SECURITY

USN-4081-1: Pango vulnerability pango1.0 vulnerability A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 19.04 Summary Pango could be made to execute arbitrary code if it received a specially crafted input. Software Description pango1.0 – Layout and rendering of internationalized text – gir bindings Details It was discovered that Pango incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. Update instructions The problem can be corrected by updating your system to the following package versions: Ubuntu 19.04 gir1.2-pango-1.0 – 1.42.4-6ubuntu0.1 libpango-1.0-0 – 1.42.4-6ubuntu0.1 libpango1.0-0 – 1.42.4-6ubuntu0.1 To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. After a standard system update you need to restart your session to make all the necessary changes. References CVE-2019-1010238 Source: USN-4081-1: Pango vulnerability

USN-4080-1: OpenJDK 8 vulnerabilities openjdk-8 vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.04 LTS Summary Several security issues were fixed in OpenJDK. Software Description openjdk-8 – Open Source Java implementation Details Keegan Ryan discovered that the ECC implementation in OpenJDK was not sufficiently resilient to side-channel attacks. An attacker could possibly use this to expose sensitive information. (CVE-2019-2745) It was discovered that OpenJDK did not sufficiently validate serial streams before deserializing suppressed exceptions in some situations. An attacker could use this to specially craft an object that, when deserialized, would cause a denial of service. (CVE-2019-2762) It was discovered that in some situations OpenJDK did not properly bound the amount of memory allocated during object deserialization. An attacker could use this to specially craft an object that, when deserialized, would cause a denial of [ more… ]

USN-4079-1: SoX vulnerabilities sox vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.04 LTS Summary SoX could be made to crash if it received a specially crafted MP3 file. Software Description sox – Swiss army knife of sound processing Details It was discovered that SoX incorrectly handled certain MP3 files. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-8354, CVE-2019-8355, CVE-2019-8356, CVE-2019-8357) Update instructions The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS libsox2 – 14.4.1-5+deb8u4ubuntu0.1 sox – 14.4.1-5+deb8u4ubuntu0.1 To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. In general, a standard system update will make all the necessary changes. References CVE-2019-8354 CVE-2019-8355 CVE-2019-8356 CVE-2019-8357 Source: USN-4079-1: SoX vulnerabilities

USN-4078-1: OpenLDAP vulnerabilities openldap vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 19.04 Ubuntu 18.04 LTS Ubuntu 16.04 LTS Summary Several security issues were fixed in OpenLDAP. Software Description openldap – OpenLDAP utilities Details It was discovered that OpenLDAP incorrectly handled rootDN delegation. A database administrator could use this issue to request authorization as an identity from another database, contrary to expectations. (CVE-2019-13057) It was discovered that OpenLDAP incorrectly handled SASL authentication and session encryption. After a first SASL bind was completed, it was possible to obtain access by performing simple binds, contrary to expectations. (CVE-2019-13565) Update instructions The problem can be corrected by updating your system to the following package versions: Ubuntu 19.04 slapd – 2.4.47+dfsg-3ubuntu2.1 Ubuntu 18.04 LTS slapd – 2.4.45+dfsg-1ubuntu1.3 Ubuntu 16.04 LTS slapd – 2.4.42+dfsg-2ubuntu3.6 To update your system, please follow [ more… ]