[USN-5990-1] musl vulnerabilities

[Mark Esler]

==========================================================================
Ubuntu Security Notice USN-5990-1
March 31, 2023

musl vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 ESM
- Ubuntu 18.04 ESM
- Ubuntu 16.04 ESM
- Ubuntu 14.04 ESM

Summary:

Several security issues were fixed in musl.

Software Description:
- musl: standard C library

Details:

It was discovered that musl did not handle certain i386 math functions
properly. An attacker could use this vulnerability to cause a denial of
service (crash) or possibly execute arbitrary code. This issue only
affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS.
(CVE-2019-14697)

It was discovered that musl did not handle wide-character conversion
properly. A remote attacker could use this vulnerability to cause resource
consumption (infinite loop), denial of service, or possibly execute
arbitrary code. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04
ESM, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2020-28928)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 ESM:
musl 1.1.24-1ubuntu0.1~esm1
musl-dev 1.1.24-1ubuntu0.1~esm1

Ubuntu 18.04 ESM:
musl 1.1.19-1ubuntu0.1~esm1
musl-dev 1.1.19-1ubuntu0.1~esm1

Ubuntu 16.04 ESM:
musl 1.1.9-1ubuntu0.1~esm3
musl-dev 1.1.9-1ubuntu0.1~esm3

Ubuntu 14.04 ESM:
musl 0.9.15-1ubuntu0.1~esm2
musl-dev 0.9.15-1ubuntu0.1~esm2

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-5990-1
CVE-2019-14697, CVE-2020-28928
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xD60B83C90513BD4F.asc
Type: application/pgp-keys
Size: 4646 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20230330/97cd8ed7/attachment.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20230330/97cd8ed7/attachment.sig>