==========================================================================
Ubuntu Security Notice USN-4664-1
December 08, 2020
aptdaemon vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 20.10
– Ubuntu 20.04 LTS
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in Aptdaemon.
Software Description:
– aptdaemon: transaction based package management service
Details:
Kevin Backhouse discovered that Aptdaemon incorrectly handled certain
properties. A local attacker could use this issue to test for the presence
of local files. (CVE-2020-16128)
Kevin Backhouse discovered that Aptdaemon incorrectly handled permission
checks. A local attacker could possibly use this issue to cause a denial of
service. (CVE-2020-27349)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
aptdaemon 1.1.1+bzr982-0ubuntu34.1
Ubuntu 20.04 LTS:
aptdaemon 1.1.1+bzr982-0ubuntu32.3
Ubuntu 18.04 LTS:
aptdaemon 1.1.1+bzr982-0ubuntu19.5
Ubuntu 16.04 LTS:
aptdaemon 1.1.1+bzr982-0ubuntu14.5
After a standard system update you need to reboot your computer to make all
the necessary changes.
References:
https://usn.ubuntu.com/4664-1
CVE-2020-16128, CVE-2020-27349
Package Information:
https://launchpad.net/ubuntu/+source/aptdaemon/1.1.1+bzr982-0ubuntu34.1
https://launchpad.net/ubuntu/+source/aptdaemon/1.1.1+bzr982-0ubuntu32.3
https://launchpad.net/ubuntu/+source/aptdaemon/1.1.1+bzr982-0ubuntu19.5
https://launchpad.net/ubuntu/+source/aptdaemon/1.1.1+bzr982-0ubuntu14.5
—–BEGIN PGP SIGNATURE—–
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl/PuDkACgkQZWnYVadE
vpNsFg//fRpNKVACOffSvOBl1FlHrB09fdmX25mjnD5cIcXgk/YFZG57XOYZKbdr
U9799yZA+gUGTUHAP9IqK9ztYR0L2RpAwKunItcFWiCjQ6mhm+oE9Tsybw0xoQP2
h8yTATLjcmRYJOtzN+iKzSDrxmpzKSt9pczCykwModhdMDNkd3fNZhkFzQg4JVnj
CTd08XS/InK827yGz4sKH31exIXzApB9WkFX4j084c65MI1lwpTBql6Tu4LFVRxB
q4SbuF231rlnCJQiMs66+zTgyQWj29wTotpOYPrdbsjon2uxta21QsNAzU3OAPnA
4qFQ6BGOXDv+i4V7D2XvIVx1xi8PHISbKaN38c/GsuzYymzTEnriO2zKfK6CVRTQ
KxjFtZJv4AVj9VNiAqaGWsThv7fBLTsOYQEXwkyBBWbtfeac8CzFcnfb8X4y1jzM
l+N6yb9IyH5dEJ1kYsx+YNYXI4e50oQ7CCMjTJVmUGVSNpSDSJRCaZ5e2j6/Lpqz
KrAwKiCacvsUT0rQDGLRmKD1wVzt+GcU8A4bhDKh/N5G3QMLraRioHBnLUfh6vD2
xgNmhyk+odHgIejKPn3A/zpPKdOqlHvOEYXvEee+frCbLu98yBAkri9Z2O4LVfu4
W/K0Hs0KkxNqX32EhnXUB3JpiWKjiRqFfOCJ88TJmK8Ln+f261o=
=i8KM
—–END PGP SIGNATURE—–
—
