==========================================================================
Ubuntu Security Notice USN-6832-1
June 13, 2024

virtuoso-opensource vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Open-Source Edition could be made to crash if it received specially crafted
input.

Software Description:
- virtuoso-opensource: high-performance database

Details:

Jingzhou Fu discovered that Virtuoso Open-Source Edition incorrectly
handled certain crafted SQL statements. An attacker could possibly use
this issue to crash the program, resulting in a denial of service.
(CVE-2023-31607, CVE-2023-31608, CVE-2023-31609, CVE-2023-31610,
CVE-2023-31611, CVE-2023-31616, CVE-2023-31617, CVE-2023-31618,
CVE-2023-31619, CVE-2023-31623, CVE-2023-31625, CVE-2023-31628)

Jingzhou Fu discovered that Virtuoso Open-Source Edition incorrectly
handled certain crafted SQL statements. An attacker could possibly use
this issue to crash the program, resulting in a denial of service.
This issue only affects Ubuntu 22.04 LTS, Ubuntu 23.10 and Ubuntu
24.04 LTS. (CVE-2023-31612, CVE-2023-31613, CVE-2023-31614,
CVE-2023-31615)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
   virtuoso-opensource             7.2.5.1+dfsg1-0.8ubuntu0.1~esm1
                                   Available with Ubuntu Pro
   virtuoso-opensource-7           7.2.5.1+dfsg1-0.8ubuntu0.1~esm1
                                   Available with Ubuntu Pro
   virtuoso-opensource-7-bin       7.2.5.1+dfsg1-0.8ubuntu0.1~esm1
                                   Available with Ubuntu Pro

Ubuntu 23.10
   virtuoso-opensource             7.2.5.1+dfsg1-0.3ubuntu1.1
   virtuoso-opensource-7           7.2.5.1+dfsg1-0.3ubuntu1.1
   virtuoso-opensource-7-bin       7.2.5.1+dfsg1-0.3ubuntu1.1

Ubuntu 22.04 LTS
   virtuoso-opensource             7.2.5.1+dfsg1-0.2ubuntu0.1~esm1
                                   Available with Ubuntu Pro
   virtuoso-opensource-7           7.2.5.1+dfsg1-0.2ubuntu0.1~esm1
                                   Available with Ubuntu Pro
   virtuoso-opensource-7-bin       7.2.5.1+dfsg1-0.2ubuntu0.1~esm1
                                   Available with Ubuntu Pro

Ubuntu 20.04 LTS
   virtuoso-opensource             6.1.6+repack-0ubuntu10+esm1
                                   Available with Ubuntu Pro
   virtuoso-opensource-6.1         6.1.6+repack-0ubuntu10+esm1
                                   Available with Ubuntu Pro
   virtuoso-opensource-6.1-bin     6.1.6+repack-0ubuntu10+esm1
                                   Available with Ubuntu Pro

Ubuntu 18.04 LTS
   virtuoso-opensource             6.1.6+repack-0ubuntu9+esm1
                                   Available with Ubuntu Pro
   virtuoso-opensource-6.1         6.1.6+repack-0ubuntu9+esm1
                                   Available with Ubuntu Pro
   virtuoso-opensource-6.1-bin     6.1.6+repack-0ubuntu9+esm1
                                   Available with Ubuntu Pro

Ubuntu 16.04 LTS
   virtuoso-opensource             6.1.6+repack-0ubuntu5+esm1
                                   Available with Ubuntu Pro
   virtuoso-opensource-6.1         6.1.6+repack-0ubuntu5+esm1
                                   Available with Ubuntu Pro
   virtuoso-opensource-6.1-bin     6.1.6+repack-0ubuntu5+esm1
                                   Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6832-1
   CVE-2023-31607, CVE-2023-31608, CVE-2023-31609, CVE-2023-31610,
   CVE-2023-31611, CVE-2023-31612, CVE-2023-31613, CVE-2023-31614,
   CVE-2023-31615, CVE-2023-31616, CVE-2023-31617, CVE-2023-31618,
   CVE-2023-31619, CVE-2023-31623, CVE-2023-31625, CVE-2023-31628

Package Information:
   https://launchpad.net/ubuntu/+source/virtuoso-opensource/7.2.5.1+dfsg1-0.3ubuntu1.1

Ubuntu 6832-1: Virtuoso Open-Source Edition Security Advisory Updates

June 13, 2024
Open-Source Edition could be made to crash if it received specially crafted input.

