System Monitoring Center is an Ideal Task Manager & Resource Monitor for Linux
Read more...

Cybersecurity: Increase your protection by using the open-source tool YARA
Read more...

How to work more efficiently with log files using Linux csvkit
Read more...

Quick video editing on Linux with Flowblade
Read more...

Gaphor: Open Source Graphical Modeling Tool
Read more...

Linux Jargon Buster: What is a Cron Job in Linux?
Read more...

4 RSS readers every Linux user should try
Read more...

Rust takes a major step forward as Linux's second official language
Read more...

Using GPG to Encrypt and Decrypt Files on Linux [Hands-on for Beginners]
Read more...

Ubuntu Web: A Chrome OS Alternative That Respects Your Privacy
Read more...

Fwupd 1.7.3 #Linux Firmware Update Tool Released with Support for Most Nordic Semiconductor nRF Secure Devices, Bug Fixes
Read more...

Kodachi is the operating system for those who value privacy but don't want to learn Linux
Read more...

Tomorrow at 11 AM o'clock we have live about #BSD.

About this Episode
GhostBSD 21.11.24 ISO available, why v7 matters so much, OpenBSD on VIA Eden X2 powered HP t510 Thin Client, OctoPkg GUI Package Manager, chdir(2) support in posix_spawn(3), install doas on FreeBSD, Access Modem's Web Interface with OPNsense, and more
NOTES
This episode of BSDNow is brought to you by Tarsnap and the BSDNow Patreon
Headlines
GhostBSD 21.11.24 ISO is now available
Why v7 matters so much
News Roundup
OpenBSD on the VIA Eden X2 powered HP t510 Thin Client
OctoPkg: A Great GUI Package Manager In FreeBSD
Project Report: Add support for chdir(2) support in posix_spawn(3)
How To Install doas in FreeBSD 13
How to Access Your Modem's Web Interface with OPNsense
Tarsnap
This weeks episode of BSDNow was sponsored by our friends at Tarsnap, the only secure online backup you can trust your data to. Even paranoids need backups.

Tips for getting started gaming on Linux
Read more...

Show Notes
Overview
Just in time for the holidays, Log4Shell comes along to wreck everyone’s weekend - so we take a deep dive into the vulnerability that has set the internet on fire, plus we cover security updates for BlueZ, Firefox, Flatpak and more.

This week in Ubuntu Security Updates
27 unique CVEs addressed

[USN-5183-1] BlueZ vulnerability [00:48]
1 CVEs addressed in Bionic (18.04 LTS)
CVE-2019-8922
Heap based buffer overflow when handling overly large SDP requests - crash / possible code execution as a result
[USN-5186-1] Firefox vulnerabilities [01:08]
10 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
CVE-2021-43540
CVE-2021-43546
CVE-2021-43545
CVE-2021-43543
CVE-2021-43542
CVE-2021-43541
CVE-2021-43539
CVE-2021-43538
CVE-2021-43537
CVE-2021-43536
95.0
[USN-5189-1] GLib vulnerability [01:34]
1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS)
CVE-2021-3800
By setting the GLIB_CHARSETALIAS_DIR env var, could then possibly exploit setuid binaries like pkexec which are linked against glib to possibly read root-owned files - fixed to just have glib not read and use this environment variable
[USN-5142-3] Samba regression [02:29]
9 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
CVE-2021-3671
CVE-2021-3738
CVE-2021-23192
CVE-2020-25722
CVE-2020-25721
CVE-2020-25719
CVE-2020-25718
CVE-2020-25717
CVE-2016-2124
Episode 138, Episode 141 - yet another upstream regression in Samba due to the most recent set of security updates which we discussed a month ago in episode 138
[USN-5174-2] Samba regression
4 CVEs addressed in Bionic (18.04 LTS)
CVE-2021-3671
CVE-2020-25722
CVE-2020-25717
CVE-2016-2124
[USN-5191-1] Flatpak vulnerability [02:48]
1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
CVE-2021-41133
Possible to escape the flatpak sandbox by tricking services running on the host that they were not in fact communicating with a flatpak sandboxed application but with a regular unconfined application. As such they then wouldn’t restrict the actions which they would perform on behalf of the flatpak’d application and so could allow it to then escape it’s own confinement
[USN-5193-1] X.Org X Server vulnerabilities [03:26]
4 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
CVE-2021-4011
CVE-2021-4010
CVE-2021-4009
CVE-2021-4008
4 different OOB writes that could be triggered by X clients - could then cause the X server to crash or possible code execution etc
In more recent releases, X runs as a regular user so impact is limited, and in most recent releases Ubuntu uses Wayland by default so it’s possible that on modern desktops there is no X server running at all \o/
[USN-5192-1] Apache Log4j 2 vulnerability [04:12]
1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
CVE-2021-44228
[USN-5197-1] Apache Log4j 2 vulnerability
1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04), Impish (21.10)
CVE-2021-45046
Goings on in Ubuntu Security Community
Log4Shell explodes the internet [04:20]
Vuln announced on Twitter late last Thursday / early Friday morning, linking to the upstream Github issue of a possible remote code execution vuln in Apache Log4j 2
Quickly it became apparent this was a high profile vuln that would affect a huge number of software products and have wide reaching consequences
Over the weekend started being picked up by mainstream news not just the security industry
Since then vendors and distros etc have scrambled to patch the vulnerability
Ubuntu released updates on Monday - 2.15.0 for Ubuntu >= 20.04 LTS and otherwise removed the offending class in Ubuntu 18.04 etc (USN-5192-1)
Stepping back
What is Log4j?
Extremely popular and widely used Java package for doing logging within applications
Is the 252nd most popular component in Maven Central repo by download volume for November 2021
Top 0.003% in popularity by downloads