USN-7198-1: rlottie vulnerabilities
Paolo Giai discovered a series of stack-based overflow vulnerabilities in the blit and grayrendercubic functions of a custom fork of the rlottie library. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2021-31315, CVE-2021-31321) Paolo Giai discovered a series of type confusion vulnerabilities in the VDasher constructor and the LOTCompLayerItem::LOTCompLayerItem function of a custom fork of the rlottie library. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-31317, CVE-2021-31318) Paolo Giai discovered an integer overflow vulnerability in the LOTGradient::populate function of a custom fork of the rlottie library. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-31319) Paolo Giai discovered a series of heap buffer overflow vulnerabilities in the VGradientCache::generateGradientColorTable and LOTGradient::populate functions of a custom fork of the rlottie library. An attacker could possibly use this issue to achieve remote code execution. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-31320, CVE-2021-31322)
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-7198-1?
The vulnerability USN-7198-1 has been classified as critical due to the potential for stack-based overflow leading to information leakage.
How do I fix USN-7198-1?
To fix the vulnerability USN-7198-1, users should upgrade the librlottie0-1 package to version 0.1+dfsg-2ubuntu0.1 on Ubuntu 22.04 or 0~git20200305.a717479+dfsg-1ubuntu0.1~esm1 on Ubuntu 20.04.
Who is affected by USN-7198-1?
USN-7198-1 specifically affects users of Ubuntu 20.04 LTS and Ubuntu 22.04 LTS using the vulnerable versions of the librlottie0-1 package.
What components are involved in the USN-7198-1 vulnerability?
The USN-7198-1 vulnerability involves the blit and gray_render_cubic functions within a custom fork of the rlottie library.
Can USN-7198-1 lead to remote attacks?
While USN-7198-1 could potentially lead to information leakage, it is not explicitly stated that it allows for remote execution or other attack vectors.