USN-3368-1: libiberty vulnerabilities
It was discovered that libiberty incorrectly handled certain string operations. If a user or automated system were tricked into processing a specially crafted binary, a remote attacker could use this issue to cause libiberty to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-2226) It was discovered that libiberty incorrectly handled parsing certain binaries. If a user or automated system were tricked into processing a specially crafted binary, a remote attacker could use this issue to cause libiberty to crash, resulting in a denial of service. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-4487, CVE-2016-4488, CVE-2016-4489, CVE-2016-4490, CVE-2016-4492, CVE-2016-4493, CVE-2016-6131) It was discovered that libiberty incorrectly handled parsing certain binaries. If a user or automated system were tricked into processing a specially crafted binary, a remote attacker could use this issue to cause libiberty to crash, resulting in a denial of service. (CVE-2016-4491)
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID of this security advisory?
The vulnerability ID of this security advisory is USN-3368-1.
What is the title of this security advisory?
The title of this security advisory is 'USN-3368-1: libiberty vulnerabilities'.
What is the description of the libiberty vulnerabilities?
The libiberty vulnerabilities involve a handling issue that could lead to a crash or possible arbitrary code execution.
What software is affected by these vulnerabilities?
The libiberty-dev package is affected on Ubuntu versions 17.04, 16.04, and 14.04.
How can I fix the libiberty vulnerabilities?
To fix the libiberty vulnerabilities, update the libiberty-dev package to the specified remedy version for your Ubuntu version.