Alerts This Week
Warning Icon 1 640
Alerts This Week
Warning Icon 1 640

Ubuntu 20.10: USN-4562-2 Moderate: Kramdown Code Execution Risk

ubuntu
Calendar Grey October 26, 2020
Dist Ubuntu Esm H88
The Kramdown flaw in Ubuntu poses risks of system failures or unauthorized script runs, which may compromise the integrity of confidential information.
kramdown could be made to crash, run programs, or leak sensitive information if it opened a specially crafted file.

Summary

kramdown could be made to crash, run programs, or leak sensitive information if

it opened a specially crafted file.

Software Description:

- ruby-kramdown: Fast, pure-Ruby Markdown-superset converter - ruby library

Details:

It was discovered that kramdown insecurely handled certain crafted input. An

attacker could use this vulnerability to read restricted files or execute

arbitrary code.

Topics%20covered

Topics Covered

security advisory information leak code execution Ubuntu kramdown

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
  kramdown                        1.17.0-4ubuntu0.20.10.1
  ruby-kramdown                   1.17.0-4ubuntu0.20.10.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-4562-2

https://ubuntu.com/security/notices/USN-4562-1

CVE-2020-14001

October 26, 2020

Topics%20covered

Topics Covered

security advisory information leak code execution Ubuntu kramdown

Package Information

https://launchpad.net/ubuntu/+source/ruby-kramdown/1.17.0-4ubuntu0.20.10.1
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here