Mehrere Probleme in Imlib2
ID: | USN-3075-1 |
Distribution: | Ubuntu |
Plattformen: | Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, Ubuntu 16.04 LTS |
Datum: | Fr, 9. September 2016, 07:17 |
Referenzen: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5326
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9763 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9762 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9771 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4024 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3993 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3994 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9764 |
Applikationen: | Imlib2 |
Originalnachricht |
|
--===============8264197719065651399== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="tzZdJ4yHDV5r1Akt" Content-Disposition: inline --tzZdJ4yHDV5r1Akt Content-Type: text/plain; charset=us-ascii Content-Disposition: inline ========================================================================== Ubuntu Security Notice USN-3075-1 September 09, 2016 imlib2 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Several security issues were fixed in Imlib2. Software Description: - imlib2: Image manipulation and rendering library Details: Jakub Wilk discovered an out of bounds read in the GIF loader implementation in Imlib2. An attacker could use this to cause a denial of service (application crash) or possibly obtain sensitive information. (CVE-2016-3994) Yuriy M. Kaminskiy discovered an off-by-one error when handling coordinates in Imlib2. An attacker could use this to cause a denial of service (application crash). (CVE-2016-3993) Yuriy M. Kaminskiy discovered that integer overflows existed in Imlib2 when handling images with large dimensions. An attacker could use this to cause a denial of service (memory exhaustion or application crash). (CVE-2014-9771, CVE-2016-4024) Kevin Ryde discovered that the ellipse drawing code in Imlib2 would attempt to divide by zero when drawing a 2x1 ellipse. An attacker could use this to cause a denial of service (application crash). (CVE-2011-5326) It was discovered that Imlib2 did not properly handled GIF images without colormaps. An attacker could use this to cause a denial of service (application crash). This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9762) It was discovered that Imlib2 did not properly handle some PNM images, leading to a division by zero. An attacker could use this to cause a denial of service (application crash). This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9763) It was discovered that Imlib2 did not properly handle error conditions when loading some GIF images. An attacker could use this to cause a denial of service (application crash). This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9764) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: libimlib2 1.4.7-1ubuntu0.1 Ubuntu 14.04 LTS: libimlib2 1.4.6-2ubuntu0.1 Ubuntu 12.04 LTS: libimlib2 1.4.4-1ubuntu0.1 After a standard system update you will need to restart applications that make use of Imlib2 to make all the necessary changes. References: http://www.ubuntu.com/usn/usn-3075-1 CVE-2011-5326, CVE-2014-9762, CVE-2014-9763, CVE-2014-9764, CVE-2014-9771, CVE-2016-3993, CVE-2016-3994, CVE-2016-4024 Package Information: https://launchpad.net/ubuntu/+source/imlib2/1.4.7-1ubuntu0.1 https://launchpad.net/ubuntu/+source/imlib2/1.4.6-2ubuntu0.1 https://launchpad.net/ubuntu/+source/imlib2/1.4.4-1ubuntu0.1 --tzZdJ4yHDV5r1Akt Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJX0jL4AAoJEC8Jno0AXoH0lcgQAI1w/aURRdtHIsH1rgu9qwYz cUoZ4EKtFbqitsK2VKXtoVes/ycTV752lks//VgrvDS84f4renoyB0Cd08CH1XYW hpyXrkHlFAVrROuJh3Ttx9phzzL/wJVtlBz95Zjk45RuWOWVYOuIPt6nbZd8KiD/ Fieb374dI3lg/wlZIDHwTd98HziW3FTnCzY1r8p1c2tEKBi0u/RRYNmxy5GAmtRL MSNSp0bSi2Da53SgPED4U+L++zKvSKeFn5R5OQ+OeU8/I/qeG8CJ3RNcDmDTRLlu ZQsweF1Sikw1Ob4HF4l72Llb3PsDRHBuwchPKijfw7oACFh2HWatOnU/zisoq82k tPDnL57nZRALZ4F5ISq8Ag9+C0Zdm2hJxeGv1l4xK0krw9AUquUMqI5IpCc59QsU kj1uZ/cb3BCJLpEY+3WViyxwZ4sb7nLbAFBqsk3x0UHuY6Y/GVnXBhFm7YoME0jy WuAuHXxaFEbHsl61AXCjvZJh2+9qszAzlaX65Uzp4GA5u4TSps9cbFT6yPY5lEH3 tWlnoUVm3X3H+/qAa+UyZ5CZM067eOJCqcOD7z/g/MQAi3f1+AEr3AgDq2SWdMy3 dqOFdkpM2IaFPwPQ/V6wdIfY0/Dpsk1IyHaatEm/1aiBemszEoK76Z7DCMOMTLlO /3edyE5AQZA3XPesjIvN =cMJT -----END PGP SIGNATURE----- --tzZdJ4yHDV5r1Akt-- --===============8264197719065651399== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce --===============8264197719065651399==-- |