USN-3075-1: Imlib2 vulnerabilities
Ubuntu Security Notice USN-3075-1
8th September, 2016
imlib2 vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary
Several security issues were fixed in Imlib2.
Software description
- imlib2 - Image manipulation and rendering library
Details
Jakub Wilk discovered an out of bounds read in the GIF loader
implementation in Imlib2. An attacker could use this to cause a
denial of service (application crash) or possibly obtain sensitive
information. (CVE-2016-3994)
Yuriy M. Kaminskiy discovered an off-by-one error when handling
coordinates in Imlib2. An attacker could use this to cause a denial of
service (application crash). (CVE-2016-3993)
Yuriy M. Kaminskiy discovered that integer overflows existed in Imlib2
when handling images with large dimensions. An attacker could use
this to cause a denial of service (memory exhaustion or application
crash). (CVE-2014-9771, CVE-2016-4024)
Kevin Ryde discovered that the ellipse drawing code in Imlib2 would
attempt to divide by zero when drawing a 2x1 ellipse. An attacker
could use this to cause a denial of service (application crash).
(CVE-2011-5326)
It was discovered that Imlib2 did not properly handled GIF images
without colormaps. An attacker could use this to cause a denial of
service (application crash). This issue only affected Ubuntu 12.04 LTS
and Ubuntu 14.04 LTS. (CVE-2014-9762)
It was discovered that Imlib2 did not properly handle some PNM images,
leading to a division by zero. An attacker could use this to cause
a denial of service (application crash). This issue only affected
Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9763)
It was discovered that Imlib2 did not properly handle error conditions
when loading some GIF images. An attacker could use this to cause
a denial of service (application crash). This issue only affected
Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9764)
Update instructions
The problem can be corrected by updating your system to the following package version:
- Ubuntu 16.04 LTS:
- libimlib2 1.4.7-1ubuntu0.1
- Ubuntu 14.04 LTS:
- libimlib2 1.4.6-2ubuntu0.1
- Ubuntu 12.04 LTS:
- libimlib2 1.4.4-1ubuntu0.1
To update your system, please follow these instructions: http://ift.tt/17VXqjU.
After a standard system update you will need to restart applications
that make use of Imlib2 to make all the necessary changes.
References
CVE-2011-5326, CVE-2014-9762, CVE-2014-9763, CVE-2014-9764, CVE-2014-9771, CVE-2016-3993, CVE-2016-3994, CVE-2016-4024
from Ubuntu Security Notices http://ift.tt/2cewhha