Ubuntu Security Podcast

Latest Episodes:

Episode 83 Jul 24, 2020

Show notes

Overview

This week Joe talks Linux Security Modules stacking with John Johansen and Steve Beattie plus Alex looks at security updates for snapd, the Linux kernel and more.

This week in Ubuntu Security Updates

24 unique CVEs addressed

[USN-4199-2] libvpx vulnerabilities [01:05]

3 CVEs addressed in Trusty ESM (14.04 ESM)
VP8/VP9 video code (webm)
Various OOB read on crafted input

[USN-4424-1] snapd vulnerabilities [01:38]

2 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-11934
- CVE-2020-11933
James Henstridge from Ubuntu Desktop team
snapd sandbox for strict mode snaps - within sandbox provides xdg-open implementation which can forward to the real xdg-open outside the sandbox - but would use XDG_DATA_DIRS env from the snap when launching xdg-open outside of the snap - XDG_DATA_DIRS could then contain a directory which the snap itself controls - allows to launch arbitrary binaries from the snap outside of confinement
Fixed to not incorporate XDG_DATA_DIRS from the snap
cloud-init would run on every boot without restriction - supports the concept of loading meta-data from an external disk - so a local attacker with physical access could alter the boot sequence - would be an issue with FDE since could intercept the disk encryption key etc - fixed via snapd to disable cloud-init after the first boot since cloud-init is managed by snapd
- Is only an issue for Ubuntu Core 16/18 devices which employed FDE
- Doesn’t affect UC20

[USN-4425-1] Linux kernel vulnerabilities [06:20]

4 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
5.4 kernel (focal / bionic hwe)
Possible bypass of Secure Boot lockdown protections via loading of ACPI tables via configs - provides a means of arbitrary memory write - allows root user to bypass lockdown
aufs inode reference count issue - BUG() -> DoS
relay subsystem crash (Episode 81)

[USN-4426-1] Linux kernel vulnerabilities [7:32]

4 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS)
4.15 kernel (bionic / xenial hwe)
ACPI lockdown bypass / aufs inode above
Second lockdown bypass via loading of ACPI tables via the SSDT EFI variable similar to above
DAX (direct access to files in persistent memory arrays) huge pages support - abuse mremap() to gain root privileges - requires the system to make use of DAX storage to be able to exploit

[USN-4427-1] Linux kernel vulnerabilities [08:30]

10 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS)
4.4 kernel (xenial / trusty hwe)
aufs
Various means to bypass spectre related mitigations
SSDT ACPI lockdown bypass

[USN-4429-1] Evolution Data Server vulnerability [09:12]

1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2020-14928
Very similar to recent mutt & Thunderbird vuln from Episode 81 / Episode 82
Would read extra data after clear-text “begin TLS” when initiating STARTTLS - would allow an untrusted attacker who could intercept and modify traffic to inject arbitrary responses that then get processed later as though they had come from the trusted, encrypted connection to the server - fixed in same way as mutt by clearing buffered content when starting TLS

[USN-4430-1] Pillow vulnerabilities [10:24]

4 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS)
Python Imaging Library - used for image handling by lots of Python GUIs
All OOB reads on crafted input -> crash, DoS

Goings on in Ubuntu Security Community

John Johansen and Steve Beattie talk Linux Security Modules with Joe [10:51]

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 82 Jul 17, 2020

Show notes

Overview With Ubuntu 19.10 going EOL, we have a special interview by Joe with Chris Coulson and Steve Beattie from the Ubuntu Security Team to talk TPMs and Ubuntu Core 20, plus Alex looks at some of the 71 CVEs addressed by the team and more. This week in Ubuntu Security Updates 71 unique CVEs addressed [USN-4407-1] LibVNCServer vulnerabilities [01:02] 5 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS) CVE-2017-18922 CVE-2019-20788 CVE-2019-15690 CVE-2019-15681 CVE-2019-15680 Used by gnome-remote-desktop, virtualbox and others Provides both a server and client libraries So some issues affect clients when connecting to a malicious server, others could be from a malicious client to the server Issues when handling WebSocket frames, cursor shape updates, ServerCutText messages and decompression of zlib compressed data - crash -> DoS, info leak, RCE etc [USN-4408-1] Firefox vulnerabilities [01:57] 11 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS) CVE-2020-12421 CVE-2020-12426 CVE-2020-12425 CVE-2020-12424 CVE-2020-12422 CVE-2020-12420 CVE-2020-12419 CVE-2020-12418 CVE-2020-12417 CVE-2020-12416 CVE-2020-12415 78.0.1 Would reject certificate chains for addons which did not terminate in a built-in root certificate - could cause some add-ons to become outdated as it would reject updates for them Usual web browser issues -> crafted website DoS, info leak, bypass permission prompts or RCE [USN-4409-1] Samba vulnerabilities [03:00] 3 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS) CVE-2020-10760 CVE-2020-10745 CVE-2020-10730 2 separate issues when handling LDAP queries -> both UAF -> crash -> DoS or RCE CPU based DoS when processing NetBIOS over TCP/IP [USN-4410-1] Net-SNMP vulnerability [03:44] 1 CVEs addressed in Focal (20.04 LTS) CVE-2019-20892 Double free -> heap memory corruption -> crash / RCE [USN-4411-1] Linux kernel vulnerabilities [04:02] 5 CVEs addressed in Focal (20.04 LTS) CVE-2020-12768 CVE-2020-13143 CVE-2020-12770 CVE-2020-10711 CVE-2020-10732 5.4 kernel Various low impact issues - info leak due to failure to initialise memory when handling ELF code, SELinux network label handling NULL ptr deref, SCSI driver OOB read, USB gadget OOB read via configfs etc [USN-4412-1] Linux kernel vulnerabilities [04:57] 5 CVEs addressed in Bionic (18.04 LTS), Eoan (19.10) CVE-2020-12768 CVE-2020-10751 CVE-2020-13143 CVE-2020-12770 CVE-2020-10711 5.3 kernel (bionic HWE) Most of above plus an SELinux failure to validate all parts of a multi-part netlink message - could then possibly bypass SELinux access controls - SELinux is not the default LSM in Ubuntu - AppArmor [USN-4413-1] Linux kernel vulnerabilities [05:58] 5 CVEs addressed in Bionic (18.04 LTS) CVE-2020-12768 CVE-2020-10751 CVE-2020-13143 CVE-2020-12770 CVE-2020-10711 5.0 kernel (gke/oem) [USN-4414-1] Linux kernel vulnerabilities [06:10] 12 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS) CVE-2019-19039 CVE-2019-12380 CVE-2020-13143 CVE-2020-12770 CVE-2020-10711 CVE-2019-19462 CVE-2019-19377 CVE-2019-19816 CVE-2019-19813 CVE-2019-19318 CVE-2019-19036 CVE-2019-16089 4.15 kernel (bionic / xenial hwe) Some of above, plus others and a kernel->user space relay bug where local user could trigger a crash -> DoS via improper return values to the kernel [USN-4419-1] Linux kernel vulnerabilities [06:49] 5 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS) CVE-2020-8992 CVE-2020-13143 CVE-2020-12770 CVE-2020-10711 CVE-2020-10690 4.4 kernel (xenial / trusty hwe) ptp race condition during device allocation and removal due to a dangling pointer to free’d memory [USN-4415-1] coTURN vulnerabilities [07:33] 3 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS) CVE-2020-6062 CVE-2020-6061 CVE-2020-4067 TURN / STUN server used to traverse VoIP media traffic over NAT with a telnet / HTTPS management interface Info leak due to failure to zero memory used for response buffers Improper handling of HTTP POST requests to the web interface -> DoS / info-leak etc [USN-4416-1] GNU C Library vulnerabilities [08:04] 11 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10) CVE-2020-1752 CVE-2020-1751 CVE-2020-10029 CVE-2019-9169 CVE-2019-19126 CVE-2018-6485 CVE-2018-19591 CVE-2018-11237 CVE-2018-11236 CVE-2017-18269 CVE-2017-12133 Failure to handle regex/s, bit patters, path tilde expansion, hostname lookups, memalign & AVX-512 optimised memcpy() etc -> memory corruption -> crash / RCE Possible ASLR bypass for setuid() programs since would not respect the LD_PREFER_MAP_32BIT_EXEC environment variable after security transition and so a local attcker could use this to restrict the range of memory addresses used when loading libraries [USN-4417-1, USN-4417-2] NSS vulnerability [09:38] 1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS) CVE-2020-12402 Possible RSA side-channel due to input-dependent code flow - would allow possible RSA private key extraction via electromagnetic-based side-channel measurements [USN-4418-1] OpenEXR vulnerabilities [10:06] 2 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS) CVE-2020-15306 CVE-2020-15305 Heap buffer overflow and UAF [USN-4420-1] Cinder and os-brick vulnerability [10:13] 1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2020-10755 Possible exposure of credentials when using the Dell EMC ScaleIO or VxFlex OS backend storage drivers - credentials would be accessible via the connection_info element in various API calls - instead credentials get moved to a file on disk so may require some changes on various deployed environments as a result [USN-4421-1] Thunderbird vulnerabilities [10:52] 10 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS) CVE-2020-12421 CVE-2020-12399 CVE-2020-12398 CVE-2020-12420 CVE-2020-12419 CVE-2020-12418 CVE-2020-12417 CVE-2020-12410 CVE-2020-12406 CVE-2020-12405 68.10.0 Most firefox issues mentioned earlier, plus a specific TB one where if an attacker could potentially intercept and modify traffic across a STARTTLS IMAP server by responding with a PREAUTH. [USN-4376-2] OpenSSL vulnerabilities [11:33] 3 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM) CVE-2019-1563 CVE-2019-1559 CVE-2019-1547 Episode 77 [USN-4422-1] WebKitGTK+ vulnerabilities [11:40] 8 CVEs addressed in Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS) CVE-2020-9850 CVE-2020-9843 CVE-2020-9807 CVE-2020-9806 CVE-2020-9805 CVE-2020-9803 CVE-2020-9802 CVE-2020-13753 [USN-4423-1] Firefox vulnerability [11:52] Affecting Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS) 78.0.2 Possible click-jacking attack via crafted X-Frame-Options bypass when visiting a specially crafted website (no CVE..) Goings on in Ubuntu Security Community Joe talks TPMs and Ubuntu Core 20 with Chris Coulson and Steve Beattie [12:30] https://forum.snapcraft.io/t/uc20-beta1-released/18631 Ubuntu 19.10 Eoan Ermine goes end-of-life [23:12] https://lists.ubuntu.com/archives/ubuntu-security-announce/2020-July/005494.html Get in contact security@ubuntu.com #ubuntu-security on the Libera.Chat IRC network ubuntu-hardened mailing list Security section on discourse.ubuntu.com @ubuntu_sec on twitter

