Mehrere Probleme in Linux
ID: | USN-4708-1 |
Distribution: | Ubuntu |
Plattformen: | Ubuntu 16.04 LTS, Ubuntu 14.04 ESM |
Datum: | Do, 28. Januar 2021, 16:07 |
Referenzen: | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19816
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27777 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13093 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25669 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19813 |
Applikationen: | Linux |
Originalnachricht |
|
--===============3075144541853841287== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="tn/+KOyBVBGpvvUM" Content-Disposition: inline --tn/+KOyBVBGpvvUM Content-Type: text/plain; charset=us-ascii Content-Disposition: inline ========================================================================== Ubuntu Security Notice USN-4708-1 January 28, 2021 linux, linux-lts-xenial vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS - Ubuntu 14.04 ESM Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux: Linux kernel - linux-lts-xenial: Linux hardware enablement kernel from Xenial for Trusty Details: Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly track inode validations. An attacker could use this to construct a malicious XFS image that, when mounted, could cause a denial of service (system crash). (CVE-2018-13093) It was discovered that the btrfs file system implementation in the Linux kernel did not properly validate file system metadata in some situations. An attacker could use this to construct a malicious btrfs image that, when mounted, could cause a denial of service (system crash). (CVE-2019-19813, CVE-2019-19816) Bodong Zhao discovered a use-after-free in the Sun keyboard driver implementation in the Linux kernel. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2020-25669) Daniel Axtens discovered that PowerPC RTAS implementation in the Linux kernel did not properly restrict memory accesses in some situations. A privileged local attacker could use this to arbitrarily modify kernel memory, potentially bypassing kernel lockdown restrictions. (CVE-2020-27777) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: linux-image-4.4.0-201-generic 4.4.0-201.233 linux-image-4.4.0-201-generic-lpae 4.4.0-201.233 linux-image-4.4.0-201-lowlatency 4.4.0-201.233 linux-image-4.4.0-201-powerpc-e500mc 4.4.0-201.233 linux-image-4.4.0-201-powerpc-smp 4.4.0-201.233 linux-image-4.4.0-201-powerpc64-emb 4.4.0-201.233 linux-image-4.4.0-201-powerpc64-smp 4.4.0-201.233 linux-image-generic 4.4.0.201.207 linux-image-generic-lpae 4.4.0.201.207 linux-image-lowlatency 4.4.0.201.207 linux-image-powerpc-e500mc 4.4.0.201.207 linux-image-powerpc-smp 4.4.0.201.207 linux-image-powerpc64-emb 4.4.0.201.207 linux-image-powerpc64-smp 4.4.0.201.207 linux-image-virtual 4.4.0.201.207 Ubuntu 14.04 ESM: linux-image-4.4.0-201-generic 4.4.0-201.233~14.04.1 linux-image-4.4.0-201-generic-lpae 4.4.0-201.233~14.04.1 linux-image-4.4.0-201-lowlatency 4.4.0-201.233~14.04.1 linux-image-4.4.0-201-powerpc-e500mc 4.4.0-201.233~14.04.1 linux-image-4.4.0-201-powerpc-smp 4.4.0-201.233~14.04.1 linux-image-4.4.0-201-powerpc64-emb 4.4.0-201.233~14.04.1 linux-image-4.4.0-201-powerpc64-smp 4.4.0-201.233~14.04.1 linux-image-generic-lpae-lts-xenial 4.4.0.201.176 linux-image-generic-lts-xenial 4.4.0.201.176 linux-image-lowlatency-lts-xenial 4.4.0.201.176 linux-image-powerpc-e500mc-lts-xenial 4.4.0.201.176 linux-image-powerpc-smp-lts-xenial 4.4.0.201.176 linux-image-powerpc64-emb-lts-xenial 4.4.0.201.176 linux-image-powerpc64-smp-lts-xenial 4.4.0.201.176 linux-image-virtual-lts-xenial 4.4.0.201.176 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://usn.ubuntu.com/4708-1 CVE-2018-13093, CVE-2019-19813, CVE-2019-19816, CVE-2020-25669, CVE-2020-27777 Package Information: https://launchpad.net/ubuntu/+source/linux/4.4.0-201.233 --tn/+KOyBVBGpvvUM Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEpgY7tWAjCaQ8jrvULwmejQBegfQFAmASZCwACgkQLwmejQBe gfScUw/+O3A37HSZnyiFqxZzh5Mbw1RcuSyx3qPLM49+plQND/g4FglrRGzNHCIl F/0mS/FYsTGw0I+75jJMHyGzzdbCd5nDL3K61o/pWGyZYW3PQ0J8UyCZEGkXolB8 K59GssyqUF/Mmv+OAtvhKBuB83Hk1YNtUFN2DbJg30kuIsXeWh1HJ+fDJ9VcsuCn KlVYHbka0xF6iPx0WswGCLiKH0X6wAgWsLBu6opZSybF71Sh70x5J2yFYVrLbPSQ kt0Eq2mPSamQlYYkT0qUDruSh4zDSgXpxEhFQDFPh0KdGgs/wQAlKejlmkeuRIdN WcQwP+8jZWg1eC/sT1gyRsQc08v04bjq27TPUM19+82NydS88obr87+yDWs9cSfb hT0Xc1uWopv0INIYM7e6qsHDFyw0KT6ZrOKx4qT/wcLz6Aus0uqPKwKDlO2DVrqc sehTYE/nUq9DVgRzk3GU+F0vB5wEERQxi9Q6EKyVqKLNPqzNXo/IGuqY0Pexn6om a6iKZXSs8ESojbk6AmvDA18T9YwRPG5TeTGzaDh7wpchyou0lItHBRHYFmAu2mA2 RrD/4YsG2OknCzg7v1h9LfYGJOO6qeByUNYiYhO6KJdXW392RoIRECOAVBztm95E OcSdCqVtH5p8PXnUd0z4G+XRrehJ+VtDx1sLpk8GpBPlCvfStDY= =J8gS -----END PGP SIGNATURE----- --tn/+KOyBVBGpvvUM-- --===============3075144541853841287== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce |