USN-3368-1: libiberty vulnerabilities
It was discovered that libiberty incorrectly handled certain string operations. If a user or automated system were tricked into processing a specially crafted binary, a remote attacker could use this issue to cause libiberty to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-2226) It was discovered that libiberty incorrectly handled parsing certain binaries. If a user or automated system were tricked into processing a specially crafted binary, a remote attacker could use this issue to cause libiberty to crash, resulting in a denial of service. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-4487, CVE-2016-4488, CVE-2016-4489, CVE-2016-4490, CVE-2016-4492, CVE-2016-4493, CVE-2016-6131) It was discovered that libiberty incorrectly handled parsing certain binaries. If a user or automated system were tricked into processing a specially crafted binary, a remote attacker could use this issue to cause libiberty to crash, resulting in a denial of service. (CVE-2016-4491)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libiberty-devto a version that resolves this vulnerability.Fixed in 20161220-1ubuntu0.2 - Upgrade
Upgrade
ubuntu/libiberty-devto a version that resolves this vulnerability.Fixed in 20160215-1ubuntu0.2 - Upgrade
Upgrade
ubuntu/libiberty-devto a version that resolves this vulnerability.Fixed in 20131116-1ubuntu0.2
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID of this security advisory?
The vulnerability ID of this security advisory is USN-3368-1.
What is the title of this security advisory?
The title of this security advisory is 'USN-3368-1: libiberty vulnerabilities'.
What is the description of the libiberty vulnerabilities?
The libiberty vulnerabilities involve a handling issue that could lead to a crash or possible arbitrary code execution.
What software is affected by these vulnerabilities?
The libiberty-dev package is affected on Ubuntu versions 17.04, 16.04, and 14.04.
How can I fix the libiberty vulnerabilities?
To fix the libiberty vulnerabilities, update the libiberty-dev package to the specified remedy version for your Ubuntu version.