--===============6077341771709753568==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature";
 boundary="FCuugMFkClbJLl1L"
Content-Disposition: inline


--FCuugMFkClbJLl1L
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

==========================================================================
Ubuntu Security Notice USN-5378-3
April 13, 2022

xz-utils vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 ESM
- Ubuntu 14.04 ESM

Summary:

XZ Utils could be made to overwrite arbitrary files.

Software Description:
- xz-utils: XZ-format compression utilities

Details:

USN-5378-2 fixed a vulnerability in XZ Utils. This update provides
the corresponding update for Ubuntu 14.04 ESM and 16.04 ESM.

Original advisory details:

 Cleemy Desu Wayo discovered that Gzip incorrectly handled certain
 filenames. If a user or automated system were tricked into performing zgrep
 operations with specially crafted filenames, a remote attacker could
 overwrite arbitrary files.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 ESM:
  xz-utils                        5.1.1alpha+20120614-2ubuntu2.16.04.1+esm1

Ubuntu 14.04 ESM:
  xz-utils                        5.1.1alpha+20120614-2ubuntu2.14.04.1+esm1

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-5378-3
  https://ubuntu.com/security/notices/USN-5378-1
  CVE-2022-1271

--FCuugMFkClbJLl1L
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEf+ebRFcoyOoAQoOeRbznW4QLH2kFAmJW8vYACgkQRbznW4QL
H2kK/A//TIolO/nmMvokIgFQv5Q+Ef4I+hempWSDnfqXJUlzqkByNtL1ZjDEw7mR
rq49XhbBfHWne1bpvF2xWIr8dxZV+QgRba45lbmGKBrWBfnInRgeWFbVSTtEsgQp
OwrtpUUmVQLkLz4yh3b4p/A+b+scgp6bUJxwrwTLX/FfRJkucEpl6WZw/y+G+d6M
x53BqBgfTVaRGZvmjdVUwgDBvmtmW05Pd67DIo0zwd7Rph4wx1/sk15pK4scb8Mb
3TWk+UzZtTeS12z0722XxsY7YBCKf8FSwot6MHIGZq4dawU/Fz9+fGZhqcvvBKUP
roUiSn4KBNBMrjdwRZ+dKgVuWey+/O872DiFyPZkzFJPRK+TlT8gPQW8y2S7UTV5
gmI2Uyy8krvzq8RtivHNHbAns3oRtUtLADB2p08l6ZG1j4XVnarQFvEDDVj6dpev
PZeTxKUqOfZYgYxIPLmLQpE8kwhguI6mn0x8ucYuuRfnnq0QkXKDguWPttcG5TT2
BamqxgHFmUAnaxSABASnWv0rGdN/Vb4PLzVmWrmxa730Us98vYrUYQD+0zRz2WoN
Hk76Q4FdOq1h03iOh2PRE1Ixq3Kw6kY4xwAtM5f2oXg/LRebdEpAercm7rJWeLx8
xunU6r1re0ZtCu+4fk+4T80HGsEdqOts2rMMEabVCa1/AVPqsRU=
=DqiG
-----END PGP SIGNATURE-----

--FCuugMFkClbJLl1L--


--===============6077341771709753568==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline


--===============6077341771709753568==--