Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in Imlib2
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in Imlib2
ID: USN-3075-1
Distribution: Ubuntu
Plattformen: Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, Ubuntu 16.04 LTS
Datum: Fr, 9. September 2016, 07:17
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5326
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9763
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9762
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9771
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4024
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3993
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3994
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9764
Applikationen: Imlib2

Originalnachricht


--===============8264197719065651399==
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature";
boundary="tzZdJ4yHDV5r1Akt"
Content-Disposition: inline


--tzZdJ4yHDV5r1Akt
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

==========================================================================
Ubuntu Security Notice USN-3075-1
September 09, 2016

imlib2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS

Summary:

Several security issues were fixed in Imlib2.

Software Description:
- imlib2: Image manipulation and rendering library

Details:

Jakub Wilk discovered an out of bounds read in the GIF loader
implementation in Imlib2. An attacker could use this to cause a
denial of service (application crash) or possibly obtain sensitive
information. (CVE-2016-3994)

Yuriy M. Kaminskiy discovered an off-by-one error when handling
coordinates in Imlib2. An attacker could use this to cause a denial of
service (application crash). (CVE-2016-3993)

Yuriy M. Kaminskiy discovered that integer overflows existed in Imlib2
when handling images with large dimensions. An attacker could use
this to cause a denial of service (memory exhaustion or application
crash). (CVE-2014-9771, CVE-2016-4024)

Kevin Ryde discovered that the ellipse drawing code in Imlib2 would
attempt to divide by zero when drawing a 2x1 ellipse. An attacker
could use this to cause a denial of service (application crash).
(CVE-2011-5326)

It was discovered that Imlib2 did not properly handled GIF images
without colormaps. An attacker could use this to cause a denial of
service (application crash). This issue only affected Ubuntu 12.04 LTS
and Ubuntu 14.04 LTS. (CVE-2014-9762)

It was discovered that Imlib2 did not properly handle some PNM images,
leading to a division by zero. An attacker could use this to cause
a denial of service (application crash). This issue only affected
Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9763)

It was discovered that Imlib2 did not properly handle error conditions
when loading some GIF images. An attacker could use this to cause
a denial of service (application crash). This issue only affected
Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9764)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
libimlib2 1.4.7-1ubuntu0.1

Ubuntu 14.04 LTS:
libimlib2 1.4.6-2ubuntu0.1

Ubuntu 12.04 LTS:
libimlib2 1.4.4-1ubuntu0.1

After a standard system update you will need to restart applications
that make use of Imlib2 to make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-3075-1
CVE-2011-5326, CVE-2014-9762, CVE-2014-9763, CVE-2014-9764,
CVE-2014-9771, CVE-2016-3993, CVE-2016-3994, CVE-2016-4024

Package Information:
https://launchpad.net/ubuntu/+source/imlib2/1.4.7-1ubuntu0.1
https://launchpad.net/ubuntu/+source/imlib2/1.4.6-2ubuntu0.1
https://launchpad.net/ubuntu/+source/imlib2/1.4.4-1ubuntu0.1


--tzZdJ4yHDV5r1Akt
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJX0jL4AAoJEC8Jno0AXoH0lcgQAI1w/aURRdtHIsH1rgu9qwYz
cUoZ4EKtFbqitsK2VKXtoVes/ycTV752lks//VgrvDS84f4renoyB0Cd08CH1XYW
hpyXrkHlFAVrROuJh3Ttx9phzzL/wJVtlBz95Zjk45RuWOWVYOuIPt6nbZd8KiD/
Fieb374dI3lg/wlZIDHwTd98HziW3FTnCzY1r8p1c2tEKBi0u/RRYNmxy5GAmtRL
MSNSp0bSi2Da53SgPED4U+L++zKvSKeFn5R5OQ+OeU8/I/qeG8CJ3RNcDmDTRLlu
ZQsweF1Sikw1Ob4HF4l72Llb3PsDRHBuwchPKijfw7oACFh2HWatOnU/zisoq82k
tPDnL57nZRALZ4F5ISq8Ag9+C0Zdm2hJxeGv1l4xK0krw9AUquUMqI5IpCc59QsU
kj1uZ/cb3BCJLpEY+3WViyxwZ4sb7nLbAFBqsk3x0UHuY6Y/GVnXBhFm7YoME0jy
WuAuHXxaFEbHsl61AXCjvZJh2+9qszAzlaX65Uzp4GA5u4TSps9cbFT6yPY5lEH3
tWlnoUVm3X3H+/qAa+UyZ5CZM067eOJCqcOD7z/g/MQAi3f1+AEr3AgDq2SWdMy3
dqOFdkpM2IaFPwPQ/V6wdIfY0/Dpsk1IyHaatEm/1aiBemszEoK76Z7DCMOMTLlO
/3edyE5AQZA3XPesjIvN
=cMJT
-----END PGP SIGNATURE-----

--tzZdJ4yHDV5r1Akt--


--===============8264197719065651399==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============8264197719065651399==--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung