Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.0823
libvorbis vulnerability
23 March 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: libvorbis
Publisher: Ubuntu
Operating System: Ubuntu
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2018-5146
Reference: ASB-2018.0060
ESB-2018.0795
ESB-2018.0775
ESB-2018.0774
Original Bulletin:
http://www.ubuntu.com/usn/usn-3604-1
- --------------------------BEGIN INCLUDED TEXT--------------------
USN-3604-1: libvorbis vulnerability
22 March 2018
libvorbis vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
o Ubuntu 17.10
o Ubuntu 16.04 LTS
o Ubuntu 14.04 LTS
Summary
libvorbis could be made to crash or run programs as your login if it opened a
specially crafted file.
Software Description
o libvorbis - The Vorbis General Audio Compression Codec
Details
Richard Zhu discovered that libvorbis incorrectly handled certain sound files.
An attacker could use this to cause libvorbis to crash, resulting in a denial
or service, or possibly execute arbitrary code.
Update instructions
The problem can be corrected by updating your system to the following package
versions:
Ubuntu 17.10
libvorbis0a - 1.3.5-4ubuntu0.2
Ubuntu 16.04 LTS
libvorbis0a - 1.3.5-3ubuntu0.2
Ubuntu 14.04 LTS
libvorbis0a - 1.3.2-1.3ubuntu1.2
To update your system, please follow these instructions: https://
wiki.ubuntu.com/Security/Upgrades.
After a standard system upgrade you need to restart any applications that use
libvorbis, such as Totem and gtkpod, to effect the necessary changes.
References
o https://usn.ubuntu.com/3604-1/
o CVE-2018-5146
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWrRIFYx+lLeg9Ub1AQimxg//Rw4WprWlBYOv9DPgzFL5F951iXSlG0dg
UpHFj3qy0ehYVCT9qCe+lx7HNxN9xRlA0+wxn7CMDbJBJYNdrlQneYQrWwjiDoDn
wVvVZYuus0XKWMfe0O70Pe1MiM1q/kshMTeRz7uAtgoa39uRWztYzGCyeSo2NSnO
2OY7AJdnaikR4JKOwLCb7CqMxXJxA8lGixABH2t13J1a5JsNUpZAo++pSNCEQ/kE
66O3Ue8ZsxfJcCP/2D0A3DWQwgnC8wInPnCO0k2fcCJboeCFdqcQ0+hRf4xwHD0m
hLnOsg8+GhVc8PXoPVx+QqHabE18rVsDrvBNQCpKFs6q4UVcu876aKQa4EjmFpa9
D7fcbpnnOEnAXObgjZgPxEXfzClWWNT02xdqpNyuqtHBANTXI1VK3X0mdvZKR2JU
Vv7OoD4dt2E8mxhNuFoqoD4tfSNGr/ghj8dfBb7z0DbotXDbmJfiOKkyjHxctVzO
0FZLGifq/fG66WMmCQl4U6qg6OmUahhdkO1r3QPR3xDapgX5DoNxmfYLuapnrmtN
nrOtfGlhUd6i2s7B5DcmxSMt2lXakV80z3Dwt5q1w5UrZd7fqNZ1+psT/V9VvGPA
LGqebU602qFNlelk4JU8Mar/F1sETeQlE4YYawIm2kbtczuh7s74qwl4e4Sct/8C
/sXc5/541EU=
=oHdL
-----END PGP SIGNATURE-----