Advisory ROSA-SA-2023-2290

Software: fribidi 1.0.4
OS: ROSA Virtualization 2.1

package_evr_string: fribidi-1.0.4-9.rv3.src.rpm

CVE-ID: CVE-2022-25308
BDU-ID: 2022-02659
CVE-Crit: CRITICAL
CVE-DESC.: A vulnerability in the GNU FriBidi library is caused by a buffer overflow on the stack. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code
CVE-STATUS: Fixed
CVE-REV: Execute yum update fribidi to close.

CVE-ID: CVE-2022-25309
BDU-ID: 2022-02660
CVE-Crit: CRITICAL.
CVE-DESC.: A vulnerability in the fribidi_cap_rtl_to_unicode function of the GNU FriBidi library is caused by a buffer overflow in dynamic memory. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code
CVE-STATUS: Fixed
CVE-REV: Execute yum update fribidi to close.

CVE-ID: CVE-2022-25310
BDU-ID: 2022-02658
CVE-Crit: CRITICAL.
CVE-DESC.: A vulnerability in the fribidi_remove_bidi_marks() function of the GNU FriBidi library exists due to insufficient input validation. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code
CVE-STATUS: Fixed
CVE-REV: Execute yum update fribidi to close.