1. Ubuntu Security Notices
  2. USN-2771-1

USN-2771-1: Click vulnerability

Publication date

15 October 2015

Overview

Click could be made to allow malicious apps unintended access to the system.

Releases

Packages

  • click - Click package manager

Details

It was discovered that click did not properly perform input sanitization
during click package installation. If a user were tricked into installing a
crafted click package, a remote attacker could exploit this to escalate
privileges by tricking click into installing lenient security policy for
the installed application.

It was discovered that click did not properly perform input sanitization
during click package installation. If a user were tricked into installing a
crafted click package, a remote attacker could exploit this to escalate
privileges by tricking click into installing lenient security policy for
the installed application.

Update instructions

In general, a standard system update will make all the necessary changes. A corresponding update will be provided to Ubuntu Phone users soon. For more information, please see: https://insights.ubuntu.com/2015/10/15/update-on-ubuntu-phone-security-issue/

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
15.04 vivid python3-click –  0.4.38.5ubuntu0.2
14.04 trusty python3-click –  0.4.21.1ubuntu0.2

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›