Skip to content

Releases: cloudfoundry/bosh-linux-stemcell-builder

ubuntu jammy v1.682

17 Dec 23:33
@bosh-admin-bot bosh-admin-bot
ubuntu-jammy/v1.682
93c21ee
Compare
Choose a tag to compare
ubuntu jammy v1.682 Latest
Latest

Metadata:

BOSH Agent Version: 2.705.0
Kernel Version: 5.15.0.127.126

USNs:

Title: USN-7125-1 -- RapidJSON vulnerability
URL: https://ubuntu.com/security/notices/USN-7125-1
Priorities: medium
Description:
It was discovered that RapidJSON incorrectly parsed numbers written in scientific notation, leading to an integer underflow. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. Update Instructions: Run sudo pro fix USN-7125-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: rapidjson-dev - 1.1.0+dfsg2-7ubuntu0.1esm1 rapidjson-doc - 1.1.0+dfsg2-7ubuntu0.1esm1 Available with Ubuntu Pro: https://ubuntu.com/pro
CVEs:

Title: USN-7129-1 -- TinyGLTF vulnerability
URL: https://ubuntu.com/security/notices/USN-7129-1
Priorities: medium
Description:
It was discovered that TinyGLTF performed file path expansion in an insecure way on certain inputs. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. Update Instructions: Run sudo pro fix USN-7129-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: libtinygltf-dev - 2.5.0+dfsg-4ubuntu0.1 libtinygltf1d - 2.5.0+dfsg-4ubuntu0.1 No subscription required
CVEs:

Title: USN-7132-1 -- PostgreSQL vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7132-1
Priorities: medium
Description:
It was discovered that PostgreSQL incorrectly tracked tables with row security. A remote attacker could possibly use this issue to perform forbidden reads and modifications. (CVE-2024-10976) Jacob Champion discovered that PostgreSQL clients used untrusted server error messages. An attacker that is able to intercept network communications could possibly use this issue to inject error messages that could be interpreted as valid query results. (CVE-2024-10977) Tom Lane discovered that PostgreSQL incorrectly handled certain privilege assignments. A remote attacker could possibly use this issue to view or change different rows from those intended. (CVE-2024-10978) Coby Abrams discovered that PostgreSQL incorrectly handled environment variables. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2024-10979) Update Instructions: Run sudo pro fix USN-7132-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: libecpg-compat3 - 14.15-0ubuntu0.22.04.1 libecpg-dev - 14.15-0ubuntu0.22.04.1 libecpg6 - 14.15-0ubuntu0.22.04.1 libpgtypes3 - 14.15-0ubuntu0.22.04.1 libpq-dev - 14.15-0ubuntu0.22.04.1 libpq5 - 14.15-0ubuntu0.22.04.1 postgresql-14 - 14.15-0ubuntu0.22.04.1 postgresql-client-14 - 14.15-0ubuntu0.22.04.1 postgresql-doc-14 - 14.15-0ubuntu0.22.04.1 postgresql-plperl-14 - 14.15-0ubuntu0.22.04.1 postgresql-plpython3-14 - 14.15-0ubuntu0.22.04.1 postgresql-pltcl-14 - 14.15-0ubuntu0.22.04.1 postgresql-server-dev-14 - 14.15-0ubuntu0.22.04.1 No subscription required
CVEs:

Title: USN-7137-1 -- recutils vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7137-1
Priorities: medium,low
Description:
It was discovered that recutils incorrectly handled memory when parsing comments with the recparser utility. An attacker could possibly use this issue to cause a denial of service or run arbitrary commands. (CVE-2021-46019, CVE-2021-46021, CVE-2021-46022) It was discovered that recutils incorrectly handled memory when parsing CSV files. An attacker could possibly use this issue to cause a denial of service or run arbitrary commands. (CVE-2019-11637, CVE-2019-11638, CVE-2019-11639, CVE-2019-11640) It was discovered that recutils incorrectly handled memory when parsing maliciously crafted recfiles. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-6455, CVE-2019-6456, CVE-2019-6457, CVE-2019-6458, CVE-2019-6459, CVE-2019-6460) Update Instructions: Run sudo pro fix USN-7137-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: librec-dev - 1.8-1ubuntu0.22.04.1esm1 librec1 - 1.8-1ubuntu0.22.04.1esm1 recutils - 1.8-1ubuntu0.22.04.1~esm1 Available with Ubuntu Pro: https://ubuntu.com/pro
CVEs:

Title: USN-7142-1 -- WebKitGTK vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7142-1
Priorities: high
Description:
Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution. Update Instructions: Run sudo pro fix USN-7142-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: gir1.2-javascriptcoregtk-4.0 - 2.46.4-0ubuntu0.22.04.1 gir1.2-javascriptcoregtk-4.1 - 2.46.4-0ubuntu0.22.04.1 gir1.2-javascriptcoregtk-6.0 - 2.46.4-0ubuntu0.22.04.1 gir1.2-webkit-6.0 - 2.46.4-0ubuntu0.22.04.1 gir1.2-webkit2-4.0 - 2.46.4-0ubuntu0.22.04.1 gir1.2-webkit2-4.1 - 2.46.4-0ubuntu0.22.04.1 libjavascriptcoregtk-4.0-18 - 2.46.4-0ubuntu0.22.04.1 libjavascriptcoregtk-4.0-bin - 2.46.4-0ubuntu0.22.04.1 libjavascriptcoregtk-4.0-dev - 2.46.4-0ubuntu0.22.04.1 libjavascriptcoregtk-4.1-0 - 2.46.4-0ubuntu0.22.04.1 libjavascriptcoregtk-4.1-dev - 2.46.4-0ubuntu0.22.04.1 libjavascriptcoregtk-6.0-1 - 2.46.4-0ubuntu0.22.04.1 libjavascriptcoregtk-6.0-dev - 2.46.4-0ubuntu0.22.04.1 libwebkit2gtk-4.0-37 - 2.46.4-0ubuntu0.22.04.1 libwebkit2gtk-4.0-dev - 2.46.4-0ubuntu0.22.04.1 libwebkit2gtk-4.0-doc - 2.46.4-0ubuntu0.22.04.1 libwebkit2gtk-4.1-0 - 2.46.4-0ubuntu0.22.04.1 libwebkit2gtk-4.1-dev - 2.46.4-0ubuntu0.22.04.1 libwebkitgtk-6.0-4 - 2.46.4-0ubuntu0.22.04.1 libwebkitgtk-6.0-dev - 2.46.4-0ubuntu0.22.04.1 webkit2gtk-driver - 2.46.4-0ubuntu0.22.04.1 No subscription required
CVEs:

Title: USN-7144-1 -- Linux kernel (Intel IoTG) vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7144-1
Priorities: high,low,medium
Description:
Supraja Sridhara, Benedict Schlüter, Mark Kuhne, Andrin Bertschi, and Shweta Shinde discovered that the Confidential Computing framework in the Linux kernel for x86 platforms did not properly handle 32-bit emulation on TDX and SEV. An attacker with access to the VMM could use this to cause a denial of service (guest crash) or possibly execute arbitrary code. (CVE-2024-25744) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - User-Mode Linux (UML); - x86 architecture; - Block layer subsystem; - Android drivers; - Serial ATA and Parallel ATA drivers; - ATM drivers; - Drivers core; - Null block device driver; - Character device driver; - ARM SCMI message protocol; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - I3C subsystem; - InfiniBand drivers; - Input Device core drivers; - Input Device (Miscellaneous) drivers; - IOMMU subsystem; - IRQ chip drivers; - ISDN/mISDN subsystem; - LED subsystem; - Multiple devices driver; - Media drivers; - VMware VMCI Driver; - MMC subsystem; - Ethernet bonding driver; - Network drivers; - Mellanox network drivers; - Near Field Communication (NFC) drivers; - NVME drivers; - Device tree and open firmware driver; - Parport drivers; - PCI subsystem; - Pin controllers subsystem; - Remote Processor subsystem; - S/390 drivers; - SCSI subsystem; - QCOM SoC drivers; - Direct Digital Synthesis drivers; - Thunderbolt and USB4 drivers; - TTY drivers; - Userspace I/O drivers; - DesignWare USB3 driver; - USB Gadget drivers; - USB Host Controller drivers; - USB Type-C Connector System Software Interface driver; - USB over IP driver; - Virtio Host (VHOST) subsystem; - File systems infrastructure; - BTRFS file system; - Ext4 file system; - F2FS file system; - JFS file system; - NILFS2 file system; - File system notification infrastructure; - NTFS3 file system; - Proc file system; - SMB network file system; - Bitmap API; - Objagg library; - Perf events; - Virtio network driver; - KCM (Kernel Connection Multiplexor) sockets driver; - Network traffic control; - Control group (cgroup); - DMA mapping infrastructure; - Locking primitives; - Padata parallel execution mechanism; - RCU subsystem; - Scheduler infrastructure; - Tracing infrastructure; - Radix Tree data structure library; - Kernel userspace event delivery library; - ...

Read more
Assets 2
Loading

ubuntu jammy v1.651

22 Nov 20:20
@bosh-admin-bot bosh-admin-bot
ubuntu-jammy/v1.651
d082353
Compare
Choose a tag to compare
ubuntu jammy v1.651

Full Changelog: ubuntu-jammy/v1.639...ubuntu-jammy/v1.651

Metadata:

BOSH Agent Version: 2.698.0
Kernel Version: 5.15.0.126.125

USNs:

Title: USN-7111-1 -- Go vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7111-1
Priorities: medium
Description:
Philippe Antoine discovered that Go incorrectly handled crafted HTTP/2 streams. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-41723) Marten Seemann discovered that Go did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2022-41724) Ameya Darshan and Jakob Ackermann discovered that Go did not properly validate the amount of memory and disk files ReadForm can consume. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2022-41725) Jakob Ackermann discovered that Go incorrectly handled multipart forms. An attacker could possibly use this issue to consume an excessive amount of resources, resulting in a denial of service. (CVE-2023-24536) It was discovered that Go did not properly validate the "//go:cgo_" directives during compilation. An attacker could possibly use this issue to inject arbitrary code during compile time. (CVE-2023-39323) Bartek Nowotarski was discovered that the Go net/http module did not properly handle the requests when request's headers exceed MaxHeaderBytes. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2023-45288) Bartek Nowotarski discovered that the Go net/http module did not properly validate the total size of the parsed form when parsing a multipart form. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2023-45290) John Howard discovered that the Go crypto/x509 module did not properly handle a certificate chain which contains a certificate with an unknown public key algorithm. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2024-24783) Juho Nurminen discovered that the Go net/mail module did not properly handle comments within display names in the ParseAddressList function. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2024-24784) Yufan You discovered that the Go archive/zip module did not properly handle certain types of invalid zip files differs from the behavior of most zip implementations. An attacker could possibly use this issue to cause a panic resulting into a denial of service. (CVE-2024-24789) Geoff Franks discovered that the Go net/http module did not properly handle responses to requests with an "Expect: 100-continue" header under certain circumstances. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-24791) It was discovered that the Go parser module did not properly handle deeply nested literal values. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2024-34155) Md Sakib Anwar discovered that the Go encoding/gob module did not properly handle message decoding under certain circumstances. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2024-34156) It was discovered that the Go build module did not properly handle certain build tag lines with deeply nested expressions. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2024-34158) Update Instructions: Run sudo pro fix USN-7111-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: golang-1.17 - 1.17.13-3ubuntu1.3 golang-1.17-doc - 1.17.13-3ubuntu1.3 golang-1.17-go - 1.17.13-3ubuntu1.3 golang-1.17-src - 1.17.13-3ubuntu1.3 No subscription required
CVEs:

