PostgreSQL could be made to run programs when creating or updating extensions.. =========================================================================Ubuntu Security Notice USN-5571-1 August 18, 2022 postgresql-10, postgresql-12, postgresql-14 vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: PostgreSQL could be made to run programs when creating or updating extensions. Software Description: - postgresql-14: Object-relational SQL database - postgresql-12: Object-relational SQL database - postgresql-10: Object-relational SQL database Details: Sven Klemm discovered that PostgreSQL incorrectly handled extensions. An attacker could possibly use this issue to execute arbitrary code when extensions are created or updated. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS: postgresql-14 14.5-0ubuntu0.22.04.1 Ubuntu 20.04 LTS: postgresql-12 12.12-0ubuntu0.20.04.1 Ubuntu 18.04 LTS: postgresql-10 10.22-0ubuntu0.18.04.1 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart PostgreSQL to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5571-1 CVE-2022-2625 Package Information: https://launchpad.net/ubuntu/+source/postgresql-14/14.5-0ubuntu0.22.04.1 https://launchpad.net/ubuntu/+source/postgresql-12/12.12-0ubuntu0.20.04.1 https://launchpad.net/ubuntu/+source/postgresql-10/10.22-0ubuntu0.18.04.1 . Ensure your PostgreSQL systems are updated promptly to address vulnerabilities related to the execution of unauthorized code during the upgrade of extensions.. PostgreSQL Security, Ubuntu Update, Extension Management. . Severity:Important. LinuxSecurity.com Team
Firefox 60.6.2 ESR repairs a certificate chain issue that caused extensions to be disabled in the past few days. More information, and details of known remaining issues, can be found at https://www.firefox.com/en-US/firefox/60.6.2/releasenotes/?redirect_source=mozilla-org and . Package : firefox-esr Version : 60.6.2esr-1~deb8u1 Debian Bug : 928415 928449 928509 Firefox 60.6.2 ESR repairs a certificate chain issue that caused extensions to be disabled in the past few days. More information, and details of known remaining issues, can be found at https://www.firefox.com/en-US/firefox/60.6.2/releasenotes/?redirect_source=mozilla-org and Installing this update will re-enable any extensions that were disabled due to this issue. Extensions installed from Debian packages were not affected. For Debian 8 "Jessie", this problem has been fixed in version 60.6.2esr-1~deb8u1. We recommend that you upgrade your firefox-esr packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Firefox ESR 60.6.2 resolves a certificate chain problem that hinders extension functionality. Users on Debian 8 are advised to upgrade.. Firefox ESR, Debian Security, Certificate Issue, Update Recommendation. . Severity: Critical. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.