[Bug 1815991] Re: [MIR] masakari and masakari-monitors

2020-02-24 Thread Alex Murray
I reviewed masakari-monitors 9.0.0~b1~git2019121714.b717be1-0ubuntu1 as checked into focal. This shouldn't be considered a full audit but rather a quick gauge of maintainability. masakari-monitors provides various binary packages containing separate monitor instances for masakari-engine - these a

[Bug 1854362] Re: [MIR] ceph-iscsi, tcmu, python-configshell-fb, python-rtslib-fb, urwid, targetcli-fb

2020-02-24 Thread Alex Murray
@rafaelftinoco - as the security team, we don't necessarily do a security review for all MIRs - only those which are deemed security relevant - and so we normally wait for the MIR team to do their review first and then if they request a security review, then we add it to our queue. So for now we on

[Bug 1815991] Re: [MIR] masakari and masakari-monitors

2020-02-25 Thread Alex Murray
@james-page - apologies for not looking closer at those unit test "failures" - thanks for investigating them and fixing the postinst typo :) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1815991 Title

[Bug 1822036] [NEW] Add devicetree overlay to support the SLB9670 TPM module for RPi

2019-03-27 Thread Alex Murray
Public bug reported: [Impact] * Currently it is not possible to use the SLB9670 TPM module with Ubuntu Core since we do not ship the required devicetree overlay to enable it https://github.com/raspberrypi/linux/commit/c28ac2dc08bd73963f953a757a3362c64b5524ed and there is no way for snaps to easi

[Bug 1820798] Re: hardening-check: add support for detecting stack clash protected binaries

2019-03-31 Thread Alex Murray
Will let the foundations team decide on the importance of this but the security team is keen for this to land in 19.10 / EE to support the toolchain hardening updates so I hope this is seen as a higher priority than Wishlist. ** Changed in: devscripts (Ubuntu) Importance: Wishlist => Undecided

[Bug 1822013] Re: extplorer package exposes /usr/ (and /etc/extplorer/) directory over HTTP

2019-04-01 Thread Alex Murray
** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1822013 Title: extplorer package exposes /usr/ (and /etc/extplorer/) directory over

[Bug 1822736] Re: Passwords longer than 255 characters break authentication

2019-04-02 Thread Alex Murray
** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1822736 Title: Passwords longer than 255 characters break authentication To manage

[Bug 1835896] Re: Heap overflow if UDT type is used with protocol 5.0

2019-10-16 Thread Alex Murray
This is already public as per https://bugzilla.redhat.com/show_bug.cgi?id=1736255 and https://bugzilla.novell.com/show_bug.cgi?id=1141132 so marking this bug public too. ** Bug watch added: Red Hat Bugzilla #1736255 https://bugzilla.redhat.com/show_bug.cgi?id=1736255 ** Bug watch added: Novell

[Bug 1848784] Re: Crash in Qt 5.12.2

2019-10-21 Thread Alex Murray
This would appear to have security implications since I imagine if an email were sent to a KMail recipient which was crafted in this same way it would crash KMail? If this is likely true a CVE should be requested from MITRE via https://cveform.mitre.org/ so that other distros etc can ensure they sh

[Bug 1790496] Re: apparmor profile for gpsd

2020-01-30 Thread Alex Murray
I can reproduce this by running: sudo gpsdctl add /dev/ttyUSB0 even without a /dev/ttyUSB0 device being present. We can then resolve the AppArmor denial by adding something like: /{,var/}run/gpsd.sock rw, to the AppArmor profile - so that this remains if the package provided profile gets repl

[Bug 1790496] Re: apparmor profile for gpsd

2020-01-30 Thread Alex Murray
Are there any additional AppArmor denials in dmesg? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1790496 Title: apparmor profile for gpsd To manage notifications about this bug go to: https://bugs

[Bug 1862112] Re: apparmor prevents DHCP from starting with IPoIB interface

2020-02-05 Thread Alex Murray
Can you try adding the following to /etc/apparmor.d/local/usr.sbin.dhcpd: network packet dgram, And then running sudo apparmor_parser -rT /etc/apparmor.d/usr.sbin.dhcpd And see if restart dhcpd then works? -- You received this bug notification because you are a member of Ubuntu Bugs, which

[Bug 1862158] [NEW] gnome-software tries to install snap updates in the background, causing unprompted polkit authentication for authorisation to install packages

