==========================================================================
Ubuntu Security Notice USN-6258-1
July 27, 2023

llvm-toolchain-13, llvm-toolchain-14, llvm-toolchain-15 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.04
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in LLVM Toolchain.

Software Description:
- llvm-toolchain-13: C, C++ and Objective-C compiler
- llvm-toolchain-14: C, C++ and Objective-C compiler
- llvm-toolchain-15: C, C++ and Objective-C compiler

Details:

It was discovered that LLVM Toolchain did not properly manage memory under
certain circumstances. If a user were tricked into opening a specially
crafted MLIR file, an attacker could possibly use this issue to cause LLVM
Toolchain to crash, resulting in a denial of service. (CVE-2023-29932,
CVE-2023-29934, CVE-2023-29939)

It was discovered that LLVM Toolchain did not properly manage memory under 
certain circumstances. If a user were tricked into opening a specially     
crafted MLIR file, an attacker could possibly use this issue to cause LLVM 
Toolchain to crash, resulting in a denial of service. This issue only
affected llvm-toolchain-15. (CVE-2023-29933)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
  llvm-13                         1:13.0.1-11ubuntu14.1
  llvm-13-tools                   1:13.0.1-11ubuntu14.1
  llvm-14                         1:14.0.6-12ubuntu0.23.04.1
  llvm-14-tools                   1:14.0.6-12ubuntu0.23.04.1
  llvm-15                         1:15.0.7-3ubuntu0.23.04.1
  llvm-15-tools                   1:15.0.7-3ubuntu0.23.04.1
  mlir-13-tools                   1:13.0.1-11ubuntu14.1
  mlir-14-tools                   1:14.0.6-12ubuntu0.23.04.1
  mlir-15-tools                   1:15.0.7-3ubuntu0.23.04.1

Ubuntu 22.04 LTS:
  llvm-13                         1:13.0.1-2ubuntu2.2
  llvm-13-tools                   1:13.0.1-2ubuntu2.2
  llvm-14                         1:14.0.0-1ubuntu1.1
  llvm-14-tools                   1:14.0.0-1ubuntu1.1
  llvm-15                         1:15.0.7-0ubuntu0.22.04.3
  llvm-15-tools                   1:15.0.7-0ubuntu0.22.04.3
  mlir-13-tools                   1:13.0.1-2ubuntu2.2
  mlir-14-tools                   1:14.0.0-1ubuntu1.1
  mlir-15-tools                   1:15.0.7-0ubuntu0.22.04.3

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-6258-1
  CVE-2023-29932, CVE-2023-29933, CVE-2023-29934, CVE-2023-29939

Package Information:
  https://launchpad.net/ubuntu/+source/llvm-toolchain-13/1:13.0.1-11ubuntu14.1
  https://launchpad.net/ubuntu/+source/llvm-toolchain-14/1:14.0.6-12ubuntu0.23.04.1
  https://launchpad.net/ubuntu/+source/llvm-toolchain-15/1:15.0.7-3ubuntu0.23.04.1
  https://launchpad.net/ubuntu/+source/llvm-toolchain-13/1:13.0.1-2ubuntu2.2
  https://launchpad.net/ubuntu/+source/llvm-toolchain-14/1:14.0.0-1ubuntu1.1
  https://launchpad.net/ubuntu/+source/llvm-toolchain-15/1:15.0.7-0ubuntu0.22.04.3

Ubuntu 6258-1: LLVM Toolchain vulnerabilities

July 27, 2023
Several security issues were fixed in LLVM Toolchain.

