Ubuntu 6286 Published by

The following two updates are available for Ubuntu Linux:

[USN-6586-1] FreeImage vulnerabilities
[USN-6587-1] X.Org X Server vulnerabilities




[USN-6586-1] FreeImage vulnerabilities


==========================================================================
Ubuntu Security Notice USN-6586-1
January 16, 2024

freeimage vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)

Summary:

Several security issues were fixed in FreeImage.

Software Description:
- freeimage: Support library for graphics image formats

Details:

It was discovered that FreeImage incorrectly handled certain memory
operations. If a user were tricked into opening a crafted TIFF file, a
remote attacker could use this issue to cause a heap buffer overflow,
resulting in a denial of service attack. This issue only affected Ubuntu
16.04 LTS and Ubuntu 20.04 LTS. (CVE-2019-12211)

It was discovered that FreeImage incorrectly processed images under
certain circumstances. If a user were tricked into opening a crafted TIFF
file, a remote attacker could possibly use this issue to cause a stack
exhaustion condition, resulting in a denial of service attack. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 20.04 LTS. (CVE-2019-12213)

It was discovered that FreeImage incorrectly processed certain images.
If a user or automated system were tricked into opening a specially
crafted image file, a remote attacker could possibly use this issue to
cause a denial of service or execute arbitrary code. (CVE-2020-21427,
CVE-2020-21428)

It was discovered that FreeImage incorrectly processed certain images.
If a user or automated system were tricked into opening a specially
crafted PFM file, an attacker could possibly use this issue to cause a
denial of service. (CVE-2020-22524)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
  libfreeimage3                   3.18.0+ds2-9.1ubuntu0.1
  libfreeimageplus3               3.18.0+ds2-9.1ubuntu0.1

Ubuntu 23.04:
  libfreeimage3                   3.18.0+ds2-9ubuntu0.1
  libfreeimageplus3               3.18.0+ds2-9ubuntu0.1

Ubuntu 22.04 LTS:
  libfreeimage3                   3.18.0+ds2-6ubuntu5.1
  libfreeimageplus3               3.18.0+ds2-6ubuntu5.1

Ubuntu 20.04 LTS:
  libfreeimage3                   3.18.0+ds2-1ubuntu3.1
  libfreeimageplus3               3.18.0+ds2-1ubuntu3.1

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
  libfreeimage3 3.17.0+ds1-5+deb9u1ubuntu0.1~esm1
  libfreeimageplus3 3.17.0+ds1-5+deb9u1ubuntu0.1~esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
  libfreeimage3                   3.17.0+ds1-2ubuntu0.1+esm1
  libfreeimageplus3               3.17.0+ds1-2ubuntu0.1+esm1

Ubuntu 14.04 LTS (Available with Ubuntu Pro):
  libfreeimage3                   3.15.4-3ubuntu0.1+esm3

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-6586-1
  CVE-2019-12211, CVE-2019-12213, CVE-2020-21427, CVE-2020-21428,
  CVE-2020-22524

Package Information:
https://launchpad.net/ubuntu/+source/freeimage/3.18.0+ds2-9.1ubuntu0.1
https://launchpad.net/ubuntu/+source/freeimage/3.18.0+ds2-9ubuntu0.1
https://launchpad.net/ubuntu/+source/freeimage/3.18.0+ds2-6ubuntu5.1
https://launchpad.net/ubuntu/+source/freeimage/3.18.0+ds2-1ubuntu3.1



[USN-6587-1] X.Org X Server vulnerabilities


==========================================================================
Ubuntu Security Notice USN-6587-1
January 16, 2024

xorg-server, xwayland vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in X.Org X Server.

Software Description:
- xorg-server: X.Org X11 server
- xwayland: X server for running X clients under Wayland

Details:

Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
memory when processing the DeviceFocusEvent and ProcXIQueryPointer APIs. An
attacker could possibly use this issue to cause the X Server to crash,
obtain sensitive information, or execute arbitrary code. (CVE-2023-6816)

Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
reattaching to a different master device. An attacker could use this issue
to cause the X Server to crash, leading to a denial of service, or possibly
execute arbitrary code. (CVE-2024-0229)

Olivier Fourdan and Donn Seeley discovered that the X.Org X Server
incorrectly labeled GLX PBuffers when used with SELinux. An attacker could
use this issue to cause the X Server to crash, leading to a denial of
service. (CVE-2024-0408)

Olivier Fourdan discovered that the X.Org X Server incorrectly handled
the curser code when used with SELinux. An attacker could use this issue to
cause the X Server to crash, leading to a denial of service.
(CVE-2024-0409)

Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
memory when processing the XISendDeviceHierarchyEvent API. An attacker
could possibly use this issue to cause the X Server to crash, or execute
arbitrary code. (CVE-2024-21885)

Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
devices being disabled. An attacker could possibly use this issue to cause
the X Server to crash, or execute arbitrary code. (CVE-2024-21886)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
xserver-xorg-core 2:21.1.7-3ubuntu2.6
xwayland 2:23.2.0-1ubuntu0.4

Ubuntu 23.04:
xserver-xorg-core 2:21.1.7-1ubuntu3.6
xwayland 2:22.1.8-1ubuntu1.4

Ubuntu 22.04 LTS:
xserver-xorg-core 2:21.1.4-2ubuntu1.7~22.04.7
xwayland 2:22.1.1-1ubuntu0.10

Ubuntu 20.04 LTS:
xserver-xorg-core 2:1.20.13-1ubuntu1~20.04.14
xwayland 2:1.20.13-1ubuntu1~20.04.14

After a standard system update you need to reboot your computer to make all
the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6587-1
CVE-2023-6816, CVE-2024-0229, CVE-2024-0408, CVE-2024-0409,
CVE-2024-21885, CVE-2024-21886

Package Information:
https://launchpad.net/ubuntu/+source/xorg-server/2:21.1.7-3ubuntu2.6
https://launchpad.net/ubuntu/+source/xwayland/2:23.2.0-1ubuntu0.4
https://launchpad.net/ubuntu/+source/xorg-server/2:21.1.7-1ubuntu3.6
https://launchpad.net/ubuntu/+source/xwayland/2:22.1.8-1ubuntu1.4
https://launchpad.net/ubuntu/+source/xorg-server/2:21.1.4-2ubuntu1.7~22.04.7
https://launchpad.net/ubuntu/+source/xwayland/2:22.1.1-1ubuntu0.10
https://launchpad.net/ubuntu/+source/xorg-server/2:1.20.13-1ubuntu1~20.04.14