Headline
Ubuntu Security Notice USN-6353-1
Ubuntu Security Notice 6353-1 - Wooseok Kang discovered that PLIB did not properly manage memory under certain circumstances. If a user were tricked into opening a specially crafted TGA file, an attacker could possibly use this issue to cause applications using PLIB to crash, resulting in a denial of service, or possibly execute arbitrary code.
==========================================================================Ubuntu Security Notice USN-6353-1September 07, 2023plib vulnerability==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 20.04 LTS- Ubuntu 18.04 LTS (Available with Ubuntu Pro)- Ubuntu 16.04 LTS (Available with Ubuntu Pro)Summary:PLIB could be made to execute arbitrary code if it opens a speciallycrafted TGA file.Software Description:- plib: Portability Libraries: Development packageDetails:Wooseok Kang discovered that PLIB did not properly manage memory undercertain circumstances. If a user were tricked into opening a speciallycrafted TGA file, an attacker could possibly use this issue to causeapplications using PLIB to crash, resulting in a denial of service, orpossibly execute arbitrary code.Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 20.04 LTS: libplib1 1.8.5-8ubuntu0.20.04.1Ubuntu 18.04 LTS (Available with Ubuntu Pro): libplib1 1.8.5-8ubuntu0.18.04.1~esm1Ubuntu 16.04 LTS (Available with Ubuntu Pro): libplib1 1.8.5-7ubuntu0.1~esm1In general, a standard system update will make all the necessary changes.References: https://ubuntu.com/security/notices/USN-6353-1 CVE-2021-38714Package Information: https://launchpad.net/ubuntu/+source/plib/1.8.5-8ubuntu0.20.04.1Related news
CVE-2021-38714: PLIB / Bugs / #55 integer overflow for maliciously crafted tga file
In Plib through 1.85, there is an integer overflow vulnerability that could result in arbitrary code execution. The vulnerability is found in ssgLoadTGA() function in src/ssg/ssgLoadTGA.cxx file.