unsafe software for Linux Mint users coming from Universe repo

[t42]

Linux Mint users should be very cautious when installing software from Universe and Multivers repositories and even consider a possibility not to enable those repositories by default. Ubuntu always stated that "neither universe nor multiverse contain officially-supported packages. In particular, there may not be security updates for these packages" and it's up to community to maintain more than 50000 packages. But in reality even if vulnerability is discovered and the libraries are patched by Ubuntu the update will not be provided for general users. Here is an example for Ubuntu 22.04 LTS supported till 2027:

USN-6008-1: Exo vulnerability 11 April 2023

libexo-common (4.16.3-1) last updated 14 Dec 2021
Not vulnerable version available with Ubuntu Pro :
libexo-common - 4.16.3-1ubuntu0.1~esm1

libexo-2-0 (4.16.3-1) last updated 14 Dec 2021
Not vulnerable version available with Ubuntu Pro :
libexo-2-0 - 4.16.3-1ubuntu0.1~esm1

USN-5620-1: OpenEXR vulnerabilities 20 September 2022

openexr 28 (2.5.7-1) last updated Aug 2021
Not vulnerable version available with Ubuntu Pro :
openexr - 2.5.7-1ubuntu0.1~esm1

libopenexr25 (2.5.7-1) last updated 28 Aug 2021
Not vulnerable version available with Ubuntu Pro :
libopenexr25 - 2.5.7-1ubuntu0.1~esm1

USN-5181-1: jQuery UI vulnerability 9 September 2022

node-jquery-ui (1.13.1+dfsg-1) last updated 18 Feb 2022
Not vulnerable version available with Ubuntu Pro :
node-jquery-ui - 1.13.1+dfsg-1ubuntu0.1~esm1

libjs-jquery-ui (1.13.1+dfsg-1) last updated 18 Feb 2022
Not vulnerable version available with Ubuntu Pro :
libjs-jquery-ui - 1.13.1+dfsg-1ubuntu0.1~esm1

USN-6621-1: ImageMagick vulnerability 1 February 2024

imagemagick (8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3) last updated 30 Mar 2023
Not vulnerable version available with Ubuntu Pro :
imagemagick - 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm3

imagemagick-6.q16 (8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3) last updated 30 Mar 2023
Not vulnerable version available with Ubuntu Pro :
imagemagick-6.q16 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm3

libmagickcore-6.q16-6 (8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3) last updated 30 Mar 2023
Not vulnerable version available with Ubuntu Pro :
libmagickcore-6.q16-6 - 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm3

libmagickcore-6.q16-6-extra (8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3) last updated 30 Mar 2023
Not vulnerable version available with Ubuntu Pro :
libmagickcore-6.q16-6-extra - 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.3+esm3

[MikeNovember]

Hi,

Ubuntu Pro can be enabled on Linux Mint, see viewtopic.php?t=391484

Regards,

MN

[Pjotr]

I don't think that Ubuntu Pro covers everything in Universe and Multiverse. In real life it'll only be a small selection of packages, I expect.

Universe and Multiverse, because they're in the hands of the community (the MOTUs), have always been problematic on the issue of security updates. Ever since the beginning of Ubuntu.

Although some security updates are being released for some packages in those repos from time to time, it's best to expect no security updates whatsoever for the packages you install from them. So: act as if those packages are insecure.

Still, those repos contain some very useful stuff. Which, by the way, can be considered as malware-free, because the MOTUs can be trusted to check for that.

Furthermore, the real-life risk of having unpatched versions of packages from them in your system, is usually rather small. A life without (some degree of) danger is impossible on our poor planet Earth.... C'est la vie.

Just don't install a web browser from Universe or Multiverse.