Full show notes at the publisher

Episode 81 Jul 03, 2020

Show notes

Overview

Joe talks cyber security policy with Dr David Reed from CU Boulder, plus Alex covers the week in security updates including Mutt, NVIDIA graphics drivers, Mailman and more.

This week in Ubuntu Security Updates

6 unique CVEs addressed

[USN-4403-1] Mutt vulnerability and regression [00:40]

1 CVEs addressed in Precise ESM (12.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-14954
When connecting to an IMAP/SMTP/POP3 server via STARTTLS, would read additional data after the clear-text command to begin TLS - if someone was able to intercept the connection they could inject content which would then later get processed by Mutt as though it had come from the TLS connection. Fixed to simply clear input buffer at the start of TLS negotiation.
Also includes a fix for a possible regression in the previous security update (Episode 80)

[USN-4404-1, USN-4404-2] NVIDIA graphics drivers & Linux kernel vulnerabilities [01:59]

3 CVEs addressed in Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
CUDA driver failed to properly perform access control during IPC - could allow a local attacker to DoS/RCE
UVM driver (Unified Virtual Memory - used with CUDA driver for better performance) race condition - local attacker DoS
Virtual guest GPU driver unspecified vuln -> privileged operations -> DoS
Updates the linux kernel source package since this is used to provide the DKMS packages

[USN-4405-1] GLib Networking vulnerability [03:15]

1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-13645
glib-networking - additional library for glib/gio to provide TLS (ie links against gnutls etc.)
Would fail to verify that the hostname of a server’s TLS certificate matches the expected hostname by the client - but only if the client failed to specify the hostname itself. If did not provide hostname, would expect it to fail validation completely. Balsa (GNOME mail client) did this, so could possibly be tricked into connecting to a different mail server as a result.

[USN-4406-1] Mailman vulnerability [04:48]

1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS)
- CVE-2020-15011
Failed to validate inputs to the private archive login page - would then echo these back inside the generated page and so provides arbitrary content injection from a crafted URL.

Goings on in Ubuntu Security Community

Joe talks cyber security policy with Dr David Reed, Scholar in Residence @ UC Boulder [05:51]

https://www.colorado.edu/program/tcp/people/david-reed
Stock price study:
- https://www.comparitech.com/blog/information-security/data-breach-share-price-analysis/
FCC 5G FAST Plan
https://docs.fcc.gov/public/attachments/DOC-354326A1.pdf

Ubuntu Security Notices relocated [27:00]

Thanks to the design and web teams at Canonical
Notices now live at https://ubuntu.com/security/notices/
Old notices from https://usn.ubuntu.com will get redirected

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 80 Jun 25, 2020

Show notes

Overview

This week, Sid Faber and Kyle Fazzari of the Ubuntu Robotics team interview Vijay Sarvepalli from CERT about the recent Ripple20 vulnerabilities announcement, plus we look at security updates for Bind, Mutt, curl and more.

This week in Ubuntu Security Updates

8 unique CVEs addressed

[USN-4397-2] NSS vulnerability [00:40]

1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM)
- CVE-2020-12399
Episode 79 - timing side-channel attack during DSA key generation

[USN-4399-1] Bind vulnerabilities [01:00]

2 CVEs addressed in Focal (20.04 LTS)
- CVE-2020-8619
- CVE-2020-8618
2 DoS issues (resulting from the ability to crash BIND) - an authoritative nameserver which provides entries containing asterisks could change entries and cause BIND to crash, also an attacker who can send crafted zone data to cause a zone transfer could trigger an assertion failure -> crash

[USN-4400-1] nfs-utils vulnerability [01:44]

1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2019-3689
/var/lib/nfs was writable by statd user - if this user were compromised could change then contents of this directory. This dir also contains files owned and managed by root (rmtab etc) - mountd uses rmtab and so since statd user can change this files contents, they could make mountd create or overwrite other files on the system as root -> and so escalate privileges. Fixed to just make the few specific subdirectories owned by statd.

[USN-4401-1] Mutt vulnerabilities [03:16]

2 CVEs addressed in Precise ESM (12.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-14154
- CVE-2020-14093
2 issues on handling of TLS connections for IMAP servers, could allow a middleperson attack since wouldn’t properly do authentication of the network connection, and would proceed to connect even if a user chooses to reject the connection due to an expired certificate. So only relevant if using mutt to connect to IMAP directly.

[USN-4402-1] curl vulnerabilities [04:06]

2 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-8177
- CVE-2020-8169
Could be tricked to overwrite local files as specified by a malicious server when using the CLI arguments -i in combination with -J - -J is used to specify that the local filename should come from a HTTP header specified by the server. Normally this refuses to overwrite any existing local file but when using in conjunction with -i this check was skipped.
Possible partial password leak since could be tricked into appending part of the password to the hostname before this is resolved via DNS during a redirect - but only if the password contains an @ character….

Goings on in Ubuntu Security Community

Sid Faber and Kyle Fazzari interview Vijay Sarvepalli from CERT about Ripple20 [05:44]

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 79 Jun 19, 2020

Show notes

Overview

This week Joe discusses Intel’s CET announcement with John Johansen, plus Alex details recent security fixes including SQLite, fwupd, NSS, DBus and more.

This week in Ubuntu Security Updates

24 unique CVEs addressed

[USN-4394-1] SQLite vulnerabilities [00:56]

9 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
NULL ptr deref via crafted query, UAF, OOB read, integer overflow when printing high precision floating point numbers, various minor issues when handling crafted databases

[USN-4385-2] Intel Microcode regression [01:43]

3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
Episode 78 - SRBDS etc - microcode is specific to processors, and is identified by the triplet of CPU Family, Model and Stepping - this is listed in /proc/cpuinfo - mine say is 6, 142, 10 - in hex - 06-8E-0A - would cause a specific Skylake processor type to fail to boot (06-4e-03) - we reverted this back to the previous release version from November 2019

[USN-4395-1] fwupd vulnerability [03:39]

1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-10759
A crafted firmware update file could bypass signature verification - in general not an issue since would need to be able to get in the middle of firmware updates (which come from LVFS via HTTPS) - so either would need to compromise LVFS directly or the HTTPS connection to it.
- Dangling S3 bucket… :/
https://github.com/justinsteven/advisories/blob/master/2020_fwupd_dangling_s3_bucket_and_CVE-2020-10759_signature_verification_bypass.md

[USN-4315-2] Apport vulnerabilities [06:11]

2 CVEs addressed in Trusty ESM (14.04 ESM)
- CVE-2020-8833
- CVE-2020-8831
Episode 70

[USN-4396-1] libexif vulnerabilities [06:24]

6 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
UAF due to uninitialised memory, various buffer over-reads, integer overflow, etc

[USN-4397-1] NSS vulnerabilities [07:24]

2 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-12399
- CVE-2019-17023
Possible timing side-channel attack during DSA key generation - due to the difference in time of various operations (dependent on the contents of the private key) - the key value could be inferred by an attacker

[USN-4398-1, USN-4398-2] DBus vulnerability [08:01]

1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-12049
DBus can be used to send file-descriptors - client sends to server via the dbus daemon - daemon will validate that messages only contain a certain number of file-descriptors - if too may, will reject BUT fail to close those file-descriptors - eventually would accumulate too many open files itself and so the daemon would not be able to accept new connections -> DoS from a local unprivileged user

Goings on in Ubuntu Security Community

Joe discusses Intel CET with John Johansen (aka JJ) [09:28]

Return Oriented Programming (ROP) https://en.wikipedia.org/wiki/Return-oriented_programming
Sigreturn Oriented Programming (SROP) (https://en.wikipedia.org/wiki/Sigreturn-oriented_programming
Jump/Call Oriented Programming (JOP) https://www.csc2.ncsu.edu/faculty/xjiang4/pubs/ASIACCS11.pdf
Control-flow Enforcement technology (CET)
- https://www.linuxplumbersconf.org/event/2/contributions/147/attachments/72/83/CET-LPC-2018.pdf
- https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-enforcement-technology-preview.pdf
CFI in software
- https://www.cse.usf.edu/~ligatti/papers/cficcs.pdf

CET on Linux

LLVM/Clang
- not just CET, clang has it own CFI not dependent on CET but will support CET
- https://clang.llvm.org/docs/ControlFlowIntegrity.html
- https://clang.llvm.org/docs/ShadowCallStack.html
CET on windows
- https://windows-internals.com/cet-on-windows/
Pre CET software based CFI on windows
- https://docs.microsoft.com/en-us/windows/win32/secbp/control-flow-guard
Papers/talks on attacking CET/CFI
- https://i.blackhat.com/asia-19/Thu-March-28/bh-asia-Sun-How-to-Survive-the-Hardware-Assisted-Control-Flow-Integrity-Enforcement.pdf
- https://windows-internals.com/cet-on-windows/
Smashing the stack for fun and profit
- https://www.eecs.umich.edu/courses/eecs588/static/stack_smashing.pdf
StackClash
- https://blog.qualys.com/securitylabs/2017/06/19/the-stack-clash

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 78 Jun 12, 2020

Show notes

Overview

SRBDS aka CrossTalk, the latest Intel speculative execution attack, is the big news this week in security updates for Ubuntu, as well as fixes for GnuTLS, Firefox and more, plus Alex and Joe talk about using STRIDE for threat modelling of software products.

This week in Ubuntu Security Updates

39 unique CVEs addressed

[USN-4381-2] Django vulnerabilities [01:00]

2 CVEs addressed in Trusty ESM (14.04 ESM)
- CVE-2020-13596
- CVE-2020-13254
Episode 77

[USN-4382-1] FreeRDP vulnerabilities [01:28]

14 CVEs addressed in Xenial (16.04 LTS)
Episode 77 covered a similar update for FreeRDP2 in 18.04 LTS, 19.10, 20.04 LTS
This is the corresponding update for FreeRDP 1 in 16.04 LTS

[USN-4383-1] Firefox vulnerabilities [02:09]

8 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
77.0.1

[USN-4384-1] GnuTLS vulnerability [02:54]

1 CVEs addressed in Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-13777
Rare Friday update - high priority GnuTLS vulnerability - would use an all-zero key for encrypting TLS session ticket
TLS1.3 -> enables a middleperson attack against resumed sessions
TLS1.2 -> enables passive decryption of traffic to/from servers when the client supports session tickets

[USN-4386-1] libjpeg-turbo vulnerability [04:19]

1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-13790
- Heap buffer over-read via crafted PPM file -> info disclosure / crash

[USN-4385-1] Intel Microcode vulnerabilities [04:49]

3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
Latest Intel microarchitectural cache side-channel vulnerabilities - L1D cache, vector registers, special registers
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SRBDS
Special register buffer data sampling (SRBDS) -> RDRAND, RDSEED etc -> aka CrossTalk -> micro-arch buffer is shared across cores so old values could be read by other processors
microcode clears buffers -> performance decrease for RDRAND etc as a result -> kernel update contains support for a kernel command-line arg to disable this mitigation

[USN-4387-1] Linux kernel vulnerabilities [07:25]

5 CVEs addressed in Bionic (18.04 LTS), Eoan (19.10)
5.3
Kernel command-line option to disable SRBDS mitigation
F2FS bounds check fail on xattrs -> OOB read -> info leak
USB scatter-gather UAF -> malicious USB device -> crash / RCE
XDP socket fail to validate userspace metadata -> OOB write -> requires CAP_NET_ADMIN

[USN-4388-1] Linux kernel vulnerabilities [08:40]

6 CVEs addressed in Bionic (18.04 LTS)
5.0 gke & oem

[USN-4389-1] Linux kernel vulnerabilities [08:54]

6 CVEs addressed in Focal (20.04 LTS)
5.4

[USN-4390-1] Linux kernel vulnerabilities [09:02]

6 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS)
4.15 (14.04 ESM azure, 16.04 LTS - hwe, 18.04 LTS all)
As above + IPsec fail to encrypt IPv6 in some conditions -> info leak

[USN-4391-1] Linux kernel vulnerabilities [09:35]

8 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS)
4.4

[USN-4392-1] Linux kernel vulnerabilities [09:46]

3 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM)
3.13

[USN-4393-1] Linux kernel vulnerabilities [09:46]

2 CVEs addressed in Precise ESM (12.04 ESM)
- CVE-2020-0543
- CVE-2020-12654
3.2

Goings on in Ubuntu Security Community

Joe and Alex discuss Threat Modelling via STRIDE [10:12]

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 77 Jun 07, 2020

Show notes

Overview

This week we look at security updates for Unbound, OpenSSL, Flask, FreeRDP, Django and more, plus Joe and Alex discuss the Octopus malware infecting Netbeans projects.

This week in Ubuntu Security Updates

40 unique CVEs addressed

[USN-4374-1] Unbound vulnerabilities

2 CVEs addressed in Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-12663
- CVE-2020-12662
NXNS attack (Episode 75) (form of DNS reflection attack)
Infinite loop when processing malformed answers from upstream servers -> CPU DoS

[USN-4375-1] PHP vulnerability

1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2019-11048
DoS via upload of files with very long names -> memory allocation failure, stop process, fail to cleanup temp file on disk -> disk space DoS

[USN-4376-1] OpenSSL vulnerabilities

4 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10)
Timing side-channel attack against ECDSA signatures -> recover private keys
RNG state shared between parent and child process across fork()
Vulnerable to padding oracle attack -> decrypt traffic

[USN-4360-4] json-c vulnerability

1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-12762
Episode 75 -> update, regression, update without fix -> now properly fixed vuln without regression

[USN-4359-2] APT vulnerability

1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM)
- CVE-2020-3810
Episode 75 (ar archive handling)

[USN-4367-2] Linux kernel regression

3 CVEs addressed in Focal (20.04 LTS)
5.4 kernel (Episode 75)
overlayfs regression - caused by adding some changes for shiftfs to special-case overlayfs - BUT in-fact was already present in overlayfs and this just manifested it - so for now revert the shiftfs related changes until is fixed properly in overlayfs itself

[USN-4369-2] Linux kernel regression

8 CVEs addressed in Bionic (18.04 LTS), Eoan (19.10)
5.3 kernel (Episode 75)
overlayfs regression above

[USN-4377-1, USN-4377-2] ca-certificates update

Affecting Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
“AddTrust Exteral Root CA” certificate had expired - curl and other applications would fail to connect if they found a certificate chain which validated via this cert (even if other paths in the chain would be valid) - removing this cert is the easiest way to fix the issue.
Updated the certs for 16.04 & 18.04 LTS as well

[USN-4378-1] Flask vulnerability

1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS)
- CVE-2018-1000656
DoS via memory exhaustion on crafted inputs

[USN-4379-1] FreeRDP vulnerabilities

19 CVEs addressed in Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
Various issues including, OOB write for RSA crypto handling, OOB read on font handling, info disclosure via ability to read client memory as color info, etc.

[USN-4380-1] Apache Ant vulnerability

1 CVEs addressed in Eoan (19.10)
- CVE-2020-1945
Info leak to / malicious code exec from a local user due to the use of system-wide /tmp for several tasks (Mike Salvatore)

[USN-4381-1] Django vulnerabilities

2 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-13596
- CVE-2020-13254
XSS via the admin ForeignKeyRawIdWidget due to failure to properly encoded query parameters
Failure to properly validate memcached cache keys - could allow a remote attacker to DoS / info leak

Goings on in Ubuntu Security Community

Alex and Joe discuss Github report on Octopus malware targetting Netbeans projects

https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 76 May 28, 2020

Show notes

Overview

This week we welcome back Vineetha Kamath, Ubuntu Security Certifications Manager, to discuss the recent release of FIPS modules for Ubuntu 18.04 LTS and we look at security updates for Bind, ClamAV, QEMU, the Linux kernel and more.

This week in Ubuntu Security Updates

24 unique CVEs addressed

[USN-4365-2] Bind vulnerabilities [00:37]

2 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM)
- CVE-2020-8617
- CVE-2020-8616
Episode 75 - https://nxnsattack.com

[USN-4369-1] Linux kernel vulnerabilities [01:11]

8 CVEs addressed in Bionic (18.04 LTS), Eoan (19.10)
5.3 (19.10, 18.04 LTS HWE)
Episode 75 for details

[USN-4370-1, USN-4370-2] ClamAV vulnerabilities [01:35]

2 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-3341
- CVE-2020-3327
Stack and heap buffer over-reads in the PDF and ARJ (Archived by Rober Jung) file parsers -> crash -> DoS

[USN-4371-1] libvirt vulnerabilities [02:36]

2 CVEs addressed in Bionic (18.04 LTS), Eoan (19.10)
- CVE-2020-12430
- CVE-2020-10703
Memory leak able to be triggered by local users with read-only qemu access when retrieving domain stats -> DoS

[USN-4372-1] QEMU vulnerabilities [03:08]

5 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
UAF in libslirp
Integer overflow in handling of ATI VGA emulation -> guest to host crash

[USN-4373-1] Thunderbird vulnerabilities [03:44]

5 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
68.8.0

Goings on in Ubuntu Security Community

Joe McManus and Vineetha Kamath discuss FIPS certification for Ubuntu 18.04 LTS [04:10]

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 75 May 22, 2020

Show notes

Overview

In episode 75 we look at security updates for APT, json-c, Bind, the Linux kernel and more, plus Joe and Alex discuss recent phishing attacks and the Wired biopic of Marcus Hutchins.

This week in Ubuntu Security Updates

26 unique CVEs addressed

[USN-4358-1] libexif vulnerabilities [00:44]

2 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-12767
- CVE-2018-20030
Divide by zero and a CPU infinite loop (DoS) for handling crafted exif content

[USN-4359-1] APT vulnerability [01:19]

1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-3810
Own ar archive handling code
Stack buffer OOB read for ar archive members with specially crafted names - tried to handle spaces etc in names but if the name was all spaces would overrun the name and read past the end of it

[USN-4360-1] json-c vulnerability [02:04]

1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-12762
Integer overflow -> OOB write from a large json file

[USN-4360-2, USN-4360-3] json-c regression [02:27]

Affecting Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
Upstream fix had a bug where logic for trying to handle integer overflow was inverted and so would cause INT_MAX (2GB) memory to be allocated
On machines with a small amount of memory this could exhaust all and trigger OOM killer
Part of logic of the package is to trigger a rexec of upstart (which serialises itself via libjson) - so this could cause upstart to consume all memory, get killed to OOM killer and cause fail to boot etc
upstart not used as default init on xenial+ and initial update was delayed for ESM so only a small number of users would be affected (those running 16.04 LTS/xenial who had manually configured upstart as init)

[USN-4361-1] Dovecot vulnerabilities [04:13]

3 CVEs addressed in Eoan (19.10), Focal (20.04 LTS)
3 issues discovered by Philippe Antoine
- UAF sending command is followed by a sufficient number of newlines -> crash
- Sending with empty quoted localpart or malformed NOOP commands -> crash

