A new release of the Ubuntu Cloud Images for stable Ubuntu release 16.04 LTS (Xenial Xerus) is available at [1]. These new images superseded the existing images [2]. Images are available for download or immediate use on EC2 via publish AMI ids. Users who wish to update their existing installations can do so with: 'sudo apt-get update && sudo apt-get dist-upgrade && sudo reboot'. The following packages have been updated. Please see the full changelogs for a complete listing of changes: * grub2: 2.02~beta2-36ubuntu3.23 => 2.02~beta2-36ubuntu3.26 * grub2-signed: 1.66.23+2.02~beta2-36ubuntu3.23 => 1.66.26+2.02~beta2-36ubuntu3.26 * libseccomp: 2.4.3-1ubuntu3.16.04.2 => 2.4.3-1ubuntu3.16.04.3 * python3.5: 3.5.2-2ubuntu0~16.04.10 => 3.5.2-2ubuntu0~16.04.11 * sosreport: 3.9-1ubuntu0.16.04.2 => 3.9.1-1ubuntu0.16.04.1 The following is a complete changelog for this image. new: {} removed: {} changed: ['grub-common', 'grub-efi-amd64', 'grub-efi-amd64-bin', 'grub-efi-amd64-signed', 'grub-pc', 'grub-pc-bin', 'grub2-common', 'libpython3.5-minimal:amd64', 'libpython3.5-stdlib:amd64', 'libpython3.5:amd64', 'libseccomp2:amd64', 'python3.5', 'python3.5-minimal', 'sosreport'] new snaps: {} removed snaps: {} changed snaps: [] ==== grub2: 2.02~beta2-36ubuntu3.23 => 2.02~beta2-36ubuntu3.26 ==== ==== grub-common grub-efi-amd64 grub-efi-amd64-bin grub-pc grub-pc-bin grub2-common [ Chris Coulson ] * SECURITY UPDATE: Heap buffer overflow when encountering commands that cannot be tokenized to less than 8192 characters. - 0082-yylex-Make-lexer-fatal-errors-actually-be-fatal.patch: Make fatal lexer errors actually be fatal - CVE-2020-10713 * SECURITY UPDATE: Multiple integer overflow bugs that could result in heap buffer allocations that were too small and subsequent heap buffer overflows when handling certain filesystems, font files or PNG images. - 0083-safemath-Add-some-arithmetic-primitives-that-check-f.patch: Add arithmetic primitives that allow for overflows to be detected - 0084-calloc-Make-sure-we-always-have-an-overflow-checking.patch: Make sure that there is always an overflow checking implementation of calloc() available - 0085-calloc-Use-calloc-at-most-places.patch: Use calloc where appropriate - 0086-malloc-Use-overflow-checking-primitives-where-we-do-.patch: Use overflow-safe arithmetic primitives when performing allocations based on the results of operations that might overflow - 0094-hfsplus-fix-two-more-overflows.patch: Fix integer overflows in hfsplus - 0095-lvm-fix-two-more-potential-data-dependent-alloc-over.patch: Fix more potential integer overflows in lvm - CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311 * SECURITY UPDATE: Use-after-free when executing a command that causes a currently executing function to be redefined. - 0092-script-Remove-unused-fields-from-grub_script_functio.patch: Remove unused fields from grub_script_function - 0093-script-Avoid-a-use-after-free-when-redefining-a-func.patch: Avoid a use-after-free when redefining a function during execution - CVE-2020-15706 * SECURITY UPDATE: Integer overflows that could result in heap buffer allocations that were too small and subsequent heap buffer overflows during initrd loading. - 0105-linux-Fix-integer-overflows-in-initrd-size-handling.patch: Fix integer overflows in initrd size handling - 0106-efilinux-Fix-integer-overflows-in-grub_cmd_initrd.patch: Fix integer overflows in linuxefi grub_cmd_initrd - CVE-2020-15707 * Various fixes as a result of code review and static analysis: - 0087-iso9660-Don-t-leak-memory-on-realloc-failures.patch: Fix a memory leak on realloc failures when processing symbolic links - 0088-font-Do-not-load-more-than-one-NAME-section.patch: Fix a memory leak when processing font files with more than one NAME section - 0089-gfxmenu-Fix-double-free-in-load_image.patch: Zero self->bitmap after it is freed in order to avoid a potential double free later on - 0090-lzma-Make-sure-we-don-t-dereference-past-array.patch: Fix an out-of-bounds read in LzmaEncode - 0091-tftp-Do-not-use-priority-queue.patch: Refactor tftp to not use priority queues and fix a double free - 0096-efi-fix-some-malformed-device-path-arithmetic-errors.patch: Fix various arithmetic errors with malformed device paths - 