ALAS2022-2022-200

Amazon Linux 2022 Security Advisory: ALAS-2022-200
Advisory Release Date: 2022-11-01 21:25 Pacific
Advisory Updated Date: 2022-11-03 20:55 Pacific
Severity: Medium
Issue Overview:

A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory leak or a denial of service. (CVE-2022-25308)

A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the --caprtl option, leading to a crash and causing a denial of service. (CVE-2022-25309)

A segmentation fault (SEGV) flaw was found in the Fribidi package and affects the fribidi_remove_bidi_marks() function of the lib/fribidi.c file. This flaw allows an attacker to pass a specially crafted file to Fribidi, leading to a crash and causing a denial of service. (CVE-2022-25310)


Affected Packages:

fribidi


Issue Correction:
Run dnf update fribidi --releasever=2022.0.20221102 to update your system.

New Packages:
aarch64:
    fribidi-debuginfo-1.0.11-3.amzn2022.0.1.aarch64
    fribidi-devel-1.0.11-3.amzn2022.0.1.aarch64
    fribidi-debugsource-1.0.11-3.amzn2022.0.1.aarch64
    fribidi-1.0.11-3.amzn2022.0.1.aarch64

src:
    fribidi-1.0.11-3.amzn2022.0.1.src

x86_64:
    fribidi-debugsource-1.0.11-3.amzn2022.0.1.x86_64
    fribidi-1.0.11-3.amzn2022.0.1.x86_64
    fribidi-devel-1.0.11-3.amzn2022.0.1.x86_64
    fribidi-debuginfo-1.0.11-3.amzn2022.0.1.x86_64

Additional References

Red Hat: CVE-2022-25308, CVE-2022-25309, CVE-2022-25310

Mitre: CVE-2022-25308, CVE-2022-25309, CVE-2022-25310