This repository has been archived by the owner on Mar 16, 2022. It is now read-only.
Releases: cloudfoundry/cflinuxfs2
Releases · cloudfoundry/cflinuxfs2
1.252.0
-ii linux-libc-dev:amd64 3.13.0-162.212 amd64 Linux Kernel Headers for development
+ii linux-libc-dev:amd64 3.13.0-163.213 amd64 Linux Kernel Headers for development
1.251.0
Notably, this release addresses:
USN-3829-1 USN-3829-1: Git vulnerabilities:
- CVE-2017-15298: Git through 2.14.2 mishandles layers of tree objects, which allows remoteattackers to cause a denial of service (memory consumption) via a craftedrepository, aka a Git bomb. This can also have an impact of diskconsumption; however, an affected process typically would not survive itsattempt to build the data structure in memory before writing to disk.
- CVE-2018-19486: Git before 2.19.2 on Linux and UNIX executes commands from the currentworking directory (as if '.' were at the end of $PATH) in certain casesinvolving the run_command() API and run-command.c, because there was adangerous change from execvp to execv during 2017.
-ii git 1:1.9.1-1ubuntu0.9 amd64 fast, scalable, distributed revision control system
-ii git-core 1:1.9.1-1ubuntu0.9 all fast, scalable, distributed revision control system (obsolete)
-ii git-man 1:1.9.1-1ubuntu0.9 all fast, scalable, distributed revision control system (manual pages)
+ii git 1:1.9.1-1ubuntu0.10 amd64 fast, scalable, distributed revision control system
+ii git-core 1:1.9.1-1ubuntu0.10 all fast, scalable, distributed revision control system (obsolete)
+ii git-man 1:1.9.1-1ubuntu0.10 all fast, scalable, distributed revision control system (manual pages)
1.250.0
Notably, this release addresses:
USN-3821-2 USN-3821-2: Linux kernel (Xenial HWE) vulnerabilities:
- CVE-2018-10880: Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4filesystem code when mounting and writing to a crafted ext4 image inext4_update_inline_data(). An attacker could use this to cause a systemcrash and a denial of service.
- CVE-2018-13053: The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linuxkernel through 4.17.3 has an integer overflow via a large relative timeoutbecause ktime_add_safe is not used.
- CVE-2018-13096: An issue was discovered in fs/f2fs/super.c in the Linux kernel through4.17.3. A denial of service (out-of-bounds memory access and BUG) can occurupon encountering an abnormal bitmap size when mounting a crafted f2fsimage.
- CVE-2018-14609: An issue was discovered in the Linux kernel through 4.17.10. There is aninvalid pointer dereference in __del_reloc_root() in fs/btrfs/relocation.cwhen mounting a crafted btrfs image, related to removing reloc rb_treeswhen reloc control has not been initialized.
- CVE-2018-14617: An issue was discovered in the Linux kernel through 4.17.10. There is aNULL pointer dereference and panic in hfsplus_lookup() in fs/hfsplus/dir.cwhen opening a file (that is purportedly a hard link) in an hfs+ filesystemthat has malformed catalog data, and is mounted read-only without ametadata directory.
- CVE-2018-17972: An issue was discovered in the proc_pid_stack function in fs/proc/base.c inthe Linux kernel through 4.18.11. It does not ensure that only root mayinspect the kernel stack of an arbitrary task, allowing a local attacker toexploit racy stack unwinding and leak kernel task stack contents.
- CVE-2018-18021: arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on thearm64 platform mishandles the KVM_SET_ON_REG ioctl. This is exploitable byattackers who can create virtual machines. An attacker can arbitrarilyredirect the hypervisor flow of control (with full register control). Anattacker can also cause a denial of service (hypervisor panic) via anillegal exception return. This occurs because of insufficient restrictionson userspace access to the core register file, and because PSTATE.Mvalidation does not prevent unintended execution modes.
