diff --git a/travis/artifacts/audits.d/bass/usn-3722-5.ini b/travis/artifacts/audits.d/bass/usn-3722-5.ini new file mode 100644 index 0000000..6ef90b5 --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3722-5.ini @@ -0,0 +1,29 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3722-5] +vuln-name = "USN-3722-5" +vuln-primary-link = "https://usn.ubuntu.com/3722-5/" +vuln-priority = 4 +vuln-additional-links = {'USN-3722-1': 'https://usn.ubuntu.com/usn/usn-3722-1', 'LP: 1792051': 'https://launchpad.net/bugs/1792051'} +vuln-short-description = "USN-3722-1 introduced a regression in ClamAV." +vuln-long-description = USN-3722-1 fixed vulnerabilities in ClamAV. The new package introduced an + issue which caused dpkg-reconfigure to enter an infinite loop. This update + fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that ClamAV incorrectly handled parsing certain HWP + files. A remote attacker could use this issue to cause ClamAV to hang, + resulting in a denial of service. (CVE-2018-0360) It was discovered that ClamAV incorrectly handled parsing certain PDF + files. A remote attacker could use this issue to cause ClamAV to hang, + resulting in a denial of service. (CVE-2018-0361) Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 18.04 LTS + clamav - 0.100.1+dfsg-1ubuntu0.18.04.3 + Ubuntu 16.04 LTS + clamav - 0.100.1+dfsg-1ubuntu0.16.04.3 + Ubuntu 14.04 LTS + clamav - 0.100.1+dfsg-1ubuntu0.14.04.4 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. In general, a standard system update will make all the necessary changes. References + USN-3722-1 + LP: 1792051 + +comparisons = {'bionic-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['clamav', 'clamav:amd64'], 'comparison-match-value': ['0.100.1+dfsg-1ubuntu0.18.04.3', '0.100.1+dfsg-1ubuntu0.18.04.3']}, 'xenial-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['clamav', 'clamav:amd64'], 'comparison-match-value': ['0.100.1+dfsg-1ubuntu0.16.04.3', '0.100.1+dfsg-1ubuntu0.16.04.3']}, 'trusty-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['clamav', 'clamav:amd64'], 'comparison-match-value': ['0.100.1+dfsg-1ubuntu0.14.04.4', '0.100.1+dfsg-1ubuntu0.14.04.4']}} +filters = {'bionic-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['bionic']}, 'xenial-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['xenial']}, 'trusty-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['trusty']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3722-6.ini b/travis/artifacts/audits.d/bass/usn-3722-6.ini new file mode 100644 index 0000000..d348ea4 --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3722-6.ini @@ -0,0 +1,25 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3722-6] +vuln-name = "USN-3722-6" +vuln-primary-link = "https://usn.ubuntu.com/3722-6/" +vuln-priority = 4 +vuln-additional-links = {'USN-3722-1': 'https://usn.ubuntu.com/usn/usn-3722-1', 'LP: 1792051': 'https://launchpad.net/bugs/1792051'} +vuln-short-description = "USN-3722-1 introduced a regression in ClamAV." +vuln-long-description = USN-3722-1 fixed vulnerabilities in ClamAV. The new package introduced an + issue which caused dpkg-reconfigure to enter an infinite loop. This update + fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that ClamAV incorrectly handled parsing certain HWP + files. A remote attacker could use this issue to cause ClamAV to hang, + resulting in a denial of service. (CVE-2018-0360) It was discovered that ClamAV incorrectly handled parsing certain PDF + files. A remote attacker could use this issue to cause ClamAV to hang, + resulting in a denial of service. (CVE-2018-0361) Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 12.04 ESM + clamav - 0.100.1+dfsg-1ubuntu0.12.04.4 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. In general, a standard system update will make all the necessary changes. References + USN-3722-1 + LP: 1792051 + +comparisons = {'precise-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['clamav', 'clamav:amd64'], 'comparison-match-value': ['0.100.1+dfsg-1ubuntu0.12.04.4', '0.100.1+dfsg-1ubuntu0.12.04.4']}} +filters = {'precise-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['precise']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3747-2.ini b/travis/artifacts/audits.d/bass/usn-3747-2.ini new file mode 100644 index 0000000..c603269 --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3747-2.ini @@ -0,0 +1,35 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3747-2] +vuln-name = "USN-3747-2" +vuln-primary-link = "https://usn.ubuntu.com/3747-2/" +vuln-priority = 4 +vuln-additional-links = {'USN-3747-1': 'https://usn.ubuntu.com/usn/usn-3747-1', 'LP: 1788250': 'https://launchpad.net/bugs/1788250'} +vuln-short-description = "USN-3747-1 introduced a regression in OpenJDK 10." +vuln-long-description = USN-3747-1 fixed vulnerabilities in OpenJDK 10 for Ubuntu 18.04 LTS. + Unfortunately, that update introduced a regression around accessability + support that prevented some Java applications from starting. + This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that OpenJDK did not properly validate types in some + situations. An attacker could use this to construct a Java class that could + possibly bypass sandbox restrictions. (CVE-2018-2825, CVE-2018-2826) It was discovered that the PatternSyntaxException class in OpenJDK did not + properly validate arguments passed to it. An attacker could use this to + potentially construct a class that caused a denial of service (excessive + memory consumption). (CVE-2018-2952) Daniel Bleichenbacher discovered a vulnerability in the Galois/Counter Mode + (GCM) mode of operation for symmetric block ciphers in OpenJDK. An attacker + could use this to expose sensitive information. (CVE-2018-2972) Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 18.04 LTS + openjdk-11-jdk - 10.0.2+13-1ubuntu0.18.04.2 + openjdk-11-jdk-headless - 10.0.2+13-1ubuntu0.18.04.2 + openjdk-11-jre - 10.0.2+13-1ubuntu0.18.04.2 + openjdk-11-jre-headless - 10.0.2+13-1ubuntu0.18.04.2 + openjdk-11-jre-zero - 10.0.2+13-1ubuntu0.18.04.2 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. This update uses a new upstream release, which includes additional bug + fixes. After a standard system update you need to restart any Java + applications or applets to make all the necessary changes. References + USN-3747-1 + LP: 1788250 + +comparisons = {'bionic-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['openjdk-11-jre-zero', 'openjdk-11-jre-zero:amd64'], 'comparison-match-value': ['10.0.2+13-1ubuntu0.18.04.2', '10.0.2+13-1ubuntu0.18.04.2']}} +filters = {'bionic-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['bionic']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3760-1.ini b/travis/artifacts/audits.d/bass/usn-3760-1.ini new file mode 100644 index 0000000..0c45b65 --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3760-1.ini @@ -0,0 +1,22 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3760-1] +vuln-name = "USN-3760-1" +vuln-primary-link = "https://usn.ubuntu.com/3760-1/" +vuln-priority = 3 +vuln-additional-links = {'CVE-2018-16140_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16140'} +vuln-short-description = "transfig could be made to execute arbitrary code if it received a + specially crafted FIG file." +vuln-long-description = It was discovered that transfig incorrectly handled certain FIG files. + An attacker could possibly use this to execute arbitrary code. Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 16.04 LTS + transfig - 1:3.2.5.e-5ubuntu0.1 + Ubuntu 14.04 LTS + transfig - 1:3.2.5.e-1ubuntu1.1 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. In general, a standard system update will make all the necessary changes. References + CVE-2018-16140 + +comparisons = {'xenial-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['transfig', 'transfig:amd64'], 'comparison-match-value': ['1:3.2.5.e-5ubuntu0.1', '1:3.2.5.e-5ubuntu0.1']}, 'trusty-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['transfig', 'transfig:amd64'], 'comparison-match-value': ['1:3.2.5.e-1ubuntu1.1', '1:3.2.5.e-1ubuntu1.1']}} +filters = {'xenial-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['xenial']}, 'trusty-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['trusty']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3761-1.ini b/travis/artifacts/audits.d/bass/usn-3761-1.ini new file mode 100644 index 0000000..520da1a --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3761-1.ini @@ -0,0 +1,35 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3761-1] +vuln-name = "USN-3761-1" +vuln-primary-link = "https://usn.ubuntu.com/3761-1/" +vuln-priority = 3 +vuln-additional-links = {'CVE-2018-12375_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-12375', 'CVE-2018-12376_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-12376', 'CVE-2018-12377_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-12377', 'CVE-2018-12378_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-12378', 'CVE-2018-12383_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-12383'} +vuln-short-description = "Firefox could be made to crash or run programs as your login if it + opened a malicious website." +vuln-long-description = Multiple security issues were discovered in Firefox. If a user were + tricked in to opening a specially crafted website, an attacker could + potentially exploit these to cause a denial of service, or execute + arbitrary code. (CVE-2018-12375, CVE-2018-12376, CVE-2018-12377, + CVE-2018-12378) It was discovered that if a user saved passwords before Firefox 58 and + then later set a master password, an unencrypted copy of these passwords + would still be accessible. A local user could exploit this to obtain + sensitive information. (CVE-2018-12383) Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 18.04 LTS + firefox - 62.0+build2-0ubuntu0.18.04.3 + Ubuntu 16.04 LTS + firefox - 62.0+build2-0ubuntu0.16.04.3 + Ubuntu 14.04 LTS + firefox - 62.0+build2-0ubuntu0.14.04.3 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. After a standard system update you need to restart Firefox to make + all the necessary changes. References + CVE-2018-12375 + CVE-2018-12376 + CVE-2018-12377 + CVE-2018-12378 + CVE-2018-12383 + +comparisons = {'bionic-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['firefox', 'firefox:amd64'], 'comparison-match-value': ['62.0+build2-0ubuntu0.18.04.3', '62.0+build2-0ubuntu0.18.04.3']}, 'xenial-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['firefox', 'firefox:amd64'], 'comparison-match-value': ['62.0+build2-0ubuntu0.16.04.3', '62.0+build2-0ubuntu0.16.04.3']}, 'trusty-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['firefox', 'firefox:amd64'], 'comparison-match-value': ['62.0+build2-0ubuntu0.14.04.3', '62.0+build2-0ubuntu0.14.04.3']}} +filters = {'bionic-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['bionic']}, 'xenial-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['xenial']}, 'trusty-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['trusty']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3761-2.ini b/travis/artifacts/audits.d/bass/usn-3761-2.ini new file mode 100644 index 0000000..a7f3de7 --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3761-2.ini @@ -0,0 +1,33 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3761-2] +vuln-name = "USN-3761-2" +vuln-primary-link = "https://usn.ubuntu.com/3761-2/" +vuln-priority = 4 +vuln-additional-links = {'USN-3761-1': 'https://usn.ubuntu.com/usn/usn-3761-1', 'LP: 1791789': 'https://launchpad.net/bugs/1791789'} +vuln-short-description = "USN-3761-1 caused several regressions in Firefox." +vuln-long-description = USN-3761-1 fixed vulnerabilities in Firefox. The update caused several + regressions affecting spellchecker dictionaries and search engines. This + update fixes the problems. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. If a user were + tricked in to opening a specially crafted website, an attacker could + potentially exploit these to cause a denial of service, or execute + arbitrary code. (CVE-2018-12375, CVE-2018-12376, CVE-2018-12377, + CVE-2018-12378) It was discovered that if a user saved passwords before Firefox 58 and + then later set a master password, an unencrypted copy of these passwords + would still be accessible. A local user could exploit this to obtain + sensitive information. (CVE-2018-12383) Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 18.04 LTS + firefox - 62.0+build2-0ubuntu0.18.04.4 + Ubuntu 16.04 LTS + firefox - 62.0+build2-0ubuntu0.16.04.4 + Ubuntu 14.04 LTS + firefox - 62.0+build2-0ubuntu0.14.04.4 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. After a standard system update you need to restart Firefox to make + all the necessary changes. References + USN-3761-1 + LP: 1791789 + +comparisons = {'bionic-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['firefox', 'firefox:amd64'], 'comparison-match-value': ['62.0+build2-0ubuntu0.18.04.4', '62.0+build2-0ubuntu0.18.04.4']}, 'xenial-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['firefox', 'firefox:amd64'], 'comparison-match-value': ['62.0+build2-0ubuntu0.16.04.4', '62.0+build2-0ubuntu0.16.04.4']}, 'trusty-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['firefox', 'firefox:amd64'], 'comparison-match-value': ['62.0+build2-0ubuntu0.14.04.4', '62.0+build2-0ubuntu0.14.04.4']}} +filters = {'bionic-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['bionic']}, 'xenial-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['xenial']}, 'trusty-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['trusty']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3762-1.ini b/travis/artifacts/audits.d/bass/usn-3762-1.ini new file mode 100644 index 0000000..aa211ff --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3762-1.ini @@ -0,0 +1,51 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3762-1] +vuln-name = "USN-3762-1" +vuln-primary-link = "https://usn.ubuntu.com/3762-1/" +vuln-priority = 3 +vuln-additional-links = {'CVE-2017-13695_(Negligible)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2017-13695', 'CVE-2018-1118_(Low)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-1118'} +vuln-short-description = "Several security issues were fixed in the Linux kernel." +vuln-long-description = It was discovered that the VirtIO subsystem in the Linux kernel did not + properly initialize memory in some situations. A local attacker could use + this to possibly expose sensitive information (kernel memory). + (CVE-2018-1118) Seunghun Han discovered an information leak in the ACPI handling code in + the Linux kernel when handling early termination of ACPI table loading. A + local attacker could use this to expose sensitive informal (kernel address + locations). (CVE-2017-13695) Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 18.04 LTS + linux-image-4.15.0-1019-gcp - 4.15.0-1019.20 + linux-image-4.15.0-1021-aws - 4.15.0-1021.21 + linux-image-4.15.0-1021-kvm - 4.15.0-1021.21 + linux-image-4.15.0-1022-raspi2 - 4.15.0-1022.24 + linux-image-4.15.0-1023-azure - 4.15.0-1023.24 + linux-image-4.15.0-34-generic - 4.15.0-34.37 + linux-image-4.15.0-34-generic-lpae - 4.15.0-34.37 + linux-image-4.15.0-34-lowlatency - 4.15.0-34.37 + linux-image-4.15.0-34-snapdragon - 4.15.0-34.37 + linux-image-aws - 4.15.0.1021.21 + linux-image-azure - 4.15.0.1023.23 + linux-image-azure-edge - 4.15.0.1023.23 + linux-image-gcp - 4.15.0.1019.21 + linux-image-generic - 4.15.0.34.36 + linux-image-generic-lpae - 4.15.0.34.36 + linux-image-gke - 4.15.0.1019.21 + linux-image-kvm - 4.15.0.1021.21 + linux-image-lowlatency - 4.15.0.34.36 + linux-image-raspi2 - 4.15.0.1022.20 + linux-image-snapdragon - 4.15.0.34.36 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. After a standard system update you need to reboot your computer to make + all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have + been given a new version number, which requires you to recompile and + reinstall all third party kernel modules you might have installed. + Unless you manually uninstalled the standard kernel metapackages + (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, + linux-powerpc), a standard system upgrade will automatically perform + this as well. References + CVE-2017-13695 + CVE-2018-1118 + +comparisons = {'bionic-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['linux-image-4.15.0-1019-gcp', 'linux-image-4.15.0-1019-gcp:amd64', 'linux-image-4.15.0-1021-aws', 'linux-image-4.15.0-1021-aws:amd64', 'linux-image-4.15.0-1021-kvm', 'linux-image-4.15.0-1021-kvm:amd64', 'linux-image-4.15.0-1022-raspi2', 'linux-image-4.15.0-1022-raspi2:amd64', 'linux-image-4.15.0-1023-azure', 'linux-image-4.15.0-1023-azure:amd64', 'linux-image-4.15.0-34-generic', 'linux-image-4.15.0-34-generic:amd64', 'linux-image-4.15.0-34-generic-lpae', 'linux-image-4.15.0-34-generic-lpae:amd64', 'linux-image-4.15.0-34-lowlatency', 'linux-image-4.15.0-34-lowlatency:amd64', 'linux-image-4.15.0-34-snapdragon', 'linux-image-4.15.0-34-snapdragon:amd64', 'linux-image-aws', 'linux-image-aws:amd64', 'linux-image-azure', 'linux-image-azure:amd64', 'linux-image-azure-edge', 'linux-image-azure-edge:amd64', 'linux-image-gcp', 'linux-image-gcp:amd64', 'linux-image-generic', 'linux-image-generic:amd64', 'linux-image-generic-lpae', 'linux-image-generic-lpae:amd64', 'linux-image-gke', 'linux-image-gke:amd64', 'linux-image-kvm', 'linux-image-kvm:amd64', 'linux-image-lowlatency', 'linux-image-lowlatency:amd64', 'linux-image-raspi2', 'linux-image-raspi2:amd64', 'linux-image-snapdragon', 'linux-image-snapdragon:amd64'], 'comparison-match-value': ['4.15.0-1019.20', '4.15.0-1019.20', '4.15.0-1021.21', '4.15.0-1021.21', '4.15.0-1021.21', '4.15.0-1021.21', '4.15.0-1022.24', '4.15.0-1022.24', '4.15.0-1023.24', '4.15.0-1023.24', '4.15.0-34.37', '4.15.0-34.37', '4.15.0-34.37', '4.15.0-34.37', '4.15.0-34.37', '4.15.0-34.37', '4.15.0-34.37', '4.15.0-34.37', '4.15.0.1021.21', '4.15.0.1021.21', '4.15.0.1023.23', '4.15.0.1023.23', '4.15.0.1023.23', '4.15.0.1023.23', '4.15.0.1019.21', '4.15.0.1019.21', '4.15.0.34.36', '4.15.0.34.36', '4.15.0.34.36', '4.15.0.34.36', '4.15.0.1019.21', '4.15.0.1019.21', '4.15.0.1021.21', '4.15.0.1021.21', '4.15.0.34.36', '4.15.0.34.36', '4.15.0.1022.20', '4.15.0.1022.20', '4.15.0.34.36', '4.15.0.34.36']}} +filters = {'bionic-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['bionic']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3762-2.ini b/travis/artifacts/audits.d/bass/usn-3762-2.ini new file mode 100644 index 0000000..4392683 --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3762-2.ini @@ -0,0 +1,46 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3762-2] +vuln-name = "USN-3762-2" +vuln-primary-link = "https://usn.ubuntu.com/3762-2/" +vuln-priority = 4 +vuln-additional-links = {'USN-3762-1': 'https://usn.ubuntu.com/usn/usn-3762-1', 'CVE-2017-13695_(Negligible)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2017-13695', 'CVE-2018-1118_(Low)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-1118'} +vuln-short-description = "Several security issues were fixed in the Linux kernel." +vuln-long-description = USN-3762-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 + LTS. This update provides the corresponding updates for the Linux + Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu + 16.04 LTS. It was discovered that the VirtIO subsystem in the Linux kernel did not + properly initialize memory in some situations. A local attacker could use + this to possibly expose sensitive information (kernel memory). + (CVE-2018-1118) Seunghun Han discovered an information leak in the ACPI handling code in + the Linux kernel when handling early termination of ACPI table loading. A + local attacker could use this to expose sensitive informal (kernel address + locations). (CVE-2017-13695) Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 16.04 LTS + linux-image-4.15.0-1019-gcp - 4.15.0-1019.20~16.04.1 + linux-image-4.15.0-1023-azure - 4.15.0-1023.24~16.04.1 + linux-image-4.15.0-34-generic - 4.15.0-34.37~16.04.1 + linux-image-4.15.0-34-generic-lpae - 4.15.0-34.37~16.04.1 + linux-image-4.15.0-34-lowlatency - 4.15.0-34.37~16.04.1 + linux-image-azure - 4.15.0.1023.29 + linux-image-gcp - 4.15.0.1019.33 + linux-image-generic-hwe-16.04 - 4.15.0.34.56 + linux-image-generic-lpae-hwe-16.04 - 4.15.0.34.56 + linux-image-gke - 4.15.0.1019.33 + linux-image-lowlatency-hwe-16.04 - 4.15.0.34.56 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. After a standard system update you need to reboot your computer to make + all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have + been given a new version number, which requires you to recompile and + reinstall all third party kernel modules you might have installed. + Unless you manually uninstalled the standard kernel metapackages + (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, + linux-powerpc), a standard system upgrade will automatically perform + this as well. References + USN-3762-1 + CVE-2017-13695 + CVE-2018-1118 + +comparisons = {'xenial-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['linux-image-gke', 