Ubuntu 16.10: USN-3197-1 Critical Integer Overflow with Libgc

ubuntu

February 15, 2017

Applications using libgc could be made to crash or run programs asyour login.

Summary

Applications using libgc could be made to crash or run programs as

your login.

Software Description:

- libgc: Boehm-Demers-Weiser garbage collecting storage allocator library

Details:

Kuang-che Wu discovered that multiple integer overflow vulnerabilities

existed in libgc. An attacker could use these to cause a denial of

service (application crash) or possibly execute arbitrary code.

Topics Covered

security advisory denial of service critical threat integer overflow ubuntu libgc

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  libgc1c2                        1:7.4.2-8ubuntu0.1

Ubuntu 16.04 LTS:
  libgc1c2                        1:7.4.2-7.3ubuntu0.1

Ubuntu 14.04 LTS:
  libgc1c2                        1:7.2d-5ubuntu2.1

Ubuntu 12.04 LTS:
  libgc1c2                        1:7.1-8ubuntu0.12.04.3

After a standard system update you need to restart applications using
libgc to make all the necessary changes.