[월:] 2019년 05월

USN-3967-1: FFmpeg vulnerabilities FFmpeg vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 19.04 Ubuntu 18.10 Ubuntu 18.04 LTS Summary FFmpeg could be made to crash if it opened a specially crafted file. Software Description ffmpeg – Tools for transcoding, streaming and playing of multimedia files Details It was discovered that FFmpeg contained multiple security issues when handling certain multimedia files. If a user were tricked into opening a crafted multimedia file, an attacker could cause a denial of service via application crash. Update instructions The problem can be corrected by updating your system to the following package versions: Ubuntu 19.04 ffmpeg – 7:4.1.3-0ubuntu1 libavcodec-extra58 – 7:4.1.3-0ubuntu1 libavcodec58 – 7:4.1.3-0ubuntu1 libavdevice58 – 7:4.1.3-0ubuntu1 libavfilter-extra7 – 7:4.1.3-0ubuntu1 libavfilter7 – 7:4.1.3-0ubuntu1 libavformat58 – 7:4.1.3-0ubuntu1 libavresample4 – 7:4.1.3-0ubuntu1 libavutil56 – 7:4.1.3-0ubuntu1 libpostproc55 – 7:4.1.3-0ubuntu1 libswresample3 – 7:4.1.3-0ubuntu1 libswscale5 – [ more… ]

USN-3968-1: Sudo vulnerabilities sudo vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.04 LTS Summary Several security issues were fixed in Sudo. Software Description sudo – Provide limited super user privileges to specific users Details Florian Weimer discovered that Sudo incorrectly handled the noexec restriction when used with certain applications. A local attacker could possibly use this issue to bypass configured restrictions and execute arbitrary commands. (CVE-2016-7076) It was discovered that Sudo did not properly parse the contents of /proc/[pid]/stat when attempting to determine its controlling tty. A local attacker in some configurations could possibly use this to overwrite any file on the filesystem, bypassing intended permissions. (CVE-2017-1000368) Update instructions The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS sudo – 1.8.16-0ubuntu1.6 sudo-ldap – 1.8.16-0ubuntu1.6 To update [ more… ]

USN-3965-1: aria2 vulnerability aria2 vulnerability A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 19.04 Ubuntu 18.10 Summary aria2 stores authentication information in plain text. Software Description aria2 – High speed command-line download utility Details Dhiraj Mishra discovered that aria2 incorrectly stored authentication information. A local attacker could possibly use this issue to obtain credentials. Update instructions The problem can be corrected by updating your system to the following package versions: Ubuntu 19.04 aria2 – 1.34.0-3ubuntu0.1 libaria2-0 – 1.34.0-3ubuntu0.1 Ubuntu 18.10 aria2 – 1.34.0-2ubuntu0.1 libaria2-0 – 1.34.0-2ubuntu0.1 To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. In general, a standard system update will make all the necessary changes. References CVE-2019-3500 Source: USN-3965-1: aria2 vulnerability