Security Team Weekly Summary for 14 July 2017

The Security Team weekly reports are intended to be very short summaries of the Security Team's weekly activities.

If you would like to reach the Security Team, you can find us at the #ubuntu-hardened channel on FreeNode. Alternatively, you can mail the Ubuntu Hardened mailing list at: ubuntu-hardened@lists.ubuntu.com

During the last week, the Ubuntu Security team:

• Triaged 468 public security vulnerability reports, retaining the 74 that applied to Ubuntu.
• Published 4 Ubuntu Security Notices which fixed 4 security issues (CVEs) across 4 supported packages.

Ubuntu Security Notices

• [USN-3351-1] Evince vulnerability

• [USN-3352-1] nginx vulnerability

• [USN-3353-1] Heimdal vulnerability

• [USN-3353-2] Samba vulnerability

Bug Triage

• Backlog: https://bugs.launchpad.net/~ubuntu-security/+subscribedbugs

Mainline Inclusion Requests

• gdm3 completed (LP: #1686393)

• htop underway (LP: #1644364)

• MIR backlog: https://bugs.launchpad.net/~ubuntu-security/+assignedbugs?field.searchtext=%5BMIR%5D

Updates to Community Supported Packages

• Simon Quigley (tsimonq2) provided debdiffs for trusty-artful for vlc (LP: #1693893)

Development

• Greengrass interface completed

• fscrypt and argon2 packages are now available for testing in security-staging

Weekly Meeting

• Log: https://wiki.ubuntu.com/MeetingLogs/Security/20170710

• Info: https://wiki.ubuntu.com/SecurityTeam/Meeting

What the Security Team is Reading This Week

• Hash-Encrypt-Hash, a block cipher mode of operation

• Data Center use of Static Diffie-Hellman in TLS 1.3

More Info

• Ubuntu CVE Tracker

• Ubuntu security notices

• Follow Ubuntu Security on Twitter

• How to help improve Ubuntu security