Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Ubuntu 23.10 USN-6487-1 Critical: Avahi Denial Of Service Threat

ubuntu
Calendar Grey November 20, 2023
Dist Ubuntu Esm H88
Upgrade your Ubuntu system to resolve serious vulnerabilities in Avahi triggered by specially designed inputs, which may result in possible system failures.
Avahi could be made to crash if it received specially crafted input.

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.10 - Ubuntu 23.04 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) - Ubuntu 14.04 LTS (Available with Ubuntu Pro) Summary: Avahi could be made to crash if it received specially crafted input. Software Description: - avahi: IPv4LL network address configuration daemon Details: Evgeny Vereshchagin discovered that Avahi contained several reachable assertions, which could lead to intentional assertion failures when specially crafted user input was given. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-38469, CVE-2023-38470, CVE-2023-38471, CVE-2023-38472, CVE-2023-38473)

Topics%20covered

Topics Covered

security advisory denial of service Ubuntu service crash Avahi

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 23.10: avahi-daemon 0.8-10ubuntu1.1 libavahi-client3 0.8-10ubuntu1.1 libavahi-common3 0.8-10ubuntu1.1 libavahi-core7 0.8-10ubuntu1.1 Ubuntu 23.04: avahi-daemon 0.8-6ubuntu1.23.04.2 libavahi-client3 0.8-6ubuntu1.23.04.2 libavahi-common3 0.8-6ubuntu1.23.04.2 libavahi-core7 0.8-6ubuntu1.23.04.2 Ubuntu 22.04 LTS: avahi-daemon 0.8-5ubuntu5.2 libavahi-client3 0.8-5ubuntu5.2 libavahi-common3 0.8-5ubuntu5.2 libavahi-core7 0.8-5ubuntu5.2 Ubuntu 20.04 LTS: avahi-daemon 0.7-4ubuntu7.3 libavahi-client3 0.7-4ubuntu7.3 libavahi-common3 0.7-4ubuntu7.3 libavahi-core7 0.7-4ubuntu7.3 Ubuntu 18.04 LTS (Available with Ubuntu Pro): avahi-daemon 0.7-3.1ubuntu1.3+esm2 libavahi-client3 0.7-3.1ubuntu1.3+esm2 libavahi-common3 0.7-3.1ubuntu1.3+esm2 libavahi-core7 0.7-3.1ubuntu1.3+esm2 Ubuntu 16.04 LTS (Available with Ubuntu Pro): avahi-daemon 0.6.32~rc+dfsg-1ubuntu2.3+esm3 libavahi-client3 0.6.32~rc+dfsg-1ubuntu2.3+esm3 libavahi-common3 0.6.32~rc+dfsg-1ubuntu2.3+esm3 libavahi-core7 0.6.32~rc+dfsg-1ubuntu2.3+esm3 Ubuntu 14.04 LTS (Available with Ubuntu Pro): avahi-daemon 0.6.31-4ubuntu1.3+esm3 libavahi-client3 0.6.31-4ubuntu1.3+esm3 libavahi-common3 0.6.31-4ubuntu1.3+esm3 libavahi-core7 0.6.31-4ubuntu1.3+esm3 In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6487-1

CVE-2023-38469, CVE-2023-38470, CVE-2023-38471, CVE-2023-38472,

CVE-2023-38473

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-6487-1

Topics%20covered

Topics Covered

security advisory denial of service Ubuntu service crash Avahi

Package Information

https://launchpad.net/ubuntu/+source/avahi/0.8-10ubuntu1.1 https://launchpad.net/ubuntu/+source/avahi/0.8-6ubuntu1.23.04.2 https://launchpad.net/ubuntu/+source/avahi/0.8-5ubuntu5.2 https://launchpad.net/ubuntu/+source/avahi/0.7-4ubuntu7.3

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here