This Extension Lets You Quickly Browse Files & Folders in GNOME Shell

gnome shell file search extensionI’m pretty happy with the GNOME Shell desktop Ubuntu switched to last October, but I do miss being able to quickly browse and open my files from the Unity Dash. But I need miss it no more. A new GNOME extension brings similar file view functionality to the GNOME Shell desktop. Argonauta is files view extension for […]

This post, This Extension Lets You Quickly Browse Files & Folders in GNOME Shell, was written by Joey Sneddon and first appeared on OMG! Ubuntu!.

Read More

USN-3591-1: Django vulnerabilities

python-django vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in Django.

Software Description

  • python-django – High-level Python web development framework

Details

James Davis discovered that Django incorrectly handled certain template
filters. A remote attacker could possibly use this issue to cause Django
to consume resources, resulting in a denial of service.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.10
python-django1:1.11.4-1ubuntu1.2
python3-django1:1.11.4-1ubuntu1.2
Ubuntu 16.04 LTS
python-django1.8.7-1ubuntu5.6
python3-django1.8.7-1ubuntu5.6
Ubuntu 14.04 LTS
python-django1.6.11-0ubuntu1.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

Read More

USN-3590-1: Irssi vulnerabilities

irssi vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in Irssi.

Software Description

  • irssi – terminal based IRC client

Details

It was discovered that Irssi incorrectly handled certain empty
nick names. An attacker could possibly use this issue to cause a denial
of service. (CVE-2018-7050)

It was discovered that Irssi incorrectly handled certain nick names.
An attacker could possibly use this to access sensitive information.
(CVE-2018-7051)

It was discovered that Irssi incorrectly handled an increase in the
number of windows. An attacker could possibly use this issue to cause
a denial of service. (CVE-2018-7052)

It was discovered that Irssi incorrectly handled certain messages.
An attacker could possibly use this issue to cause a denial of service
or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and
Ubuntu 17.10. (CVE-2018-7053)

It was discovered that Irssi incorrectly handled certain disconnections.
An attacker could possibly use this to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 17.10. (CVE-2018-7054)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.10
irssi1.0.4-1ubuntu2.3
Ubuntu 16.04 LTS
irssi0.8.19-1ubuntu1.7
Ubuntu 14.04 LTS
irssi0.8.15-5ubuntu3.5

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Irssi to make all the necessary changes.

References

Read More

USN-3589-1: PostgreSQL vulnerability

postgresql-9.3, postgresql-9.5, postgresql-9.6 vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

PostgreSQL could be made to execute arbitrary code.

Software Description

  • postgresql-9.6 – Object-relational SQL database
  • postgresql-9.5 – Object-relational SQL database
  • postgresql-9.3 – Object-relational SQL database

Details

It was discovered that PostgreSQL incorrectly handled certain settings.
An attacker could possibly use this issue to execute arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.10
postgresql-9.69.6.8-0ubuntu0.17.10
Ubuntu 16.04 LTS
postgresql-9.59.5.12-0ubuntu0.16.04
Ubuntu 14.04 LTS
postgresql-9.39.3.22-0ubuntu0.14.04

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.

References

Read More

USN-3575-2: QEMU regression

Ubuntu Security Notice USN-3575-2

5th March, 2018

qemu regression

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

USN-3575-1 introduced a regression in QEMU.

Software description

  • qemu
    – Machine emulator and virtualizer

Details

USN-3575-1 fixed vulnerabilities in QEMU. The fix for CVE-2017-11334 caused
a regression in Xen environments. This update removes the problematic fix
pending further investigation.

We apologize for the inconvenience.

Original advisory details:

It was discovered that QEMU incorrectly handled guest ram. A privileged
attacker inside the guest could use this issue to cause QEMU to crash,
resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS
and Ubuntu 16.04 LTS. (CVE-2017-11334)

David Buchanan discovered that QEMU incorrectly handled the VGA device. A
privileged attacker inside the guest could use this issue to cause QEMU to
crash, resulting in a denial of service. This issue was only addressed in
Ubuntu 17.10. (CVE-2017-13672)

Thomas Garnier discovered that QEMU incorrectly handled multiboot. An
attacker could use this issue to cause QEMU to crash, resulting in a denial
of service, or possibly execute arbitrary code on the host. In the default
installation, when QEMU is used with libvirt, attackers would be isolated
by the libvirt AppArmor profile. This issue only affected Ubuntu 14.04 LTS
and Ubuntu 16.04 LTS. (CVE-2017-14167)

Tuomas Tynkkynen discovered that QEMU incorrectly handled VirtFS directory
sharing. An attacker could use this issue to obtain sensitive information
from host memory. (CVE-2017-15038)

Eric Blake discovered that QEMU incorrectly handled memory in the
NBD server. An attacker could use this issue to cause the NBD server to
crash, resulting in a denial of service. This issue only affected Ubuntu
17.10. (CVE-2017-15118)

Eric Blake discovered that QEMU incorrectly handled certain options to the
NBD server. An attacker could use this issue to cause the NBD server to
crash, resulting in a denial of service. This issue only affected Ubuntu
14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-15119)

Daniel Berrange discovered that QEMU incorrectly handled the VNC server. A
remote attacker could possibly use this issue to consume memory, resulting
in a denial of service. This issue was only addressed in Ubuntu 17.10.
(CVE-2017-15124)

Carl Brassey discovered that QEMU incorrectly handled certain websockets. A
remote attacker could possibly use this issue to consume memory, resulting
in a denial of service. This issue only affected Ubuntu 17.10.
(CVE-2017-15268)

Guoxiang Niu discovered that QEMU incorrectly handled the Cirrus VGA
device. A privileged attacker inside the guest could use this issue to
cause QEMU to crash, resulting in a denial of service. (CVE-2017-15289)

Cyrille Chatras discovered that QEMU incorrectly handled certain PS2 values
during migration. An attacker could possibly use this issue to cause QEMU
to crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10.
(CVE-2017-16845)

It was discovered that QEMU incorrectly handled the Virtio Vring
implementation. An attacker could possibly use this issue to cause QEMU to
crash, resulting in a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 17.10. (CVE-2017-17381)

Eric Blake discovered that QEMU incorrectly handled certain rounding
operations. An attacker could possibly use this issue to cause QEMU to
crash, resulting in a denial of service. This issue only affected Ubuntu
14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-18043)

Jiang Xin and Lin ZheCheng discovered that QEMU incorrectly handled the
VGA device. A privileged attacker inside the guest could use this issue to
cause QEMU to crash, resulting in a denial of service. (CVE-2018-5683)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.04 LTS:
qemu

1:2.5+dfsg-5ubuntu10.24
Ubuntu 14.04 LTS:
qemu

2.0.0+dfsg-2ubuntu1.40

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.

References

LP: 1752761

Read More

USN-3587-1: Dovecot vulnerabilities

Ubuntu Security Notice USN-3587-1

5th March, 2018

dovecot vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in Dovecot.

Software description

  • dovecot
    – IMAP and POP3 email server

Details

It was discovered that Dovecot incorrectly handled parsing certain email
addresses. A remote attacker could use this issue to cause Dovecot to
crash, resulting in a denial of service, or possibly obtain sensitive
information. (CVE-2017-14461)

It was discovered that Dovecot incorrectly handled TLS SNI config lookups.
A remote attacker could possibly use this issue to cause Dovecot to crash,
resulting in a denial of service. (CVE-2017-15130)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 17.10:
dovecot-core

1:2.2.27-3ubuntu1.3
Ubuntu 16.04 LTS:
dovecot-core

1:2.2.22-1ubuntu2.7
Ubuntu 14.04 LTS:
dovecot-core

1:2.2.9-1ubuntu2.4

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2017-14461,

CVE-2017-15130

Read More

USN-3588-1: Memcached vulnerabilities

Ubuntu Security Notice USN-3588-1

5th March, 2018

memcached vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

Several security issues were fixed in Memcached.

Software description

  • memcached
    – high-performance memory object caching system

Details

Daniel Shapira discovered an integer overflow issue in Memcached. A remote
attacker could use this to cause a denial of service (daemon crash).
(CVE-2017-9951)

It was discovered that Memcached listened to UDP by default. A remote
attacker could use this as part of a distributed denial of service attack.
(CVE-2018-1000115)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 17.10:
memcached

1.4.33-1ubuntu3.2
Ubuntu 16.04 LTS:
memcached

1.4.25-2ubuntu1.3
Ubuntu 14.04 LTS:
memcached

1.4.14-0ubuntu9.2

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

Please note that after applying this update, Memcached will no longer
listen to UDP by default. If UDP service is desired, please add
‘-U 11211’ to /etc/memcached.conf and restart the memcached service.

References

CVE-2017-9951,

CVE-2018-1000115

Read More