2020-02-06 Thread Alex Murray
Public bug reported: Every morning about ~30mins after powering on my focal machine I get (unprompted) a gnome-shell policykit authorisation popup saying 'authentication is required to install software' - I haven't yet actually authorised it since I wasn't sure what was causing it, however I notic

[Bug 1862158] Re: gnome-software tries to install snap updates in the background, causing unprompted polkit authentication for authorisation to install packages

2020-02-06 Thread Alex Murray
Attached log output for gnome-software (if there is a better way to obtain this or more complete logs for gnome-software please let me know). -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1862158 Titl

[Bug 1862158] Re: gnome-software tries to install snap updates in the background, causing unprompted polkit authentication for authorisation to install packages

2020-02-06 Thread Alex Murray
** Attachment added: "journalctl --grep gnome-software --since 'Thu 2020-02-06 05:40:25 ACDT'" https://bugs.launchpad.net/ubuntu/+source/gnome-software/+bug/1862158/+attachment/5325864/+files/journalctl--grep-gnome-software-for-today.log -- You received this bug notification because you are

[Bug 1862158] Re: gnome-software tries to install snap updates in the background, causing unprompted polkit authentication for authorisation to install packages

2020-02-06 Thread Alex Murray
Happened again this morning - see attached for some screenshots which demonstrate the various elements. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1862158 Title: gnome-software tries to install s

[Bug 1862158] Re: gnome-software tries to install snap updates in the background, causing unprompted polkit authentication for authorisation to install packages

2020-02-06 Thread Alex Murray
Happened again this morning - see attached for some screenshots which demonstrate the various elements. ** Attachment added: "polkit dialog trigged automatically with no user interaction" https://bugs.launchpad.net/ubuntu/+source/gnome-software/+bug/1862158/+attachment/5326025/+files/Screensh

[Bug 1862158] Re: gnome-software tries to install snap updates in the background, causing unprompted polkit authentication for authorisation to install packages

2020-02-06 Thread Alex Murray
Also note after choosing 'Cancel' for the authentication, it notifies to say updates were successfully installed which is very odd :/ ** Attachment added: "Notification of updated snaps even though operation was not authorised" https://bugs.launchpad.net/ubuntu/+source/gnome-software/+bug/186

[Bug 1862158] Re: gnome-software tries to install snap updates in the background, causing unprompted polkit authentication for authorisation to install packages

2020-02-06 Thread Alex Murray
Thanks for the patch - I've rebuilt gnome-software with it here https://launchpad.net/~alexmurray/+archive/ubuntu/lp1862158 and will let you know how that behaves. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.

[Bug 1862287] [NEW] package qemu-system-common 1:4.2-1ubuntu1 failed to install/upgrade: trying to overwrite '/usr/bin/ivshmem-client', which is also in package qemu-utils 1:4.0+dfsg-0ubuntu10

2020-02-06 Thread Alex Murray
Public bug reported: During a recent dist-upgrade apt error'd out with the specified error - doing an 'apt install -f' afterwards appeared to work fine and finish the dist-upgrade without further errors. ProblemType: Package DistroRelease: Ubuntu 20.04 Package: qemu-system-common 1:4.2-1ubuntu1 P

[Bug 1856873] Re: sa-exim Greylisting.pm vulnerability

2020-01-20 Thread Alex Murray
This is public as per https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=946829 ** Information type changed from Private Security to Public Security ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-19920 -- You received this bug notification because you are a member of Ubuntu B

[Bug 1860414] Re: ZDI-CAN-9867: Canonical libgsm AssertFailure

2020-01-21 Thread Alex Murray
** Information type changed from Public to Public Security -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1860414 Title: ZDI-CAN-9867: Canonical libgsm AssertFailure To manage notifications about th

[Bug 681423] Re: [MIR] libssh2

2019-12-16 Thread Alex Murray
** Changed in: libssh2 (Ubuntu) Assignee: Ubuntu Security Team (ubuntu-security) => (unassigned) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/681423 Title: [MIR] libssh2 To manage notificatio

[Bug 1507025] Re: Shell Command Injection with the hostname

2019-12-19 Thread Alex Murray
Even our oldest supported (as extended security maintenance) release Ubuntu 12.04 had bash 4.2 (https://launchpad.net/ubuntu/+source/bash) - so whether this affects bash 3.2.57 is not relevant to Ubuntu anymore. -- You received this bug notification because you are a member of Ubuntu Bugs, which

