Alerts This Week
Warning Icon 1 1,146
Alerts This Week
Warning Icon 1 1,146

Ubuntu 20.04 LTS: USN-4457-1 Critical Software Properties Manipulation

ubuntu
Calendar Grey August 12, 2020
Dist Ubuntu Esm H88
Ubuntu Security Alert USN-4458-1 brings attention to a flaw in system-packages across multiple iterations. Apply updates immediately
Software Properties could be made to manipulate the display.

Summary

Software Properties could be made to manipulate the display.

Software Description:

- software-properties: manage the repositories that you install software from

Details:

Jason A. Donenfeld discovered that Software Properties incorrectly filtered

certain escape sequences when displaying PPA descriptions. If a user were

tricked into adding an arbitrary PPA, a remote attacker could possibly

manipulate the screen.

Topics%20covered

Topics Covered

security advisory remote attack update instructions ubuntu manipulation software properties

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
  python3-software-properties     0.98.9.2
  software-properties-common      0.98.9.2

Ubuntu 18.04 LTS:
  python3-software-properties     0.96.24.32.14
  software-properties-common      0.96.24.32.14

Ubuntu 16.04 LTS:
  python-software-properties      0.96.20.10
  python3-software-properties     0.96.20.10
  software-properties-common      0.96.20.10

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-4457-1

CVE-2020-15709

Severity
critical
Lowest
Low
Medium
High
Critical

August 12, 2020

Topics%20covered

Topics Covered

security advisory remote attack update instructions ubuntu manipulation software properties

Package Information

https://launchpad.net/ubuntu/+source/software-properties/0.98.9.2
https://launchpad.net/ubuntu/+source/software-properties/0.96.24.32.14
https://launchpad.net/ubuntu/+source/software-properties/0.96.20.10

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here