Summary
It was discovered that abcm2ps incorrectly
handled memory when parsing specially crafted ABC files.
An attacker could use this issue to cause abcm2ps to crash,
leading to a denial of service, or possibly execute
arbitrary code. This issue only affected Ubuntu 16.04 ESM
and Ubuntu 18.04 LTS.
(CVE-2018-10753, CVE-2018-10771, CVE-2019-1010069)
Chiba of Topsec Alpha Lab discovered that abcm2ps incorrectly
handled memory when parsing specially crafted ABC files.
An attacker could use this issue to cause abcm2ps to crash,
leading to a denial of service.
(CVE-2021-32434, CVE-2021-32435, CVE-2021-32436)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | abcm2ps | 7.8.9-1+deb9u1build0.18.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | abcm2ps | 7.8.9-1ubuntu0.16.04.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | abcm2ps | 8.14.6-0.1ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | abcm2ps | 8.14.11-0.1ubuntu0.1~esm1 |
Vulnerabilities 6
-
Unscored —
Stack-based buffer overflow in the delayed_output function in music.c in abcm2ps through 8.13.20 allows remote attacker…
-
Unscored —
Stack-based buffer overflow in the get_key function in parse.c in abcm2ps through 8.13.20 allows remote attackers to ca…
-
Unscored —
moinejf abcm2ps 8.13.20 is affected by: Incorrect Access Control. The impact is: Allows attackers to cause a denial of …
-
Unscored —
abcm2ps v8.14.11 was discovered to contain an out-of-bounds read in the function calculate_beam at draw.c.
-
Unscored —
Stack-based buffer overflow in the function get_key in parse.c of abcm2ps v8.14.11 allows remote attackers to cause a D…
-
Unscored —
An out-of-bounds read in the function write_title() in subs.c of abcm2ps v8.14.11 allows remote attackers to cause a De…
References
-
report
https://ubuntu.com/security/CVE-2018-10753
-
report
https://ubuntu.com/security/CVE-2018-10771
-
report
https://ubuntu.com/security/CVE-2019-1010069
-
report
https://ubuntu.com/security/CVE-2021-32434
-
report
https://ubuntu.com/security/CVE-2021-32435
-
report
https://ubuntu.com/security/CVE-2021-32436