[월:] 2020년 05월

USN-4376-1: OpenSSL vulnerabilities openssl vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 19.10 Ubuntu 18.04 LTS Ubuntu 16.04 LTS Summary Several security issues were fixed in OpenSSL. Software Description openssl – Secure Socket Layer (SSL) cryptographic library and tools Details Cesar Pereida García, Sohaib ul Hassan, Nicola Tuveri, Iaroslav Gridin, Alejandro Cabrera Aldaya, and Billy Brumley discovered that OpenSSL incorrectly handled ECDSA signatures. An attacker could possibly use this issue to perform a timing side-channel attack and recover private ECDSA keys. (CVE-2019-1547) Matt Caswell discovered that OpenSSL incorrectly handled the random number generator (RNG). This may result in applications that use the fork() system call sharing the same RNG state between the parent and the child, contrary to expectations. This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.10. (CVE-2019-1549) Guido Vranken discovered that OpenSSL [ more… ]

USN-4360-4: json-c vulnerability json-c vulnerability A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 20.04 LTS Ubuntu 19.10 Ubuntu 18.04 LTS Ubuntu 16.04 LTS Ubuntu 14.04 ESM Ubuntu 12.04 ESM Summary json-c could be made to execute arbitrary code if it received a specially crafted JSON file. Software Description json-c – JSON manipulation library Details USN-4360-1 fixed a vulnerability in json-c. The security fix introduced a memory leak that was reverted in USN-4360-2 and USN-4360-3. This update provides the correct fix update for CVE-2020-12762. Original advisory details: It was discovered that json-c incorrectly handled certain JSON files. An attacker could possibly use this issue to execute arbitrary code. Update instructions The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS libjson-c4 – 0.13.1+dfsg-7ubuntu0.3 Ubuntu 19.10 libjson-c4 – 0.13.1+dfsg-4ubuntu0.3 Ubuntu 18.04 [ more… ]

USN-4375-1: PHP vulnerability php5, php7.0, php7.2, php7.3, php7.4 vulnerability A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 20.04 LTS Ubuntu 19.10 Ubuntu 18.04 LTS Ubuntu 16.04 LTS Ubuntu 14.04 ESM Ubuntu 12.04 ESM Summary PHP could be made to crash if it received a specially crafted file. Software Description php7.4 – server-side, HTML-embedded scripting language (metapackage) php7.3 – server-side, HTML-embedded scripting language (metapackage) php7.2 – HTML-embedded scripting language interpreter php7.0 – HTML-embedded scripting language interpreter php5 – HTML-embedded scripting language interpreter Details It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. Update instructions The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS libapache2-mod-php7.4 – 7.4.3-4ubuntu2.2 php7.4-cgi – 7.4.3-4ubuntu2.2 php7.4-cli – 7.4.3-4ubuntu2.2 php7.4-fpm – 7.4.3-4ubuntu2.2 php7.4-mbstring [ more… ]