Ubuntu 6406 Published by

The following security updates are available for Ubuntu Linux:

[USN-6587-4] X.Org X Server regression
[USN-6620-1] GNU C Library vulnerabilities
[USN-6621-1] ImageMagick vulnerability




[USN-6587-4] X.Org X Server regression


=========================================================================
Ubuntu Security Notice USN-6587-4
February 01, 2024

xorg-server, xwayland regression
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)

Summary:

A regression was fixed in X.Org X Server.

Software Description:
- xorg-server: X.Org X11 server

Details:

USN-6587-1 fixed vulnerabilities in X.Org X Server. The fix was incomplete
resulting in a possible regression. This update fixes the problem.

Original advisory details:

Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
memory when processing the DeviceFocusEvent and ProcXIQueryPointer APIs. An
attacker could possibly use this issue to cause the X Server to crash,
obtain sensitive information, or execute arbitrary code. (CVE-2023-6816)

Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
reattaching to a different master device. An attacker could use this issue
to cause the X Server to crash, leading to a denial of service, or possibly
execute arbitrary code. (CVE-2024-0229)

Olivier Fourdan and Donn Seeley discovered that the X.Org X Server
incorrectly labeled GLX PBuffers when used with SELinux. An attacker could
use this issue to cause the X Server to crash, leading to a denial of
service. (CVE-2024-0408)

Olivier Fourdan discovered that the X.Org X Server incorrectly handled
the curser code when used with SELinux. An attacker could use this issue to
cause the X Server to crash, leading to a denial of service.
(CVE-2024-0409)

Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
memory when processing the XISendDeviceHierarchyEvent API. An attacker
could possibly use this issue to cause the X Server to crash, or execute
arbitrary code. (CVE-2024-21885)

Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
devices being disabled. An attacker could possibly use this issue to cause
the X Server to crash, or execute arbitrary code. (CVE-2024-21886)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
xserver-xorg-core 2:1.19.6-1ubuntu4.15+esm5
xwayland 2:1.19.6-1ubuntu4.15+esm5

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
xserver-xorg-core 2:1.18.4-0ubuntu0.12+esm10
xwayland 2:1.18.4-0ubuntu0.12+esm10

After a standard system update you need to reboot your computer to make all
the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6587-4
https://ubuntu.com/security/notices/USN-6587-1
https://launchpad.net/bugs/2051536



[USN-6620-1] GNU C Library vulnerabilities


==========================================================================
Ubuntu Security Notice USN-6620-1
February 01, 2024

glibc vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.10

Summary:

GNU C Library could be made to crash or run programs as an administrator
if it handled a specially crafted request.

Software Description:
- glibc: GNU C Library

Details:

It was discovered that the GNU C Library incorrectly handled the syslog()
function call. A local attacker could use this issue to execute arbitrary
code and possibly escalate privileges.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
libc6 2.38-1ubuntu6.1

After a standard system update you need to reboot your computer to make all
the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6620-1
CVE-2023-6246, CVE-2023-6779, CVE-2023-6780

Package Information:
https://launchpad.net/ubuntu/+source/glibc/2.38-1ubuntu6.1



[USN-6621-1] ImageMagick vulnerability


==========================================================================
Ubuntu Security Notice USN-6621-1
February 01, 2024

imagemagick vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS (Available with Ubuntu Pro)
- Ubuntu 20.04 LTS (Available with Ubuntu Pro)
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)

Summary:

ImageMagick could be made to crash if it opened a specially crafted
file.

Software Description:
- imagemagick: Image manipulation programs and library

Details:

It was discovered that ImageMagick incorrectly handled certain values when
processing BMP files. An attacker could exploit this to cause a denial of
service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS (Available with Ubuntu Pro):
imagemagick 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm3
imagemagick-6.q16 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm3
libmagickcore-6.q16-6 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm3
libmagickcore-6.q16-6-extra 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm3

Ubuntu 20.04 LTS (Available with Ubuntu Pro):
imagemagick 8:6.9.10.23+dfsg-2.1ubuntu11.9+esm2
imagemagick-6.q16 8:6.9.10.23+dfsg-2.1ubuntu11.9+esm2
libmagickcore-6.q16-6 8:6.9.10.23+dfsg-2.1ubuntu11.9+esm2
libmagickcore-6.q16-6-extra 8:6.9.10.23+dfsg-2.1ubuntu11.9+esm2

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
imagemagick 8:6.9.7.4+dfsg-16ubuntu6.15+esm3
libmagickcore-6.q16-3 8:6.9.7.4+dfsg-16ubuntu6.15+esm3
libmagickcore-6.q16-3-extra 8:6.9.7.4+dfsg-16ubuntu6.15+esm3

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
imagemagick 8:6.8.9.9-7ubuntu5.16+esm10
imagemagick-6.q16 8:6.8.9.9-7ubuntu5.16+esm10
libmagickcore-6.q16-2 8:6.8.9.9-7ubuntu5.16+esm10
libmagickcore-6.q16-2-extra 8:6.8.9.9-7ubuntu5.16+esm10

Ubuntu 14.04 LTS (Available with Ubuntu Pro):
imagemagick 8:6.7.7.10-6ubuntu3.13+esm7
libmagickcore5 8:6.7.7.10-6ubuntu3.13+esm7
libmagickcore5-extra 8:6.7.7.10-6ubuntu3.13+esm7

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6621-1
CVE-2023-5341