Summary
It was discovered that FriBidi incorrectly handled the processing of input
strings, resulting in memory corruption. An attacker could possibly use this
issue to cause FriBidi to crash, resulting in a denial of service, or
potentially execute arbitrary code. (CVE-2022-25308)
It was discovered that FriBidi incorrectly validated input data to its CapRTL
unicode encoder, resulting in memory corruption. An attacker could possibly
use this issue to cause FriBidi to crash, resulting in a denial of service, or
potentially execute arbitrary code. (CVE-2022-25309)
It was discovered that FriBidi incorrectly handled empty input when removing
marks from unicode strings. An attacker could possibly use this to cause
FriBidi to crash, resulting in a denial of service, or potentially execute
arbitrary code. (CVE-2022-25310)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | fribidi | 0.19.7-1ubuntu0.1~esm1 |
Vulnerabilities 3
-
Unscored —
A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially c…
-
Unscored —
A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() functio…
-
Unscored —
A segmentation fault (SEGV) flaw was found in the Fribidi package and affects the fribidi_remove_bidi_marks() function …