[Bug 1854362] Re: [MIR] ceph-iscsi, tcmu, python-configshell-fb, python-rtslib-fb, urwid, targetcli-fb

2020-03-24 Thread Alex Murray
** Changed in: targetcli-fb (Ubuntu) Assignee: Alex Murray (alexmurray) => (unassigned) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1854362 Title: [MIR] ceph-iscsi, tcmu, python-configsh

[Bug 1864439] Re: [MIR] libfido2, libcbor (dependencies of openssh)

2020-03-29 Thread Alex Murray
** Changed in: libcbor (Ubuntu) Assignee: Ubuntu Security Team (ubuntu-security) => (unassigned) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1864439 Title: [MIR] libfido2, libcbor (dependenci

[Bug 1862933] Re: Apport crash report & cron script TOCTTOU

2020-04-01 Thread Alex Murray
** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1862933 Title: Apport crash report & cron script TOCTTOU To manage notifications a

[Bug 1862348] Re: Apport lock file root privilege escalation

2020-04-01 Thread Alex Murray
** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1862348 Title: Apport lock file root privilege escalation To manage notifications

[Bug 1854362] Re: [MIR] ceph-iscsi, tcmu, python-configshell-fb, python-rtslib-fb, urwid, targetcli-fb

2020-04-01 Thread Alex Murray
Upstream have merged in a fix for the world-writable targetcli-fb daemon socket - https://github.com/open-iscsi/targetcli-fb/issues/162 - and assigned CVE-2020-10699 for it - but there has been no official release. With this fix in place, I would be happy to change the NACK to an ACK for targetcli-

[Bug 1857539] Re: nautilus crashed with SIGSEGV

2020-03-02 Thread Alex Murray
@seb128 - I just noticed this - Apport popped up just after login saying Files (aka nautilus) had crashed - and pointed at this bug report. This was the first time I have seen it so not sure if it is reproducible and I didn't take any particular steps to make it occur. -- You received this bug n

[Bug 1866042] Re: AppIndicator labels are not vertically centered

2020-03-04 Thread Alex Murray
Image demonstrating the issue ** Attachment added: "Screenshot from 2020-03-04 21-21-01.png" https://bugs.launchpad.net/ubuntu/+source/gnome-shell-extension-appindicator/+bug/1866042/+attachment/5333430/+files/Screenshot%20from%202020-03-04%2021-21-01.png ** Summary changed: - AppIndicator l

[Bug 1866042] [NEW] AppIndicator labels are not centered vertically

2020-03-04 Thread Alex Murray
Public bug reported: After a recent gnome-shell + yaru-theme update, AppIndicator labels are now shown aligned with the top of the top bar instead of aligned vertically centered as previously https://imgur.com/a/jKVP5w9 (This is the indicator-sensors snap, which creates an AppIndicator with a lab

[Bug 1866256] Re: Disabled animations breaks lock screen and other dialogs, reveals information from the screen without unlocking

2020-03-05 Thread Alex Murray
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privile

[Bug 1751508] Re: Xwayland crashed with SIGABRT in OsAbort()

2018-04-11 Thread Alex Murray
I am also seeing this on a similar system - Lenovo Thinkpad X260 - and for me this occurs when I boot with the laptop docked with two external monitors connected. If I boot without it docked then it boots fine - but when docked Xwayland seems to always crash on startup. -- You received this bug n

[Bug 1842007] Re: CVE-2019-11500

2019-09-03 Thread Alex Murray
** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1842007 Title: CVE-2019-11500 To manage notifications about this bug go to: https:

[Bug 1841595] Re: [MIR] tpm2-tss

2019-09-03 Thread Alex Murray
@ebarretto from ~ubuntu-security previously reviewed tpm2-tss internally - so am pasting that review here for completeness: I've reviewed tpm2-tss 2.1.0-4 as checked into disco. This shouldn't be considered a full audit but rather a quick gauge of maintainability. tpm2-tss is TCG's (Trusted Compu

[Bug 1842902] Re: FFe: create zfs dataset for each user automatically

2019-09-05 Thread Alex Murray
Didier - could you please add some checks on the return values from the various open/dup2/execvl syscalls? Whilst currently I can't see a huge problem if these silently fail (open returns -1, dup2 then fails, or if dup2 fails anyway - then the only consequence is stdout/stderr is not silenced) I t

