[월:] 2019년 04월

USN-3922-2: PHP vulnerabilities php5 vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.04 LTS Summary Several security issues were fixed in PHP. Software Description php5 – HTML-embedded scripting language interpreter Details USN-3922-1 fixed vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 14.04 LTS. It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to access sensitive information. (CVE-2019-9022) It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2019-9675) Original advisory details: It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information. (CVE-2019-9637, CVE-2019-9638, CVE-2019-9639, CVE-2019-9640, CVE-2019-9641) Update instructions The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS [ more… ]

USN-3953-1: PHP vulnerabilities php7.0, php7.2 vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 19.04 Ubuntu 18.10 Ubuntu 18.04 LTS Ubuntu 16.04 LTS Summary Several security issues were fixed in PHP. Software Description php7.2 – HTML-embedded scripting language interpreter php7.0 – HTML-embedded scripting language interpreter Details It was discovered that PHP incorrectly handled certain exif tags in JPEG images. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. Update instructions The problem can be corrected by updating your system to the following package versions: Ubuntu 19.04 libapache2-mod-php7.2 – 7.2.17-0ubuntu0.19.04.1 php7.2-cgi – 7.2.17-0ubuntu0.19.04.1 php7.2-cli – 7.2.17-0ubuntu0.19.04.1 php7.2-fpm – 7.2.17-0ubuntu0.19.04.1 Ubuntu 18.10 libapache2-mod-php7.2 – 7.2.17-0ubuntu0.18.10.1 php7.2-cgi – 7.2.17-0ubuntu0.18.10.1 php7.2-cli – 7.2.17-0ubuntu0.18.10.1 php7.2-fpm – 7.2.17-0ubuntu0.18.10.1 Ubuntu 18.04 LTS libapache2-mod-php7.2 – 7.2.17-0ubuntu0.18.04.1 php7.2-cgi – 7.2.17-0ubuntu0.18.04.1 php7.2-cli [ more… ]

USN-3952-1: Pacemaker vulnerabilities pacemaker vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 19.04 Ubuntu 18.10 Ubuntu 18.04 LTS Ubuntu 16.04 LTS Summary Several security issues were fixed in Pacemaker. Software Description pacemaker – Cluster resource manager Details Jan Pokorný discovered that Pacemaker incorrectly handled client-server authentication. A local attacker could possibly use this issue to escalate privileges. (CVE-2018-16877) Jan Pokorný discovered that Pacemaker incorrectly handled certain verifications. A local attacker could possibly use this issue to cause a denial of service. (CVE-2018-16878) Jan Pokorný discovered that Pacemaker incorrectly handled certain memory operations. A local attacker could possibly use this issue to obtain sensitive information in log outputs. This issue only applied to Ubuntu 18.04 LTS, Ubuntu 18.10, and Ubuntu 19.04. (CVE-2019-3885) Update instructions The problem can be corrected by updating your system to the following [ more… ]

USN-3951-1: Dovecot vulnerability dovecot vulnerability A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 19.04 Ubuntu 18.10 Summary Dovecot could be made to crash if it received specially crafted network traffic. Software Description dovecot – IMAP and POP3 email server Details It was discovered that the Dovecot JSON encoder incorrectly handled certain invalid UTF-8 characters. A remote attacker could possibly use this issue to cause Dovecot to repeatedly crash, resulting in a denial of service. Update instructions The problem can be corrected by updating your system to the following package versions: Ubuntu 19.04 dovecot-core – 1:2.3.4.1-1ubuntu2.1 Ubuntu 18.10 dovecot-core – 1:2.3.2.1-1ubuntu3.3 To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. In general, a standard system update will make all the necessary changes. References CVE-2019-10691 Source: USN-3951-1: Dovecot vulnerability