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 23.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Open-Source Edition could be made to crash if it received specially crafted input. Software Description: - virtuoso-opensource: high-performance database Details: Jingzhou Fu discovered that Virtuoso Open-Source Edition incorrectly handled certain crafted SQL statements. An attacker could possibly use this issue to crash the program, resulting in a denial of service. (CVE-2023-31607, CVE-2023-31608, CVE-2023-31609, CVE-2023-31610, CVE-2023-31611, CVE-2023-31616, CVE-2023-31617, CVE-2023-31618, CVE-2023-31619, CVE-2023-31623, CVE-2023-31625, CVE-2023-31628) Jingzhou Fu discovered that Virtuoso Open-Source Edition incorrectly handled certain crafted SQL statements. An attacker could possibly use this issue to crash the program, resulting in a denial of service. This issue only affects Ubuntu 22.04 LTS, Ubuntu 23.10 and Ubuntu 24.04 LTS. (CVE-2023-31612, CVE-2023-31613, CVE-2023-31614, CVE-2023-31615)

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS virtuoso-opensource 7.2.5.1+dfsg1-0.8ubuntu0.1~esm1 Available with Ubuntu Pro virtuoso-opensource-7 7.2.5.1+dfsg1-0.8ubuntu0.1~esm1 Available with Ubuntu Pro virtuoso-opensource-7-bin 7.2.5.1+dfsg1-0.8ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 23.10 virtuoso-opensource 7.2.5.1+dfsg1-0.3ubuntu1.1 virtuoso-opensource-7 7.2.5.1+dfsg1-0.3ubuntu1.1 virtuoso-opensource-7-bin 7.2.5.1+dfsg1-0.3ubuntu1.1 Ubuntu 22.04 LTS virtuoso-opensource 7.2.5.1+dfsg1-0.2ubuntu0.1~esm1 Available with Ubuntu Pro virtuoso-opensource-7 7.2.5.1+dfsg1-0.2ubuntu0.1~esm1 Available with Ubuntu Pro virtuoso-opensource-7-bin 7.2.5.1+dfsg1-0.2ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS virtuoso-opensource 6.1.6+repack-0ubuntu10+esm1 Available with Ubuntu Pro virtuoso-opensource-6.1 6.1.6+repack-0ubuntu10+esm1 Available with Ubuntu Pro virtuoso-opensource-6.1-bin 6.1.6+repack-0ubuntu10+esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS virtuoso-opensource 6.1.6+repack-0ubuntu9+esm1 Available with Ubuntu Pro virtuoso-opensource-6.1 6.1.6+repack-0ubuntu9+esm1 Available with Ubuntu Pro virtuoso-opensource-6.1-bin 6.1.6+repack-0ubuntu9+esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS virtuoso-opensource 6.1.6+repack-0ubuntu5+esm1 Available with Ubuntu Pro virtuoso-opensource-6.1 6.1.6+repack-0ubuntu5+esm1 Available with Ubuntu Pro virtuoso-opensource-6.1-bin 6.1.6+repack-0ubuntu5+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6832-1

CVE-2023-31607, CVE-2023-31608, CVE-2023-31609, CVE-2023-31610,

CVE-2023-31611, CVE-2023-31612, CVE-2023-31613, CVE-2023-31614,

CVE-2023-31615, CVE-2023-31616, CVE-2023-31617, CVE-2023-31618,

CVE-2023-31619, CVE-2023-31623, CVE-2023-31625, CVE-2023-31628

Severity
Ubuntu Security Notice USN-6832-1

Package Information

https://launchpad.net/ubuntu/+source/virtuoso-opensource/7.2.5.1+dfsg1-0.3ubuntu1.1

Related News

8.Locks HexConnections CodeGlobe Esm H170
2 - 4 min read
Canonical has made headlines with its groundbreaking long-term support (LTS) service offering to extend far beyond Ubuntu deb packages, promising 12
14.Lock Code WorldMap Esm H170
2 - 4 min read
Government agencies are drawing attention to an issue plaguing open-source communities: memory-unsafe languages. A study entitled " Exploring Memory
11.Locks IsometricPattern Esm H170
2 - 3 min read
Cybersecurity threats continue to emerge regularly, and Promon's security team recently identified one such novel threat, Snowblind. This malware
32.Lock Code Circular Esm H170
2 - 4 min read
The Cybersecurity and Infrastructure Security Agency (CISA) recently added a new Linux kernel privilege escalation bug ( CVE-2024-1086 ) to its
6.EmailConnection Touch Esm H170
2 - 3 min read
Recent security updates for Ubuntu and Debian have been released to address vulnerabilities in Thunderbird, the popular open-source mail and
20.Lock AbstractDigital Circular Esm H170
2 - 3 min read
Google has released fixes for a high-severity Chromium security flaw ( CVE-2024-5274 ) impacting its widely used Chrome browser and other
20.Lock AbstractDigital Circular Esm H170
2 - 4 min read
The recent discovery of a backdoor in Linux's xz compression tool has shed light on cybercriminals' ingenious methods of gaining entry and remaining
19.Laptop Bed Esm H170
2 - 4 min read
Wordfence security researchers recently shed light on an infamous supply chain attack that may have affected as many as 36,000 WordPress websites.

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved