Discover Government News

=========================================================================Ubuntu Security Notice USN-3067-1
August 24, 2016

harfbuzz vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

HarfBuzz could be made to crash or run programs as your login if it
processed specially crafted data.

Software Description:
- harfbuzz: OpenType text shaping engine

Details:

Kostya Serebryany discovered that HarfBuzz incorrectly handled memory. A
remote attacker could use this issue to cause HarfBuzz to crash, resulting
in a denial of service, or possibly execute arbitrary code. (CVE-2015-8947)

It was discovered that HarfBuzz incorrectly handled certain length checks.
A remote attacker could use this issue to cause HarfBuzz to crash,
resulting in a denial of service, or possibly execute arbitrary code.
This issue only applied to Ubuntu 16.04 LTS. (CVE-2016-2052)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  libharfbuzz0b                   1.0.1-1ubuntu0.1

Ubuntu 14.04 LTS:
  libharfbuzz0b                   0.9.27-1ubuntu1.1

After a standard system update you need to restart your session to make
all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-3067-1
  CVE-2015-8947, CVE-2016-2052

Package Information:
  https://launchpad.net/ubuntu/+source/harfbuzz/1.0.1-1ubuntu0.1
  https://launchpad.net/ubuntu/+source/harfbuzz/0.9.27-1ubuntu1.1


Ubuntu 3067-1: HarfBuzz vulnerabilities

August 24, 2016
HarfBuzz could be made to crash or run programs as your login if it processed specially crafted data.

Summary

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: libharfbuzz0b 1.0.1-1ubuntu0.1 Ubuntu 14.04 LTS: libharfbuzz0b 0.9.27-1ubuntu1.1 After a standard system update you need to restart your session to make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-3067-1

CVE-2015-8947, CVE-2016-2052

Severity
August 24, 2016

Package Information

https://launchpad.net/ubuntu/+source/harfbuzz/1.0.1-1ubuntu0.1 https://launchpad.net/ubuntu/+source/harfbuzz/0.9.27-1ubuntu1.1

Related News