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.04 - Ubuntu 22.04 LTS Summary: Several security issues were fixed in LLVM Toolchain. Software Description: - llvm-toolchain-13: C, C++ and Objective-C compiler - llvm-toolchain-14: C, C++ and Objective-C compiler - llvm-toolchain-15: C, C++ and Objective-C compiler Details: It was discovered that LLVM Toolchain did not properly manage memory under certain circumstances. If a user were tricked into opening a specially crafted MLIR file, an attacker could possibly use this issue to cause LLVM Toolchain to crash, resulting in a denial of service. (CVE-2023-29932, CVE-2023-29934, CVE-2023-29939) It was discovered that LLVM Toolchain did not properly manage memory under certain circumstances. If a user were tricked into opening a specially crafted MLIR file, an attacker could possibly use this issue to cause LLVM Toolchain to crash, resulting in a denial of service. This issue only affected llvm-toolchain-15. (CVE-2023-29933)

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 23.04: llvm-13 1:13.0.1-11ubuntu14.1 llvm-13-tools 1:13.0.1-11ubuntu14.1 llvm-14 1:14.0.6-12ubuntu0.23.04.1 llvm-14-tools 1:14.0.6-12ubuntu0.23.04.1 llvm-15 1:15.0.7-3ubuntu0.23.04.1 llvm-15-tools 1:15.0.7-3ubuntu0.23.04.1 mlir-13-tools 1:13.0.1-11ubuntu14.1 mlir-14-tools 1:14.0.6-12ubuntu0.23.04.1 mlir-15-tools 1:15.0.7-3ubuntu0.23.04.1 Ubuntu 22.04 LTS: llvm-13 1:13.0.1-2ubuntu2.2 llvm-13-tools 1:13.0.1-2ubuntu2.2 llvm-14 1:14.0.0-1ubuntu1.1 llvm-14-tools 1:14.0.0-1ubuntu1.1 llvm-15 1:15.0.7-0ubuntu0.22.04.3 llvm-15-tools 1:15.0.7-0ubuntu0.22.04.3 mlir-13-tools 1:13.0.1-2ubuntu2.2 mlir-14-tools 1:14.0.0-1ubuntu1.1 mlir-15-tools 1:15.0.7-0ubuntu0.22.04.3 In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6258-1

CVE-2023-29932, CVE-2023-29933, CVE-2023-29934, CVE-2023-29939

Severity
Ubuntu Security Notice USN-6258-1

Package Information

https://launchpad.net/ubuntu/+source/llvm-toolchain-13/1:13.0.1-11ubuntu14.1 https://launchpad.net/ubuntu/+source/llvm-toolchain-14/1:14.0.6-12ubuntu0.23.04.1 https://launchpad.net/ubuntu/+source/llvm-toolchain-15/1:15.0.7-3ubuntu0.23.04.1 https://launchpad.net/ubuntu/+source/llvm-toolchain-13/1:13.0.1-2ubuntu2.2 https://launchpad.net/ubuntu/+source/llvm-toolchain-14/1:14.0.0-1ubuntu1.1 https://launchpad.net/ubuntu/+source/llvm-toolchain-15/1:15.0.7-0ubuntu0.22.04.3

Related News

5.ShakingHands Esm H320
3 - 5 min read
There has been a promising shift in the tech industry, with major companies pledging to release products with built-in security features. This
21.Globe RadiatingCode Esm H320
2 - 3 min read
The recent discovery of a backdoor in XZ Utils , a widely used Linux tool, raises concerns about the security of the open-source ecosystem. While
13.Lock StylizedMotherboard Esm H320
1 - 2 min read
Spiral Linux is a Debian-based distribution that offers a range of desktop environments, making it stand out from other Linux distributions. In
32.Lock Code Circular Esm H320
2 - 3 min read
Two critical security vulnerabilities were found in pgAdmin, the open-source administration tool for PostgreSQL . The vulnerabilities assigned
1.Penguin Landscape Esm H320
2 - 3 min read
The recent release of AlmaLinux 9.4 , closely aligned with Red Hat Enterprise Linux (RHEL) 9.4 , presents Linux admins and infosec professionals
11.Locks IsometricPattern Esm H320
2 - 3 min read
The upcoming release of Linux Mint 22 will introduce significant changes, particularly in handling XApp , GNOME applications, and the Software
2.Motherboard Esm H320
2 - 3 min read
German software engineer Lennart Poettering recently presented run0 , a new tool in systemd v256 that aims to address the security concerns
22.Lock ScreenEffect Esm H320
2 - 3 min read
Red Hat recently released its newest enterprise Linux distro, Red Hat Enterprise Linux (RHEL) 9.4 , which introduces several features designed to
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved