[USN-6586-1] FreeImage vulnerabilities
[USN-6587-1] X.Org X Server vulnerabilities
[USN-6586-1] FreeImage vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6586-1
January 16, 2024
freeimage vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in FreeImage.
Software Description:
- freeimage: Support library for graphics image formats
Details:
It was discovered that FreeImage incorrectly handled certain memory
operations. If a user were tricked into opening a crafted TIFF file, a
remote attacker could use this issue to cause a heap buffer overflow,
resulting in a denial of service attack. This issue only affected Ubuntu
16.04 LTS and Ubuntu 20.04 LTS. (CVE-2019-12211)
It was discovered that FreeImage incorrectly processed images under
certain circumstances. If a user were tricked into opening a crafted TIFF
file, a remote attacker could possibly use this issue to cause a stack
exhaustion condition, resulting in a denial of service attack. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 20.04 LTS. (CVE-2019-12213)
It was discovered that FreeImage incorrectly processed certain images.
If a user or automated system were tricked into opening a specially
crafted image file, a remote attacker could possibly use this issue to
cause a denial of service or execute arbitrary code. (CVE-2020-21427,
CVE-2020-21428)
It was discovered that FreeImage incorrectly processed certain images.
If a user or automated system were tricked into opening a specially
crafted PFM file, an attacker could possibly use this issue to cause a
denial of service. (CVE-2020-22524)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
libfreeimage3 3.18.0+ds2-9.1ubuntu0.1
libfreeimageplus3 3.18.0+ds2-9.1ubuntu0.1
Ubuntu 23.04:
libfreeimage3 3.18.0+ds2-9ubuntu0.1
libfreeimageplus3 3.18.0+ds2-9ubuntu0.1
Ubuntu 22.04 LTS:
libfreeimage3 3.18.0+ds2-6ubuntu5.1
libfreeimageplus3 3.18.0+ds2-6ubuntu5.1
Ubuntu 20.04 LTS:
libfreeimage3 3.18.0+ds2-1ubuntu3.1
libfreeimageplus3 3.18.0+ds2-1ubuntu3.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libfreeimage3 3.17.0+ds1-5+deb9u1ubuntu0.1~esm1
libfreeimageplus3 3.17.0+ds1-5+deb9u1ubuntu0.1~esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libfreeimage3 3.17.0+ds1-2ubuntu0.1+esm1
libfreeimageplus3 3.17.0+ds1-2ubuntu0.1+esm1
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
libfreeimage3 3.15.4-3ubuntu0.1+esm3
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6586-1
CVE-2019-12211, CVE-2019-12213, CVE-2020-21427, CVE-2020-21428,
CVE-2020-22524
Package Information:
https://launchpad.net/ubuntu/+source/freeimage/3.18.0+ds2-9.1ubuntu0.1
https://launchpad.net/ubuntu/+source/freeimage/3.18.0+ds2-9ubuntu0.1
https://launchpad.net/ubuntu/+source/freeimage/3.18.0+ds2-6ubuntu5.1
https://launchpad.net/ubuntu/+source/freeimage/3.18.0+ds2-1ubuntu3.1
[USN-6587-1] X.Org X Server vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6587-1
January 16, 2024
xorg-server, xwayland vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in X.Org X Server.
Software Description:
- xorg-server: X.Org X11 server
- xwayland: X server for running X clients under Wayland
Details:
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
memory when processing the DeviceFocusEvent and ProcXIQueryPointer APIs. An
attacker could possibly use this issue to cause the X Server to crash,
obtain sensitive information, or execute arbitrary code. (CVE-2023-6816)
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
reattaching to a different master device. An attacker could use this issue
to cause the X Server to crash, leading to a denial of service, or possibly
execute arbitrary code. (CVE-2024-0229)
Olivier Fourdan and Donn Seeley discovered that the X.Org X Server
incorrectly labeled GLX PBuffers when used with SELinux. An attacker could
use this issue to cause the X Server to crash, leading to a denial of
service. (CVE-2024-0408)
Olivier Fourdan discovered that the X.Org X Server incorrectly handled
the curser code when used with SELinux. An attacker could use this issue to
cause the X Server to crash, leading to a denial of service.
(CVE-2024-0409)
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
memory when processing the XISendDeviceHierarchyEvent API. An attacker
could possibly use this issue to cause the X Server to crash, or execute
arbitrary code. (CVE-2024-21885)
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
devices being disabled. An attacker could possibly use this issue to cause
the X Server to crash, or execute arbitrary code. (CVE-2024-21886)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
xserver-xorg-core 2:21.1.7-3ubuntu2.6
xwayland 2:23.2.0-1ubuntu0.4
Ubuntu 23.04:
xserver-xorg-core 2:21.1.7-1ubuntu3.6
xwayland 2:22.1.8-1ubuntu1.4
Ubuntu 22.04 LTS:
xserver-xorg-core 2:21.1.4-2ubuntu1.7~22.04.7
xwayland 2:22.1.1-1ubuntu0.10
Ubuntu 20.04 LTS:
xserver-xorg-core 2:1.20.13-1ubuntu1~20.04.14
xwayland 2:1.20.13-1ubuntu1~20.04.14
After a standard system update you need to reboot your computer to make all
the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6587-1
CVE-2023-6816, CVE-2024-0229, CVE-2024-0408, CVE-2024-0409,
CVE-2024-21885, CVE-2024-21886
Package Information:
https://launchpad.net/ubuntu/+source/xorg-server/2:21.1.7-3ubuntu2.6
https://launchpad.net/ubuntu/+source/xwayland/2:23.2.0-1ubuntu0.4
https://launchpad.net/ubuntu/+source/xorg-server/2:21.1.7-1ubuntu3.6
https://launchpad.net/ubuntu/+source/xwayland/2:22.1.8-1ubuntu1.4
https://launchpad.net/ubuntu/+source/xorg-server/2:21.1.4-2ubuntu1.7~22.04.7
https://launchpad.net/ubuntu/+source/xwayland/2:22.1.1-1ubuntu0.10
https://launchpad.net/ubuntu/+source/xorg-server/2:1.20.13-1ubuntu1~20.04.14