Title: USN-7113-1 -- WebKitGTK vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7113-1
Priorities: medium
Description:
Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution. Update Instructions: Run sudo pro fix USN-7113-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: gir1.2-javascriptcoregtk-4.0 - 2.46.3-0ubuntu0.22.04.1 gir1.2-javascriptcoregtk-4.1 - 2.46.3-0ubuntu0.22.04.1 gir1.2-javascriptcoregtk-6.0 - 2.46.3-0ubuntu0.22.04.1 gir1.2-webkit-6.0 - 2.46.3-0ubuntu0.22.04.1 gir1.2-webkit2-4.0 - 2.46.3-0ubuntu0.22.04.1 gir1.2-webkit2-4.1 - 2.46.3-0ubuntu0.22.04.1 libjavascriptcoregtk-4.0-18 - 2.46.3-0ubuntu0.22.04.1 libjavascriptcoregtk-4.0-bin - 2.46.3-0ubuntu0.22.04.1 libjavascriptcoregtk-4.0-dev - 2.46.3-0ubuntu0.22.04.1 libjavascriptcoregtk-4.1-0 - 2.46.3-0ubuntu0.22.04.1 libjavascriptcoregtk-4.1-dev - 2.46.3-0ubuntu0.22.04.1 libjavascriptcoregtk-6.0-1 - 2.46.3-0ubuntu0.22.04.1 libjavascriptcoregtk-6.0-dev - 2.46.3-0ubuntu0.22.04.1 libwebkit2gtk-4.0-37 - 2.46.3-0ubuntu0.22.04.1 libwebkit2gtk-4.0-dev - 2.46.3-0ubuntu0.22.04.1 libwebkit2gtk-4.0-doc - 2.46.3-0ubuntu0.22.04.1 libwebkit2gtk-4.1-0 - 2.46.3-0ubuntu0.22.04.1 libwebkit2gtk-4.1-dev - 2.46.3-0ubuntu0.22.04.1 libwebkitgtk-6.0-4 - 2.46.3-0ubuntu0.22.04.1 libwebkitgtk-6.0-dev - 2.46.3-0ubuntu0.22.04.1 webkit2gtk-driver - 2.46.3-0ubuntu0.22.04.1 No subscription required
CVEs:

Title: USN-7114-1 -- GLib vulnerability
URL: https://ubuntu.com/security/notices/USN-7114-1
Priorities: medium
Description:
It was discovered that Glib incorrectly handled certain trailing characters. An attacker could possibly use this issue to cause a crash or other undefined behavior. Update Instructions: Run sudo pro fix USN-7114-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: libglib2.0-0 - 2.72.4-0ubuntu2.4 libglib2.0-bin - 2.72.4-0ubuntu2.4 libglib2.0-data - 2.72.4-0ubuntu2.4 libglib2.0-dev - 2.72.4-0ubuntu2.4 libglib2.0-dev-bin - 2.72.4-0ubuntu2.4 libglib2.0-doc - 2.72.4-0ubuntu2.4 libglib2.0-tests - 2.72.4-0ubuntu2.4 No subscription required
CVEs:

Title: USN-7117-1 -- needrestart and Module::ScanDeps vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7117-1
Priorities: medium,high
Description:
Qualys discovered that needrestart passed unsanitized data to a library (libmodule-scandeps-perl) which expects safe input. A local attacker could possibly use this issue to execute arbitrary code as root. (CVE-2024-11003) Qualys discovered that the library libmodule-scandeps-perl incorrectly parsed perl code. This could allow a local attacker to execute arbitrary shell commands. (CVE-2024-10224) Qualys discovered that needrestart incorrectly used the PYTHONPATH environment variable to spawn a new Python interpreter. A local attacker could possibly use this issue to execute arbitrary code as root. (CVE-2024-48990) Qualys discovered that needrestart incorrectly checked the path to the Python interpreter. A local attacker could possibly use this issue to win a race condition and execute arbitrary code as root. (CVE-2024-48991) Qualys discovered that needrestart incorrectly used the RUBYLIB environment variable to spawn a new Ruby interpreter. A local attacker could possibly use this issue to execute arbitrary code as root. (CVE-2024-48992) Update Instructions: Run sudo pro fix USN-7117-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: libmodule-scandeps-perl - 1.31-1ubuntu0.1 No subscription required needrestart - 3.5-5ubuntu2.2 No subscription required
CVEs:

Title: USN-7120-1 -- Linux kernel vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7120-1
Priorities: high,medium
Description:
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - File systems infrastructure; - Network traffic control; (CVE-2024-46800, CVE-2024-43882) Update Instructions: Run sudo pro fix USN-7120-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: linux-buildinfo-6.8.0-1018-gcp - 6.8.0-1018.2022.04.1 linux-buildinfo-6.8.0-1018-nvidia - 6.8.0-1018.2022.04.1 linux-buildinfo-6.8.0-1018-nvidia-64k - 6.8.0-1018.2022.04.1 linux-cloud-tools-nvidia-6.8 - 6.8.0-1018.2022.04.1 linux-cloud-tools-nvidia-hwe-22.04 - 6.8.0-1018.2...

Read more
Assets 2
Loading

ubuntu jammy v1.639

13 Nov 02:11
@bosh-admin-bot bosh-admin-bot
ubuntu-jammy/v1.639
f6d9fd2
Compare
Choose a tag to compare
ubuntu jammy v1.639

Metadata:

BOSH Agent Version: 2.698.0
Kernel Version: 5.15.0.125.124

Full Changelog: ubuntu-jammy/v1.631...ubuntu-jammy/v1.639

USNs:

Title: USN-7091-1 -- Ruby vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7091-1
Priorities: medium
Description:
It was discovered that Ruby incorrectly handled parsing of an XML document that has specific XML characters in an attribute value using REXML gem. An attacker could use this issue to cause Ruby to crash, resulting in a denial of service. This issue only affected in Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-35176, CVE-2024-39908, CVE-2024-41123) It was discovered that Ruby incorrectly handled parsing of an XML document that has many entity expansions with SAX2 or pull parser API. An attacker could use this issue to cause Ruby to crash, resulting in a denial of service. (CVE-2024-41946) It was discovered that Ruby incorrectly handled parsing of an XML document that has many digits in a hex numeric character reference. An attacker could use this issue to cause Ruby to crash, resulting in a denial of service. (CVE-2024-49761) Update Instructions: Run sudo pro fix USN-7091-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: libruby3.0 - 3.0.2-7ubuntu2.8 ruby3.0 - 3.0.2-7ubuntu2.8 ruby3.0-dev - 3.0.2-7ubuntu2.8 ruby3.0-doc - 3.0.2-7ubuntu2.8 No subscription required
CVEs:

Title: USN-7093-1 -- Werkzeug vulnerability
URL: https://ubuntu.com/security/notices/USN-7093-1
Priorities: medium
Description:
It was discovered that Werkzeug incorrectly handled multiple form submission requests. A remote attacker could possibly use this issue to cause Werkzeug to consume resources, leading to a denial of service. Update Instructions: Run sudo pro fix USN-7093-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: python-werkzeug-doc - 2.0.2+dfsg1-1ubuntu0.22.04.3 python3-werkzeug - 2.0.2+dfsg1-1ubuntu0.22.04.3 No subscription required
CVEs:

Title: USN-7095-1 -- Linux kernel vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7095-1
Priorities: low,medium
Description:
Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - MIPS architecture; - PA-RISC architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - x86 architecture; - Cryptographic API; - Serial ATA and Parallel ATA drivers; - Null block device driver; - Bluetooth drivers; - Cdrom driver; - Clock framework and drivers; - Hardware crypto device drivers; - CXL (Compute Express Link) drivers; - Cirrus firmware drivers; - GPIO subsystem; - GPU drivers; - I2C subsystem; - IIO subsystem; - InfiniBand drivers; - ISDN/mISDN subsystem; - LED subsystem; - Multiple devices driver; - Media drivers; - Fastrpc Driver; - Network drivers; - Microsoft Azure Network Adapter (MANA) driver; - Near Field Communication (NFC) drivers; - NVME drivers; - NVMEM (Non Volatile Memory) drivers; - PCI subsystem; - Pin controllers subsystem; - x86 platform drivers; - S/390 drivers; - SCSI drivers; - Thermal drivers; - TTY drivers; - UFS subsystem; - USB DSL drivers; - USB core drivers; - DesignWare USB3 driver; - USB Gadget drivers; - USB Serial drivers; - VFIO drivers; - VHOST drivers; - File systems infrastructure; - BTRFS file system; - GFS2 file system; - JFFS2 file system; - JFS file system; - Network file systems library; - Network file system client; - NILFS2 file system; - NTFS3 file system; - SMB network file system; - Memory management; - Netfilter; - Tracing infrastructure; - io_uring subsystem; - BPF subsystem; - Core kernel; - Bluetooth subsystem; - CAN network layer; - Ceph Core library; - Networking core; - IPv4 networking; - IPv6 networking; - IUCV driver; - MAC80211 subsystem; - Network traffic control; - Sun RPC protocol; - Wireless networking; - AMD SoC Alsa drivers; - SoC Audio for Freescale CPUs drivers; - MediaTek ASoC drivers; - SoC audio core drivers; - SOF drivers; - Sound sequencer drivers; (CVE-2024-42271, CVE-2024-42068, CVE-2024-42086, CVE-2024-42132, CVE-2024-42074, CVE-2024-41017, CVE-2024-42090, CVE-2024-42280, CVE-2024-41030, CVE-2024-41037, CVE-2024-42248, CVE-2024-42084, CVE-2024-41057, CVE-2024-42252, CVE-2024-41055, CVE-2024-42158, CVE-2024-42097, CVE-2024-42101, CVE-2024-42095, CVE-2024-41084, CVE-2024-41051, CVE-2024-41032, CVE-2024-41046, CVE-2024-42231, CVE-2024-42133, CVE-2024-42089, CVE-2024-41062, CVE-2024-41033, CVE-2024-41012, CVE-2024-41077, CVE-2024-41064, CVE-2024-41082, CVE-2024-41090, CVE-2024-42065, CVE-2024-41096, CVE-2024-42119, CVE-2024-41054, CVE-2024-42064, CVE-2024-42253, CVE-2024-42237, CVE-2024-42120, CVE-2024-41066, CVE-2024-41083, CVE-2024-42129, CVE-2024-41085, CVE-2024-41058, CVE-2024-42146, CVE-2024-42156, CVE-2024-42076, CVE-2024-42149, CVE-2024-42069, CVE-2024-41039, CVE-2024-42110, CVE-2024-42150, CVE-2024-41015, CVE-2024-39486, CVE-2024-42144, CVE-2024-42131, CVE-2024-42087, CVE-2024-42091, CVE-2024-42236, CVE-2024-42088, CVE-2024-42112, CVE-2024-42142, CVE-2024-42082, CVE-2024-42111, CVE-2024-41028, CVE-2024-45001, CVE-2024-42077, CVE-2024-42102, CVE-2024-42239, CVE-2024-42140, CVE-2024-41091, CVE-2024-41050, CVE-2024-41034, CVE-2024-43858, CVE-2024-42145, CVE-2024-42227, CVE-2024-41029, CVE-2024-42230, CVE-2024-42096, CVE-2024-42238, CVE-2024-41027, CVE-2024-42063, CVE-2024-41023, CVE-2024-41041, CVE-2024-41038, CVE-2024-41073, CVE-2024-41067, CVE-2024-41025, CVE-2024-42152, CVE-2024-42247, CVE-2024-41065, CVE-2024-42121, CVE-2024-42157, CVE-2024-42080, CVE-2024-41076, CVE-2024-41059, CVE-2024-42108, CVE-2024-42251, CVE-2024-42093, CVE-2024-42130, CVE-2024-42126, CVE-2024-42079, CVE-2024-42246, CVE-2024-41081, CVE-2024-42092, CVE-2024-43855, CVE-2024-42235, CVE-2024-42118, CVE-2024-42067, CVE-2024-41047, CVE-2024-42155, CVE-2024-41010, CVE-2024-41061, CVE-2024-41007, CVE-2024-42245, CVE-2024-42106, CVE-2024-42066, CVE-2024-41078, CVE-2024-42113, CVE-2024-41087, CVE-2024-41092, CVE-2024-42234, CVE-2024-42124, CVE-2024-42100, CVE-2024-42128, CVE-2024-41072, CVE-2024-41022, CVE-2024-41049, CVE-2024-42229, CVE-2024-42225, CVE-2024-41052, CVE-2024-42151, CVE-2024-41094, CVE-2024-41098, CVE-2024-41035, CVE-2024-41042, CVE-2024-42114, CVE-2024-42250, CVE-2024-41095, CVE-2024-42138, CVE-2024-42241, CVE-2024-42103, CVE-2024-42094, CVE-2024-41045, CVE-2024-41075, CVE-2024-42073, CVE-2024-42153, CVE-2024-41048, CVE-2024-42085, CVE-2024-41074, CVE-2024-42244, CVE-2024-41018, CVE-2024-41079, CVE-2024-42127, CVE-2023-52887, CVE-2023-52888, CVE-2024-41071, CVE-2024-41020, CVE-2024-41036, CVE-2024-42117, CVE-2024-41068, CVE-2024-41056, CVE-2024-39487, CVE-2024-42243, CVE-2024-41019, CVE-2024-41070, CVE-2024-41044, CVE-2024-41060, CVE-2024-41088, CVE-2024-41021, CVE-2024-41053, CVE-2024-42137, CVE-2024-41086, CVE-2024-42104, CVE-2024-42109, CVE-2024-42105, CVE-2024-42136, CVE-2024-41080, CVE-2024-42098, CVE-2024-41093, CVE-2024-41063, CVE-2024-42161, CVE-2024-42147, CVE-2024-42223, CVE-2024-41097, CVE-2024-41069, CVE-2024-42240, CVE-2024-42135, CVE-2024-42070, CVE-2024-41089, CVE-2024-42141, CVE-2024-42115, CVE-2024-41031, CVE-2024-42232) Update Instructions: Run sudo pro fix USN-7095-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: linux-buildinfo-6.8.0-1017-nvidia - 6.8.0-1017.1922.04.1 linux-buildinfo-6.8.0-1017-nvidia-64k - 6.8.0-1017.1922.04.1 linux-cloud-tools-nvidia-6.8 - 6.8.0-1017.1922.04.1 linux-cloud-tools-nvidia-hwe-22.04 - 6.8.0-1017.1922.04.1 linux-cloud-tools-nvidia-hwe-22.04-edge - 6.8.0-1017.1922.04.1 linux-headers-6.8.0-1017-nvidia - 6.8.0-1017.1922.04.1 linux-headers-6.8.0-1017-nvidia-64k - 6.8.0-1017.1922.04.1 linux-headers-nvidia-6.8 - 6.8.0-1017.1922.04.1 linux-headers-nvidia-64k-6.8 - 6.8.0-1017.1922.04.1 linux-headers-nvidia-64k-hwe-22.04 - 6.8.0-1017.1922.04.1 linux-headers-nvidia-64k-hwe-22.04-edge - 6.8.0-1017.1922.04.1 linux-headers-nvidia-hwe-22.04 - 6.8.0-1017.1922.04.1 linux-headers-nvidia-hwe-22.04-edge - 6.8.0-1017.1922.04.1 linux-image-6.8.0-1017-nvidia - 6.8.0-1017.1922.04.1 linux-image-6.8.0-1017-nvidia-64k - 6.8.0-1017.1922.04.1 linux-image-nvidia-6.8 - 6.8.0-1017.1922.04.1 linux-image-nvidia-64k-6.8 - 6.8.0-1017.1922.04.1 linux-image-nvidia-64k-hwe-22.04 - 6.8.0-1017.1922.04.1 linux-image-nvidia-64k-hwe-22.04-edge - 6.8.0-1017.1922.04.1 linux-image-nvidia-hwe-22.04 - 6.8.0-1017.1922.04.1 linux-image-nvidia-hwe-22.04-edge - 6.8.0-1017.1922.04.1 linux-image-uc-6.8.0-1017-nvidia - 6.8.0-1017.1922.04.1 linux-image-uc-6.8.0-1017-nvidia-64k - 6.8.0-1017.1922.04.1 linux-image-unsigned-6.8.0-1017-nvidia - 6.8.0-1017.1922.04.1 linux-image-unsigned-6.8.0-1017-nvidia-64k - 6.8.0-1017.1922.04.1 linux-modules-6.8.0-1017-nvidia - 6.8.0-1017.1922.04.1 linux-modules-6.8.0-1017-nvidia-64k - 6.8.0-1017.1922.04.1 linux-modules-extra-6.8.0-1017-nvidia - 6.8.0-1017.1922.04.1 linux-modules-nvidia-fs-6.8.0-1017-nvidia - 6...

Read more
Assets 2
Loading

ubuntu jammy v1.631

04 Nov 18:09
@bosh-admin-bot bosh-admin-bot
ubuntu-jammy/v1.631
a2424bf
Compare
Choose a tag to compare
ubuntu jammy v1.631

What's Changed

  • Default apt sources are restored once stemcell is built by @selzoc in #384

Full Changelog: ubuntu-jammy/v1.621...ubuntu-jammy/v1.631

Metadata:

BOSH Agent Version: 2.696.0
Kernel Version: 5.15.0.124.124

USNs:

Title: USN-7021-5: Linux kernel vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7021-5
Priorities: unknown,medium,high
Description:
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:

Title: USN-7072-2: Linux kernel (GKE) vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7072-2
Priorities: unknown,high,medium
Description:
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:

Title: USN-7087-1 -- libarchive vulnerability
URL: https://ubuntu.com/security/notices/USN-7087-1
Priorities: medium
Description:
It was discovered that libarchive incorrectly handled certain RAR archive files. If a user or automated system were tricked into processing a specially crafted RAR archive, an attacker could use this issue to cause libarchive to crash, resulting in a denial of service, or possibly execute arbitrary code. Update Instructions: Run sudo pro fix USN-7087-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: libarchive-dev - 3.6.0-1ubuntu1.3 libarchive-tools - 3.6.0-1ubuntu1.3 libarchive13 - 3.6.0-1ubuntu1.3 No subscription required
CVEs:

Title: USN-7089-1 -- Linux kernel vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7089-1
Priorities: medium,low
Description:
Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. (CVE-2024-25741) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - MIPS architecture; - PA-RISC architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - x86 architecture; - Cryptographic API; - Serial ATA and Parallel ATA drivers; - Null block device driver; - Bluetooth drivers; - Cdrom driver; - Clock framework and drivers; - Hardware crypto device drivers; - CXL (Compute Express Link) drivers; - Cirrus firmware drivers; - GPIO subsystem; - GPU drivers; - I2C subsystem; - IIO subsystem; - InfiniBand drivers; - ISDN/mISDN subsystem; - LED subsystem; - Multiple devices driver; - Media drivers; - Fastrpc Driver; - Network drivers; - Microsoft Azure Network Adapter (MANA) driver; - Near Field Communication (NFC) drivers; - NVME drivers; - NVMEM (Non Volatile Memory) drivers; - PCI subsystem; - Pin controllers subsystem; - x86 platform drivers; - S/390 drivers; - SCSI drivers; - Thermal drivers; - TTY drivers; - UFS subsystem; - USB DSL drivers; - USB core drivers; - DesignWare USB3 driver; - USB Gadget drivers; - USB Serial drivers; - VFIO drivers; - VHOST drivers; - File systems infrastructure; - BTRFS file system; - GFS2 file system; - JFFS2 file system; - JFS file system; - Network file systems library; - Network file system client; - NILFS2 file system; - NTFS3 file system; - SMB network file system; - Memory management; - Netfilter; - Tracing infrastructure; - io_uring subsystem; - BPF subsystem; - Core kernel; - Bluetooth subsystem; - CAN network layer; - Ceph Core library; - Networking core; - IPv4 networking; - IPv6 networking; - IUCV driver; - MAC80211 subsystem; - Network traffic control; - Sun RPC protocol; - Wireless networking; - AMD SoC Alsa drivers; - SoC Audio for Freescale CPUs drivers; - MediaTek ASoC drivers; - SoC audio core drivers; - SOF drivers; - Sound sequencer drivers; (CVE-2024-41079, CVE-2024-41058, CVE-2024-41029, CVE-2024-42253, CVE-2024-41075, CVE-2024-42280, CVE-2024-42102, CVE-2024-41055, CVE-2024-41025, CVE-2024-42124, CVE-2024-41060, CVE-2024-41027, CVE-2024-42145, CVE-2024-42146, CVE-2024-42251, CVE-2024-41081, CVE-2024-42065, CVE-2024-42129, CVE-2024-41031, CVE-2024-41035, CVE-2024-41047, CVE-2023-52888, CVE-2024-42248, CVE-2024-41039, CVE-2024-42119, CVE-2024-41038, CVE-2024-42150, CVE-2024-42073, CVE-2024-42089, CVE-2024-41007, CVE-2024-42120, CVE-2024-42069, CVE-2024-41096, CVE-2024-42153, CVE-2024-41012, CVE-2024-42151, CVE-2024-42241, CVE-2024-42126, CVE-2024-42092, CVE-2024-42231, CVE-2024-41032, CVE-2024-41076, CVE-2024-42136, CVE-2024-41078, CVE-2024-41068, CVE-2024-41070, CVE-2024-41091, CVE-2024-42063, CVE-2024-42157, CVE-2024-42118, CVE-2024-41046, CVE-2024-41023, CVE-2024-42094, CVE-2024-41042, CVE-2024-41034, CVE-2024-42096, CVE-2024-42105, CVE-2024-41051, CVE-2024-42239, CVE-2024-42117, CVE-2024-41019, CVE-2024-41033, CVE-2024-42223, CVE-2024-41098, CVE-2024-41052, CVE-2024-41036, CVE-2024-41087, CVE-2024-42115, CVE-2024-41057, CVE-2024-42161, CVE-2024-42240, CVE-2024-41093, CVE-2024-42097, CVE-2024-42077, CVE-2024-41062, CVE-2024-42156, CVE-2024-41077, CVE-2024-42235, CVE-2024-41085, CVE-2023-52887, CVE-2024-42237, CVE-2024-41061, CVE-2024-41073, CVE-2024-42087, CVE-2024-41086, CVE-2024-41044, CVE-2024-41066, CVE-2024-42128, CVE-2024-42144, CVE-2024-42227, CVE-2024-41020, CVE-2024-41015, CVE-2024-42232, CVE-2024-41072, CVE-2024-41030, CVE-2024-42098, CVE-2024-42121, CVE-2024-42080, CVE-2024-41071, CVE-2024-42225, CVE-2024-42064, CVE-2024-42246, CVE-2024-42113, CVE-2024-41082, CVE-2024-42095, CVE-2024-41080, CVE-2024-41056, CVE-2024-42147, CVE-2024-41069, CVE-2024-42135, CVE-2024-42245, CVE-2024-42244, CVE-2024-42271, CVE-2024-41084, CVE-2024-42234, CVE-2024-41064, CVE-2024-42108, CVE-2024-41090, CVE-2024-42079, CVE-2024-42138, CVE-2024-42127, CVE-2024-42149, CVE-2024-41067, CVE-2024-42130, CVE-2024-42086, CVE-2024-41045, CVE-2024-42088, CVE-2024-42131, CVE-2024-41063, CVE-2024-42111, CVE-2024-41088, CVE-2024-42110, CVE-2024-41074, CVE-2024-41041, CVE-2024-39487, CVE-2024-42076, CVE-2024-42091, CVE-2024-42132, CVE-2024-42100, CVE-2024-41010, CVE-2024-42093, CVE-2024-41048, CVE-2024-41059, CVE-2024-42137, CVE-2024-41065, CVE-2024-42067, CVE-2024-42140, CVE-2024-42250, CVE-2024-42084, CVE-2024-42155, CVE-2024-41021, CVE-2024-41089, CVE-2024-42106, CVE-2024-41083, CVE-2024-42112, CVE-2024-42101, CVE-2024-42229, CVE-2024-41053, CVE-2024-42074, CVE-2024-42252, CVE-2024-41018, CVE-2024-41095, CVE-2024-42090, CVE-2024-41097, CVE-2024-42236, CVE-2024-42109, CVE-2024-42158, CVE-2024-43858, CVE-2024-42133, CVE-2024-42066, CVE-2024-41094, CVE-2024-39486, CVE-2024-41050, CVE-2024-41028, CVE-2024-42114, CVE-2024-41049, CVE-2024-42070, CVE-2024-42243, CVE-2024-41092, CVE-2024-43855, CVE-2024-42103, CVE-2024-41022, CVE-2024-42142, CVE-2024-42238, CVE-2024-42152, CVE-2024-41037, CVE-2024-42230, CVE-2024-42082, CVE-2024-42085, CVE-2024-42104, CVE-2024-41017, CVE-2024-41054, CVE-2024-42068, CVE-2024-42141, CVE-2024-42247) Update Instructions: Run sudo pro fix USN-7089-1 to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: linux-buildinfo-6.8.0-1017-gcp - 6.8.0-1017.1922.04.1 linux-gcp - 6.8.0-1017.1922.04.1 linux-gcp-6.8-headers-6.8.0-1017 - 6.8.0-1017.1922.04.1 linux-gcp-6.8-tools-6.8.0-1017 - 6.8.0-1017.1922.04.1 linux-gcp-edge - 6.8.0-1017.1922.04.1 linux-headers-6.8.0-1017-gcp - 6.8.0-1017.1922.04.1 linux-headers-gcp - 6.8.0-1017.1922.04.1 linux-headers-gcp-edge - 6.8.0-1017.1922.04.1 linux-image-6.8.0-1017-gcp - 6.8.0-1017.1922.04.1 linux-image-gcp - 6.8.0-1017.1922.04.1 linux-image-gcp-edge - 6.8.0-1017.1922.04.1 linux-image-unsigned-6.8.0-1017-gcp - 6.8.0-1017.1922.04.1 linux-modules-6.8.0-1017-gcp - 6.8.0-1017.1922.04.1 linux-modules-extra-6.8.0-1017-gcp - 6.8.0-1017.1922.04.1 linux-modules-extra-gcp - 6.8.0-1017.1922.04.1 linux-modules-extra-gcp-edge - 6.8.0-1017.1922.04.1 linux-tools-6.8.0-1017-gcp - 6.8.0-1017.1922.04.1 linux-tools-gcp - 6.8.0-1017.1922.04.1 linux-tools-gcp-edge - 6.8.0-1017.1922.04.1 No subscription required linux-azure - 6.8.0-1017.2022.04.1 linux-azure-6.8-cloud-tools-6.8.0-1017 - 6.8.0-1017.2022.04.1 linux-azure-6.8-headers-6.8.0-1017 - 6.8.0-1017.2022.04.1 linux-azure-6.8-tools-6.8.0-1017 - 6.8.0-1017.2022.04.1 linux-azure-edge - 6.8.0-1017.2022.04.1 linux-azure-fde - 6.8.0-1017.20~22.04.1 linux-...

Read more

Contributors

selzoc
Assets 2
Loading

ubuntu jammy v1.621

21 Oct 22:07
@bosh-admin-bot bosh-admin-bot
ubuntu-jammy/v1.621
095b10e
Compare
Choose a tag to compare
ubuntu jammy v1.621

Metadata:

BOSH Agent Version: 2.695.0
Kernel Version: 5.15.0.124.124

USNs:

Title: USN-7064-1: nano vulnerability
URL: https://ubuntu.com/security/notices/USN-7064-1
Priorities: medium
Description:
It was discovered that nano allowed a possible privilege escalation
through an insecure temporary file. If nano was killed while editing, the
permissions granted to the emergency save file could be used by an
attacker to escalate privileges using a malicious symlink.
CVEs:

Title: USN-7070-1: libarchive vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7070-1
Priorities: critical,high
Description:
It was discovered that libarchive mishandled certain memory checks,
which could result in a NULL pointer dereference. An attacker could
potentially use this issue to cause a denial of service. This issue
only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-36227)

It was discovered that libarchive mishandled certain memory operations,
which could result in an out-of-bounds memory access. An attacker could
potentially use this issue to cause a denial of service. This issue only
affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
(CVE-2024-48957, CVE-2024-48958)
CVEs:

Title: USN-7071-1: Linux kernel vulnerability
URL: https://ubuntu.com/security/notices/USN-7071-1
Priorities: medium
Description:
A security issue was discovered in the Linux kernel.
An attacker could possibly use this to compromise the system.
This update corrects flaws in the following subsystems:

Title: USN-7072-1: Linux kernel vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7072-1
Priorities: unknown,high,medium
Description:
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:

Title: USN-7076-1: Linux kernel (Azure) vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7076-1
Priorities: unknown,high,medium
Description:
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:

Assets 2
Loading

ubuntu jammy v1.613

15 Oct 21:30
@bosh-admin-bot bosh-admin-bot
ubuntu-jammy/v1.613
395447f
Compare
Choose a tag to compare
ubuntu jammy v1.613

Metadata:

BOSH Agent Version: 2.695.0
Kernel Version: 5.15.0.122.122

USNs:

Title: USN-7007-3: Linux kernel vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7007-3
Priorities: medium,unknown,high,low,critical
Description:
Chenyuan Yang discovered that the CEC driver driver in the Linux kernel
contained a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2024-23848)

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel
did not properly check for the device to be enabled before writing. A local
attacker could possibly use this to cause a denial of service.
(CVE-2024-25741)

It was discovered that the JFS file system contained an out-of-bounds read
vulnerability when printing xattr debug information. A local attacker could
use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:

Read more

Contributors

xtreme-nitin-ravindran
Assets 2
Loading

ubuntu jammy v1.572

20 Sep 21:37
@bosh-admin-bot bosh-admin-bot
ubuntu-jammy/v1.572
2edc1e2
Compare
Choose a tag to compare
ubuntu jammy v1.572

Metadata:

BOSH Agent Version: 2.688.0
Kernel Version: 5.15.0.122.122

USNs:

Title: USN-6993-1: Vim vulnerabilities
URL: https://ubuntu.com/security/notices/USN-6993-1
Priorities: medium
Description:
It was discovered that Vim incorrectly handled memory when closing a
window, leading to a double-free vulnerability. If a user was tricked
into opening a specially crafted file, an attacker could crash the
application, leading to a denial of service, or possibly achieve code
execution with user privileges. (CVE-2024-41957)

It was discovered that Vim incorrectly handled memory when adding a new
file to an argument list, leading to a use-after-free. If a user was
tricked into opening a specially crafted file, an attacker could crash
the application, leading to a denial of service. (CVE-2024-43374)
CVEs:

Title: USN-6995-1: Thunderbird vulnerabilities
URL: https://ubuntu.com/security/notices/USN-6995-1
Priorities: medium
Description:
Multiple security issues were discovered in Thunderbird. If a user were
tricked into opening a specially crafted website in a browsing context, an
attacker could potentially exploit these to cause a denial of service,
obtain sensitive information, bypass security restrictions, cross-site
tracing, or execute arbitrary code. (CVE-2024-7521, CVE-2024-7526,
CVE-2024-7527, CVE-2024-7529, CVE-2024-8382)

