USN-5008-2: Avahi vulnerability
7 July 2021
Avahi could be made to denial of service if it received a specially crafted input.
Releases
Packages
- avahi - Avahi IPv4LL network address configuration daemon
Details
USN-5008-1 fixed a vulnerability in avahi. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
Thomas Kremer discovered that Avahi incorrectly handled termination signals
on the Unix socket. A local attacker could possibly use this issue to cause
Avahi to hang, resulting in a denial of service.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04
-
avahi-daemon
-
0.6.32~rc+dfsg-1ubuntu2.3+esm1
Available with Ubuntu Pro
-
libavahi-core7
-
0.6.32~rc+dfsg-1ubuntu2.3+esm1
Available with Ubuntu Pro
Ubuntu 14.04
-
avahi-daemon
-
0.6.31-4ubuntu1.3+esm1
Available with Ubuntu Pro
-
libavahi-core7
-
0.6.31-4ubuntu1.3+esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-5008-1: libavahi-core7, libavahi-core7-udeb, libavahi-client-dev, libavahi-common3, avahi-discover, libavahi-common-dev, avahi-utils, libavahi-common3-udeb, libavahi-client3, libavahi-ui-gtk3-0, libavahi-common-data, python-avahi, libavahi-glib1, libavahi-gobject-dev, avahi, libavahi-glib-dev, libavahi-core-dev, libavahi-compat-libdnssd-dev, libavahi-compat-libdnssd1, avahi-daemon, libavahi-gobject0, gir1.2-avahi-0.6, python3-avahi, avahi-dnsconfd, avahi-ui-utils, libavahi-ui-gtk3-dev, avahi-autoipd