Debian Security Advisory

DLA-2974-1 fribidi -- LTS security update

Date Reported:
14 Apr 2022
Affected Packages:
fribidi
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2022-25308, CVE-2022-25309, CVE-2022-25310.
More information:

Several issues have been found in fribidi, a free Implementation of the Unicode BiDi algorithm. The issues are related to stack-buffer-overflow, heap-buffer-overflow, and a SEGV.

  • CVE-2022-25308

    stack-buffer-overflow issue in main()

  • CVE-2022-25309

    heap-buffer-overflow issue in fribidi_cap_rtl_to_unicode()

  • CVE-2022-25310

    SEGV issue in fribidi_remove_bidi_marks()

    For Debian 9 stretch, these problems have been fixed in version 0.19.7-1+deb9u2.

    We recommend that you upgrade your fribidi packages.

    For the detailed security status of fribidi please refer to its security tracker page at: https://security-tracker.debian.org/tracker/fribidi

    Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS