--===============7171071287937443234==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature";
 boundary="a8Wt8u1KmwUX3Y2C"
Content-Disposition: inline


--a8Wt8u1KmwUX3Y2C
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

==========================================================================
Ubuntu Security Notice USN-5078-2
September 15, 2021

squashfs-tools vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 ESM

Summary:

Squashfs-Tools could be made to overwrite files.

Software Description:
- squashfs-tools: Tools to create and modify squashfs filesystems

Details:

USN-5078-1 fixed several vulnerabilities in Squashfs-Tools.
This update provides the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

 Etienne Stalmans discovered that Squashfs-Tools mishandled certain
 malformed SQUASHFS files. An attacker could use this vulnerability
 to write arbitrary files to the filesystem. (CVE-2021-40153)

 Richard Weinberger discovered that Squashfs-Tools mishandled certain
 malformed SQUASHFS files. An attacker could use this vulnerability to
 write arbitrary files to the filesystem. (CVE-2021-41072)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 ESM:
  squashfs-tools                  1:4.3-3ubuntu2.16.04.3+esm1

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-5078-2
  https://ubuntu.com/security/notices/USN-5078-1
  CVE-2021-40153, CVE-2021-41072

--a8Wt8u1KmwUX3Y2C
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEf+ebRFcoyOoAQoOeRbznW4QLH2kFAmFCM/YACgkQRbznW4QL
H2mmhBAAvgmPwpKx+xbZZjyZgluAn/vHtbhu+A8miIZ3r6yLHB2gPkHiVLLdHTEW
Wzh0vL1Z050MG1FOKSIEIU7rgeAV9XTbXXF4bLKZwxaaQI9wQJYGo5HFAw/Hlhtn
2kBih+yFPbS2BbDFZj6pCaunbcCUZcjnwb/5FVVal/ahv7FYV/CAVqMP5ujJFGBl
sjDC3M441POHgKCqg4sSR8oB+1PEIZV35Wh5nsVUKK5bWcBCS1gTH74qhB8RvlPj
Dqjp4nk2ex+JW1iKFhxQMf1lkLTCbFzyPIu3tCBHxQD17Rf/vnlyLOkXkcIbIZtq
IYolSlZvb6XuFb6z3NVPcIEo2Bpu10Do1DCMNWOMKKXd2xVw14juDXkvQ7DeTmKz
gMpEeadnrOEe0yl7IQMh+ofzkvs7Kmv9gY0Y8en+jX92fsSOkRtr+nnkeJJSlWMx
3h70Xk7qnuWDxH1L+HbDVIq5b0UG36S//4Xt6Y2WIADnzBobaFpGOSRj9NcgGhPy
S586nn58w91lxWG7MlbmQAPLVaQGbjlqgYm4WjKCCMswi2wupJezSt3arDy9gapa
DkwIC+7pcje9Vpsf/fUwMM5rYDLmRkSQuRxYcu9UV2VClYsmuKraXYGXVC8le2vC
FY7ek747eVi8dUc8beCKoFBrXujh23mNcyPAe0U2sre1f53zRYg=
=JxR7
-----END PGP SIGNATURE-----

--a8Wt8u1KmwUX3Y2C--


--===============7171071287937443234==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce