Ubuntu 6538 Published by

The following updates has been released for Ubuntu Linux:

USN-3610-1: ICU vulnerability
USN-3611-1: OpenSSL vulnerability
USN-3612-1: librelp vulnerability



USN-3610-1: ICU vulnerability

==========================================================================
Ubuntu Security Notice USN-3610-1
March 28, 2018

icu vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 17.10
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

ICU could be made to crash if it received specially crafted input.

Software Description:
- icu: International Components for Unicode library

Details:

It was discovered that ICU incorrectly handled certain calendars. If an
application using ICU processed crafted data, a remote attacker could
possibly cause it to crash, leading to a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.10:
libicu57 57.1-6ubuntu0.3

Ubuntu 16.04 LTS:
libicu55 55.1-7ubuntu0.4

Ubuntu 14.04 LTS:
libicu52 52.1-3ubuntu0.8

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3610-1
CVE-2017-15422

Package Information:
https://launchpad.net/ubuntu/+source/icu/57.1-6ubuntu0.3
https://launchpad.net/ubuntu/+source/icu/55.1-7ubuntu0.4
https://launchpad.net/ubuntu/+source/icu/52.1-3ubuntu0.8



USN-3611-1: OpenSSL vulnerability

==========================================================================
Ubuntu Security Notice USN-3611-1
March 28, 2018

openssl vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 17.10
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

OpenSSL could be made to crash if it received specially crafted network
traffic.

Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

It was discovered that OpenSSL incorrectly handled certain ASN.1 types. A
remote attacker could possibly use this issue to cause a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.10:
libssl1.0.0 1.0.2g-1ubuntu13.4

Ubuntu 16.04 LTS:
libssl1.0.0 1.0.2g-1ubuntu4.11

Ubuntu 14.04 LTS:
libssl1.0.0 1.0.1f-1ubuntu2.24

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3611-1
CVE-2018-0739

Package Information:
https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu13.4
https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu4.11
https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.24


USN-3612-1: librelp vulnerability

==========================================================================
Ubuntu Security Notice USN-3612-1
March 28, 2018

librelp vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS

Summary:

librelp could be made to crash or run programs if it received specially
crafted network traffic.

Software Description:
- librelp: Reliable Event Logging Protocol (RELP) library

Details:

Bas van Schaik and Kevin Backhouse discovered that librelp incorrectly
handled checking certain x509 certificates. A remote attacker able to
connect to rsyslog could possibly use this issue to execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
librelp0 1.2.2-2ubuntu1.1

After a standard system update you need to restart rsyslog to make all the
necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3612-1
CVE-2018-1000140

Package Information:
https://launchpad.net/ubuntu/+source/librelp/1.2.2-2ubuntu1.1