Skip to content

ubuntu bionic v1.15
Compare
Choose a tag to compare
@bosh-ci-push-pull bosh-ci-push-pull released this 20 Jul 08:48
· 103 commits to master since this release
ubuntu-bionic/v1.15
1f8f41d

Metadata:

BOSH Agent Version: 2.346.0

Updates:

  • bumped azure agent #170
  • record sudo activity #167
  • update rsyslog #169
  • added bionic packages when removing remove_dev_tools #182 #171

USNs:

Title: USN-5006-1: PHP vulnerabilities
URL: https://ubuntu.com/security/notices/USN-5006-1
Priorities: low,medium
Description:
It was discovered that PHP incorrectly handled certain PHAR files. A remote
attacker could possibly use this issue to cause PHP to crash, resulting in
a denial of service, or possibly obtain sensitive information. This issue
only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-7068)

It was discovered that PHP incorrectly handled parsing URLs with passwords.
A remote attacker could possibly use this issue to cause PHP to mis-parse
the URL and produce wrong data. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2020-7071)

It was discovered that PHP incorrectly handled certain malformed XML data
when being parsed by the SOAP extension. A remote attacker could possibly
use this issue to cause PHP to crash, resulting in a denial of service.
This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu
20.10. (CVE-2021-21702)

It was discovered that PHP incorrectly handled the pdo_firebase module. A
remote attacker could possibly use this issue to cause PHP to crash,
resulting in a denial of service. (CVE-2021-21704)

It was discovered that PHP incorrectly handled the FILTER_VALIDATE_URL
check. A remote attacker could possibly use this issue to perform a server-
side request forgery attack. (CVE-2021-21705)
CVEs:

Title: USN-5004-1: RabbitMQ vulnerabilities
URL: https://ubuntu.com/security/notices/USN-5004-1
Priorities: medium,low
Description:
It was discovered that RabbitMQ incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2019-11287)

Jonathan Knudsen discovered RabbitMQ incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2021-22116)
CVEs:

Title: USN-4995-2: Thunderbird vulnerabilities
URL: https://ubuntu.com/security/notices/USN-4995-2
Priorities: low,medium
Description:
USN-4995-1 fixed vulnerabilities in Thunderbird. This update provides
the corresponding updates for Ubuntu 18.04 LTS.

Original advisory details:

Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, spoof the UI, bypass security restrictions,
or execute arbitrary code. (CVE-2021-23961, CVE-2021-23981,
CVE-2021-23982, CVE-2021-23987, CVE-2021-23994, CVE-2021-23998,
CVE-2021-23999, CVE-2021-29945, CVE-2021-29946, CVE-2021-29967)

It was discovered that extensions could open popup windows with control
of the window title in some circumstances. If a user were tricked into
installing a specially crafted extension, an attacker could potentially
exploit this to spoof a website and trick the user into providing
credentials. (CVE-2021-23984)

Multiple security issues were discovered in Thunderbird's OpenPGP
integration. If a user were tricked into importing a specially crafted
key in some circumstances, an attacker could potentially exploit this
to cause a denial of service (inability to send encrypted email) or
confuse the user. (CVE-2021-23991, CVE-2021-23992, CVE-2021-23993)

A use-after-free was discovered when Responsive Design Mode was
enabled. If a user were tricked into opening a specially crafted
website with Responsive Design Mode enabled, an attacker could
potentially exploit this to cause a denial of service, or execute
arbitrary code. (CVE-2021-23995)

It was discovered that Thunderbird mishandled ftp URLs with encoded
newline characters. If a user were tricked into clicking on a specially
crafted link, an attacker could potentially exploit this to send arbitrary
FTP commands. (CVE-2021-24002)

It was discovered that Thunderbird wrote signatures to disk and read them
back during verification. A local attacker could potentially exploit this
to replace the data with another signature file. (CVE-2021-29948)

It was discovered that Thunderbird might load an alternative OTR
library. If a user were tricked into copying a specially crafted
library to one of Thunderbird's search paths, an attacker could
potentially exploit this to execute arbitrary code. (CVE-2021-29949)

It was discovered that secret keys imported into Thunderbird were
stored unencrypted. A local attacker could potentially exploit this to
obtain private keys. (CVE-2021-29956)

It was discovered that Thunderbird did not indicate when an inline signed
or encrypted message contained additional unprotected parts.
(CVE-2021-29957)
CVEs:

USNs:

Title: USN-5006-1: PHP vulnerabilities
URL: https://ubuntu.com/security/notices/USN-5006-1
Priorities: low,medium
Description:
It was discovered that PHP incorrectly handled certain PHAR files. A remote
attacker could possibly use this issue to cause PHP to crash, resulting in
a denial of service, or possibly obtain sensitive information. This issue
only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-7068)

It was discovered that PHP incorrectly handled parsing URLs with passwords.
A remote attacker could possibly use this issue to cause PHP to mis-parse
the URL and produce wrong data. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2020-7071)

It was discovered that PHP incorrectly handled certain malformed XML data
when being parsed by the SOAP extension. A remote attacker could possibly
use this issue to cause PHP to crash, resulting in a denial of service.
This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu
20.10. (CVE-2021-21702)

It was discovered that PHP incorrectly handled the pdo_firebase module. A
remote attacker could possibly use this issue to cause PHP to crash,
resulting in a denial of service. (CVE-2021-21704)

It was discovered that PHP incorrectly handled the FILTER_VALIDATE_URL
check. A remote attacker could possibly use this issue to perform a server-
side request forgery attack. (CVE-2021-21705)
CVEs:

Title: USN-5004-1: RabbitMQ vulnerabilities
URL: https://ubuntu.com/security/notices/USN-5004-1
Priorities: medium,low
Description:
It was discovered that RabbitMQ incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a denial of service. This
issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2019-11287)

Jonathan Knudsen discovered RabbitMQ incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2021-22116)
CVEs:

Title: USN-4995-2: Thunderbird vulnerabilities
URL: https://ubuntu.com/security/notices/USN-4995-2
Priorities: low,medium
Description:
USN-4995-1 fixed vulnerabilities in Thunderbird. This update provides
the corresponding updates for Ubuntu 18.04 LTS.

