USN-4252-1: tcpdump vulnerabilities
Severity
Medium
Vendor
Canonical Ubuntu
Versions Affected
- Canonical Ubuntu 16.04
- Canonical Ubuntu 18.04
Description
Multiple security issues were discovered in tcpdump. A remote attacker could use these issues to cause tcpdump to crash, resulting in a denial of service, or possibly execute arbitrary code.
CVEs contained in this USN include: CVE-2017-16808, CVE-2018-19519, CVE-2018-10103, CVE-2018-10105, CVE-2018-14461, CVE-2018-14462, CVE-2018-14463, CVE-2018-14464, CVE-2018-14465, CVE-2018-14466, CVE-2018-14467, CVE-2018-14468, CVE-2018-14469, CVE-2018-14470, CVE-2018-14879, CVE-2018-14880, CVE-2018-14881, CVE-2018-14882, CVE-2018-16227, CVE-2018-16228, CVE-2018-16229, CVE-2018-16230, CVE-2018-16300, CVE-2018-16451, CVE-2018-16452, CVE-2019-1010220, CVE-2019-15166, CVE-2019-15167.
Affected Cloud Foundry Products and Versions
Severity is medium unless otherwise noted.
- Xenial Stemcells
- 621.x versions prior to 621.55
- 456.x versions prior to 456.96
- 315.x versions prior to 315.167
- 250.x versions prior to 250.181
- 170.x versions prior to 170.201
- 97.x versions prior to 97.230
- All other stemcells not listed.
- cflinuxfs3
- All versions prior to 0.158.0
- CF Deployment
- All versions prior to v12.29.0
Mitigation
Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:
- Xenial Stemcells
- Upgrade 621.x versions to 621.55 or greater
- Upgrade 456.x versions to 456.96 or greater
- Upgrade 315.x versions to 315.167 or greater
- Upgrade 250.x versions to 250.181 or greater
- Upgrade 170.x versions to 170.201 or greater
- Upgrade 97.x versions to 97.230 or greater
- All other stemcells should be upgraded to the latest version available on bosh.io.
- cflinuxfs3
- Upgrade all versions to 0.158.0 or greater
- CF Deployment
- Upgrade all versions to v12.29.0 or greater
References
- USN Notice
- CVE-2017-16808
- CVE-2018-19519
- CVE-2018-10103
- CVE-2018-10105
- CVE-2018-14461
- CVE-2018-14462
- CVE-2018-14463
- CVE-2018-14464
- CVE-2018-14465
- CVE-2018-14466
- CVE-2018-14467
- CVE-2018-14468
- CVE-2018-14469
- CVE-2018-14470
- CVE-2018-14879
- CVE-2018-14880
- CVE-2018-14881
- CVE-2018-14882
- CVE-2018-16227
- CVE-2018-16228
- CVE-2018-16229
- CVE-2018-16230
- CVE-2018-16300
- CVE-2018-16451
- CVE-2018-16452
- CVE-2019-1010220
- CVE-2019-15166
- CVE-2019-15167
History
2020-01-27: Initial vulnerability report published.