This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============2627697376866874948==
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="xY8UPTmq1GTPGp3Wt5SdvgTv5TJOTwsXO"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--xY8UPTmq1GTPGp3Wt5SdvgTv5TJOTwsXO
Content-Type: multipart/mixed;
 boundary="xbfIW0p68xejk25OHTJXomADknWRLJtNj";
 protected-headers="v1"
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: "ubuntu-security-announce@lists.ubuntu.com"
 <ubuntu-security-announce@lists.ubuntu.com>
Message-ID: <8f5815cd-ab35-ddef-f1c1-8a307981d939@canonical.com>
Subject: [USN-4746-1] xterm vulnerability

--xbfIW0p68xejk25OHTJXomADknWRLJtNj
Content-Type: text/plain; charset=utf-8
Content-Language: en-C
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-4746-1
February 24, 2021

xterm vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

xterm could be made to crash or run programs if it handled specially
crafted character sequences.

Software Description:
- xterm: X terminal emulator

Details:

Tavis Ormandy discovered that xterm incorrectly handled certain character
sequences. A remote attacker could use this issue to cause xterm to crash,
resulting in a denial of service, or possibly execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
  xterm                           353-1ubuntu1.20.10.2

Ubuntu 20.04 LTS:
  xterm                           353-1ubuntu1.20.04.2

Ubuntu 18.04 LTS:
  xterm                           330-1ubuntu2.2

Ubuntu 16.04 LTS:
  xterm                           322-1ubuntu1.2

In general, a standard system update will make all the necessary changes.

References:
  https://usn.ubuntu.com/4746-1
  CVE-2021-27135

Package Information:
  https://launchpad.net/ubuntu/+source/xterm/353-1ubuntu1.20.10.2
  https://launchpad.net/ubuntu/+source/xterm/353-1ubuntu1.20.04.2
  https://launchpad.net/ubuntu/+source/xterm/330-1ubuntu2.2
  https://launchpad.net/ubuntu/+source/xterm/322-1ubuntu1.2


--xbfIW0p68xejk25OHTJXomADknWRLJtNj--

--xY8UPTmq1GTPGp3Wt5SdvgTv5TJOTwsXO
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmA2aFcACgkQZWnYVadE
vpM6/hAArstDybBm0ALwp1kmaZzBvryqcLzlpXifb30kFdVmCwGLgzWFNCOsWGJo
xzLMC2YsUpPFOH3AP7u2V27VB/wGcgQKOVKl+mOY7YmP2+9e2UB3naPjFTN152ON
e9GczceOD0xpOPWK9ChewLYMA/p92dH9oTRcV2gepqal/3181K10P9OdokqHPsPV
kwyrV86LuaVx55upSGIpmrKXqNH4xSjTAz88YwsDzCOaqbW8s39ewcwNl5IE4af0
y9r/tel06OMkToj2QpmvkEaw5SQV/ECJSEucEoVs3WBDl2f7XFqamcRxndGrEN+s
NiBiCOUlzNw040dbSzCx+V2AmolRRxd2RhG3vPDZMYxv7TU1zcsg5BWLVK5a4KH/
JDDTsPLi6L7iN5RRlh3uCu7PdRX2rVvLRnnNFT6aqblDYYiT9YB1N9pUeprDribB
pNiFIvZ1MCtMs3bzJF9bqJRSNog+Qwr3gVrpeoNY+cTtHgQBmZPaDPPdc3pp0bPm
560i298Y/6F5p79wbmLreOkAEEqcCrQg2OnY30jrqQ6i+sfXYJ4YY33B+VBgojcv
SH93MwahuqbsDyJzN+N0JsUlGlBQB74pB8dSlwBKG/nESUdk9m2CIsP04WJkhD2I
gWL9VGOdv9Kn8HLGLQbrFZPv51yUHh7f7U7UpEJxjuWopVJlLhc=
=AaZg
-----END PGP SIGNATURE-----

--xY8UPTmq1GTPGp3Wt5SdvgTv5TJOTwsXO--


--===============2627697376866874948==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5
LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl
IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj
dXJpdHktYW5ub3VuY2UK

--===============2627697376866874948==--