'linux-image-gke:amd64', 'linux-image-lowlatency-hwe-16.04', 'linux-image-lowlatency-hwe-16.04:amd64'], 'comparison-match-value': ['4.15.0.1019.33', '4.15.0.1019.33', '4.15.0.34.56', '4.15.0.34.56']}} +filters = {'xenial-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['xenial']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3763-1.ini b/travis/artifacts/audits.d/bass/usn-3763-1.ini new file mode 100644 index 0000000..4cac268 --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3763-1.ini @@ -0,0 +1,42 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3763-1] +vuln-name = "USN-3763-1" +vuln-primary-link = "https://usn.ubuntu.com/3763-1/" +vuln-priority = 4 +vuln-additional-links = {'CVE-2018-5390_(High)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-5390'} +vuln-short-description = "The system could be made to crash if it received specially crafted + network traffic." +vuln-long-description = Juha-Matti Tilli discovered that the TCP implementation in the Linux kernel + performed algorithmically expensive operations in some situations when + handling incoming packets. A remote attacker could use this to cause a + denial of service. Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 12.04 ESM + linux-image-3.2.0-135-generic - 3.2.0-135.181 + linux-image-3.2.0-135-generic-pae - 3.2.0-135.181 + linux-image-3.2.0-135-highbank - 3.2.0-135.181 + linux-image-3.2.0-135-omap - 3.2.0-135.181 + linux-image-3.2.0-135-powerpc-smp - 3.2.0-135.181 + linux-image-3.2.0-135-powerpc64-smp - 3.2.0-135.181 + linux-image-3.2.0-135-virtual - 3.2.0-135.181 + linux-image-generic - 3.2.0.135.150 + linux-image-generic-pae - 3.2.0.135.150 + linux-image-highbank - 3.2.0.135.150 + linux-image-omap - 3.2.0.135.150 + linux-image-powerpc-smp - 3.2.0.135.150 + linux-image-powerpc64-smp - 3.2.0.135.150 + linux-image-virtual - 3.2.0.135.150 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. After a standard system update you need to reboot your computer to make + all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have + been given a new version number, which requires you to recompile and + reinstall all third party kernel modules you might have installed. + Unless you manually uninstalled the standard kernel metapackages + (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, + linux-powerpc), a standard system upgrade will automatically perform + this as well. References + CVE-2018-5390 + +comparisons = {'precise-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['linux-image-3.2.0-135-generic', 'linux-image-3.2.0-135-generic:amd64', 'linux-image-3.2.0-135-generic-pae', 'linux-image-3.2.0-135-generic-pae:amd64', 'linux-image-3.2.0-135-highbank', 'linux-image-3.2.0-135-highbank:amd64', 'linux-image-3.2.0-135-omap', 'linux-image-3.2.0-135-omap:amd64', 'linux-image-3.2.0-135-powerpc-smp', 'linux-image-3.2.0-135-powerpc-smp:amd64', 'linux-image-3.2.0-135-powerpc64-smp', 'linux-image-3.2.0-135-powerpc64-smp:amd64', 'linux-image-3.2.0-135-virtual', 'linux-image-3.2.0-135-virtual:amd64', 'linux-image-generic', 'linux-image-generic:amd64', 'linux-image-generic-pae', 'linux-image-generic-pae:amd64', 'linux-image-highbank', 'linux-image-highbank:amd64', 'linux-image-omap', 'linux-image-omap:amd64', 'linux-image-powerpc-smp', 'linux-image-powerpc-smp:amd64', 'linux-image-powerpc64-smp', 'linux-image-powerpc64-smp:amd64', 'linux-image-virtual', 'linux-image-virtual:amd64'], 'comparison-match-value': ['3.2.0-135.181', '3.2.0-135.181', '3.2.0-135.181', '3.2.0-135.181', '3.2.0-135.181', '3.2.0-135.181', '3.2.0-135.181', '3.2.0-135.181', '3.2.0-135.181', '3.2.0-135.181', '3.2.0-135.181', '3.2.0-135.181', '3.2.0-135.181', '3.2.0-135.181', '3.2.0.135.150', '3.2.0.135.150', '3.2.0.135.150', '3.2.0.135.150', '3.2.0.135.150', '3.2.0.135.150', '3.2.0.135.150', '3.2.0.135.150', '3.2.0.135.150', '3.2.0.135.150', '3.2.0.135.150', '3.2.0.135.150', '3.2.0.135.150', '3.2.0.135.150']}} +filters = {'precise-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['precise']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3764-1.ini b/travis/artifacts/audits.d/bass/usn-3764-1.ini new file mode 100644 index 0000000..e79adb4 --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3764-1.ini @@ -0,0 +1,30 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3764-1] +vuln-name = "USN-3764-1" +vuln-primary-link = "https://usn.ubuntu.com/3764-1/" +vuln-priority = 4 +vuln-additional-links = {'CVE-2018-0502_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-0502', 'CVE-2018-1100_(Low)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-1100', 'CVE-2018-13259_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-13259'} +vuln-short-description = "Zsh could be made to execute arbitrary code if it received + a specially crafted script." +vuln-long-description = It was discovered that Zsh incorrectly handled certain scripts. + An attacker could possibly use this issue to execute arbitrary code. + (CVE-2018-0502, CVE-2018-13259) Richard Maciel Costa discovered that Zsh incorrectly handled certain scripts. + An attacker could possibly use this issue to execute arbitrary code. + (CVE-2018-1100) Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 18.04 LTS + zsh - 5.4.2-3ubuntu3.1 + Ubuntu 16.04 LTS + zsh - 5.1.1-1ubuntu2.3 + Ubuntu 14.04 LTS + zsh - 5.0.2-3ubuntu6.3 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. After a standard system update you need to restart Zsh to make + all the necessary changes. References + CVE-2018-0502 + CVE-2018-1100 + CVE-2018-13259 + +comparisons = {'bionic-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['zsh', 'zsh:amd64'], 'comparison-match-value': ['5.4.2-3ubuntu3.1', '5.4.2-3ubuntu3.1']}, 'xenial-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['zsh', 'zsh:amd64'], 'comparison-match-value': ['5.1.1-1ubuntu2.3', '5.1.1-1ubuntu2.3']}, 'trusty-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['zsh', 'zsh:amd64'], 'comparison-match-value': ['5.0.2-3ubuntu6.3', '5.0.2-3ubuntu6.3']}} +filters = {'bionic-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['bionic']}, 'xenial-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['xenial']}, 'trusty-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['trusty']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3765-1.ini b/travis/artifacts/audits.d/bass/usn-3765-1.ini new file mode 100644 index 0000000..b24c2c4 --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3765-1.ini @@ -0,0 +1,33 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3765-1] +vuln-name = "USN-3765-1" +vuln-primary-link = "https://usn.ubuntu.com/3765-1/" +vuln-priority = 4 +vuln-additional-links = {'CVE-2018-14618_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-14618'} +vuln-short-description = "curl could be made to run arbitrary code if it received a specially + crafted input." +vuln-long-description = It was discovered that curl incorrectly handled certain inputs. + An attacker could possibly use this to execute arbitrary code. Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 18.04 LTS + curl - 7.58.0-2ubuntu3.3 + libcurl3-gnutls - 7.58.0-2ubuntu3.3 + libcurl3-nss - 7.58.0-2ubuntu3.3 + libcurl4 - 7.58.0-2ubuntu3.3 + Ubuntu 16.04 LTS + curl - 7.47.0-1ubuntu2.9 + libcurl3 - 7.47.0-1ubuntu2.9 + libcurl3-gnutls - 7.47.0-1ubuntu2.9 + libcurl3-nss - 7.47.0-1ubuntu2.9 + Ubuntu 14.04 LTS + curl - 7.35.0-1ubuntu2.17 + libcurl3 - 7.35.0-1ubuntu2.17 + libcurl3-gnutls - 7.35.0-1ubuntu2.17 + libcurl3-nss - 7.35.0-1ubuntu2.17 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. In general, a standard system update will make all the necessary changes. References + CVE-2018-14618 + +comparisons = {'bionic-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['curl', 'curl:amd64', 'libcurl3-gnutls', 'libcurl3-gnutls:amd64', 'libcurl3-nss', 'libcurl3-nss:amd64', 'libcurl4', 'libcurl4:amd64'], 'comparison-match-value': ['7.58.0-2ubuntu3.3', '7.58.0-2ubuntu3.3', '7.58.0-2ubuntu3.3', '7.58.0-2ubuntu3.3', '7.58.0-2ubuntu3.3', '7.58.0-2ubuntu3.3', '7.58.0-2ubuntu3.3', '7.58.0-2ubuntu3.3']}, 'xenial-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['curl', 'curl:amd64', 'libcurl3', 'libcurl3:amd64', 'libcurl3-gnutls', 'libcurl3-gnutls:amd64', 'libcurl3-nss', 'libcurl3-nss:amd64'], 'comparison-match-value': ['7.47.0-1ubuntu2.9', '7.47.0-1ubuntu2.9', '7.47.0-1ubuntu2.9', '7.47.0-1ubuntu2.9', '7.47.0-1ubuntu2.9', '7.47.0-1ubuntu2.9', '7.47.0-1ubuntu2.9', '7.47.0-1ubuntu2.9']}, 'trusty-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['curl', 'curl:amd64', 'libcurl3', 'libcurl3:amd64', 'libcurl3-gnutls', 'libcurl3-gnutls:amd64', 'libcurl3-nss', 'libcurl3-nss:amd64'], 'comparison-match-value': ['7.35.0-1ubuntu2.17', '7.35.0-1ubuntu2.17', '7.35.0-1ubuntu2.17', '7.35.0-1ubuntu2.17', '7.35.0-1ubuntu2.17', '7.35.0-1ubuntu2.17', '7.35.0-1ubuntu2.17', '7.35.0-1ubuntu2.17']}} +filters = {'bionic-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['bionic']}, 'xenial-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['xenial']}, 'trusty-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['trusty']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3765-2.ini b/travis/artifacts/audits.d/bass/usn-3765-2.ini new file mode 100644 index 0000000..0894aff --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3765-2.ini @@ -0,0 +1,25 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3765-2] +vuln-name = "USN-3765-2" +vuln-primary-link = "https://usn.ubuntu.com/3765-2/" +vuln-priority = 4 +vuln-additional-links = {'USN-3765-1': 'https://usn.ubuntu.com/usn/usn-3765-1', 'CVE-2018-14618_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-14618'} +vuln-short-description = "curl could be made to run arbitrary code if it received a specially + crafted input." +vuln-long-description = USN-3765-1 fixed a vulnerability in curl. This update provides + the corresponding update for Ubuntu 12.04 ESM. Original advisory details: It was discovered that curl incorrectly handled certain inputs. + An attacker could possibly use this to execute arbitrary code. Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 12.04 ESM + curl - 7.22.0-3ubuntu4.23 + libcurl3 - 7.22.0-3ubuntu4.23 + libcurl3-gnutls - 7.22.0-3ubuntu4.23 + libcurl3-nss - 7.22.0-3ubuntu4.23 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. In general, a standard system update will make all the necessary changes. References + USN-3765-1 + CVE-2018-14618 + +comparisons = {'precise-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['curl', 'curl:amd64', 'libcurl3', 'libcurl3:amd64', 'libcurl3-gnutls', 'libcurl3-gnutls:amd64', 'libcurl3-nss', 'libcurl3-nss:amd64'], 'comparison-match-value': ['7.22.0-3ubuntu4.23', '7.22.0-3ubuntu4.23', '7.22.0-3ubuntu4.23', '7.22.0-3ubuntu4.23', '7.22.0-3ubuntu4.23', '7.22.0-3ubuntu4.23', '7.22.0-3ubuntu4.23', '7.22.0-3ubuntu4.23']}} +filters = {'precise-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['precise']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3766-1.ini b/travis/artifacts/audits.d/bass/usn-3766-1.ini new file mode 100644 index 0000000..09b2bfd --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3766-1.ini @@ -0,0 +1,39 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3766-1] +vuln-name = "USN-3766-1" +vuln-primary-link = "https://usn.ubuntu.com/3766-1/" +vuln-priority = 4 +vuln-additional-links = {'CVE-2015-9253_(Low)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2015-9253', 'CVE-2018-14851_(Low)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-14851', 'CVE-2018-14883_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-14883'} +vuln-short-description = "Several security issues were fixed in PHP." +vuln-long-description = It was discovered that PHP incorrectly handled restarting certain child + processes when php-fpm is used. A remote attacker could possibly use this + issue to cause a denial of service. This issue was only addressed in Ubuntu + 18.04 LTS. (CVE-2015-9253) It was discovered that PHP incorrectly handled certain exif tags in JPEG + images. A remote attacker could possibly use this issue to cause PHP to + crash, resulting in a denial of service. (CVE-2018-14851, CVE-2018-14883) Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 18.04 LTS + libapache2-mod-php7.2 - 7.2.10-0ubuntu0.18.04.1 + php7.2-cgi - 7.2.10-0ubuntu0.18.04.1 + php7.2-cli - 7.2.10-0ubuntu0.18.04.1 + php7.2-fpm - 7.2.10-0ubuntu0.18.04.1 + Ubuntu 16.04 LTS + libapache2-mod-php7.0 - 7.0.32-0ubuntu0.16.04.1 + php7.0-cgi - 7.0.32-0ubuntu0.16.04.1 + php7.0-cli - 7.0.32-0ubuntu0.16.04.1 + php7.0-fpm - 7.0.32-0ubuntu0.16.04.1 + Ubuntu 14.04 LTS + libapache2-mod-php5 - 5.5.9+dfsg-1ubuntu4.26 + php5-cgi - 5.5.9+dfsg-1ubuntu4.26 + php5-cli - 5.5.9+dfsg-1ubuntu4.26 + php5-fpm - 5.5.9+dfsg-1ubuntu4.26 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. In Ubuntu 16.04 LTS and Ubuntu 18.04 LTS, this update uses a new upstream + release, which includes additional bug fixes. In general, a standard system update will make all the necessary changes. References + CVE-2015-9253 + CVE-2018-14851 + CVE-2018-14883 + +comparisons = {'bionic-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['php7.2-fpm', 'php7.2-fpm:amd64'], 'comparison-match-value': ['7.2.10-0ubuntu0.18.04.1', '7.2.10-0ubuntu0.18.04.1']}, 'xenial-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['php7.0-fpm', 'php7.0-fpm:amd64'], 'comparison-match-value': ['7.0.32-0ubuntu0.16.04.1', '7.0.32-0ubuntu0.16.04.1']}, 'trusty-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['libapache2-mod-php5', 'libapache2-mod-php5:amd64', 'php5-cgi', 'php5-cgi:amd64', 'php5-cli', 'php5-cli:amd64', 'php5-fpm', 'php5-fpm:amd64'], 'comparison-match-value': ['5.5.9+dfsg-1ubuntu4.26', '5.5.9+dfsg-1ubuntu4.26', '5.5.9+dfsg-1ubuntu4.26', '5.5.9+dfsg-1ubuntu4.26', '5.5.9+dfsg-1ubuntu4.26', '5.5.9+dfsg-1ubuntu4.26', '5.5.9+dfsg-1ubuntu4.26', '5.5.9+dfsg-1ubuntu4.26']}} +filters = {'bionic-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['bionic']}, 'xenial-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['xenial']}, 