Debian Security Advisory
DLA-2974-1 fribidi -- LTS security update
- Date Reported:
- 14 Apr 2022
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2022-25308, CVE-2022-25309, CVE-2022-25310.
- More information:
Several issues have been found in fribidi, a free Implementation of the Unicode BiDi algorithm. The issues are related to stack-buffer-overflow, heap-buffer-overflow, and a SEGV.
stack-buffer-overflow issue in main()
heap-buffer-overflow issue in fribidi_cap_rtl_to_unicode()
SEGV issue in fribidi_remove_bidi_marks()
For Debian 9 stretch, these problems have been fixed in version 0.19.7-1+deb9u2.
We recommend that you upgrade your fribidi packages.
For the detailed security status of fribidi please refer to its security tracker page at: https://security-tracker.debian.org/tracker/fribidi
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS