OverviewThis week saw the unexpected release of Ubuntu 20.04.6 so we go into the detailbehind that, plus we talk Everything Open and we cover security updatesincluding Emacs, LibreCAD, Python, vim and more.

This week in Ubuntu Security Updates82 unique CVEs addressed

[USN-5955-1] Emacs vulnerability [00:50]* 1 CVEs addressed in Xenial ESM (16.04 ESM) + CVE-2022-48339 * htmlfontify package would try and validate whether a given file is text bycalling file on it - but would fail to escape the filename - so if a usercould be tricked into running htmlfontify-copy-and-link-dir on a crafteddirectory, could get code execution in the context of emacs * Unlikely to be an issue in practice, also there doesn’t appear to be any usersof this function on github (other than references to the documentation for it)

[USN-5956-1, USN-5956-2] PHPMailer vulnerabilities [02:03]* 7 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) + CVE-2021-3603 + CVE-2020-13625 + CVE-2018-19296 + CVE-2017-5223 + CVE-2017-11503 + CVE-2016-10045 + CVE-2016-10033 * email sending library for PHP * similarly, possible RCE since could possibly inject commands that would bepassed to the shell when executing the underlying mail command - originalpatch didn’t fix properly so second CVE was issued for the fix

[USN-5957-1] LibreCAD vulnerabilities [02:58]* 7 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS) + CVE-2021-45343 + CVE-2021-45342 + CVE-2021-45341 + CVE-2021-21900 + CVE-2021-21899 + CVE-2021-21898 + CVE-2018-19105 * Various memory corruption issues when parsing DXF, DWG, DRW or JWW files + OOB writes, UAFs, NULL ptr deref - RCE / DoS

[USN-5855-2] ImageMagick vulnerabilities [03:37]* 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) + CVE-2022-44268 + CVE-2022-44267

[USN-5958-1] FFmpeg vulnerabilities [03:45]* 4 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) + CVE-2022-3965 + CVE-2022-3964 + CVE-2022-3341 + CVE-2022-3109 * 2 NULL ptr derefs and 2 OOB reads -> DoS

[USN-5954-1] Firefox vulnerabilities [03:59]* 9 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) + CVE-2023-28161 + CVE-2023-28164 + CVE-2023-28160 + CVE-2023-25751 + CVE-2023-28177 + CVE-2023-28176 + CVE-2023-28162 + CVE-2023-25752 + CVE-2023-25750 * 111.0 + usual mix of issues for web engines (DoS, info leak across domains, RCE) ifvisited a malicious website + memory corruption, plus a few logic issues that could be used to eithercause firefox to leak local information back to the web server or spoofparts of the UI etc

[USN-5961-1] abcm2ps vulnerabilities* 6 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) + CVE-2021-32436 + CVE-2021-32435 + CVE-2021-32434 + CVE-2019-1010069 + CVE-2018-10771 + CVE-2018-10753

[USN-5962-1] Linux kernel (Intel IoTG) vulnerabilities [04:47]* 18 CVEs addressed in Jammy (22.04 LTS) + CVE-2023-26605 + CVE-2023-0468 + CVE-2022-47521 + CVE-2022-47520 + CVE-2022-47519 + CVE-2022-47518 + CVE-2022-45869 + CVE-2022-4379 + CVE-2022-42329 + CVE-2022-42328 + CVE-2022-4139 + CVE-2022-3545 + CVE-2022-3521 + CVE-2022-3435 + CVE-2022-3344 + CVE-2022-3169 + CVE-2023-0179 + CVE-2023-0461 * two high priority issues + netfilter mishandling of vlan headers - OOB write -> crash / RCE + UAF in upper-level protocol subsystem - can be triggered by local user -similarly, crash / RCE

[USN-5959-1] Kerberos vulnerabilities [05:32]* 2 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) + CVE-2021-37750 + CVE-2021-36222 * NULL ptr derefs -> crash in kerberos daemon -> DoS

