[월:] 2023년 05월

USN-6106-1: calamares-settings-ubuntu vulnerability It was discovered that calamares-settings-ubuntu allowed creating the first user with a blank password, contrary to expectations. Source: USN-6106-1: calamares-settings-ubuntu vulnerability

USN-6105-1: ca-certificates update The ca-certificates package contained outdated CA certificates. This update refreshes the included certificates to those contained in the 2.60 version of the Mozilla certificate authority bundle. Source: USN-6105-1: ca-certificates update

USN-6104-1: PostgreSQL vulnerabilities Alexander Lakhin discovered that PostgreSQL incorrectly handled certain CREATE privileges. An authenticated user could possibly use this issue to execute arbitrary code as the bootstrap supervisor. (CVE-2023-2454) Wolfgang Walther discovered that PostgreSQL incorrectly handled certain row security policies. An authenticated user could possibly use this issue to complete otherwise forbidden reads and modifications. (CVE-2023-2455) Source: USN-6104-1: PostgreSQL vulnerabilities

USN-6103-1: JSON Schema vulnerability It was discovered that JSON Schema incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to exploit JavaScript runtimes and cause a denial of service or execute arbitrary code. Source: USN-6103-1: JSON Schema vulnerability

USN-6102-1: xmldom vulnerabilities It was discovered that xmldom incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause unexpected syntactic changes during XML processing. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-21366) It was discovered that xmldom incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2022-37616, CVE-2022-39353) Source: USN-6102-1: xmldom vulnerabilities