SECURITY

USN-3416-1: Thunderbird vulnerabilities Ubuntu Security Notice USN-3416-1 14th September, 2017 thunderbird vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.04 Ubuntu 16.04 LTS Ubuntu 14.04 LTS Summary Several security issues were fixed in Thunderbird. Software description thunderbird – Mozilla Open Source mail and newsgroup client Details Multiple security issues were discovered in Thunderbird. If a user weretricked in to opening a specially crafted website in a browsing context,an attacker could potentially exploit these to bypass same-originrestrictions, bypass CSP restrictions, obtain sensitive information, spoofthe origin of modal alerts, cause a denial of service via applicationcrash, or execute arbitrary code. (CVE-2017-7753, CVE-2017-7779,CVE-2017-7784, CVE-2017-7785, CVE-2017-7787, CVE-2017-7791, CVE-2017-7792,CVE-2017-7800, CVE-2017-7801, CVE-2017-7802, CVE-2017-7803, CVE-2017-7807,CVE-2017-7809) A buffer overflow was discovered when displaying SVG content in somecircumstances. If a user were tricked in to opening a specially craftedmessage, an attacker could potentially exploit [ more… ]

USN-3417-1: Libgcrypt vulnerability Ubuntu Security Notice USN-3417-1 14th September, 2017 libgcrypt20 vulnerability A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.04 Summary Libgcrypt could be made to expose sensitive information. Software description libgcrypt20 – LGPL Crypto library Details Daniel Genkin, Luke Valenta, and Yuval Yarom discovered that Libgcrypt wassusceptible to an attack via side channels. A local attacker could use thisattack to recover Curve25519 private keys. Update instructions The problem can be corrected by updating your system to the following package version: Ubuntu 17.04: libgcrypt20 1.7.6-1ubuntu0.2 To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. In general, a standard system update will make all the necessary changes. References CVE-2017-0379 Source: USN-3417-1: Libgcrypt vulnerability