==========================================================================
Ubuntu Security Notice USN-3411-2
October 24, 2017
bzr vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 12.04 ESM
Summary:
Bazaar could be made run programs as your login if it opened a
specially crafted URL.
Software Description:
– bzr: easy to use distributed version control system
Details:
USN-3411-1 fixed a vulnerability in Bazaar. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Adam Collard discovered that Bazaar did not properly handle host names
in ‘bzr+ssh://’ URLs. A remote attacker could use this to construct
a bazaar repository URL that when accessed could run arbitrary code
with the privileges of the user.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
bzr 2.5.1-0ubuntu2.1
python-bzrlib 2.5.1-0ubuntu2.1
In general, a standard system update will make all the necessary
changes.
References:
https://www.ubuntu.com/usn/usn-3411-2
https://www.ubuntu.com/usn/usn-3411-1
CVE-2017-14176
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2
iQIcBAABCAAGBQJZ71IjAAoJEEW851uECx9pQh8P/R5tSMU5fHmby6WR/19u7J5T
qEyu6shQKr2e9TbHGnLVP98QiS/0eSpGY7Y1GRObkYmpB4hdBSwAGP2L5930Ofka
HB9GCx0CkBLOTFB0uTm2MBFFCuqX0OMGWNFu6mCZuwSrHMfY7Q0Yh0lhFFETLjdI
sd5/vlSHsuzfBAoz/vTIpRAkviiy0yPG66jB04cCvxwAUPCfl1KRyWfYkIXda3Wl
63fYMdiodpid+siYDYZEbl6Ud6J/IDbWmjhaAm66tc9XyNLDbaEYmu9yDJW2LepE
32eE+1ZEl/VZ29/hSEm6hEzkV6XShUc4B2wRAJ/XWz3KKrT1djO9SyQ4enUa8u/y
92oZJ3KVxqFYarb4NOV1XPW7kJGHJdG2ge0O/n/oK4kgBcJmkKw37WFe4pnKdRJT
8XS5D60PFpWRP6BMioK/WZ6nVjinQEIDNCtnR65nJIzOkFYxsf8wYEI6PuGxi/H7
2pF7zDE0Ckt3VhZenoB/StA9bw/wolIqiqeA9EV5rAUo0CE85PD9D++06sPQ9is+
0lDqR1FXABCgwo2IyQP5JHou7RT4lLm/aL5Kpd2AR6IA3L+v+znHrl7Eu/cUzS2J
XqH7hHLsnodvaYF5rTLq0D6HmRuoBsk7A0ePmTevdw/2b2M3hpYMHo+xYHzBXvwj
jcIjcy1BGRcZkERDt/D4
=3qY1
—–END PGP SIGNATURE—–
—
