu0.1~esm6 libslurmdb-perl 2.6.5-1ubuntu0.1~esm6 libslurmdb26 2.6.5-1ubuntu0.1~esm6 slurm-llnl 2.6.5-1ubuntu0.1~esm6 slurm-llnl-basic-plugins 2.6.5-1ubuntu0.1~esm6 slurm-llnl-slurmdbd 2.6.5-1ubuntu0.1~esm6 slurm-llnl-sview 2.6.5-1ubuntu0.1~esm6 slurm-llnl-torque 2.6.5-1ubuntu0.1~esm6 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-4781-2 https://ubuntu.com/security/notices/USN-4781-1 CVE-2016-10030, CVE-2018-10995 OpenPGP_0x86A73CCF854ECB9A.asc Description: OpenPGP public key OpenPGP_signature Description: OpenPGP digital signature
