USN-3067-1: HarfBuzz vulnerabilities

Medium

Vendor

Canonical Ubuntu

Versions Affected

• Ubuntu 14.04 LTS

Description

Kostya Serebryany discovered that HarfBuzz incorrectly handled memory. A remote attacker could use this issue to cause HarfBuzz to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-8947)

It was discovered that HarfBuzz incorrectly handled certain length checks.A remote attacker could use this issue to cause HarfBuzz to crash,resulting in a denial of service, or possibly execute arbitrary code.This issue only applied to Ubuntu 16.04 LTS. (CVE-2016-2052)

Affected Products and Versions

_Severity is medium unless otherwise noted.
_

• All versions of Cloud Foundry cflinuxfs2 prior to v.1.78.0

Mitigation

Users of affected versions should apply the following mitigation:

• The Cloud Foundry project recommends that Cloud Foundry deployments run with cflinuxfs2 v.1.78.0 or later versions

Credit

Kostya Serebryany

References

• <https://www.ubuntu.com/usn/usn-3067-1&gt;
• <http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-8947&gt;
• <http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-2052.html&gt;