==========================================================================
Ubuntu Security Notice USN-4106-1
August 20, 2019

NLTK vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 19.04
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

NLTK could be made to overwrite files.

Software Description:
– nltk: Python libraries for natural language processing

Details:

Mike Salvatore discovered that NLTK mishandled crafted ZIP archives during
extraction. A remote attacker could use this vulnerability to write
arbitrary files to the filesystem

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
python-nltk 3.4-1ubuntu0.1
python3-nltk 3.4-1ubuntu0.1

Ubuntu 18.04 LTS:
python-nltk 3.2.5-1ubuntu0.1
python3-nltk 3.2.5-1ubuntu0.1

Ubuntu 16.04 LTS:
python-nltk 3.1-1ubuntu0.1
python3-nltk 3.1-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4106-1
CVE-2019-14751

Package Information:
https://launchpad.net/ubuntu/+source/nltk/3.4-1ubuntu0.1
https://launchpad.net/ubuntu/+source/nltk/3.2.5-1ubuntu0.1
https://launchpad.net/ubuntu/+source/nltk/3.1-1ubuntu0.1

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEwZbe96kJeWh2OITRdyg1Qz0oXX0FAl1cCoQACgkQdyg1Qz0o
XX0tVhAAk0rcQWrCeq07yWIp+yes1qnOK72ozV5DlZkKL/r3yidiRiDJYnfFKywD
ZaeWSc48JD82NemPnSRzk0QRBMjyNvTWkjZYBRHQV8LlgEGYZAwE3mTiJ2MfrGjy
I4U7o0YUjZ23z089Ds5v4gWPHByJZKgrNidJKikErj3ZFi7tnDox7cXutpxxPFvw
qPZe/2zCCzg7QHXYgyPDrtAG2BncX7VaYIxBgCSW0XodIaZbO+AJ5PHD9iNkNf01
hTk5dpd1z4euMVGTxEUnvph9KJV/+hJOc0voBlxlv34RKEYSqsXWVTBE2a2MlJNE
PJ6INd0AYzT0Au+3WDM3giAEb7gBNUferQZMxMXZN026UqiTWk6ActrdnsbSsqq5
A16SRSRHN6//jLht2zNaB9ixp8sangxDmc4S7NL3baphhK6Dr46NeQBGUcYqtY1A
6WTnrZtOJmyUauWi8S7CqSbuIJu3T0jKqT0haFTjdHCOsRAHQcZOqH8eCXuk6qQb
5mD/AjN3kNYjo+sY57c5lLUVj3c8QAJhIPynYEQMMLuEMk3wCTSAUlbvRZ5uylZN
sHNnMyxeXeCg6clLOKMgYB28FYabVQepwkwykdQFDXMUVrVm+RpoNdTaYkwsjnXr
xvVnN6K0reQa9b990dgDDhpew0Q1rUQ1Kx3MkWb17ETwOYkdmMs=
=mCXZ
—–END PGP SIGNATURE—–
—