0098-Fix-a-regression-caused-by-efi-fix-some-malformed-de.patch: Fix a NULL deref in the chainloader command introduced by a previous patch - 0100-chainloader-Avoid-a-double-free-when-validation-fail.patch: Avoid a double free in the chainloader command when validation fails - 0101-relocator-Protect-grub_relocator_alloc_chunk_addr-in.patch: Protect grub_relocator_alloc_chunk_addr input arguments against integer overflow / underflow - 0102-relocator-Protect-grub_relocator_alloc_chunk_align-m.patch: Protect grub_relocator_alloc_chunk_align max_addr argument against integer underflow - 0103-relocator-Fix-grub_relocator_alloc_chunk_align-top-m.patch: Fix grub_relocator_alloc_chunk_align top memory allocation - 0104-linux-loader-avoid-overflow-on-initrd-size-calculati.patch: Avoid overflow on initrd size calculation * debian/patches/linuxefi_disable_sb_fallback.patch: Disallow unsigned kernels if UEFI Secure Boot is enabled. If UEFI Secure Boot is enabled and kernel signature verification fails, do not boot the kernel. Patch from Linn Crosetto. (LP: #1401532) * ubuntu-Make-the-linux-command-in-EFI-grub-always-try.patch: - Make the linux command in EFI grub always try EFI handover [ Dimitri John Ledkov ] * SECURITY UPDATE: Grub does not enforce kernel signature validation when the shim protocol isn't present. - 0097-linuxefi-fail-kernel-validation-without-shim-protoco.patch: Fail kernel validation if the shim protocol isn't available - CVE-2020-15705 ==== grub2-signed: 1.66.23+2.02~beta2-36ubuntu3.23 => 1.66.26+2.02~beta2-36ubuntu3.26 ==== ==== grub-efi-amd64-signed ==== libseccomp: 2.4.3-1ubuntu3.16.04.2 => 2.4.3-1ubuntu3.16.04.3 ==== ==== libseccomp2:amd64 * d/p/db-consolidate-some-of-the-code-which-adds-rules.patch * d/p/db-add-shadow-transactions.patch (LP: #1861177) Backport upstream patches to address performance regression introduced in libseccomp 2.4. ==== python3.5: 3.5.2-2ubuntu0~16.04.10 => 3.5.2-2ubuntu0~16.04.11 ==== ==== libpython3.5-minimal:amd64 libpython3.5-stdlib:amd64 libpython3.5:amd64 python3.5 python3.5-minimal * SECURITY UPDATE: Misleading information - debian/patches/CVE-2019-17514.patch: explain that the orderness of the of the result is system-dependant in Doc/library/glob.rst. - CVE-2019-17514 * SECURITY UPDATE: Denial of service - debian/patches/CVE-2019-9674.patch: add pitfalls to zipfile module doc in Doc/library/zipfile.rst, Misc/NEWS.d/next/Documentation/2019-06-04-09-29-00.bpo-36260.WrGuc-.rst. - CVE-2019-9674 * SECURITY UPDATE: Infinite loop - debian/patches/CVE-2019-20907.patch: avoid infinite loop in the tarfile module in Lib/tarfile.py, Lib/test/test_tarfile.py and add Lib/test/recursion.tar binary for test. - CVE-2019-20907 * SECURITY UPDATE: Denial of service - debian/patches/CVE-2020-14422.patch: Resolve hash collisions for IPv4Interface and IPv6Interface in Lib/ipaddress.py, Lib/test/test_ipaddress.py. - CVE-2020-14422 ==== sosreport: 3.9-1ubuntu0.16.04.2 => 3.9.1-1ubuntu0.16.04.1 ==== ==== sosreport * New 3.9.1 upstream release. (LP: #1884293) This maintenance release includes: - New plugins: sos_extras, ovirt_engine_backup, console, validation_framework. - lxd plugin collections have been overhauled. - Fixed handling of the namespace pattern for the networking plugin. - A basic path is now defined in Policy for all subclasses. Plugin API Enhancements: - Enablement checks have been extended to include architecture constraints. - SoSPredicate has been extended to include architecture constraints, as well as negative constraints for all elements. - Plugins will now capture service status information for all services defined in the services class attr. Further release information and tarballs are available at: - https://github.com/sosreport/sos/releases/tag/3.9.1 * Former patches now fixed upstream: - d/p/0001-unittest-py3-fix.patch * Remaining patch: - d/p/0001-lshw-command.patch * Other specific modifications: - d/p/0002-lds-substitute-oidc-conf.patch - d/p/0003-kvm-change-trigger-to-dev-kvm.patch (LP: #1883320) - d/p/0004-maas-add-snap-support.patch (LP: #1886494) - Add simple.sh as part of the autopkgtest (LP: #1865212) -- [1] http://cloud-images.ubuntu.com/releases/xenial/release-20200729/ [2] http://cloud-images.ubuntu.com/releases/xenial/release-20200721/