Original advisory details:

Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, spoof the UI, bypass security restrictions,
or execute arbitrary code. (CVE-2021-23961, CVE-2021-23981,
CVE-2021-23982, CVE-2021-23987, CVE-2021-23994, CVE-2021-23998,
CVE-2021-23999, CVE-2021-29945, CVE-2021-29946, CVE-2021-29967)

It was discovered that extensions could open popup windows with control
of the window title in some circumstances. If a user were tricked into
installing a specially crafted extension, an attacker could potentially
exploit this to spoof a website and trick the user into providing
credentials. (CVE-2021-23984)

Multiple security issues were discovered in Thunderbird's OpenPGP
integration. If a user were tricked into importing a specially crafted
key in some circumstances, an attacker could potentially exploit this
to cause a denial of service (inability to send encrypted email) or
confuse the user. (CVE-2021-23991, CVE-2021-23992, CVE-2021-23993)

A use-after-free was discovered when Responsive Design Mode was
enabled. If a user were tricked into opening a specially crafted
website with Responsive Design Mode enabled, an attacker could
potentially exploit this to cause a denial of service, or execute
arbitrary code. (CVE-2021-23995)

It was discovered that Thunderbird mishandled ftp URLs with encoded
newline characters. If a user were tricked into clicking on a specially
crafted link, an attacker could potentially exploit this to send arbitrary
FTP commands. (CVE-2021-24002)

It was discovered that Thunderbird wrote signatures to disk and read them
back during verification. A local attacker could potentially exploit this
to replace the data with another signature file. (CVE-2021-29948)

It was discovered that Thunderbird might load an alternative OTR
library. If a user were tricked into copying a specially crafted
library to one of Thunderbird's search paths, an attacker could
potentially exploit this to execute arbitrary code. (CVE-2021-29949)

It was discovered that secret keys imported into Thunderbird were
stored unencrypted. A local attacker could potentially exploit this to
obtain private keys. (CVE-2021-29956)

It was discovered that Thunderbird did not indicate when an inline signed
or encrypted message contained additional unprotected parts.
(CVE-2021-29957)
CVEs:

Title: USN-5008-1: Avahi vulnerabilities
URL: https://ubuntu.com/security/notices/USN-5008-1
Priorities: medium
Description:
Thomas Kremer discovered that Avahi incorrectly handled termination signals
on the Unix socket. A local attacker could possibly use this issue to cause
Avahi to hang, resulting in a denial of service. This issue only affected
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-3468)

It was discovered that Avahi incorrectly handled certain hostnames. A local
attacker could possibly use this issue to cause Avahi to crash, resulting
in a denial of service. This issue only affected Ubuntu 20.10 and Ubuntu
21.04. (CVE-2021-3502)
CVEs:

Title: LSN-0078-1: Kernel Live Patch Security Notice
URL: https://ubuntu.com/security/notices/LSN-0078-1
Priorities: high
Description:
Norbert Slusarek discovered a race condition in the CAN BCM networking
protocol of the Linux kernel leading to multiple use-after-free
vulnerabilities. A local attacker could use this issue to execute arbitrary
code.(CVE-2021-3609)
CVEs:

Title: USN-5005-1: DjVuLibre vulnerability
URL: https://ubuntu.com/security/notices/USN-5005-1
Priorities: medium
Description:
It was discovered that DjVuLibre incorrectly handled certain djvu files.
An attacker could possibly use this issue to execute arbitrary code or
cause a crash.
CVEs:

Title: USN-5008-1: Avahi vulnerabilities
URL: https://ubuntu.com/security/notices/USN-5008-1
Priorities: medium
Description:
Thomas Kremer discovered that Avahi incorrectly handled termination signals
on the Unix socket. A local attacker could possibly use this issue to cause
Avahi to hang, resulting in a denial of service. This issue only affected
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2021-3468)

It was discovered that Avahi incorrectly handled certain hostnames. A local
attacker could possibly use this issue to cause Avahi to crash, resulting
in a denial of service. This issue only affected Ubuntu 20.10 and Ubuntu
21.04. (CVE-2021-3502)
CVEs:

Title: LSN-0078-1: Kernel Live Patch Security Notice
URL: https://ubuntu.com/security/notices/LSN-0078-1
Priorities: high
Description:
Norbert Slusarek discovered a race condition in the CAN BCM networking
protocol of the Linux kernel leading to multiple use-after-free
vulnerabilities. A local attacker could use this issue to execute arbitrary
code.(CVE-2021-3609)
CVEs:

Title: USN-5005-1: DjVuLibre vulnerability
URL: https://ubuntu.com/security/notices/USN-5005-1
Priorities: medium
Description:
It was discovered that DjVuLibre incorrectly handled certain djvu files.
An attacker could possibly use this issue to execute arbitrary code or
cause a crash.
CVEs:

Assets 2
Loading