[USN-4362-1] DPDK vulnerabilities [04:47]

5 CVEs addressed in Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
Data-plane development kit (provides TCP offloading to userspace to accelerate package processing workloads)
Used by openvswitch for OpenStack software defined networking
Memory leak and file-descriptor leak -> DoS
Guest to host crash via a missing check on an address in an io descriptor
Failure to validate key lengths
Integer overflow on host from guest -> crash

[USN-4367-1] Linux kernel vulnerabilities [05:51]

3 CVEs addressed in Focal (20.04 LTS)
5.4 kernel
UAF due to a race-condition in bfq block io scheduler in block subsystem
Bug in parsing of mount options for tmpfs -> stack overflow (need root privileges etc to specify mount options)
UAF in btrfs when handling a specially crafted file-system image

[USN-4363-1] Linux kernel vulnerabilities [06:42]

4 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS)
4.15 kernel
block io scheduler UAF
PowerPC specific guest -> host VM crash on save / restore of authority mask registers
tmpfs mount option parsing
Serial CAN driver did not initialise stack data so could leak stack memory to userspace etc

[USN-4364-1] Linux kernel vulnerabilities [07:30]

7 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS)
4.4 kernel
USB camera drivers fail to validate device metadata -> NULL ptr deref etc (crash)
tmpfs & serial CAN above

[USN-4368-1] Linux kernel vulnerabilities [07:59]

8 CVEs addressed in Bionic (18.04 LTS)
5.0 gke/eom (based off Ubuntu 19.04 disco kernel)
block io scheduler UAF
ppc specific guest -> host VM crash on save / restore of authority mask registers
USB camera drivers fail to validate device metadata
tmpfs & serial CAN above

[USN-4365-1] Bind vulnerabilities [08:31]

2 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-8617
- CVE-2020-8616
DNS refelection attack via recursive resolution - http://www.nxnsattack.com/

[USN-4366-1] Exim vulnerability [09:14]

1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-12783
OOB read in Secure Password Authentication (SPA, also known as NTLM) authenticator, could result in SPA/NTLM auth bypass

Goings on in Ubuntu Security Community

Alex and Joe discuss recent trends in phishing attacks and Marcus Hutchins (aka MalwareTech) [09:43]

https://www.wired.com/story/confessions-marcus-hutchins-hacker-who-saved-the-internet/

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 74 May 15, 2020

Show notes

Overview

Special guest, Tim McNamara, author of Rust In Action talks all things Rust plus we look at security updates for Linux bluetooth firmware, OpenLDAP, PulseAudio, Squid and more.

This week in Ubuntu Security Updates

17 unique CVEs addressed

[USN-4351-1] Linux firmware vulnerability [01:03]

1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS)
- CVE-2018-5383
Bluetooth devices failed to properly validate elliptic curve parameters used in key exchange - remote attacker could possibly force a weak key to be used and hence obtain the encryption key. Required changes to both the kernel and firmware blobs - kernel was updated previously (Episode 43) - this is the corresponding update for firmware

[USN-4352-1, USN-4352-2] OpenLDAP vulnerability [02:05]

1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-12243
A search filter with a large number of nested boolean expressions could cause slapd daemon to crash via deep stack recursion - add a hard coded limit to resolve this

[USN-4353-1] Firefox vulnerabilities [02:46]

8 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
76.0
Displays alerts for breached passwords stored in Lockwise
Usual UAF, sandbox escape, buffer overflows, content security policy bypass etc
https://www.mozilla.org/en-US/firefox/76.0/releasenotes/

[USN-4353-2] Firefox regression [03:34]

8 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
76.0.1
Regression in behaviour related to addons - could impair their functionality
https://www.mozilla.org/en-US/firefox/76.0.1/releasenotes/

[USN-4354-1] Mailman vulnerability [03:51]

1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS)
- CVE-2020-12108
- Arbitrary content injection via options login page - if the submitted
email address looking invalid it would be echo’d back to the user - and so anything supplied as the email address would be displayed

[USN-4355-1] PulseAudio vulnerability [04:23]

1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
- CVE-2020-11931
Snap policy module for pulseaudio - only exists in Ubuntu - is designed to allow snapd to mediate access to pulseaudio for snaps - so if plug pulseaudio (or audio-playback / record) interface(s) can talk to pulseaudio but then should only be able to do certain actions - however the policy did not restrict unloading the policy module itself so any snap with access could unload the policy and then have unrestricted access to pulseaudio - so could say record audio when only audio-playback interface was connected.

