Ubuntu Security Notice 6166-2 - USN-6166-1 fixed a vulnerability in libcap2. This update provides the corresponding update for Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. Richard Weinberger discovered that libcap2 incorrectly handled certain long input strings. An attacker could use this issue to cause libcap2 to crash, resulting in a denial of service, or possibly execute arbitrary code.
9d3ef7276e2ceeb88a0d8282a8238d902c361649bf8b40434cc484189e0d822b
==========================================================================
Ubuntu Security Notice USN-6166-2
June 19, 2023
libcap2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
libcap could be made to crash or possibly execute arbitrary code
if it received a specially crafted input.
Software Description:
- libcap2: POSIX 1003.1e capabilities (library)
Details:
USN-6166-1 fixed a vulnerability in libcap2. This update provides
the corresponding update for Ubuntu 14.04 ESM, Ubuntu 16.04 ESM
and Ubuntu 18.04 ESM.
Original advisory details:
Richard Weinberger discovered that libcap2 incorrectly handled certain long
input strings. An attacker could use this issue to cause libcap2 to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2023-2603)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libcap2 1:2.25-1.2ubuntu0.1~esm1
libcap2-bin 1:2.25-1.2ubuntu0.1~esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libcap2 1:2.24-12ubuntu0.1~esm1
libcap2-bin 1:2.24-12ubuntu0.1~esm1
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
libcap2 1:2.24-0ubuntu2+esm1
libcap2-bin 1:2.24-0ubuntu2+esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6166-2
https://ubuntu.com/security/notices/USN-6166-1
CVE-2023-2603