Headline
Ubuntu Security Notice USN-6964-2
Ubuntu Security Notice 6964-2 - USN-6964-1 fixed a vulnerability in ORC. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Noriko Totsuka discovered that ORC incorrectly handled certain specially crafted files. An attacker could possibly use this issue to execute arbitrary code.
==========================================================================
Ubuntu Security Notice USN-6964-2
October 01, 2024
orc vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
ORC could be made to crash or execute arbitrary code
Software Description:
- orc: Library of Optimized Inner Loops Runtime Compiler
Details:
USN-6964-1 fixed a vulnerability in ORC. This update provides the
corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
Noriko Totsuka discovered that ORC incorrectly handled certain
specially crafted files. An attacker could possibly use this issue
to execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS
liborc-0.4-0 1:0.4.28-1ubuntu0.1~esm1
Available with Ubuntu Pro
liborc-0.4-dev 1:0.4.28-1ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 16.04 LTS
liborc-0.4-0 1:0.4.25-1ubuntu0.1~esm1
Available with Ubuntu Pro
liborc-0.4-dev 1:0.4.25-1ubuntu0.1~esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6964-2
https://ubuntu.com/security/notices/USN-6964-1
CVE-2024-40897
Related news
Red Hat Security Advisory 2024-6184-03 - An update for orc is now available for Red Hat Enterprise Linux 9. Issues addressed include a buffer overflow vulnerability.
Red Hat Security Advisory 2024-6159-03 - An update for orc is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Issues addressed include a buffer overflow vulnerability.
Red Hat Security Advisory 2024-5882-03 - An update for the orc:0.4.28 module is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support. Issues addressed include a buffer overflow vulnerability.
Ubuntu Security Notice 6964-1 - Noriko Totsuka discovered that ORC incorrectly handled certain crafted file. An attacker could possibly use this issue to execute arbitrary code.
Red Hat Security Advisory 2024-5306-03 - An update for orc is now available for Red Hat Enterprise Linux 8. Issues addressed include a buffer overflow vulnerability.