[USN-5960-1] Python vulnerability [05:51]* 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) + CVE-2023-24329 * possibly to bypass blocklists in urllib.parse() simply by prefixing the URLwith a space - blocklisting is not part of upstream functionality but oftenwould be implemented in application / library logic by first using urlparse()to parse the given URL - if prefixed with a space then can get urlparse() tofail to return the correct scheme/hostname - can workaround simply by firstcalling strip() on URL - apparently upstream still discussing whether thecurrent fix is sufficient so watch this space

[USN-5963-1] Vim vulnerabilities [07:14]* 9 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) + CVE-2023-1264 + CVE-2023-1175 + CVE-2023-1170 + CVE-2023-0051 + CVE-2023-0433 + CVE-2023-0288 + CVE-2023-0054 + CVE-2023-0049 + CVE-2022-47024 * moar vim vulns from bug-bounty - all found via fuzzing of vim - all memorycorruption vulns -> DoS / RCE

[USN-5964-1] curl vulnerabilities [07:41]* 5 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) + CVE-2023-27538 + CVE-2023-27536 + CVE-2023-27535 + CVE-2023-27534 + CVE-2023-27533 * various connection reuse issues - eg. would reuse an SSH connection even ifcaller had changed an SSH option - similar for FTP. * mishandling of ~ in SFTP could then allow access to unintended files (wouldexpand even if not the first part of the path)

[USN-5806-3] Ruby vulnerability [08:43]* 1 CVEs addressed in Focal (20.04 LTS) + CVE-2021-33621

[USN-5965-1] TigerVNC vulnerability [08:53]* 1 CVEs addressed in Focal (20.04 LTS) + CVE-2020-26117 * when processing a TLS certificate, would store that internally as acertificate authority - then if client connected to a different server woulduse that stored cert as a CA cert to validate the new server - could thenallow a malicious server to impersonate other servers

[USN-5904-2] SoX regression [09:35]* 9 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) + CVE-2022-31651 + CVE-2022-31650 + CVE-2021-40426 + CVE-2021-3643 + CVE-2021-23210 + CVE-2021-23172 + CVE-2021-23159 + CVE-2019-13590 + CVE-2021-33844 * Fix for one of the vulns fixed in the original update was incomplete

Goings on in Ubuntu Security CommunityUbuntu 20.04.6 LTS Released [09:49]* https://lists.ubuntu.com/archives/ubuntu-announce/2023-March/000287.html * https://wiki.ubuntu.com/FocalFossa/ReleaseSchedule * Wasn’t originally planned to be released

Unlike previous point releases, 20.04.6 is a refresh of the amd64installer media after recent key revocations, re-enabling their usageon Secure Boot enabled systems.

Many other security updates for additional high-impact bug fixes are alsoincluded, with a focus on maintaining stability and compatibility withUbuntu 20.04 LTS.

• TL;DR - recent vulnerabilities in shim and grub meant that we revoked thoseold versions such that they would not boot anymore if updates had beeninstalled - so if wanted to reinstall using the 20.04.5 media it would fail toboot. Can prove this to yourself:

cat /sys/firmware/efi/efivars/SbatLevelRT-605dab50-e046-4300-abb6-3dd810dd8b23

sbat,1,2022052400grub,2

objdump -j .sbat -s grubx64.efi Ubuntu Security at Everything Open 2023 [12:02]* https://ubuntu.com/blog/everything-open-2023-in-melbourne * https://2023.everythingopen.au/schedule/presentation/64/ * Presented about how the Ubuntu Security keeps Ubuntu secure and also gaveadvice on how you can improve the security of your own open source projects

Get in contact* security@ubuntu.com * #ubuntu-security on the Libera.Chat IRC network * ubuntu-hardened mailing list * Security section on discourse.ubuntu.com * @ubuntusecurity@fosstodon.org, @ubuntu_sec on twitter