[USN-4357-1] IPRoute vulnerability [05:39]

1 CVEs addressed in Bionic (18.04 LTS)
- CVE-2019-20795
UAF when listing network namespaces (ip netns list)

[USN-4356-1] Squid vulnerabilities [05:59]

4 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
Possible cache poisoning, crash or RE from malicious remote servers via Edge Side Includes
Failure to properly validate hostname in cachemanager for certain browsers -> HTML injection
Nonce reply due to failure to properly validate Digest Authentication nonce values

[USN-3911-2] file regression [06:40]

Affecting Xenial (16.04 LTS), Bionic (18.04 LTS)
Episode 25 - USN-3911-1 - update for file caused a regression where the name of the interpreter parsed by file would be truncated and so the output would be incorrect - used sizeof(var) - but var is a char * and so sizeof() is size of a pointer - should instead be the length of the string - updated to use strlen(var) +1

Goings on in Ubuntu Security Community

Alex talks Rust with Tim McNamara [08:14]

https://tim.mcnamara.nz/
https://www.manning.com/books/rust-in-action
Offer for listeners:
- 40% off all Manning Products in all forms using the code: podubuntu20
5 copies of Rust in Action e-book to giveaway
- Send us your favourite security tools written in Rust or your thoughts on Rust in Ubuntu to win a copy

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Our TOPPODCAST Picks

Follow Us

Stay Connected

Overview

This week in Ubuntu Security Updates

[USN-4199-2] libvpx vulnerabilities [01:05]

[USN-4424-1] snapd vulnerabilities [01:38]

[USN-4425-1] Linux kernel vulnerabilities [06:20]

[USN-4426-1] Linux kernel vulnerabilities [7:32]

[USN-4427-1] Linux kernel vulnerabilities [08:30]

[USN-4429-1] Evolution Data Server vulnerability [09:12]

[USN-4430-1] Pillow vulnerabilities [10:24]

Goings on in Ubuntu Security Community

John Johansen and Steve Beattie talk Linux Security Modules with Joe [10:51]

Get in contact

Overview

This week in Ubuntu Security Updates

[USN-4403-1] Mutt vulnerability and regression [00:40]

[USN-4404-1, USN-4404-2] NVIDIA graphics drivers & Linux kernel vulnerabilities [01:59]

[USN-4405-1] GLib Networking vulnerability [03:15]

[USN-4406-1] Mailman vulnerability [04:48]

Goings on in Ubuntu Security Community

Joe talks cyber security policy with Dr David Reed, Scholar in Residence @ UC Boulder [05:51]

Ubuntu Security Notices relocated [27:00]

Get in contact

Overview

This week in Ubuntu Security Updates

[USN-4397-2] NSS vulnerability [00:40]

[USN-4399-1] Bind vulnerabilities [01:00]

[USN-4400-1] nfs-utils vulnerability [01:44]

[USN-4401-1] Mutt vulnerabilities [03:16]

[USN-4402-1] curl vulnerabilities [04:06]

Goings on in Ubuntu Security Community

Sid Faber and Kyle Fazzari interview Vijay Sarvepalli from CERT about Ripple20 [05:44]

Get in contact

Overview

This week in Ubuntu Security Updates

[USN-4394-1] SQLite vulnerabilities [00:56]

[USN-4385-2] Intel Microcode regression [01:43]

[USN-4395-1] fwupd vulnerability [03:39]

[USN-4315-2] Apport vulnerabilities [06:11]

[USN-4396-1] libexif vulnerabilities [06:24]

[USN-4397-1] NSS vulnerabilities [07:24]

[USN-4398-1, USN-4398-2] DBus vulnerability [08:01]

Goings on in Ubuntu Security Community

Joe discusses Intel CET with John Johansen (aka JJ) [09:28]

Get in contact

Overview

This week in Ubuntu Security Updates

[USN-4381-2] Django vulnerabilities [01:00]

[USN-4382-1] FreeRDP vulnerabilities [01:28]

[USN-4383-1] Firefox vulnerabilities [02:09]

[USN-4384-1] GnuTLS vulnerability [02:54]

[USN-4386-1] libjpeg-turbo vulnerability [04:19]

[USN-4385-1] Intel Microcode vulnerabilities [04:49]

[USN-4387-1] Linux kernel vulnerabilities [07:25]

[USN-4388-1] Linux kernel vulnerabilities [08:40]

[USN-4389-1] Linux kernel vulnerabilities [08:54]

[USN-4390-1] Linux kernel vulnerabilities [09:02]

[USN-4391-1] Linux kernel vulnerabilities [09:35]

[USN-4392-1] Linux kernel vulnerabilities [09:46]

[USN-4393-1] Linux kernel vulnerabilities [09:46]

Goings on in Ubuntu Security Community

Joe and Alex discuss Threat Modelling via STRIDE [10:12]

Get in contact

Overview

This week in Ubuntu Security Updates

[USN-4374-1] Unbound vulnerabilities

[USN-4375-1] PHP vulnerability

[USN-4376-1] OpenSSL vulnerabilities

[USN-4360-4] json-c vulnerability

[USN-4359-2] APT vulnerability

[USN-4367-2] Linux kernel regression

[USN-4369-2] Linux kernel regression

[USN-4377-1, USN-4377-2] ca-certificates update

[USN-4378-1] Flask vulnerability

[USN-4379-1] FreeRDP vulnerabilities

[USN-4380-1] Apache Ant vulnerability

[USN-4381-1] Django vulnerabilities