Marc Deslauriers

Name of the Vulnerable Software and Affected Versions Sudo versions through 1.9.17p2 Description A failure of a setuid, setgid, or setgroups call during a privilege drop before running the mailer is not a fatal error and can lead to privilege escalation. Recommendations Update Sudo to a version later than 1.9.17p2.

**Name of the Vulnerable Software and Affected Versions** wpa supplicant (affected versions not specified) **Description** The issue is related to an uncontrolled search path element in wpa supplicant, allowing a local unprivileged attacker to escalate privileges to the user that wpa supplicant runs as, usually root. Membership in the netdev group or access to the dbus interface of wpa supplicant allows an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa supplicant process. The estimated number of potentially affected devices is in the millions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AccountsService (affected versions not specified) **Description** The issue is related to insufficient access control in the AccountsService of the Ubuntu operating system. It may allow an attacker to cause a denial of service. The problem is that accountsservice no longer drops permissions when writing .pam environment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** remote-login-service versions 1.0.0-0ubuntu3 and prior versions **Description** The cryptographic algorithm used in remote-login-service to cache usernames and passwords is insecure, allowing an attacker to potentially recover usernames and passwords from the file. **Recommendations** For versions 1.0.0-0ubuntu3 and prior, update to a version that uses a secure cryptographic algorithm for caching usernames and passwords. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** software-properties versions prior to 0.92 **Description** The issue is related to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. The software didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. **Recommendations** For software-properties versions prior to 0.92, update to version 0.92 to resolve the issue. As a temporary workaround, consider disabling the use of TLS connections or ensuring a valid certificate bundle is provided when using python3 until the update is applied. Restrict access to the `softwareproperties/ppa.py` module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** trust-store (Ubuntu) versions prior to 1.1.0+15.04.20150123-0ubuntu1 trust-store (Ubuntu RTM) versions prior to 1.1.0+15.04.20150123~rtm-0ubuntu1 **Description** The issue arises when a user revokes location access from an application in Ubuntu's trust-store. Despite the revocation, the location remains accessible to the application due to it honoring incorrect, cached permissions. This occurs because the cache was not ordered by creation time by the Select struct in src/core/trust/impl/sqlite3/store.cpp. **Recommendations** For trust-store (Ubuntu) versions prior to 1.1.0+15.04.20150123-0ubuntu1, update to version 1.1.0+15.04.20150123-0ubuntu1 or later. For trust-store (Ubuntu RTM) versions prior to 1.1.0+15.04.20150123~rtm-0ubuntu1, update to version 1.1.0+15.04.20150123~rtm-0ubuntu1 or later.

**Name of the Vulnerable Software and Affected Versions** signond versions prior to 8.57+15.04.20141127.1-0ubuntu1 **Description** The issue is related to the signond application, which did not properly restrict other applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extension. This could allow an attacker to create a malicious click app that collects oauth tokens for other applications, potentially exposing sensitive information. **Recommendations** For versions prior to 8.57+15.04.20141127.1-0ubuntu1, update to version 8.57+15.04.20141127.1-0ubuntu1 or later to resolve the issue. As a temporary workaround, consider restricting the use of oath tokens or implementing additional security measures to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 3.0.0-16.28 **Description** The issue is related to missing inode security checks in OverlayFS, which could allow attackers to bypass security restrictions and perform unauthorized actions. **Recommendations** For Linux kernel versions prior to 3.0.0-16.28, update to version 3.0.0-16.28 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Ubuntu Cobbler versions prior to 2.2.2 **Description** A Security Bypass issue exists due to an error when verifying the GPG signature in the cobbler-ubuntu-import script. **Recommendations** For versions prior to 2.2.2, update to version 2.2.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Python keyring (affected versions not specified) **Description** The issue concerns insecure permissions on new databases created by Python keyring, allowing world-readable files to be created. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** unity-firefox-extension versions prior to 3.0.0+14.04.20140416-0ubuntu1.14.04.1 **Description** The issue is related to resource release errors in the unity-firefox-extension package. It can be exploited by a remote attacker to cause a denial of service. The exploitation involves tricking the package into dropping a C callback that is still in use, leading to a crash when Firefox attempts to free it. This can be achieved by adding an action to the launcher and updating it with new callbacks until a rate limit is hit. **Recommendations** For versions prior to 3.0.0+14.04.20140416-0ubuntu1.14.04.1, update to version 3.0.0+14.04.20140416-0ubuntu1.14.04.1 or later of unity-firefox-extension to resolve the issue. Alternatively, consider disabling the unity-firefox-extension package entirely, as done in the fixed versions of libunity-webapps, to prevent the attack.

