USN-4759-1: GLib vulnerabilities

Krzesimir Nowak discovered that GLib incorrectly handled certain large
buffers. A remote attacker could use this issue to cause applications
linked to GLib to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2021-27218)

Kevin Backhouse discovered that GLib incorrectly handled certain memory
allocations. A remote attacker could use this issue to cause applications
linked to GLib to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2021-27219)




USN-4733-2: GNOME Autoar regression

USN-4733-1 fixed a vulnerability in GNOME Autoar. The upstream fix
introduced a regression when extracting archives containing directories.
This update fixes the problem.

Original advisory details:

Yiğit Can Yılmaz discovered that GNOME Autoar could extract files outside
of the intended directory. If a user were tricked into extracting a
specially crafted archive, a remote attacker could create files in
arbitrary locations, possibly leading to code execution.




Let’s Count the Installed Packages!

how to use ‘dpkg’ to get a list of installed applications. It was a pretty simple command.

Now, you could try this:

[code]cat Documents/installed_apps.txt | grep ii | wc -l[/code]

cat‘ stands for concatenate. It has been around since pretty much Unix v. 1. It basically reads a file and spits out the content. The man page describes it as thus:

See? Pretty simple.

[code]dpkg -l | grep ii | wc -l[/code]

pipe. You’ll see it fairly often. It’s used to take the commands from one command and use them in another. It goes back to the philosophy of ‘hiding the internals’, with the goal being simplicity and clarity. But, you never have to make the text file to perform this counting exercise.

 




How To: Make Ubuntu Show Asterisks When Typing Password

shoulder-surfing won’t be able to see the number of characters in your password. This is how to get some feedback when you enter your password in the terminal.

[code]sudo nano /etc/sudoers[/code]

Enter your password and hit enter, of course. (This will be the last time you enter your password in the terminal without some sort of visual feedback!)

Now it gets a little tricky. 

Use the down arrow until your at the start of the line that says:

[code]Defaults            mail_badpass[/code]

Press the ENTER button. This should move that line down and leave a blank line above it. Use the arrow button to move up to that blank line and enter:

[code]Defaults[/code]

Then press the TAB button on your keyboard. This will move the cursor to the right location. Add this text:

[code]pwfeedback[/code]

The entire line should look something like:

[code]Defaults            pwfeedback[/code]

Press CTRL + X, then Y, and then ENTER.

[code]sudo apt update[/code]

asterisk feedback in the terminal

See? Asterisks for feedback in the terminal.

USN-4757-2: wpa_supplicant and hostapd vulnerability

USN-4757-1 fixed a vulnerability in wpa_supplicant and hostapd. This update
provides the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that wpa_supplicant did not properly handle P2P
(Wi-Fi Direct) provision discovery requests in some situations. A
physically proximate attacker could use this to cause a denial of service
or possibly execute arbitrary code.