[Bug 1842902] Re: FFe: create zfs dataset for each user automatically

2019-09-06 Thread Alex Murray
Thanks Didier, looks great :) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1842902 Title: FFe: create zfs dataset for each user automatically To manage notifications about this bug go to: https://

[Bug 1843041] Re: CVE-2019-15846 exim4 execute programs with root privileges

2019-09-06 Thread Alex Murray
c/string.c - CVE-2019-15846 -- Alex Murray Thu, 05 Sep 2019 11:19:50 +0930 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1843041 Title: CVE-2019-15846 exim4 execute programs with root p

[Bug 1843041] Re: CVE-2019-15846 exim4 execute programs with root privileges

2019-09-06 Thread Alex Murray
c/string.c - CVE-2019-15846 -- Alex Murray Wed, 04 Sep 2019 21:14:01 +0930 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1843041 Title: CVE-2019-15846 exim4 execute programs with root p

[Bug 1843041] Re: CVE-2019-15846 exim4 execute programs with root privileges

2019-09-06 Thread Alex Murray
ing.c - CVE-2019-15846 -- Alex Murray Thu, 05 Sep 2019 11:20:47 +0930 ** Changed in: exim4 (Ubuntu) Status: New => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1843041

[Bug 1843229] Re: [MIR] libxml++2.6

2019-09-11 Thread Alex Murray
Is this MIR targeted for 19.10 or 20.04? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1843229 Title: [MIR] libxml++2.6 To manage notifications about this bug go to: https://bugs.launchpad.net/ubun

[Bug 1840188] Re: Apply fix for CVE-2019-0197 in v2.4.29 in Bionic and Disco

2019-08-21 Thread Alex Murray
There is a package in the ubuntu-security-proposed PPA which includes this fix (and some others) for both bionic and disco, any testing which you could provide would be appreciated. https://launchpad.net/~ubuntu- security-proposed/+archive/ubuntu/ppa -- You received this bug notification because

[Bug 1840188] Re: Apply fix for CVE-2019-0197 in v2.4.29 in Bionic and Disco

2019-08-24 Thread Alex Murray
Any testing which you can give would be great. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1840188 Title: Apply fix for CVE-2019-0197 in v2.4.29 in Bionic and Disco To manage notifications about

[Bug 1841614] Re: Doesn't start

2019-08-27 Thread Alex Murray
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privile

[Bug 1841612] Re: package mouseemu 0.16-0ubuntu10 failed to install/upgrade: installed mouseemu package post-installation script subprocess returned error exit status 127

2019-08-27 Thread Alex Murray
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privile

[Bug 1841614]

2019-08-27 Thread Alex Murray
Thank you for using Ubuntu and taking the time to report a bug. Your report should contain, at a minimum, the following information so we can better find the source of the bug and work to resolve it. Submitting the bug about the proper source package is essential. For help see https://wiki.ubuntu.

[Bug 1841394] Re: package mouseemu 0.16-0ubuntu10 failed to install/upgrade: installed mouseemu package post-installation script subprocess returned error exit status 127

2019-08-27 Thread Alex Murray
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privile

[Bug 1814596] Re: DynamicUser can create setuid binaries when assisted by another process

2019-10-09 Thread Alex Murray
DynamicUser is only supported in systemd>=235 so this is not needed for xenial, only bionic and disco. ** Also affects: systemd (Ubuntu Bionic) Importance: Undecided Status: New ** Also affects: systemd (Ubuntu Disco) Importance: Undecided Status: New -- You received this bu

[Bug 1828218] Re: boeug

2019-05-08 Thread Alex Murray
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privile

[Bug 1828324] Re: ERROR 2003 (HY000): Can't connect to MySQL server on '127.0.0.1' (111)

2019-05-08 Thread Alex Murray
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privile

[Bug 1828191] Re: latest debian for urllib3 in ubuntu 16.04

2019-05-08 Thread Alex Murray
As noted in the Ubuntu Security Team FAQ we do not upgrade versions for stable Ubuntu releases - however the Security Team does backport security fixes where possible https://wiki.ubuntu.com/SecurityTeam/FAQ#Versions To determine any possible outstanding vulnerabilities for python-urllib3 please c

