USN-5366-2

See a problem?
Source
https://ubuntu.com/security/notices/USN-5366-2
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/USN-5366-2.json
JSON Data
https://api.osv.dev/v1/vulns/USN-5366-2
Related
Published
2022-04-27T06:40:15.302236Z
Modified
2022-04-27T06:40:15.302236Z
Summary
fribidi vulnerabilities
Details

USN-5366-1 fixed several vulnerabilities in FriBidi. This update provides the corresponding updates for Ubuntu 22.04 LTS.

Original advisory details:

It was discovered that FriBidi incorrectly handled processing of input strings resulting in memory corruption. An attacker could use this issue to cause FriBidi to crash, resulting in a denial of service, or potentially execute arbitrary code. (CVE-2022-25308)

It was discovered that FriBidi incorrectly validated input data to its CapRTL unicode encoder, resulting in memory corruption. An attacker could use this issue to cause FriBidi to crash, resulting in a denial of service, or potentially execute arbitrary code. (CVE-2022-25309)

It was discovered that FriBidi incorrectly handled empty input when removing marks from unicode strings, resulting in a crash. An attacker could use this to cause FriBidi to crash, resulting in a denial of service, or potentially execute arbitrary code. (CVE-2022-25310)

References

Affected packages

Ubuntu:22.04:LTS / fribidi

Package

Name
fribidi

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0.8-2ubuntu3.1

Ecosystem specific

{
    "availability": "No subscription needed",
    "binaries": [
        {
            "libfribidi-bin": "1.0.8-2ubuntu3.1",
            "libfribidi-dev": "1.0.8-2ubuntu3.1",
            "libfribidi0": "1.0.8-2ubuntu3.1"
        }
    ]
}