Headline
Ubuntu Security Notice USN-6964-1
Ubuntu Security Notice 6964-1 - Noriko Totsuka discovered that ORC incorrectly handled certain crafted file. An attacker could possibly use this issue to execute arbitrary code.
==========================================================================
Ubuntu Security Notice USN-6964-1
August 15, 2024
orc vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
ORC could be made to crash or execute arbitrary code
Software Description:
- orc: Library of Optimized Inner Loops Runtime Compiler
Details:
Noriko Totsuka discovered that ORC incorrectly handled certain
crafted file. An attacker could possibly use this issue to execute
arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
liborc-0.4-0t64 1:0.4.38-1ubuntu0.1
Ubuntu 22.04 LTS
liborc-0.4-0 1:0.4.32-2ubuntu0.1
Ubuntu 20.04 LTS
liborc-0.4-0 1:0.4.31-1ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6964-1
CVE-2024-40897
Package Information:
https://launchpad.net/ubuntu/+source/orc/1:0.4.38-1ubuntu0.1
https://launchpad.net/ubuntu/+source/orc/1:0.4.32-2ubuntu0.1
https://launchpad.net/ubuntu/+source/orc/1:0.4.31-1ubuntu0.1
Related news
Ubuntu Security Notice 6964-2 - USN-6964-1 fixed a vulnerability in ORC. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Noriko Totsuka discovered that ORC incorrectly handled certain specially crafted files. An attacker could possibly use this issue to execute arbitrary code.
Red Hat Security Advisory 2024-6184-03 - An update for orc is now available for Red Hat Enterprise Linux 9. Issues addressed include a buffer overflow vulnerability.
Red Hat Security Advisory 2024-6159-03 - An update for orc is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Issues addressed include a buffer overflow vulnerability.
Red Hat Security Advisory 2024-5882-03 - An update for the orc:0.4.28 module is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support. Issues addressed include a buffer overflow vulnerability.
Red Hat Security Advisory 2024-5306-03 - An update for orc is now available for Red Hat Enterprise Linux 8. Issues addressed include a buffer overflow vulnerability.