It was discovered that Thunderbird did not properly manage certain memory
operations when processing graphics shared memory. An attacker could
potentially exploit this issue to escape the sandbox. (CVE-2024-7519)

Irvan Kurniawan discovered that Thunderbird did not properly check an
attribute value in the editor component, leading to an out-of-bounds read
vulnerability. An attacker could possibly use this issue to cause a denial
of service or expose sensitive information. (CVE-2024-7522)

Rob Wu discovered that Thunderbird did not properly check permissions when
creating a StreamFilter. An attacker could possibly use this issue to
modify response body of requests on any site using a web extension.
(CVE-2024-7525)

Nils Bars discovered that Thunderbird contained a type confusion
vulnerability when performing certain property name lookups. An attacker
could potentially exploit this issue to cause a denial of service, or
execute arbitrary code. (CVE-2024-8381)

It was discovered that Thunderbird did not properly manage memory during
garbage collection. An attacker could potentially exploit this issue to
cause a denial of service, or execute arbitrary code. (CVE-2024-8384)
CVEs:

Title: USN-6997-1: LibTIFF vulnerability
URL: https://ubuntu.com/security/notices/USN-6997-1
Priorities: medium
Description:
It was discovered that LibTIFF incorrectly handled memory. An attacker
could possibly use this issue to cause the application to crash, resulting
in a denial of service.
CVEs:

Title: USN-7000-2: Expat vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7000-2
Priorities: critical
Description:
USN-7000-1 fixed vulnerabilities in Expat. This update
provides the corresponding updates for Ubuntu 22.04 LTS.

Original advisory details:

Shang-Hung Wan discovered that Expat did not properly handle certain
function calls when a negative input length was provided. An attacker
could use this issue to cause a denial of service or possibly execute
arbitrary code. (CVE-2024-45490)

Shang-Hung Wan discovered that Expat did not properly handle the
potential for an integer overflow on 32-bit platforms. An attacker
could use this issue to cause a denial of service or possibly execute
arbitrary code. (CVE-2024-45491, CVE-2024-45492)
CVEs:

Title: USN-7007-1: Linux kernel vulnerabilities
URL: https://ubuntu.com/security/notices/USN-7007-1
Priorities: medium,unknown,high,low,critical
Description:
Chenyuan Yang discovered that the CEC driver driver in the Linux kernel
contained a use-after-free vulnerability. A local attacker could use this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2024-23848)

Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel
did not properly check for the device to be enabled before writing. A local
attacker could possibly use this to cause a denial of service.
(CVE-2024-25741)

It was discovered that the JFS file system contained an out-of-bounds read
vulnerability when printing xattr debug information. A local attacker could
use this to cause a denial of service (system crash). (CVE-2024-40902)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:

Read more
Assets 2
Loading

ubuntu jammy v1.555

11 Sep 18:52
@bosh-admin-bot bosh-admin-bot
ubuntu-jammy/v1.555
caf1083
Compare
Choose a tag to compare
ubuntu jammy v1.555

Metadata:

BOSH Agent Version: 2.685.0
Kernel Version: 5.15.0.119.119

USNs:

No high high or critical USN's in this release.

What's Changed

Full Changelog: ubuntu-jammy/v1.531...ubuntu-jammy/v1.555

Contributors

rthill91
Assets 2
Loading

ubuntu jammy v1.531

23 Aug 21:15
@cf-bosh-ci-bot cf-bosh-ci-bot
ubuntu-jammy/v1.531
c61e10a
Compare
Choose a tag to compare
ubuntu jammy v1.531

Metadata:

BOSH Agent Version: 2.679.0
Kernel Version: 5.15.0.119.119

USNs:

Title: USN-6974-1: Linux kernel vulnerabilities
URL: https://ubuntu.com/security/notices/USN-6974-1
Priorities: medium,high
Description:
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:

What's Changed

  • Prevent early deletion of temp files in specs by @ystros in #377
  • Fix quoting on stemcell version by @ystros in #378

Full Changelog: ubuntu-jammy/v1.529...ubuntu-jammy/v1.531

Contributors

ystros
Assets 2
Loading

ubuntu jammy v1.529

21 Aug 18:43
@cf-bosh-ci-bot cf-bosh-ci-bot
ubuntu-jammy/v1.529
752c8c5
Compare
Choose a tag to compare
ubuntu jammy v1.529

Metadata:

BOSH Agent Version: 2.679.0
Kernel Version: 5.15.0.118.118

USNs:

Title: USN-6895-4: Linux kernel vulnerabilities
URL: https://ubuntu.com/security/notices/USN-6895-4
Priorities: medium,low,high
Description:
It was discovered that the ATA over Ethernet (AoE) driver in the Linux
kernel contained a race condition, leading to a use-after-free
vulnerability. An attacker could use this to cause a denial of service or
possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the HugeTLB file system component of the Linux
Kernel contained a NULL pointer dereference vulnerability. A privileged
attacker could possibly use this to to cause a denial of service.
(CVE-2024-0841)

It was discovered that the Open vSwitch implementation in the Linux kernel
could overflow its stack during recursive action operations under certain
conditions. A local attacker could use this to cause a denial of service
(system crash). (CVE-2024-1151)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel
contained a race condition, leading to an integer overflow vulnerability. A
privileged attacker could possibly use this to cause a denial of service
(system crash). (CVE-2024-23307)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in
the Linux kernel contained a race condition, leading to an integer overflow
vulnerability. An attacker could possibly use this to cause a denial of
service (system crash). (CVE-2024-24861)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:

Title: USN-6922-2: Linux kernel vulnerabilities
URL: https://ubuntu.com/security/notices/USN-6922-2
Priorities: low,medium
Description:
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel when modifying certain settings values through debugfs.
A privileged local attacker could use this to cause a denial of service.
(CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device
volume management subsystem did not properly validate logical eraseblock
sizes in certain situations. An attacker could possibly use this to cause a
denial of service (system crash). (CVE-2024-25739)
CVEs:

Read more
Assets 2
Loading