[월:] 2020년 03월

USN-4312-1: Timeshift vulnerability Timeshift vulnerability A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 19.10 Summary Timeshift could be made to run programs as an administrator. Software Description timeshift – System restore utility Details Matthias Gerstner discovered that Timeshift did not securely create temporary files. An attacker could exploit a race condition in Timeshift and potentially execute arbitrary commands as root. Update instructions The problem can be corrected by updating your system to the following package versions: Ubuntu 19.10 timeshift – 19.01+ds-2ubuntu0.1 To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. In general, a standard system update will make all the necessary changes. References CVE-2020-10174 Source: USN-4312-1: Timeshift vulnerability

USN-4310-1: WebKitGTK+ vulnerability webkit2gtk vulnerability A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 19.10 Ubuntu 18.04 LTS Summary Several security issues were fixed in WebKitGTK+. Software Description webkit2gtk – Web content engine library for GTK+ Details A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution. Update instructions The problem can be corrected by updating your system to the following package versions: Ubuntu 19.10 libjavascriptcoregtk-4.0-18 – 2.28.0-0ubuntu0.19.10.2 libwebkit2gtk-4.0-37 – 2.28.0-0ubuntu0.19.10.2 Ubuntu 18.04 LTS libjavascriptcoregtk-4.0-18 – 2.28.0-0ubuntu0.18.04.3 libwebkit2gtk-4.0-37 – 2.28.0-0ubuntu0.18.04.3 To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. This update uses a new upstream release, [ more… ]

USN-4308-2: Twisted vulnerabilities twisted vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.04 ESM Summary Several security issues were fixed in Twisted. Software Description twisted – Event-based framework for internet applications Details USN-4308-1 fixed several vulnerabilities in Twisted. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: it was discovered that Twisted incorrectly validated or sanitized certain URIs or HTTP methods. A remote attacker could use this issue to inject invalid characters and possibly perform header injection attacks. (CVE-2019-12387) It was discovered that Twisted incorrectly verified XMPP TLS certificates. A remote attacker could possibly use this issue to perform a man-in-the-middle attack and obtain sensitive information. (CVE-2019-12855) Jake Miller and ZeddYu Lu discovered that Twisted incorrectly handled certain content-length headers. A remote attacker could possibly use this issue to perform HTTP [ more… ]