USN-8992-1: Shapelib vulnerability
It was discovered that the shpsort utility in Shapelib incorrectly handled certain inputs, leading to a double free. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/shapelibto a version that resolves this vulnerability.Fixed in 1.5.0-2+deb11u1build0.22.04.1 - Upgrade
Upgrade
ubuntu/shapelibto a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/shapelibto a version that resolves this vulnerability.Fixed in 1.3.0-5ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/shapelibto a version that resolves this vulnerability.Fixed in 1.4.1-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/shapelibto a version that resolves this vulnerability.Fixed in 1.5.0-1ubuntu0.1~esm1
Event History
Frequently Asked Questions
Which component is affected?
The issue is in the shpsort utility provided by Shapelib on Ubuntu.
What would an attacker need to do to exploit this issue?
An attacker would need to provide shpsort with specially crafted input that triggers the double-free condition.
What is the potential impact?
Successful exploitation could cause a denial of service or potentially allow arbitrary code execution.