ALAS2023-2023-069

Amazon Linux 2023 Security Advisory: ALAS-2023-069
Advisory Release Date: 2023-02-17 20:46 Pacific
Advisory Updated Date: 2023-02-22 23:32 Pacific
Severity: Medium
Issue Overview:

A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory leak or a denial of service. (CVE-2022-25308)

A heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl.c file. This flaw allows an attacker to pass a specially crafted file to the Fribidi application with the --caprtl option, leading to a crash and causing a denial of service. (CVE-2022-25309)

A segmentation fault (SEGV) flaw was found in the Fribidi package and affects the fribidi_remove_bidi_marks() function of the lib/fribidi.c file. This flaw allows an attacker to pass a specially crafted file to Fribidi, leading to a crash and causing a denial of service. (CVE-2022-25310)


Affected Packages:

fribidi


Issue Correction:
Run dnf update fribidi --releasever=2023.0.20230222 to update your system.

New Packages:
aarch64:
    fribidi-debugsource-1.0.11-3.amzn2023.0.2.aarch64
    fribidi-devel-1.0.11-3.amzn2023.0.2.aarch64
    fribidi-debuginfo-1.0.11-3.amzn2023.0.2.aarch64
    fribidi-1.0.11-3.amzn2023.0.2.aarch64

src:
    fribidi-1.0.11-3.amzn2023.0.2.src

x86_64:
    fribidi-debugsource-1.0.11-3.amzn2023.0.2.x86_64
    fribidi-debuginfo-1.0.11-3.amzn2023.0.2.x86_64
    fribidi-devel-1.0.11-3.amzn2023.0.2.x86_64
    fribidi-1.0.11-3.amzn2023.0.2.x86_64

Additional References

Red Hat: CVE-2022-25308, CVE-2022-25309, CVE-2022-25310

Mitre: CVE-2022-25308, CVE-2022-25309, CVE-2022-25310