–===============8778290378793851964==
Content-Type: multipart/signed; micalg=”pgp-sha256″;
protocol=”application/pgp-signature”; boundary=”=-+WvuJbG8Cn7kKs2TEMOe”
–=-+WvuJbG8Cn7kKs2TEMOe
Content-Type: text/plain; charset=”UTF-8″
Content-Transfer-Encoding: quoted-printable
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Ubuntu Security Notice USN-3731-1
August 06, 2018
lftp vulnerability
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS
– Ubuntu 14.04 LTS
Summary:
LFTP could be made to crash if it received specially crafted file.
Software Description:
– lftp: Sophisticated command-line FTP/HTTP/BitTorrent client programs
Details:
It was discovered that LFTP incorrectly handled certain files.
An attacker could possibly use this issue to cause a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
=C2=A0 lftp=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A04.8.1-1ubuntu0.1
Ubuntu 16.04 LTS:
=C2=A0 lftp=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A04.6.3a-1ubuntu0.1
Ubuntu 14.04 LTS:
=C2=A0 lftp=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A04.4.13-1ubuntu0.1
In general, a standard system update will make all the necessary
changes.
References:
=C2=A0 https://usn.ubuntu.com/usn/usn-3731-1
=C2=A0 CVE-2018-10196
Package Information:
=C2=A0 https://launchpad.net/ubuntu/+source/lftp/4.8.1-1ubuntu0.1
=C2=A0 https://launchpad.net/ubuntu/+source/lftp/4.6.3a-1ubuntu0.1
=C2=A0 https://launchpad.net/ubuntu/+source/lftp/4.4.13-1ubuntu0.1
–=-+WvuJbG8Cn7kKs2TEMOe
Content-Type: application/pgp-signature; name=”signature.asc”
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2
iQIcBAABCAAGBQJbaJ/CAAoJEEW851uECx9pA+QP/30+U5V/xk1C6qQSU10fD8g9
RbpSlTuFj9i1wEfOv1e0rcVbChMIi49wkc0aRV6AFMf0EYHdMDrT84T56/Uofm+5
ikMAI4LGa6tgmgL0ArToMvocjK67PAZXepyM4dcA/9yVNg5P7arqOin2M2dpY+z1
bXXwEWXWqJB9HCMOvTL6B1XqHfu7E4BqNOx7b3M8X0XAPrHqkxKaAPBoRE32N9DC
Mm6VpyDQIePr6AYU0Gw/keweVJUaEUC8i3WRQvEkvuNq3zlBDIP4qcZI2pJBXV6b
C/CpPG2IbCDkdWZl1IbH3jNfj7e5llLuQrp5VzfVWjQlZnzIpoz12ocz5n6sgNMX
6PDHPXpBHgXJautQEVl6IcNd0dMCgDk/1UgJ+XG1ORN7EmACfKVRk947n2Ki0S24
D3UZGHjAeeDiDMLuaZOia+KDWqVpD8q9F9isP4ZG3+2u9K13MpT51pV2HG1zXtSB
nz+cgOA6CULpkTz6ZjWTxVlv0skovDhilOqISm7v/aiGM72knlB4MID1ISHOAfUS
zwuXwugtDkomR/OFUqINPXLCaexQ2l5K6x1lB10nEWE6yr42iONGrx6Bzi8T7/qB
H4nvb3pU1mQ0+LuNy2XiN7PSva8K6We772pJ1GuBMrFG05A2yufw2+PwH5ALH3Dw
baoCBkBxKXGwpeph4aim
=f3E9
—–END PGP SIGNATURE—–
–=-+WvuJbG8Cn7kKs2TEMOe–
–===============8778290378793851964==
Content-Type: text/plain; charset=”utf-8″
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline
LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5
LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl
IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj
dXJpdHktYW5ub3VuY2UK
–===============8778290378793851964==–