[USN-7469-4] H2O vulnerability
[USN-7315-2] PostgreSQL vulnerability
[USN-7471-1] poppler vulnerabilities
[USN-7469-4] H2O vulnerability
==========================================================================
Ubuntu Security Notice USN-7469-4
April 30, 2025
h2o vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
Summary:
H2O could be made to crash if it received specially crafted network
traffic.
Software Description:
- h2o: an optimized HTTP server with support for HTTP/1.x, HTTP/2, and HTTP/3
Details:
USN-7469-1 fixed a vulnerability in Apache Traffic Server. This update
provides the corresponding updates for H2O.
Original advisory details:
It was discovered that Apache Traffic Server exhibited poor server
resource management in its HTTP/2 protocol. An attacker could possibly
use this issue to cause Apache Traffic Server to crash, resulting in
a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS
h2o 2.2.4+dfsg-1ubuntu0.1~esm2
Available with Ubuntu Pro
libh2o0.13 2.2.4+dfsg-1ubuntu0.1~esm2
Available with Ubuntu Pro
After a standard system update you need to restart H2O to make all the
necessary changes.
References:
https://ubuntu.com/security/notices/USN-7469-4
https://ubuntu.com/security/notices/USN-7469-3
https://ubuntu.com/security/notices/USN-7469-2
https://ubuntu.com/security/notices/USN-7469-1
CVE-2023-44487
[USN-7315-2] PostgreSQL vulnerability
==========================================================================
Ubuntu Security Notice USN-7315-2
April 30, 2025
postgresql-10 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
Summary:
PostgreSQL could be made to execute arbitrary code if it received specially
crafted input.
Software Description:
- postgresql-10: Object-relational SQL database
Details:
USN-7315-1 fixed a vulnerability in PostgreSQL. This update provides the
corresponding update for Ubuntu 18.04 LTS.
Original advisory details:
Stephen Fewer discovered that PostgreSQL incorrectly handled quoting
syntax in certain scenarios. A remote attacker could possibly use this
issue to perform SQL injection attacks.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS
postgresql-10 10.23-0ubuntu0.18.04.2+esm3
Available with Ubuntu Pro
postgresql-client-10 10.23-0ubuntu0.18.04.2+esm3
Available with Ubuntu Pro
After a standard system update you need to restart PostgreSQL to make all
the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7315-2
https://ubuntu.com/security/notices/USN-7315-1
CVE-2025-1094
[USN-7471-1] poppler vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7471-1
April 29, 2025
poppler vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 25.04
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
poppler could be made to treat documents with forged signatures as
legitimately signed.
Software Description:
- poppler: PDF rendering library
Details:
It was discovered that poppler did not properly verify adbe.pkcs7.sha1
signatures in PDF documents. An attacker could possibly use this issue
to create documents with forged signatures that are treated as
legitimately signed.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 25.04
libpoppler147 25.03.0-3ubuntu1
poppler-utils 25.03.0-3ubuntu1
Ubuntu 24.10
libpoppler140 24.08.0-1ubuntu0.3
poppler-utils 24.08.0-1ubuntu0.3
Ubuntu 24.04 LTS
libpoppler134 24.02.0-1ubuntu9.4
poppler-utils 24.02.0-1ubuntu9.4
Ubuntu 22.04 LTS
libpoppler118 22.02.0-2ubuntu0.8
poppler-utils 22.02.0-2ubuntu0.8
Ubuntu 20.04 LTS
libpoppler97 0.86.1-0ubuntu1.7
poppler-utils 0.86.1-0ubuntu1.7
Ubuntu 18.04 LTS
libpoppler73 0.62.0-2ubuntu2.14+esm6
Available with Ubuntu Pro
poppler-utils 0.62.0-2ubuntu2.14+esm6
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7471-1
CVE-2025-43903
Package Information:
https://launchpad.net/ubuntu/+source/poppler/25.03.0-3ubuntu1
https://launchpad.net/ubuntu/+source/poppler/24.08.0-1ubuntu0.3
https://launchpad.net/ubuntu/+source/poppler/24.02.0-1ubuntu9.4
https://launchpad.net/ubuntu/+source/poppler/22.02.0-2ubuntu0.8
https://launchpad.net/ubuntu/+source/poppler/0.86.1-0ubuntu1.7
