Podman could be made to expose sensitive information or execute binary code.. ========================================================================== Ubuntu Security Notice USN-6295-1 August 16, 2023 libpod vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS Summary: Podman could be made to expose sensitive information or execute binary code. Software Description: - libpod: engine to run OCI-based containers in Pods Details: It was discovered that Podman incorrectly handled certain supplementary groups. An attacker could possibly use this issue to expose sensitive information or execute binary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS: podman 3.4.4+ds1-1ubuntu1.22.04.2 podman-docker 3.4.4+ds1-1ubuntu1.22.04.2 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6295-1 CVE-2022-2989 Package Information: https://launchpad.net/ubuntu/+source/libpod/3.4.4+ds1-1ubuntu1.22.04.2 . Podman may leak confidential data or run executable files on Ubuntu 22.04 LTS. Implement a fix for this vulnerability immediately!. Podman Vulnerability, Ubuntu 22.04, Libpod Threat, Sensitive Information Leak. . Severity: Critical. LinuxSecurity.com Team
An update for okular is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: okular security update Advisory ID: RHSA-2020:4024-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:4024 Issue date: 2020-09-29 CVE Names: CVE-2020-9359 ==================================================================== 1. Summary: An update for okular is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64le, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: Okular is a universal document viewer developed by KDE supporting different kinds of documents, like PDF, Postscript, DjVu, CHM, XPS, ePub and others. Security Fix(es): * okular: local binary execution via specially crafted PDF files (CVE-2020-9359) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes linked from the References section. 4. Solution: Fordetails on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1815651 - CVE-2020-9359 okular: local binary execution via specially crafted PDF files 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: okular-4.10.5-9.el7.src.rpm x86_64: okular-4.10.5-9.el7.x86_64.rpm okular-debuginfo-4.10.5-9.el7.i686.rpm okular-debuginfo-4.10.5-9.el7.x86_64.rpm okular-libs-4.10.5-9.el7.i686.rpm okular-libs-4.10.5-9.el7.x86_64.rpm okular-part-4.10.5-9.el7.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: okular-debuginfo-4.10.5-9.el7.i686.rpm okular-debuginfo-4.10.5-9.el7.x86_64.rpm okular-devel-4.10.5-9.el7.i686.rpm okular-devel-4.10.5-9.el7.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: okular-4.10.5-9.el7.src.rpm ppc64le: okular-4.10.5-9.el7.ppc64le.rpm okular-debuginfo-4.10.5-9.el7.ppc64le.rpm okular-devel-4.10.5-9.el7.ppc64le.rpm okular-libs-4.10.5-9.el7.ppc64le.rpm okular-part-4.10.5-9.el7.ppc64le.rpm x86_64: okular-4.10.5-9.el7.x86_64.rpm okular-debuginfo-4.10.5-9.el7.i686.rpm okular-debuginfo-4.10.5-9.el7.x86_64.rpm okular-devel-4.10.5-9.el7.i686.rpm okular-devel-4.10.5-9.el7.x86_64.rpm okular-libs-4.10.5-9.el7.i686.rpm okular-libs-4.10.5-9.el7.x86_64.rpm okular-part-4.10.5-9.el7.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: okular-4.10.5-9.el7.src.rpm x86_64: okular-4.10.5-9.el7.x86_64.rpm okular-debuginfo-4.10.5-9.el7.i686.rpm okular-debuginfo-4.10.5-9.el7.x86_64.rpm okular-devel-4.10.5-9.el7.i686.rpm okular-devel-4.10.5-9.el7.x86_64.rpm okular-libs-4.10.5-9.el7.i686.rpm okular-libs-4.10.5-9.el7.x86_64.rpm okular-part-4.10.5-9.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7.References: https://access.redhat.com/security/cve/CVE-2020-9359 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBX3OgeNzjgjWX9erEAQg88A//RVUXNMbVYSAOxgp1nM8YzzqUmMXM8C4P SKCEgpsw8nYhUKYJKLySZkfSAApk2IXf6tA7b7UkO6CzDvwjhU9OEoXneJo2GXO3 /QPpBCcLfKJ2Mz01PhY7m/ZDOcl7h+Nz3N89k5Ys+KXnUfB0B/cCye5OdhHZk+bM gxDbfew2fOG5QTMUMvSwF0DNhkHhukboqlUjvKE6YTkJSqv7EgccfQyI9kaTjeWp GQUGTkv6nwAx43AtiYI/dMfpJX0lQaEbsicpKTsbmahpyXYIXkbeZWd7bsQJcG/d ttEN1T5i+++uUJv/nCaUux6TBsiKuqOigIMyPdsj2IQeT6PmDl+Ir+PAPpRhOFkh roO9XRUHI71DUJCz9oU4ANlKI9CxzlJgy5ekH7ufHCSWbkGqC7torD6rLBah3NqQ AWKx+0Y7NlFVZ8+7v2XplxpYZ7pEE5psBo3erv5+MS15mvL7rq37Q4M40rV7qPAA 2P04p7yoT9FIP5pPZSUhywDaRxKMoJhVRWaEeUz6BhewuDGvi9murSwa3JzeqzRh GLEp2pnhaetVCg2IqhhbW1UWqnoQMOPvx1JMNMMkdOoVF9oOqWJacAWaQhALyM13 4pEyd3GAmlyixqUI1duHBU5rhAAlgiNFpJnCiI3MZpBmlLSP1yGQpML9EaI6Jq6+ RXEXr6QrRzo=Ck++ -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Security fix for CVE-2020-9359. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-dcde488e68 2020-03-31 00:15:07.171312 --------------------------------------------------------------------------------Name : okular Product : Fedora 32 Version : 19.12.3 Release : 2.fc32 URL : https://apps.kde.org//graphics/okular/ Summary : A document viewer Description : A document viewer. --------------------------------------------------------------------------------Update Information: Security fix for CVE-2020-9359 --------------------------------------------------------------------------------ChangeLog: * Sun Mar 22 2020 Rex Dieter - 19.12.3-2 - Security fix for CVE-2020-9359 (#1815651,1815652) * Fri Mar 6 2020 Rex Dieter - 19.12.3-1 - 19.12.3 * Tue Feb 4 2020 Rex Dieter - 19.12.2-1 - 19.12.2 --------------------------------------------------------------------------------References: [ 1 ] Bug #1815651 - CVE-2020-9359 okular: local binary execution via specially crafted PDF files https://bugzilla.redhat.com/show_bug.cgi?id=1815651 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-dcde488e68' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Get the latest Linux and open source security news straight to your inbox.