The following updates has been released for Ubuntu Linux:
USN-3610-1: ICU vulnerability
USN-3611-1: OpenSSL vulnerability
USN-3612-1: librelp vulnerability
USN-3610-1: ICU vulnerability
USN-3611-1: OpenSSL vulnerability
USN-3612-1: librelp vulnerability
USN-3610-1: ICU vulnerability
==========================================================================
Ubuntu Security Notice USN-3610-1
March 28, 2018
icu vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
ICU could be made to crash if it received specially crafted input.
Software Description:
- icu: International Components for Unicode library
Details:
It was discovered that ICU incorrectly handled certain calendars. If an
application using ICU processed crafted data, a remote attacker could
possibly cause it to crash, leading to a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
libicu57 57.1-6ubuntu0.3
Ubuntu 16.04 LTS:
libicu55 55.1-7ubuntu0.4
Ubuntu 14.04 LTS:
libicu52 52.1-3ubuntu0.8
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3610-1
CVE-2017-15422
Package Information:
https://launchpad.net/ubuntu/+source/icu/57.1-6ubuntu0.3
https://launchpad.net/ubuntu/+source/icu/55.1-7ubuntu0.4
https://launchpad.net/ubuntu/+source/icu/52.1-3ubuntu0.8
USN-3611-1: OpenSSL vulnerability
==========================================================================
Ubuntu Security Notice USN-3611-1
March 28, 2018
openssl vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
OpenSSL could be made to crash if it received specially crafted network
traffic.
Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools
Details:
It was discovered that OpenSSL incorrectly handled certain ASN.1 types. A
remote attacker could possibly use this issue to cause a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 17.10:
libssl1.0.0 1.0.2g-1ubuntu13.4
Ubuntu 16.04 LTS:
libssl1.0.0 1.0.2g-1ubuntu4.11
Ubuntu 14.04 LTS:
libssl1.0.0 1.0.1f-1ubuntu2.24
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3611-1
CVE-2018-0739
Package Information:
https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu13.4
https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu4.11
https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.24
USN-3612-1: librelp vulnerability
==========================================================================
Ubuntu Security Notice USN-3612-1
March 28, 2018
librelp vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
Summary:
librelp could be made to crash or run programs if it received specially
crafted network traffic.
Software Description:
- librelp: Reliable Event Logging Protocol (RELP) library
Details:
Bas van Schaik and Kevin Backhouse discovered that librelp incorrectly
handled checking certain x509 certificates. A remote attacker able to
connect to rsyslog could possibly use this issue to execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
librelp0 1.2.2-2ubuntu1.1
After a standard system update you need to restart rsyslog to make all the
necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3612-1
CVE-2018-1000140
Package Information:
https://launchpad.net/ubuntu/+source/librelp/1.2.2-2ubuntu1.1