'trusty-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['trusty']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3766-2.ini b/travis/artifacts/audits.d/bass/usn-3766-2.ini new file mode 100644 index 0000000..cad899f --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3766-2.ini @@ -0,0 +1,26 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3766-2] +vuln-name = "USN-3766-2" +vuln-primary-link = "https://usn.ubuntu.com/3766-2/" +vuln-priority = 4 +vuln-additional-links = {'USN-3766-1': 'https://usn.ubuntu.com/usn/usn-3766-1', 'CVE-2018-14851_(Low)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-14851', 'CVE-2018-14883_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-14883'} +vuln-short-description = "Several security issues were fixed in PHP." +vuln-long-description = USN-3766-1 fixed a vulnerability in PHP. This update provides + the corresponding update for Ubuntu 12.04 ESM. Original advisory details: It was discovered that PHP incorrectly handled certain exif tags in JPEG + images. A remote attacker could possibly use this issue to cause PHP to + crash, resulting in a denial of service. (CVE-2018-14851, CVE-2018-14883) Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 12.04 ESM + libapache2-mod-php5 - 5.3.10-1ubuntu3.32 + php5-cgi - 5.3.10-1ubuntu3.32 + php5-cli - 5.3.10-1ubuntu3.32 + php5-fpm - 5.3.10-1ubuntu3.32 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. In general, a standard system update will make all the necessary changes. References + USN-3766-1 + CVE-2018-14851 + CVE-2018-14883 + +comparisons = {'precise-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['libapache2-mod-php5', 'libapache2-mod-php5:amd64', 'php5-cgi', 'php5-cgi:amd64', 'php5-cli', 'php5-cli:amd64', 'php5-fpm', 'php5-fpm:amd64'], 'comparison-match-value': ['5.3.10-1ubuntu3.32', '5.3.10-1ubuntu3.32', '5.3.10-1ubuntu3.32', '5.3.10-1ubuntu3.32', '5.3.10-1ubuntu3.32', '5.3.10-1ubuntu3.32', '5.3.10-1ubuntu3.32', '5.3.10-1ubuntu3.32']}} +filters = {'precise-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['precise']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3767-1.ini b/travis/artifacts/audits.d/bass/usn-3767-1.ini new file mode 100644 index 0000000..ea7914a --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3767-1.ini @@ -0,0 +1,34 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3767-1] +vuln-name = "USN-3767-1" +vuln-primary-link = "https://usn.ubuntu.com/3767-1/" +vuln-priority = 4 +vuln-additional-links = {'CVE-2018-16428_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16428', 'CVE-2018-16429_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16429'} +vuln-short-description = "Several security issues were fixed in GLib." +vuln-long-description = It was discovered that GLib incorrectly handled certain files. + An attacker could possibly use this issue to cause a denial of service or + execute arbitrary code. (CVE-2018-16428) It was discovered that GLib incorrectly handled certain files. + An attacker could possibly use this issue to access sensitive information. + (CVE-2018-16429) Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 18.04 LTS + libglib2.0-0 - 2.56.2-0ubuntu0.18.04.2 + libglib2.0-bin - 2.56.2-0ubuntu0.18.04.2 + libglib2.0-dev - 2.56.2-0ubuntu0.18.04.2 + Ubuntu 16.04 LTS + libglib2.0-0 - 2.48.2-0ubuntu4.1 + libglib2.0-bin - 2.48.2-0ubuntu4.1 + libglib2.0-dev - 2.48.2-0ubuntu4.1 + Ubuntu 14.04 LTS + libglib2.0-0 - 2.40.2-0ubuntu1.1 + libglib2.0-bin - 2.40.2-0ubuntu1.1 + libglib2.0-dev - 2.40.2-0ubuntu1.1 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. After a standard system update you need to reboot your computer to make + all the necessary changes. References + CVE-2018-16428 + CVE-2018-16429 + +comparisons = {'bionic-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['libglib2.0-dev', 'libglib2.0-dev:amd64'], 'comparison-match-value': ['2.56.2-0ubuntu0.18.04.2', '2.56.2-0ubuntu0.18.04.2']}, 'xenial-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['libglib2.0-0', 'libglib2.0-0:amd64', 'libglib2.0-bin', 'libglib2.0-bin:amd64', 'libglib2.0-dev', 'libglib2.0-dev:amd64'], 'comparison-match-value': ['2.48.2-0ubuntu4.1', '2.48.2-0ubuntu4.1', '2.48.2-0ubuntu4.1', '2.48.2-0ubuntu4.1', '2.48.2-0ubuntu4.1', '2.48.2-0ubuntu4.1']}, 'trusty-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['libglib2.0-0', 'libglib2.0-0:amd64', 'libglib2.0-bin', 'libglib2.0-bin:amd64', 'libglib2.0-dev', 'libglib2.0-dev:amd64'], 'comparison-match-value': ['2.40.2-0ubuntu1.1', '2.40.2-0ubuntu1.1', '2.40.2-0ubuntu1.1', '2.40.2-0ubuntu1.1', '2.40.2-0ubuntu1.1', '2.40.2-0ubuntu1.1']}} +filters = {'bionic-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['bionic']}, 'xenial-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['xenial']}, 'trusty-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['trusty']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3767-2.ini b/travis/artifacts/audits.d/bass/usn-3767-2.ini new file mode 100644 index 0000000..4adb908 --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3767-2.ini @@ -0,0 +1,28 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3767-2] +vuln-name = "USN-3767-2" +vuln-primary-link = "https://usn.ubuntu.com/3767-2/" +vuln-priority = 4 +vuln-additional-links = {'USN-3767-1': 'https://usn.ubuntu.com/usn/usn-3767-1', 'CVE-2018-16428_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16428', 'CVE-2018-16429_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16429'} +vuln-short-description = "Several security issues were fixed in GLib." +vuln-long-description = USN-3767-1 fixed a vulnerability in GLib. This update provides + the corresponding update for Ubuntu 12.04 ESM. Original advisory details: It was discovered that GLib incorrectly handled certain files. + An attacker could possibly use this issue to cause a denial of service or + execute arbitrary code. (CVE-2018-16428) It was discovered that GLib incorrectly handled certain files. + An attacker could possibly use this issue to access sensitive information. + (CVE-2018-16429) Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 12.04 ESM + libglib2.0-0 - 2.32.4-0ubuntu1.1 + libglib2.0-bin - 2.32.4-0ubuntu1.1 + libglib2.0-dev - 2.32.4-0ubuntu1.1 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. After a standard system update you need to reboot your computer to make + all the necessary changes. References + USN-3767-1 + CVE-2018-16428 + CVE-2018-16429 + +comparisons = {'precise-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['libglib2.0-0', 'libglib2.0-0:amd64', 'libglib2.0-bin', 'libglib2.0-bin:amd64', 'libglib2.0-dev', 'libglib2.0-dev:amd64'], 'comparison-match-value': ['2.32.4-0ubuntu1.1', '2.32.4-0ubuntu1.1', '2.32.4-0ubuntu1.1', '2.32.4-0ubuntu1.1', '2.32.4-0ubuntu1.1', '2.32.4-0ubuntu1.1']}} +filters = {'precise-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['precise']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3768-1.ini b/travis/artifacts/audits.d/bass/usn-3768-1.ini new file mode 100644 index 0000000..9fdc89e --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3768-1.ini @@ -0,0 +1,43 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3768-1] +vuln-name = "USN-3768-1" +vuln-primary-link = "https://usn.ubuntu.com/3768-1/" +vuln-priority = 4 +vuln-additional-links = {'CVE-2018-11645_(Low)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-11645', 'CVE-2018-15908_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-15908', 'CVE-2018-15909_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-15909', 'CVE-2018-15910_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-15910', 'CVE-2018-15911_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-15911', 'CVE-2018-16509_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16509', 'CVE-2018-16510_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16510', 'CVE-2018-16511_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16511', 'CVE-2018-16513_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16513', 'CVE-2018-16539_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16539', 'CVE-2018-16540_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16540', 'CVE-2018-16541_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16541', 'CVE-2018-16542_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16542', 'CVE-2018-16543_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16543', 'CVE-2018-16585_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16585', 'CVE-2018-16802_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16802'} +vuln-short-description = "Several security issues were fixed in Ghostscript." +vuln-long-description = Tavis Ormandy discovered multiple security issues in Ghostscript. If a user + or automated system were tricked into processing a specially crafted file, + a remote attacker could possibly use these issues to access arbitrary + files, execute arbitrary code, or cause a denial of service. Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 18.04 LTS + ghostscript - 9.22~dfsg+1-0ubuntu1.2 + libgs9 - 9.22~dfsg+1-0ubuntu1.2 + Ubuntu 16.04 LTS + ghostscript - 9.18~dfsg~0-0ubuntu2.9 + libgs9 - 9.18~dfsg~0-0ubuntu2.9 + Ubuntu 14.04 LTS + ghostscript - 9.10~dfsg-0ubuntu10.13 + libgs9 - 9.10~dfsg-0ubuntu10.13 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. In general, a standard system update will make all the necessary changes. References + CVE-2018-11645 + CVE-2018-15908 + CVE-2018-15909 + CVE-2018-15910 + CVE-2018-15911 + CVE-2018-16509 + CVE-2018-16510 + CVE-2018-16511 + CVE-2018-16513 + CVE-2018-16539 + CVE-2018-16540 + CVE-2018-16541 + CVE-2018-16542 + CVE-2018-16543 + CVE-2018-16585 + CVE-2018-16802 + +comparisons = {'bionic-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['ghostscript', 'ghostscript:amd64', 'libgs9', 'libgs9:amd64'], 'comparison-match-value': ['9.22~dfsg+1-0ubuntu1.2', '9.22~dfsg+1-0ubuntu1.2', '9.22~dfsg+1-0ubuntu1.2', '9.22~dfsg+1-0ubuntu1.2']}, 'xenial-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['ghostscript', 'ghostscript:amd64', 'libgs9', 'libgs9:amd64'], 'comparison-match-value': ['9.18~dfsg~0-0ubuntu2.9', '9.18~dfsg~0-0ubuntu2.9', '9.18~dfsg~0-0ubuntu2.9', '9.18~dfsg~0-0ubuntu2.9']}, 'trusty-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['ghostscript', 'ghostscript:amd64', 'libgs9', 'libgs9:amd64'], 'comparison-match-value': ['9.10~dfsg-0ubuntu10.13', '9.10~dfsg-0ubuntu10.13', '9.10~dfsg-0ubuntu10.13', '9.10~dfsg-0ubuntu10.13']}} +filters = {'bionic-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['bionic']}, 'xenial-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['xenial']}, 'trusty-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['trusty']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3769-1.ini b/travis/artifacts/audits.d/bass/usn-3769-1.ini new file mode 100644 index 0000000..a4e9e32 --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3769-1.ini @@ -0,0 +1,25 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3769-1] +vuln-name = "USN-3769-1" +vuln-primary-link = "https://usn.ubuntu.com/3769-1/" +vuln-priority = 4 +vuln-additional-links = {'CVE-2018-5740_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-5740'} +vuln-short-description = "Bind could be made to crash if it received specially crafted network + traffic." +vuln-long-description = It was discovered that Bind incorrectly handled the deny-answer-aliases + feature. If this feature is enabled, a remote attacker could use this issue + to cause Bind to crash, resulting in a denial of service. Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 18.04 LTS + bind9 - 1:9.11.3+dfsg-1ubuntu1.2 + Ubuntu 16.04 LTS + bind9 - 1:9.10.3.dfsg.P4-8ubuntu1.11 + Ubuntu 14.04 LTS + bind9 - 1:9.9.5.dfsg-3ubuntu0.18 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. In general, a standard system update will make all the necessary changes. References + CVE-2018-5740 + +comparisons = {'bionic-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['bind9', 'bind9:amd64'], 'comparison-match-value': ['1:9.11.3+dfsg-1ubuntu1.2', '1:9.11.3+dfsg-1ubuntu1.2']}, 'xenial-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['bind9', 'bind9:amd64'], 'comparison-match-value': ['1:9.10.3.dfsg.P4-8ubuntu1.11', '1:9.10.3.dfsg.P4-8ubuntu1.11']}, 'trusty-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages'], 'comparison-collection-subtype': ['bind9', 'bind9:amd64'], 'comparison-match-value': ['1:9.9.5.dfsg-3ubuntu0.18', '1:9.9.5.dfsg-3ubuntu0.18']}} +filters = {'bionic-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['bionic']}, 'xenial-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['xenial']}, 'trusty-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['trusty']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3770-1.ini b/travis/artifacts/audits.d/bass/usn-3770-1.ini new file mode 100644 index 0000000..120025b --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3770-1.ini @@ -0,0 +1,31 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3770-1] +vuln-name = "USN-3770-1" +vuln-primary-link = "https://usn.ubuntu.com/3770-1/" +vuln-priority = 4 +vuln-additional-links = {'CVE-2016-10165_(Low)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2016-10165', 'CVE-2018-16435_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16435'} +vuln-short-description = "Several security issues were fixed in Little CMS." +vuln-long-description = Ibrahim El-Sayed discovered that Little CMS incorrectly handled certain files. + An attacker could possibly use this issue to cause a denial of service. + (CVE-2016-10165) Quang Nguyen discovered that Little CMS incorrectly handled certain files. + An attacker could possibly use this issue to execute arbitrary code. + (CVE-2018-16435) Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 18.04 LTS + liblcms2-2 - 2.9-1ubuntu0.1 + liblcms2-utils - 2.9-1ubuntu0.1 + Ubuntu 16.04 LTS + liblcms2-2 - 2.6-3ubuntu2.1 + liblcms2-utils - 2.6-3ubuntu2.1 + Ubuntu 14.04 LTS + liblcms2-2 - 2.5-0ubuntu4.2 + liblcms2-utils - 2.5-0ubuntu4.2 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. After a standard system update you need to restart applications using Little + CMS to make all the necessary changes. References + CVE-2016-10165 + CVE-2018-16435 + +comparisons = {'bionic-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['liblcms2-2', 'liblcms2-2:amd64', 'liblcms2-utils', 'liblcms2-utils:amd64'], 'comparison-match-value': ['2.9-1ubuntu0.1', '2.9-1ubuntu0.1', '2.9-1ubuntu0.1', '2.9-1ubuntu0.1']}, 'xenial-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['liblcms2-2', 'liblcms2-2:amd64', 'liblcms2-utils', 'liblcms2-utils:amd64'], 'comparison-match-value': ['2.6-3ubuntu2.1', '2.6-3ubuntu2.1', '2.6-3ubuntu2.1', '2.6-3ubuntu2.1']}, 'trusty-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['liblcms2-2', 'liblcms2-2:amd64', 'liblcms2-utils', 'liblcms2-utils:amd64'], 'comparison-match-value': ['2.5-0ubuntu4.2', '2.5-0ubuntu4.2', '2.5-0ubuntu4.2', '2.5-0ubuntu4.2']}} +filters = {'bionic-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['bionic']}, 'xenial-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['xenial']}, 'trusty-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['trusty']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3770-2.ini b/travis/artifacts/audits.d/bass/usn-3770-2.ini new file mode 100644 index 0000000..d92f484 --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3770-2.ini @@ -0,0 +1,32 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3770-2] +vuln-name = "USN-3770-2" +vuln-primary-link = "https://usn.ubuntu.com/3770-2/" +vuln-priority = 4 +vuln-additional-links = {'USN-3770-1': 'https://usn.ubuntu.com/usn/usn-3770-1', 'CVE-2013-4276_(Low)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2013-4276', 'CVE-2016-10165_(Low)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2016-10165', 'CVE-2018-16435_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16435'} +vuln-short-description = "Several security issues were fixed in Little CMS." +vuln-long-description = USN-3770-1 fixed a vulnerability in Little CMS. This update provides + the corresponding update for Ubuntu 12.04 ESM. Original advisory details: Pedro Ribeiro discoreved that Little CMS incorrectly handled certain files. + An attacker could possibly use this issue to cause a denial of service. + (CVE-2013-4276) Ibrahim El-Sayed discovered that Little CMS incorrectly handled certain files. + An attacker could possibly use this issue to cause a denial of service. + (CVE-2016-10165) Quang Nguyen discovered that Little CMS incorrectly handled certain files. + An attacker could possibly use this issue to execute arbitrary code. + (CVE-2018-16435) Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 12.04 ESM + liblcms-utils - 1.19.dfsg-1ubuntu3.1 + liblcms1 - 1.19.dfsg-1ubuntu3.1 + liblcms2-2 - 2.2+git20110628-2ubuntu3.3 + liblcms2-utils - 2.2+git20110628-2ubuntu3.3 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. After a standard system update you need to restart applications using Little + CMS to make all the necessary changes. References + USN-3770-1 + CVE-2013-4276 + CVE-2016-10165 + CVE-2018-16435 + +comparisons = {'precise-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['liblcms-utils', 'liblcms-utils:amd64', 'liblcms1', 'liblcms1:amd64', 'liblcms2-2', 'liblcms2-2:amd64', 'liblcms2-utils', 'liblcms2-utils:amd64'], 'comparison-match-value': ['1.19.dfsg-1ubuntu3.1', '1.19.dfsg-1ubuntu3.1', '1.19.dfsg-1ubuntu3.1', '1.19.dfsg-1ubuntu3.1', '2.2+git20110628-2ubuntu3.3', '2.2+git20110628-2ubuntu3.3', '2.2+git20110628-2ubuntu3.3', '2.2+git20110628-2ubuntu3.3']}} +filters = {'precise-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['precise']}} + diff --git a/travis/artifacts/audits.d/bass/usn-3771-1.ini b/travis/artifacts/audits.d/bass/usn-3771-1.ini new file mode 100644 index 0000000..57bc0fd --- /dev/null +++ b/travis/artifacts/audits.d/bass/usn-3771-1.ini @@ -0,0 +1,36 @@ +[GLOBAL] +jellyfishversion = 2 + +[USN-3771-1] +vuln-name = "USN-3771-1" +vuln-primary-link = "https://usn.ubuntu.com/3771-1/" +vuln-priority = 4 +vuln-additional-links = {'CVE-2018-10811_(Low)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-10811', 'CVE-2018-16151_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16151', 'CVE-2018-16152_(Medium)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-16152', 'CVE-2018-5388_(Low)': 'https://people.canonical.com/~ubuntu-security/cve/CVE-2018-5388'} +vuln-short-description = "Several security issues were fixed in strongSwan." +vuln-long-description = It was discovered that strongSwan incorrectly handled IKEv2 key derivation. + A remote attacker could possibly use this issue to cause strongSwan to + crash, resulting in a denial of service. (CVE-2018-10811) Sze Yiu Chau discovered that strongSwan incorrectly handled parsing OIDs in + the gmp plugin. A remote attacker could possibly use this issue to bypass + authorization. (CVE-2018-16151) Sze Yiu Chau discovered that strongSwan incorrectly handled certain + parameters fields in the gmp plugin. A remote attacker could possibly use + this issue to bypass authorization. (CVE-2018-16152) It was discovered that strongSwan incorrectly handled the stroke plugin. A + local administrator could use this issue to cause a denial of service, or + possibly execute arbitrary code. (CVE-2018-5388) Update instructions The problem can be corrected by updating your system to the following package versions: + Ubuntu 18.04 LTS + libstrongswan - 5.6.2-1ubuntu2.2 + strongswan - 5.6.2-1ubuntu2.2 + Ubuntu 16.04 LTS + libstrongswan - 5.3.5-1ubuntu3.7 + strongswan - 5.3.5-1ubuntu3.7 + Ubuntu 14.04 LTS + libstrongswan - 5.1.2-0ubuntu2.10 + strongswan - 5.1.2-0ubuntu2.10 + To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. In general, a standard system update will make all the necessary changes. References + CVE-2018-10811 + CVE-2018-16151 + CVE-2018-16152 + CVE-2018-5388 + +comparisons = {'bionic-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['libstrongswan', 'libstrongswan:amd64', 'strongswan', 'strongswan:amd64'], 'comparison-match-value': ['5.6.2-1ubuntu2.2', '5.6.2-1ubuntu2.2', '5.6.2-1ubuntu2.2', '5.6.2-1ubuntu2.2']}, 'xenial-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['libstrongswan', 'libstrongswan:amd64', 'strongswan', 'strongswan:amd64'], 'comparison-match-value': ['5.3.5-1ubuntu3.7', '5.3.5-1ubuntu3.7', '5.3.5-1ubuntu3.7', '5.3.5-1ubuntu3.7']}, 'trusty-bucket': {'comparison-match': 'aptge', 'comparison-collection-type': ['packages', 'packages', 'packages', 'packages'], 'comparison-collection-subtype': ['libstrongswan', 'libstrongswan:amd64', 'strongswan', 'strongswan:amd64'], 'comparison-match-value': ['5.1.2-0ubuntu2.10', '5.1.2-0ubuntu2.10', '5.1.2-0ubuntu2.10', '5.1.2-0ubuntu2.10']}} +filters = {'bionic-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['bionic']}, 'xenial-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['xenial']}, 'trusty-bucket': {'filter-match': 'is', 'filter-collection-type': ['release'], 'filter-collection-subtype': ['default'], 'filter-match-value': ['trusty']}} +