[Bug 1828190] Re: latest wget debian for ubuntu 16.04

2019-05-08 Thread Alex Murray
As noted in the Ubuntu Security Team FAQ we do not upgrade versions for stable Ubuntu releases - however the Security Team does backport security fixes where possible https://wiki.ubuntu.com/SecurityTeam/FAQ#Versions To determine any possible outstanding vulnerabilities for glibc please check the

[Bug 1828189] Re: latest debians for glibc for ubuntu 16.04

2019-05-08 Thread Alex Murray
As noted in the Ubuntu Security Team FAQ we do not upgrade versions for stable Ubuntu releases - however the Security Team does backport security fixes where possible https://wiki.ubuntu.com/SecurityTeam/FAQ#Versions To determine any possible outstanding vulnerabilities for glibc please check the

[Bug 1828190] Re: latest wget debian for ubuntu 16.04

2019-05-08 Thread Alex Murray
As noted in the Ubuntu Security Team FAQ we do not upgrade versions for stable Ubuntu releases - however the Security Team does backport security fixes where possible https://wiki.ubuntu.com/SecurityTeam/FAQ#Versions To determine any possible outstanding vulnerabilities for wget please check the U

[Bug 1827924] Re: Panic or segfault in Samba

2019-05-08 Thread Alex Murray
** Information type changed from Private Security to Public -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1827924 Title: Panic or segfault in Samba To manage notifications about this bug go to: htt

[Bug 1828474] Re: package sudo 1.8.3p1-1ubuntu3.7 failed to install/upgrade: subprocess installed pre-removal script returned error exit status 1

2019-05-09 Thread Alex Murray
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privile

[Bug 1025525] Re: DRM buffer permission model is inadequate

2019-05-09 Thread Alex Murray
** Information type changed from Private Security to Public Security -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1025525 Title: DRM buffer permission model is inadequate To manage notifications a

[Bug 1828191] Re: latest debian for urllib3 in ubuntu 16.04

2019-05-10 Thread Alex Murray
Which fix are you referring to? There is nothing specifically mentioned in this bug report - as noted in comment#1 you can see the current status of security fix backports in the CVE tracker. As for a timeline for outstanding fixes - hopefully within a week or so. -- You received this bug notific

[Bug 1828190] Re: latest wget debian for ubuntu 16.04

2019-05-10 Thread Alex Murray
Which fix are you referring to? There is nothing specifically mentioned in this bug report - as noted in comment#2 you can see the current status of security fix backports in the CVE tracker. If you had looked you would have noticed there is currently no outstanding CVEs for wget therefore the time

[Bug 1828487] Re: The grub failed to install shim

2019-05-10 Thread Alex Murray
Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privile

[Bug 1828189] Re: latest debians for glibc for ubuntu 16.04

2019-05-10 Thread Alex Murray
Which fix are you referring to? There is nothing specifically mentioned in this bug report - as noted in comment#1 you can see the current status of security fix backports in the CVE tracker. As for a timeline for outstanding fixes - there are currently a reasonable number of outstanding CVEs for g

[Bug 1816548] Re: [MIR] usbguard

2019-05-10 Thread Alex Murray
I reviewed usbguard 0.7.4+ds-1 as checked into eoan. This shouldn't be considered a full audit but rather a quick gauge of maintainability. usbguard consists of a daemon which manages the authorization of new USB devices via udev events. It provides an IPC interface (which by default is only acce

[Bug 1828124] Re: org.gnome.evolution.dataserver.Source completely unveils account credentials in plain text while using dbus-monitor

2019-05-12 Thread Alex Murray
>From a security PoV this is basic security by obscurity and effectively pointless - they are simply XORing each byte with a fixed value and then base64 encoding it - since the source code is public anyone can easily find this out and hence easily decode it - the only way to do this securely would

[Bug 1828116] Re: Password works uppercase and lowercase

2019-05-14 Thread Alex Murray
** Information type changed from Private Security to Public Security ** Changed in: gdm3 (Ubuntu) Status: Incomplete => New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1828116 Title: Passw

[Bug 1829071] Re: Privilege escalation via LXD (local root exploit)

2019-05-21 Thread Alex Murray
Since this is already public via other sources I have no objections - I would like to see Chris' suggestions in comment:10 investigated by the LXD team to see if these would be suitable as future features to try and attenuate the authority which comes via lxd. ** Information type changed from Priv