**Name of the Vulnerable Software and Affected Versions** unity-firefox-extension versions prior to 3.0.0+14.04.20140416-0ubuntu1.14.04.1 **Description** The issue is related to the unity-firefox-extension package, which could be tricked into destroying the Unity webapps context, causing Firefox to crash. This could be achieved by spinning the event loop inside the webapps initialization callback. The problem is also associated with resource release errors. **Recommendations** For versions prior to 3.0.0+14.04.20140416-0ubuntu1.14.04.1, update to version 3.0.0+14.04.20140416-0ubuntu1.14.04.1 or later, which ships an empty package and thus disables the extension entirely. As a temporary workaround, consider disabling the unity-firefox-extension to prevent potential crashes.

**Name of the Vulnerable Software and Affected Versions** Unity Settings Daemon versions prior to 14.04.0+14.04.20150825-0ubuntu2 Unity Settings Daemon versions 15.04.x prior to 15.04.1+15.04.20150408-0ubuntu1.2 **Description** The issue allows physically proximate attackers to mount removable media while the screen is locked, as demonstrated by inserting a USB thumb drive, due to the Unity Settings Daemon not properly detecting if the screen is locked. **Recommendations** For Unity Settings Daemon versions prior to 14.04.0+14.04.20150825-0ubuntu2, update to version 14.04.0+14.04.20150825-0ubuntu2 or later. For Unity Settings Daemon versions 15.04.x prior to 15.04.1+15.04.20150408-0ubuntu1.2, update to version 15.04.1+15.04.20150408-0ubuntu1.2 or later.

**Name of the Vulnerable Software and Affected Versions** International Components for Unicode (ICU) versions prior to 55.1 **Description** The issue is related to the resolveImplicitLevels function in the Unicode Bidirectional Algorithm implementation, which does not properly track directionally isolated pieces of text. This allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted text. The problem is caused by a heap-based buffer overflow. **Recommendations** For versions prior to 55.1, update to version 55.1 or later to resolve the issue. As a temporary workaround, consider restricting the input to the resolveImplicitLevels function to prevent exploitation until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** International Components for Unicode (ICU) versions prior to 55.1 **Description** The issue is related to errors in number processing in the resolveImplicitLevels function, part of the Unicode Bidirectional Algorithm implementation in the International Components for Unicode library. This can be exploited by a remote attacker using specially crafted text to cause a denial of service or possibly execute arbitrary code. **Recommendations** For versions prior to 55.1, update to version 55.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the resolveImplicitLevels function in the common/ubidi.c file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Light Display Manager (LightDM) versions prior to 1.1.1 **Description** The issue allows local users to read arbitrary files via a symlink attack on the ~/.dmrc file. This is due to a flaw in the dmrc.c component of LightDM. **Recommendations** For versions prior to 1.1.1, update to version 1.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the ~/.dmrc file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Ubuntu Metal as a Service (MaaS) versions 1.2 and 1.4 **Description** The issue allows local users to obtain RabbitMQ authentication credentials by reading a file with world-readable permissions. This affects the txlongpoll.yaml file. **Recommendations** For Ubuntu Metal as a Service (MaaS) version 1.2, update the permissions of the txlongpoll.yaml file to restrict access. For Ubuntu Metal as a Service (MaaS) version 1.4, update the permissions of the txlongpoll.yaml file to restrict access.

**Name of the Vulnerable Software and Affected Versions** LightDM versions 1.7.5 through 1.8.3 LightDM versions 1.9.x before 1.9.2 **Description** The issue allows local users to bypass intended restrictions by leveraging the Guest account, as the AppArmor profile is not applied to it. **Recommendations** For versions 1.7.5 through 1.8.3, update to a version that applies the AppArmor profile to the Guest account. For versions 1.9.x before 1.9.2, update to version 1.9.2 or later to ensure the AppArmor profile is applied to the Guest account.

**Name of the Vulnerable Software and Affected Versions** MAAS versions prior to 13.10 **Description** The issue allows remote attackers to modify downloaded files via a man-in-the-middle (MITM) attack because the integrity of these files is not verified. **Recommendations** For versions prior to 13.10, update to version 13.10 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** unity-firefox-extension version 2.4.1 **Description** The issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted webpage, due to the exposure of the `toDataURL` function in an API call in the `content/unity-api.js` file. **Recommendations** For version 2.4.1, consider disabling the `toDataURL` function in the `content/unity-api.js` file as a temporary workaround until a patch is available. Restrict access to the unity-firefox-extension to minimize the risk of exploitation.