A fribidi security update has been released for Debian GNU/Linux 8 Extended LTS to address several issues.

ELA-592-1 fribidi security update

Package fribidi
Version 0.19.6-3+deb8u1
Related CVEs CVE-2022-25308 CVE-2022-25309 CVE-2022-25310

Several issues have been found in fribidi, a free Implementation of the Unicode BiDi algorithm. The issues are related to stack-buffer-overflow, heap-buffer-overflow, and a SEGV.

CVE-2022-25308 stack-buffer-overflow issue in main()

CVE-2022-25309 heap-buffer-overflow issue in fribidi_cap_rtl_to_unicode()

CVE-2022-25310 SEGV issue in fribidi_remove_bidi_marks()

For Debian 8 jessie, these problems have been fixed in version 0.19.6-3+deb8u1.

We recommend that you upgrade your fribidi packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

  ELA-592-1 fribidi security update