-ii libldap-2.4-2:amd64 2.4.31-1+nmu2ubuntu8.4 amd64 OpenLDAP libraries
-ii libldap2-dev:amd64 2.4.31-1+nmu2ubuntu8.4 amd64 OpenLDAP development libraries
+ii libldap-2.4-2:amd64 2.4.31-1+nmu2ubuntu8.5 amd64 OpenLDAP libraries
+ii libldap2-dev:amd64 2.4.31-1+nmu2ubuntu8.5 amd64 OpenLDAP development libraries
-ii mercurial 2.8.2-1ubuntu1.3 amd64 easy-to-use, scalable distributed version control system
-ii mercurial-common 2.8.2-1ubuntu1.3 all easy-to-use, scalable distributed version control system (common files)
+ii mercurial 2.8.2-1ubuntu1.4 amd64 easy-to-use, scalable distributed version control system
+ii mercurial-common 2.8.2-1ubuntu1.4 all easy-to-use, scalable distributed version control system (common files)
1.249.0
-ii linux-libc-dev:amd64 3.13.0-161.211 amd64 Linux Kernel Headers for development
+ii linux-libc-dev:amd64 3.13.0-162.212 amd64 Linux Kernel Headers for development
1.248.0
Notably, this release addresses:
USN-3817-1 USN-3817-1: Python vulnerabilities:
- CVE-2018-1000030: Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as aHeap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerableand it appears that Python 2.7.17 and prior may also be vulnerable howeverthis has not been confirmed. The vulnerability lies when multiply threadsare handling large amounts of data. In both cases there is essentially arace condition that occurs. For the Heap-Buffer-Overflow, Thread 2 iscreating the size for a buffer, but Thread1 is already writing to thebuffer without knowing how much to write. So when a large amount of data isbeing processed, it is very easy to cause memory corruption using aHeap-Buffer-Overflow. As for the Use-After-Free,Thread3->Malloc->Thread1->Free's->Thread2-Re-uses-Free'd Memory. The PSRThas stated that this is not a security vulnerability due to the fact thatthe attacker must be able to run code, however in some situations, such asfunction as a service, this vulnerability can potentially be used by anattacker to violate a trust boundary, as such the DWF feels this issuedeserves a CVE.
- CVE-2018-1000802: Python Software Foundation Python (CPython) version 2.7 contains a CWE-77:Improper Neutralization of Special Elements used in a Command ('CommandInjection') vulnerability in shutil module (make_archive function) that canresult in Denial of service, Information gain via injection of arbitraryfiles on the system or entire drive. This attack appear to be exploitablevia Passage of unfiltered user input to the function. This vulnerabilityappears to have been fixed in after commitadd531a1e55b0a739b0f42582f1c9747e5649ace.
- CVE-2018-1060: python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 isvulnerable to catastrophic backtracking in pop3lib's apop() method. Anattacker could use this flaw to cause denial of service.
- CVE-2018-1061: python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 isvulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.
- CVE-2018-14647: Python's elementtree C accelerator failed to initialise Expat's hash saltduring initialization. This could make it easy to conduct denial of serviceattacks against Expat by constructing an XML document that would causepathological hash collisions in Expat's internal data structures, consuminglarge amounts CPU and RAM. Python 3.8, 3.7, 3.6, 3.5, 3.4, 2.7 are believedto be vulnerable.
USN-3815-1 USN-3815-1: gettext vulnerability:
- CVE-2018-18751: An issue was discovered in GNU gettext 0.19.8. There is a double free indefault_add_message in read-catalog.c, related to an invalid free inpo_gram_parse in po-gram-gen.y, as demonstrated by lt-msgfmt.
-ii libpython2.7-minimal:amd64 2.7.6-8ubuntu0.4 amd64 Minimal subset of the Python language (version 2.7)
-ii libpython2.7-stdlib:amd64 2.7.6-8ubuntu0.4 amd64 Interactive high-level object-oriented language (standard library, version 2.7)
+ii libpython2.7-minimal:amd64 2.7.6-8ubuntu0.5 amd64 Minimal subset of the Python language (version 2.7)
+ii libpython2.7-stdlib:amd64 2.7.6-8ubuntu0.5 amd64 Interactive high-level object-oriented language (standard library, version 2.7)
-ii libpython3.4:amd64 3.4.3-1ubuntu1~14.04.6 amd64 Shared Python runtime library (version 3.4)
-ii libpython3.4-minimal:amd64 3.4.3-1ubuntu1~14.04.6 amd64 Minimal subset of the Python language (version 3.4)
-ii libpython3.4-stdlib:amd64 3.4.3-1ubuntu1~14.04.6 amd64 Interactive high-level object-oriented language (standard library, version 3.4)
