==========================================================================
Ubuntu Security Notice USN-3411-2
October 24, 2017

bzr vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 12.04 ESM

Summary:

Bazaar could be made run programs as your login if it opened a
specially crafted URL.

Software Description:
– bzr: easy to use distributed version control system

Details:

USN-3411-1 fixed a vulnerability in Bazaar. This update
provides the corresponding update for Ubuntu 12.04 ESM.

Original advisory details:

 Adam Collard discovered that Bazaar did not properly handle host names
 in ‘bzr+ssh://’ URLs. A remote attacker could use this to construct
 a bazaar repository URL that when accessed could run arbitrary code
 with the privileges of the user.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 ESM:
  bzr                             2.5.1-0ubuntu2.1
  python-bzrlib                   2.5.1-0ubuntu2.1

In general, a standard system update will make all the necessary
changes.

References:
  https://www.ubuntu.com/usn/usn-3411-2
  https://www.ubuntu.com/usn/usn-3411-1
  CVE-2017-14176
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2

iQIcBAABCAAGBQJZ71IjAAoJEEW851uECx9pQh8P/R5tSMU5fHmby6WR/19u7J5T
qEyu6shQKr2e9TbHGnLVP98QiS/0eSpGY7Y1GRObkYmpB4hdBSwAGP2L5930Ofka
HB9GCx0CkBLOTFB0uTm2MBFFCuqX0OMGWNFu6mCZuwSrHMfY7Q0Yh0lhFFETLjdI
sd5/vlSHsuzfBAoz/vTIpRAkviiy0yPG66jB04cCvxwAUPCfl1KRyWfYkIXda3Wl
63fYMdiodpid+siYDYZEbl6Ud6J/IDbWmjhaAm66tc9XyNLDbaEYmu9yDJW2LepE
32eE+1ZEl/VZ29/hSEm6hEzkV6XShUc4B2wRAJ/XWz3KKrT1djO9SyQ4enUa8u/y
92oZJ3KVxqFYarb4NOV1XPW7kJGHJdG2ge0O/n/oK4kgBcJmkKw37WFe4pnKdRJT
8XS5D60PFpWRP6BMioK/WZ6nVjinQEIDNCtnR65nJIzOkFYxsf8wYEI6PuGxi/H7
2pF7zDE0Ckt3VhZenoB/StA9bw/wolIqiqeA9EV5rAUo0CE85PD9D++06sPQ9is+
0lDqR1FXABCgwo2IyQP5JHou7RT4lLm/aL5Kpd2AR6IA3L+v+znHrl7Eu/cUzS2J
XqH7hHLsnodvaYF5rTLq0D6HmRuoBsk7A0ePmTevdw/2b2M3hpYMHo+xYHzBXvwj
jcIjcy1BGRcZkERDt/D4
=3qY1
—–END PGP SIGNATURE—–
—