Ubuntu update for graphite2

1) Out-of-bounds read

EUVDB-ID: #VU7082

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-7771

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in Graphite 2 library due to out-of-bounds-read. A remote attacker can cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Update the affected packages.

Ubuntu 17.04:

libgraphite2-3 1.3.10-0ubuntu0.17.04.1

Ubuntu 16.04 LTS:

libgraphite2-3 1.3.10-0ubuntu0.16.04.1

Ubuntu 14.04 LTS:

libgraphite2-3 1.3.10-0ubuntu0.14.04.1

Vulnerable software versions

Ubuntu: 14.04 - 17.04

CPE2.3

External links

https://www.ubuntu.com/usn/usn-3398-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Heap-buffer-overflow write

EUVDB-ID: #VU7083

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-7772

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in Graphite 2 library due to heap-buffer-overflow write. A remote attacker can execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected packages.

Ubuntu 17.04:

libgraphite2-3 1.3.10-0ubuntu0.17.04.1

Ubuntu 16.04 LTS:

libgraphite2-3 1.3.10-0ubuntu0.16.04.1

Ubuntu 14.04 LTS:

libgraphite2-3 1.3.10-0ubuntu0.14.04.1

Vulnerable software versions

Ubuntu: 14.04 - 17.04

CPE2.3

External links

https://www.ubuntu.com/usn/usn-3398-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Heap-buffer-overflow write

EUVDB-ID: #VU7084

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-7773

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in Graphite 2 library due to heap-buffer-overflow write. A remote attacker can execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected packages.

Ubuntu 17.04:

libgraphite2-3 1.3.10-0ubuntu0.17.04.1

Ubuntu 16.04 LTS:

libgraphite2-3 1.3.10-0ubuntu0.16.04.1

Ubuntu 14.04 LTS:

libgraphite2-3 1.3.10-0ubuntu0.14.04.1

Vulnerable software versions

Ubuntu: 14.04 - 17.04

CPE2.3

External links

https://www.ubuntu.com/usn/usn-3398-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Out-of-bounds read

EUVDB-ID: #VU7085

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-7774

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in Graphite 2 library due to out-of-bounds-read. A remote attacker can cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Update the affected packages.

Ubuntu 17.04:

libgraphite2-3 1.3.10-0ubuntu0.17.04.1

Ubuntu 16.04 LTS:

libgraphite2-3 1.3.10-0ubuntu0.16.04.1

Ubuntu 14.04 LTS:

libgraphite2-3 1.3.10-0ubuntu0.14.04.1

Vulnerable software versions

Ubuntu: 14.04 - 17.04

CPE2.3

External links

https://www.ubuntu.com/usn/usn-3398-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Denial of service

EUVDB-ID: #VU7086

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-7775

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in Graphite 2 library due to an error in 'size() > n'. A remote attacker can cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Update the affected packages.

Ubuntu 17.04:

libgraphite2-3 1.3.10-0ubuntu0.17.04.1

Ubuntu 16.04 LTS:

libgraphite2-3 1.3.10-0ubuntu0.16.04.1

Ubuntu 14.04 LTS:

libgraphite2-3 1.3.10-0ubuntu0.14.04.1

Vulnerable software versions

Ubuntu: 14.04 - 17.04

CPE2.3

External links

https://www.ubuntu.com/usn/usn-3398-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Heap-buffer-overflow read

EUVDB-ID: #VU7087

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-7776

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in Graphite 2 library due to heap-buffer-overflow read. A remote attacker can cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Update the affected packages.

Ubuntu 17.04:

libgraphite2-3 1.3.10-0ubuntu0.17.04.1

Ubuntu 16.04 LTS:

libgraphite2-3 1.3.10-0ubuntu0.16.04.1

Ubuntu 14.04 LTS:

libgraphite2-3 1.3.10-0ubuntu0.14.04.1

Vulnerable software versions

Ubuntu: 14.04 - 17.04

CPE2.3

External links

https://www.ubuntu.com/usn/usn-3398-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Denial of service

EUVDB-ID: #VU7088

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-7777

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in Graphite 2 library due to use of uninitialized memory. A remote attacker can cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Update the affected packages.

Ubuntu 17.04:

libgraphite2-3 1.3.10-0ubuntu0.17.04.1

Ubuntu 16.04 LTS:

libgraphite2-3 1.3.10-0ubuntu0.16.04.1

Ubuntu 14.04 LTS:

libgraphite2-3 1.3.10-0ubuntu0.14.04.1

Vulnerable software versions

Ubuntu: 14.04 - 17.04

CPE2.3

External links

https://www.ubuntu.com/usn/usn-3398-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds write

EUVDB-ID: #VU7081

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-7778

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in Graphite 2 library due to out-of-bounds-write. A remote attacker can execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected packages.

Ubuntu 17.04:

libgraphite2-3 1.3.10-0ubuntu0.17.04.1

Ubuntu 16.04 LTS:

libgraphite2-3 1.3.10-0ubuntu0.16.04.1

Ubuntu 14.04 LTS:

libgraphite2-3 1.3.10-0ubuntu0.14.04.1

Vulnerable software versions

Ubuntu: 14.04 - 17.04

CPE2.3

External links

https://www.ubuntu.com/usn/usn-3398-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	8
CVE-ID	CVE-2017-7771 CVE-2017-7772 CVE-2017-7773 CVE-2017-7774 CVE-2017-7775 CVE-2017-7776 CVE-2017-7777 CVE-2017-7778
CWE-ID	CWE-125 CWE-787
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Ubuntu Operating systems & Components / Operating system
Vendor	Canonical Ltd.