Weak session cookies generated using libICE could allow sensitive information to be exposed.. =========================================================================Ubuntu Security Notice USN-5744-1 November 28, 2022 libice vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 ESM Summary: Weak session cookies generated using libICE could allow sensitive information to be exposed. Software Description: - libice: X11 Inter-Client Exchange library (development headers) Details: It was discovered that libICE was using a weak mechanism to generate the session cookies. A local attacker could possibly use this issue to perform a privilege escalation attack. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS: libice-dev 2:1.0.9-2ubuntu0.18.04.1 libice6 2:1.0.9-2ubuntu0.18.04.1 Ubuntu 16.04 ESM: libice-dev 2:1.0.9-1ubuntu0.16.04.1+esm1 libice6 2:1.0.9-1ubuntu0.16.04.1+esm1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5744-1 CVE-2017-2626 Package Information: https://launchpad.net/ubuntu/+source/libice/2:1.0.9-2ubuntu0.18.04.1 . Insecure session tokens in libICE could reveal confidential data. Ensure your Ubuntu systems are updated to enhance security.. libICE vulnerability, Ubuntu 18.04 LTS, privilege escalation. . Severity: Critical. LinuxSecurity.com Team
It has been found, that libice, an X11 Inter-Client Exchange library, uses weak entropy to generate keys. . Package : libice Version : 2:1.0.9-1+deb8u1 CVE ID : CVE-2017-2626 It has been found, that libice, an X11 Inter-Client Exchange library, uses weak entropy to generate keys. Using arc4random_buf() from libbsd should avoid this flaw. For Debian 8 "Jessie", this problem has been fixed in version 2:1.0.9-1+deb8u1. We recommend that you upgrade your libice packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Important notification concerning libice on Debian regarding insufficient entropy for secure key generation. Essential patch ready for implementation immediately.. libice, security update, Debian LTS, entropy flaw. . Severity: Critical. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.