Summary
USN-5172-1 fixed vulnerabilities in uriparser.
This update provides the corresponding updates for Ubuntu 14.04 ESM and
Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that uriparser mishandled certain input. An attacker
could use this vulnerability to cause uriparser to crash or possibly
execute arbitrary code. (CVE-2018-19198, CVE-2018-19199, CVE-2018-19200)
It was discovered that uriparser incorrectly handled certain URIs. An
attacker could use this vulnerability to cause a crash or possibly leak
sensitive information. (CVE-2018-20721)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | uriparser | 0.7.5-1ubuntu2+esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | uriparser | 0.8.4-1ubuntu0.16.04.1~esm2 |
Vulnerabilities 4
-
Unscored —
An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an out-of-bounds write via a uriComposeQuery* or u…
-
Unscored —
An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an integer overflow via a uriComposeQuery* or uriC…
-
Unscored —
An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriReset…
-
Unscored —
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex* functions) for an incompl…