[ubuntu/impish-security] fribidi 1.0.8-2ubuntu2.1 (Accepted)

[Ray Veldkamp]

fribidi (1.0.8-2ubuntu2.1) impish-security; urgency=medium
  
  * SECURITY UPDATE: Incorrect length checking in processing of line input
    could result in a stack buffer overflow, resulting in a crash or potential
    code execution.
    - debian/patches/CVE-2022-25308.patch: add checking to length of string
      buffer before processing in bin/fribidi-main.c
    - CVE-2022-25308

  * SECURITY UPDATE: Insufficient sanitization of input data to the CapRTL
    encoder could result in a heap buffer overflow, resulting in a crash or
    potential code execution.
    - debian/patches/CVE-2022-25309.patch: add checking and removal of
      dangerous characters before encoding stage, in
      lib/fribidi-char-sets-cap-rtl.c
    - CVE-2022-25309

  * SECURITY UPDATE: Incorrect handling of string pointer can result in a
    crash in fribidi_remove_bidi_marks().
    - debian/patches/CVE-2022-25310.patch: add checking for NULL strings, to avoid
      potential use-after-free in lib/fribidi.c
    - CVE-2022-25310

Date: 2022-04-06 05:55:09.305558+00:00
Changed-By: Ray Veldkamp <ray.veldkamp at canonical.com>
https://launchpad.net/ubuntu/+source/fribidi/1.0.8-2ubuntu2.1
-------------- next part --------------
Sorry, changesfile not available.