Ubuntu Security Notice 4106-1 - Mike Salvatore discovered that NLTK mishandled crafted ZIP archives during extraction. A remote attacker could use this vulnerability to write arbitrary files to the filesystem.
67c1fd94cc02ae15969151dfdc1c8669a70df4dbbdafd497a25c319b1b295ec0
==========================================================================
Ubuntu Security Notice USN-4106-1
August 20, 2019
NLTK vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.04
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
NLTK could be made to overwrite files.
Software Description:
- nltk: Python libraries for natural language processing
Details:
Mike Salvatore discovered that NLTK mishandled crafted ZIP archives during
extraction. A remote attacker could use this vulnerability to write
arbitrary files to the filesystem
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 19.04:
python-nltk 3.4-1ubuntu0.1
python3-nltk 3.4-1ubuntu0.1
Ubuntu 18.04 LTS:
python-nltk 3.2.5-1ubuntu0.1
python3-nltk 3.2.5-1ubuntu0.1
Ubuntu 16.04 LTS:
python-nltk 3.1-1ubuntu0.1
python3-nltk 3.1-1ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4106-1
CVE-2019-14751
Package Information:
https://launchpad.net/ubuntu/+source/nltk/3.4-1ubuntu0.1
https://launchpad.net/ubuntu/+source/nltk/3.2.5-1ubuntu0.1
https://launchpad.net/ubuntu/+source/nltk/3.1-1ubuntu0.1