Security updates for Thursday [LWN.net]

Dist.	ID	Release	Package	Date
Debian	DLA-1969-1	LTS	file	2019-10-23
Mageia	MGASA-2019-0299	7	bind	2019-10-23
Mageia	MGASA-2019-0304	7	chromium-browser-stable	2019-10-23
Mageia	MGASA-2019-0302	7	java-1.8.0-openjdk	2019-10-23
Mageia	MGASA-2019-0300	7	libsndfile	2019-10-23
Mageia	MGASA-2019-0301	7	mediawiki	2019-10-23
Mageia	MGASA-2019-0303	7	virtualbox	2019-10-23
Oracle	ELSA-2019-3193	OL7	firefox	2019-10-23
Oracle	ELSA-2019-3193	OL7	firefox	2019-10-23
Red Hat	RHSA-2019:3196-01	EL8	firefox	2019-10-24
Red Hat	RHSA-2019:3197-01	EL7	sudo	2019-10-24
Red Hat	RHSA-2019:3204-01	EL7.5	sudo	2019-10-24
Red Hat	RHSA-2019:3205-01	EL7.6	sudo	2019-10-24
Scientific Linux	RITM0891205	SL6 SL7	OpenAFS	2019-10-23
Scientific Linux	SLSA-2019:3193-1	SL7	firefox	2019-10-23
SUSE	SUSE-SU-2019:2756-1	SLE12	kernel	2019-10-23
SUSE	SUSE-SU-2019:2757-1	SLE15	lz4	2019-10-23
SUSE	SUSE-SU-2019:2755-1	SLE15	rust	2019-10-23
SUSE	SUSE-SU-2019:2753-1	SLE12	xen	2019-10-23
Ubuntu	USN-4165-1	16.04 18.04 19.04 19.10	firefox	2019-10-23

to post comments

Security updates for Thursday

Posted Oct 24, 2019 22:05 UTC (Thu) by NYKevin (subscriber, #129325) [Link] (1 responses)

So on Monday we had aspell and now we have file. That's moderately interesting, since both of those are relatively "simple" tools that you wouldn't expect to have security implications (recall the strings vulnerability from several years ago). Even more interesting is the fact that they were both caught by oss-fuzz.

Security updates for Thursday

Posted Oct 31, 2019 16:17 UTC (Thu) by nix (subscriber, #2304) [Link]

Oh file has security problems all the damn time. It's run under the covers by all sorts of things on totally untrusted input and has to parse it, and it's written in C... there has been an attempt to sandbox it with seccomp, but unsurprisingly this works poorly when used with a tool which can invoke arbitrary external decompressors before trying the magic number thing, so some distros at least have turned the sandboxing off again.

/me wonders about Rustizing file(1) the way libxslt has been, hmm...