Sign up to save your podcasts
Or
Share Episode 81
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Episode 81
Overview
Joe talks cyber security policy with Dr David Reed from CU Boulder, plus
Alex covers the week in security updates including Mutt, NVIDIA graphics
drivers, Mailman and more.
This week in Ubuntu Security Updates
6 unique CVEs addressed
[USN-4403-1] Mutt vulnerability and regression [00:40]
additional data after the clear-text command to begin TLS - if someone
was able to intercept the connection they could inject content which
would then later get processed by Mutt as though it had come from the TLS
connection. Fixed to simply clear input buffer at the start of TLS
negotiation.
update (Episode 80)
[USN-4404-1, USN-4404-2] NVIDIA graphics drivers & Linux kernel vulnerabilities [01:59]
allow a local attacker to DoS/RCE
performance) race condition - local attacker DoS
DKMS packages
[USN-4405-1] GLib Networking vulnerability [03:15]
links against gnutls etc.)
matches the expected hostname by the client - but only if the client
failed to specify the hostname itself. If did not provide hostname, would
expect it to fail validation completely. Balsa (GNOME mail client) did
this, so could possibly be tricked into connecting to a different mail
server as a result.
[USN-4406-1] Mailman vulnerability [04:48]
echo these back inside the generated page and so provides arbitrary
content injection from a crafted URL.
Goings on in Ubuntu Security Community
Joe talks cyber security policy with Dr David Reed, Scholar in Residence @ UC Boulder [05:51]
Ubuntu Security Notices relocated [27:00]
Get in contact
View all episodes
By Ubuntu Security Team
4.8
1010 ratings
Overview
Joe talks cyber security policy with Dr David Reed from CU Boulder, plus
Alex covers the week in security updates including Mutt, NVIDIA graphics
drivers, Mailman and more.
This week in Ubuntu Security Updates
6 unique CVEs addressed
[USN-4403-1] Mutt vulnerability and regression [00:40]
additional data after the clear-text command to begin TLS - if someone
was able to intercept the connection they could inject content which
would then later get processed by Mutt as though it had come from the TLS
connection. Fixed to simply clear input buffer at the start of TLS
negotiation.
update (Episode 80)
[USN-4404-1, USN-4404-2] NVIDIA graphics drivers & Linux kernel vulnerabilities [01:59]
allow a local attacker to DoS/RCE
performance) race condition - local attacker DoS
DKMS packages
[USN-4405-1] GLib Networking vulnerability [03:15]
links against gnutls etc.)
matches the expected hostname by the client - but only if the client
failed to specify the hostname itself. If did not provide hostname, would
expect it to fail validation completely. Balsa (GNOME mail client) did
this, so could possibly be tricked into connecting to a different mail
server as a result.
[USN-4406-1] Mailman vulnerability [04:48]
echo these back inside the generated page and so provides arbitrary
content injection from a crafted URL.
Goings on in Ubuntu Security Community
Joe talks cyber security policy with Dr David Reed, Scholar in Residence @ UC Boulder [05:51]
Ubuntu Security Notices relocated [27:00]
Get in contact