--===============5768693695346817637==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature";
 boundary="oaibbvf4rbsvcgpx"
Content-Disposition: inline


--oaibbvf4rbsvcgpx
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

==========================================================================
Ubuntu Security Notice USN-3926-1
March 29, 2019

gpac vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.10
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

GPAC could be made to crash or run programs as your login if it
opened a specially crafted file.

Software Description:
- gpac: GPAC Project on Advanced Content

Details:

It was discovered that the GPAC MP4Box utility incorrectly handled certain
memory operations. If an user or automated system were tricked into opening a
specially crafted MP4 file, a remote attacker could use this issue to cause
MP4Box to crash, resulting in a denial of service, or possibly execute
arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
  gpac                            0.5.2-426-gc5ad4e4+dfsg5-4ubuntu0.1
  gpac-modules-base               0.5.2-426-gc5ad4e4+dfsg5-4ubuntu0.1
  libgpac4                        0.5.2-426-gc5ad4e4+dfsg5-4ubuntu0.1

Ubuntu 18.04 LTS:
  gpac                            0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1
  gpac-modules-base               0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1
  libgpac4                        0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1

Ubuntu 16.04 LTS:
  gpac                            0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1
  gpac-modules-base               0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1
  libgpac4                        0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
  https://usn.ubuntu.com/usn/usn-3926-1
  CVE-2018-1000100, CVE-2018-13005, CVE-2018-13006, CVE-2018-20760,
  CVE-2018-20761, CVE-2018-20762, CVE-2018-20763, CVE-2018-7752

Package Information:
  https://launchpad.net/ubuntu/+source/gpac/0.5.2-426-gc5ad4e4+dfsg5-4ubuntu0.1
  https://launchpad.net/ubuntu/+source/gpac/0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1
  https://launchpad.net/ubuntu/+source/gpac/0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1

--oaibbvf4rbsvcgpx
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEkCdEQ5T6DutSveCybUp5kL3izGYFAlyeZREACgkQbUp5kL3i
zGakxA/+IoOjvwO8vOzMEk6QV9GO5wn3ukjqTTvnJbxc7bEzO9xACoTDpXsrH8el
DNmyLh5Gz/7c4GxQK8w2sZQxV3zIU6TP9yIKwERLkjnZYuXbPQUVcMn7S01jkwj6
36j2LqifubkW7Cvr5294FU9nkTuBzDJzhN5GBMLfJf+4+KLE7cYUAbkxICrDsGK/
GR7KngxwH+N/DmkpJR2cYAEtT7xDLLZzJu4aJUearVxwVJ2tptyvnA9SPPzdn+gh
uQGXJMCEek64n8PnaAtFZqx/b+M67wFzLgGVnQv9xLR4hc9RFFL9wgfhPWrna6wR
R9lCjmxfXkZNvbbFJzne4VKUsqBpYcfD28ksfstiwWbPAywgvHIpksXfnHpycGXl
0vXVreeHQfsoim69inZZTqZwn5rCa2M7IPElV2rKrwrjptcSkLf0Nh445C8OXxN4
jALrREYas61BofTuSBK0g7W1M7dCD0Z9tdVsmr6Qmc46EV2Jgd80U1v5nEo1q+OV
F2ddA3rTLk9f8ZAXc3jGTtrPRttgaopqUJRQAlptAr1P6445BsLYegtTNQCcfyyF
YhkVvwFKOFDiP0/07pOtWxXzzq/6cCv2/Lj2wB4F8qBKGGPsULmL+4CxQzjJzaVS
Dx/gYiUArYoUAZcncRrxNu33ux7QAmiTaAm+/p2k+dC/TcNCb+g=
=7mph
-----END PGP SIGNATURE-----

--oaibbvf4rbsvcgpx--


--===============5768693695346817637==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce