Ubuntu Wiki

Security Team Weekly Summary for 28 July 2017

The Security Team weekly reports are intended to be very short summaries of the Security Team's weekly activities.

If you would like to reach the Security Team, you can find us at the #ubuntu-hardened channel on FreeNode. Alternatively, you can mail the Ubuntu Hardened mailing list at: ubuntu-hardened@lists.ubuntu.com

During the last week, the Ubuntu Security team:

• Triaged 318 public security vulnerability reports, retaining the 164 that applied to Ubuntu.
• Published 16 Ubuntu Security Notices which fixed 101 security issues (CVEs) across 22 supported packages.

Ubuntu Security Notices

• [USN-3353-3] Heimdal vulnerability

• [USN-3362-1] X.Org X server vulnerabilities

• [USN-3363-1] ImageMagick vulnerabilities

• [USN-3353-4] Samba vulnerability

• [USN-3357-2] MySQL vulnerabilities

• [USN-3364-1] Linux kernel vulnerabilities

• [USN-3364-2] Linux kernel (Xenial HWE) vulnerabilities

• [USN-3365-1] Ruby vulnerabilities

• [USN-3364-3] Linux kernel (AWS, GKE) vulnerabilities

• [USN-3367-1] gdb vulnerabilities

• [USN-3368-1] libiberty vulnerabilities

• [USN-3366-1] OpenJDK 8 vulnerabilities

• [USN-3369-1] FreeRADIUS vulnerabilities

• [USN-3370-1] Apache HTTP Server vulnerability

• [USN-3370-2] Apache HTTP Server vulnerability

• [USN-3371-1] Linux kernel (HWE) kernel vulnerabilities

Bug Triage

• Backlog: https://bugs.launchpad.net/~ubuntu-security/+subscribedbugs

Mainline Inclusion Requests

• http-parser underway (LP: #1638957)

• MIR backlog: https://bugs.launchpad.net/~ubuntu-security/+assignedbugs?field.searchtext=%5BMIR%5D

Development

• update review tools for base snaps and miscellaneous smaller updates
• investigate mmap denials for snapcrafter who is snapping a proprietary application and advise on working with executable stacks

• document how to strace snaps

• submit miscellaneous policy updates PR to snapd

• codify classic confinement processes based on sprint outcomes

• AppArmor abstractions update to artful for python3.6 and systemd-resolved

• various snapd PR reviews

Weekly Meeting

• Log: https://wiki.ubuntu.com/MeetingLogs/Security/20170728

• Info: https://wiki.ubuntu.com/SecurityTeam/Meeting

More Info

• Ubuntu CVE Tracker

• Ubuntu security notices

• Follow Ubuntu Security on Twitter

• How to help improve Ubuntu security