+ii libpython3.4:amd64 3.4.3-1ubuntu1~14.04.7 amd64 Shared Python runtime library (version 3.4)
+ii libpython3.4-minimal:amd64 3.4.3-1ubuntu1~14.04.7 amd64 Minimal subset of the Python language (version 3.4)
+ii libpython3.4-stdlib:amd64 3.4.3-1ubuntu1~14.04.7 amd64 Interactive high-level object-oriented language (standard library, version 3.4)
-ii python2.7 2.7.6-8ubuntu0.4 amd64 Interactive high-level object-oriented language (version 2.7)
-ii python2.7-minimal 2.7.6-8ubuntu0.4 amd64 Minimal subset of the Python language (version 2.7)
+ii python2.7 2.7.6-8ubuntu0.5 amd64 Interactive high-level object-oriented language (version 2.7)
+ii python2.7-minimal 2.7.6-8ubuntu0.5 amd64 Minimal subset of the Python language (version 2.7)
-ii python3.4 3.4.3-1ubuntu1~14.04.6 amd64 Interactive high-level object-oriented language (version 3.4)
-ii python3.4-minimal 3.4.3-1ubuntu1~14.04.6 amd64 Minimal subset of the Python language (version 3.4)
+ii python3.4 3.4.3-1ubuntu1~14.04.7 amd64 Interactive high-level object-oriented language (version 3.4)
+ii python3.4-minimal 3.4.3-1ubuntu1~14.04.7 amd64 Minimal subset of the Python language (version 3.4)
1.247.0
Notably, this release addresses:
USN-3809-1 USN-3809-1: OpenSSH vulnerabilities:
-ii openssh-client 1:6.6p1-2ubuntu2.10 amd64 secure shell (SSH) client, for secure access to remote machines
-ii openssh-server 1:6.6p1-2ubuntu2.10 amd64 secure shell (SSH) server, for secure access from remote machines
-ii openssh-sftp-server 1:6.6p1-2ubuntu2.10 amd64 secure shell (SSH) sftp server module, for SFTP access from remote machines
+ii openssh-client 1:6.6p1-2ubuntu2.11 amd64 secure shell (SSH) client, for secure access to remote machines
+ii openssh-server 1:6.6p1-2ubuntu2.11 amd64 secure shell (SSH) server, for secure access from remote machines
+ii openssh-sftp-server 1:6.6p1-2ubuntu2.11 amd64 secure shell (SSH) sftp server module, for SFTP access from remote machines
1.246.0
+ii ubuntu-advantage-tools 10ubuntu0.14.04.2 all management tools for Ubuntu Advantage
-ii ubuntu-minimal 1.325 amd64 Minimal core of Ubuntu
+ii ubuntu-minimal 1.325.1 amd64 Minimal core of Ubuntu
1.245.0
Notably, this release addresses:
USN-3805-1 USN-3805-1: curl vulnerabilities:
-ii curl 7.35.0-1ubuntu2.17 amd64 command line tool for transferring data with URL syntax
+ii curl 7.35.0-1ubuntu2.19 amd64 command line tool for transferring data with URL syntax
-ii libcurl3:amd64 7.35.0-1ubuntu2.17 amd64 easy-to-use client-side URL transfer library (OpenSSL flavour)
-ii libcurl3-gnutls:amd64 7.35.0-1ubuntu2.17 amd64 easy-to-use client-side URL transfer library (GnuTLS flavour)
-ii libcurl4-openssl-dev:amd64 7.35.0-1ubuntu2.17 amd64 development files and documentation for libcurl (OpenSSL flavour)
+ii libcurl3:amd64 7.35.0-1ubuntu2.19 amd64 easy-to-use client-side URL transfer library (OpenSSL flavour)
+ii libcurl3-gnutls:amd64 7.35.0-1ubuntu2.19 amd64 easy-to-use client-side URL transfer library (GnuTLS flavour)
+ii libcurl4-openssl-dev:amd64 7.35.0-1ubuntu2.19 amd64 development files and documentation for libcurl (OpenSSL flavour)
-ii tzdata 2018f-0ubuntu0.14.04 all time zone and daylight-saving time data
+ii tzdata 2018g-0ubuntu0.14.04 all time zone and daylight-saving time data
1.244.0
Notably, this release addresses:
USN-3800-1 USN-3800-1: audiofile vulnerabilities:
-ii libaudiofile1:amd64 0.3.6-2ubuntu0.14.04.2 amd64 Open-source version of SGI's audiofile library
+ii libaudiofile1:amd64 0.3.6-2ubuntu0.14.04.3 amd64 Open-source version of SGI's audiofile library
-rc libmysqlclient18:amd64 5.5.61-0ubuntu0.14.04.1 amd64 MySQL database client library
+rc libmysqlclient18:amd64 5.5.62-0ubuntu0.14.04.1 amd64 MySQL database client library
-ii mysql-common 5.5.61-0ubuntu0.14.04.1 all MySQL database common files, e.g. /etc/mysql/my.cnf
+ii mysql-common 5.5.62-0ubuntu0.14.04.1 all MySQL database common files, e.g. /etc/mysql/my.cnf
-ii tzdata 2018e-0ubuntu0.14.04 all time zone and daylight-saving time data
+ii tzdata 2018f-0ubuntu0.14.04 all time zone and daylight-saving time data
1.243.0
Notably, this release addresses:
USN-3797-2 USN-3797-2: Linux kernel (Xenial HWE) vulnerabilities:
-ii linux-libc-dev:amd64 3.13.0-160.210 amd64 Linux Kernel Headers for development
+ii linux-libc-dev:amd64 3.13.0-161.211 amd64 Linux Kernel Headers for development