SB2025030401 - Ubuntu update for cmark-gfm
Published: March 4, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2022-39209)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a polynomial time complexity issue in the autolink extension. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.
2) Inefficient Algorithmic Complexity (CVE-ID: CVE-2023-22483)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to several polynomial time complexity issues. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
3) Inefficient Algorithmic Complexity (CVE-ID: CVE-2023-22484)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a polynomial time complexity issue in cmark-gfm may in handle_pointy_brace. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
4) Inefficient Algorithmic Complexity (CVE-ID: CVE-2023-22486)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a polynomial time complexity issue in cmark-gfm in handle_close_bracket. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
5) Inefficient Algorithmic Complexity (CVE-ID: CVE-2023-26485)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the polynomial time complexity issue. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.