[Bug 1830743] Re: Ubuntu 18 ,19 doesn't launch on new hardware

2019-05-28 Thread Alex Murray
*** This bug is a duplicate of bug 1829620 *** https://bugs.launchpad.net/bugs/1829620 ** This bug has been marked a duplicate of bug 1829620 intel-microcode on ASUS makes kernel stuck during loading initramfs on bionic-updates, bionic-security -- You received this bug notification becau

[Bug 1830812] Re: Whiskey Lake Intel CPU incompatible with microcode firmware upgrade

2019-05-28 Thread Alex Murray
*** This bug is a duplicate of bug 1829620 *** https://bugs.launchpad.net/bugs/1829620 ** Information type changed from Private Security to Public ** This bug has been marked a duplicate of bug 1829620 intel-microcode on ASUS makes kernel stuck during loading initramfs on bionic-updates,

[Bug 1830629] Re: Errors when extracting ZIP files. It can not differentiate between files and directories

2019-05-30 Thread Alex Murray
Thanks for reporting this issue - this would appear to have potential security implications, however as it is already public I see no reason to keep this private - if a CVE were to be assigned then this could be fixed via a security update by the security team, otherwise this would be fixed via the

[Bug 1848784] Re: Crash in Qt 5.12.2

2019-11-20 Thread Alex Murray
Removing the bionic task since the version in bionic is not affected (it doesn't contain the original vulnerability). ** No longer affects: qtbase-opensource-src (Ubuntu Bionic) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://

[Bug 1853614] Re: System stuck in reboot loop on AMD EPYC 7542 32-Core Processor

2019-11-25 Thread Alex Murray
** Changed in: amd64-microcode (Ubuntu) Assignee: (unassigned) => Ubuntu Security Team (ubuntu-security) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1853614 Title: System stuck in reboot loop

[Bug 1853614] Re: System stuck in reboot loop on AMD EPYC 7542 32-Core Processor

2019-11-25 Thread Alex Murray
All the comments on this bug mention removing the amd64-microcode package - so it is not clear to me if this worked previously with the older version of amd64-microcode. The security team has prepared updates which revert this to the older version - can anyone who is affected by this please try ins

[Bug 1853459] Re: bionic/linux-hwe-edge: 5.3.0-23.25~18.04.2 -proposed tracker

2019-11-26 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: Confirmed => In Progress ** Changed in: kernel-sru-workflow/security-signoff Assignee: Canonical Security Team (canonical-security) => Alex Murray (alexmurray) -- You received this bug notification because you are a

[Bug 1852223] Re: eoan/linux-aws: 5.3.0-1008.9 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1852223 Title: eoan/linux-aws: 5.3.0-1008.9 -proposed tra

[Bug 1852224] Re: bionic/linux-azure-5.3: 5.3.0-1008.9~18.04.1 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1852224 Title: bionic/linux-azure-5.3: 5.3.0-1008.9~18.04

[Bug 1852225] Re: eoan/linux-azure: 5.3.0-1008.9 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1852225 Title: eoan/linux-azure: 5.3.0-1008.9 -proposed t

[Bug 1852226] Re: bionic/linux-gcp-5.3: 5.3.0-1009.10~18.04.1 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1852226 Title: bionic/linux-gcp-5.3: 5.3.0-1009.10~18.04.

[Bug 1852227] Re: eoan/linux-gcp: 5.3.0-1009.10 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1852227 Title: eoan/linux-gcp: 5.3.0-1009.10 -proposed tr

[Bug 1852228] Re: eoan/linux-kvm: 5.3.0-1008.9 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1852228 Title: eoan/linux-kvm: 5.3.0-1008.9 -proposed tra

[Bug 1852230] Re: eoan/linux-oracle: 5.3.0-1007.8 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1852230 Title: eoan/linux-oracle: 5.3.0-1007.8 -proposed

[Bug 1852232] Re: eoan/linux: 5.3.0-24.26 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released ** Changed in: kernel-sru-workflow/security-signoff Assignee: Steve Beattie (sbeattie) => Ubuntu Security Team (ubuntu-security) ** Changed in: kernel-sru-workflow/security-signoff Assignee:

[Bug 1852233] Re: disco/linux-raspi2: 5.0.0-1023.24 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1852233 Title: disco/linux-raspi2: 5.0.0-1023.24 -propose

[Bug 1852235] Re: bionic/linux-aws-5.0: 5.0.0-1022.25~18.04.1 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1852235 Title: bionic/linux-aws-5.0: 5.0.0-1022.25~18.04.

[Bug 1852236] Re: disco/linux-aws: 5.0.0-1022.25 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1852236 Title: disco/linux-aws: 5.0.0-1022.25 -proposed t

[Bug 1852241] Re: bionic/linux-gcp: 5.0.0-1026.27~18.04.1 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1852241 Title: bionic/linux-gcp: 5.0.0-1026.27~18.04.1 -p

[Bug 1852244] Re: disco/linux-gcp: 5.0.0-1026.27 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1852244 Title: disco/linux-gcp: 5.0.0-1026.27 -proposed t

[Bug 1852243] Re: bionic/linux-gke-5.0: 5.0.0-1026.27~18.04.2 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1852243 Title: bionic/linux-gke-5.0: 5.0.0-1026.27~18.04.

[Bug 1852245] Re: disco/linux-kvm: 5.0.0-1023.25 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released ** Changed in: kernel-sru-workflow/security-signoff Assignee: Steve Beattie (sbeattie) => Alex Murray (alexmurray) -- You received this bug notification because you are a member of Ubunt

[Bug 1852247] Re: bionic/linux-oracle-5.0: 5.0.0-1008.13~18.04.1 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1852247 Title: bionic/linux-oracle-5.0: 5.0.0-1008.13~18.

[Bug 1852250] Re: bionic/linux-hwe: 5.0.0-37.40~18.04.1 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1852250 Title: bionic/linux-hwe: 5.0.0-37.40~18.04.1 -pro

[Bug 1852248] Re: disco/linux-oracle: 5.0.0-1008.13 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1852248 Title: disco/linux-oracle: 5.0.0-1008.13 -propose

[Bug 1852266] Re: bionic/linux-oem: 4.15.0-1065.75 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released ** Changed in: kernel-sru-workflow/security-signoff Assignee: Steve Beattie (sbeattie) => Alex Murray (alexmurray) -- You received this bug notification because you are a member of Ubunt

[Bug 1852253] Re: disco/linux: 5.0.0-37.40 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released ** Changed in: kernel-sru-workflow/security-signoff Assignee: Steve Beattie (sbeattie) => Alex Murray (alexmurray) -- You received this bug notification because you are a member of Ubunt

[Bug 1852273] Re: bionic/linux-kvm: 4.15.0-1051.51 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released ** Changed in: kernel-sru-workflow/security-signoff Assignee: Steve Beattie (sbeattie) => Alex Murray (alexmurray) -- You received this bug notification because you are a member of Ubunt

[Bug 1852272] Re: bionic/linux-gke-4.15: 4.15.0-1049.52 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released ** Changed in: kernel-sru-workflow/security-signoff Assignee: Steve Beattie (sbeattie) => Alex Murray (alexmurray) -- You received this bug notification because you are a member of Ubunt

[Bug 1852282] Re: xenial/linux-azure: 4.15.0-1064.69 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released ** Changed in: kernel-sru-workflow/security-signoff Assignee: Steve Beattie (sbeattie) => Alex Murray (alexmurray) -- You received this bug notification because you are a member of Ubunt

[Bug 1852275] Re: xenial/linux-oracle: 4.15.0-1030.33~16.04.1 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released ** Changed in: kernel-sru-workflow/security-signoff Assignee: Steve Beattie (sbeattie) => Alex Murray (alexmurray) -- You received this bug notification because you are a member of Ubunt

[Bug 1852277] Re: bionic/linux-oracle: 4.15.0-1030.33 -proposed tracker

2019-11-28 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released ** Changed in: kernel-sru-workflow/security-signoff Assignee: Steve Beattie (sbeattie) => Alex Murray (alexmurray) -- You received this bug notification because you are a member of Ubunt

[Bug 1852285] Re: xenial/linux-gcp: 4.15.0-1050.53 -proposed tracker

2019-11-29 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released ** Changed in: kernel-sru-workflow/security-signoff Assignee: Steve Beattie (sbeattie) => Alex Murray (alexmurray) -- You received this bug notification because you are a member of Ubunt

[Bug 1852298] Re: xenial/linux-kvm: 4.4.0-1063.70 -proposed tracker

2019-11-29 Thread Alex Murray
** Changed in: kernel-sru-workflow/security-signoff Status: In Progress => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1852298 Title: xenial/linux-kvm: 4.4.0-1063.70 -proposed

<    1   2   3   4   5   6   7   8   9   10   >