CVE-2022-25310

NameCVE-2022-25310
DescriptionA segmentation fault (SEGV) flaw was found in the Fribidi package and affects the fribidi_remove_bidi_marks() function of the lib/fribidi.c file. This flaw allows an attacker to pass a specially crafted file to Fribidi, leading to a crash and causing a denial of service.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2974-1
Debian Bugs1008793

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
fribidi (PTS)bullseye1.0.8-2+deb11u1fixed
bookworm1.0.8-2.1fixed
sid, trixie1.0.15-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
fribidisourcestretch0.19.7-1+deb9u2DLA-2974-1
fribidisourcebuster1.0.5-3.1+deb10u2
fribidisourcebullseye1.0.8-2+deb11u1
fribidisource(unstable)1.0.8-2.11008793

Notes

https://github.com/fribidi/fribidi/issues/183
https://github.com/fribidi/fribidi/pull/186
https://github.com/fribidi/fribidi/commit/175850b03e1af251d705c1d04b2b9b3c1c06e48f
Search for package or bug name: Reporting problems