==========================================================================
Ubuntu Security Notice USN-3770-1
September 20, 2018
lcms2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS
– Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Little CMS.
Software Description:
– lcms2: Little CMS color management library
Details:
Ibrahim El-Sayed discovered that Little CMS incorrectly handled certain
files. An attacker could possibly use this issue to cause a denial of
service. (CVE-2016-10165)
Quang Nguyen discovered that Little CMS incorrectly handled certain
files. An attacker could possibly use this issue to execute arbitrary
code. (CVE-2018-16435)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
liblcms2-2 2.9-1ubuntu0.1
liblcms2-utils 2.9-1ubuntu0.1
Ubuntu 16.04 LTS:
liblcms2-2 2.6-3ubuntu2.1
liblcms2-utils 2.6-3ubuntu2.1
Ubuntu 14.04 LTS:
liblcms2-2 2.5-0ubuntu4.2
liblcms2-utils 2.5-0ubuntu4.2
After a standard system update you need to restart applications using
Little CMS to make all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3770-1
CVE-2016-10165, CVE-2018-16435
Package Information:
https://launchpad.net/ubuntu/+source/lcms2/2.9-1ubuntu0.1
https://launchpad.net/ubuntu/+source/lcms2/2.6-3ubuntu2.1
https://launchpad.net/ubuntu/+source/lcms2/2.5-0ubuntu4.2—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2
iQIcBAABCAAGBQJbo3wUAAoJEEW851uECx9pAQkP/0Lm+yuFI2TvaVKwo0+DA9Fe
45cQtiu+QJRDg+s0oQMznW/NDb31zpFL739O8sfGkHUytnTtFUnp7FAJWBTBPV4y
AyWuwZTkiYmL+wjHftXRKaosNSJfd7C7QSatR/uSD2otOC3qbQXefY0FuV0TNq0C
ZQtvirZt/D7qI3ICj/ScTcW/fDFYpwbqPhi0f00iSb51DQd6P/652biZ8KfUgNcd
pJqkQvosxvke5VVh9pCSjKXPhd2ZhJx5V+B+SYIv1HDRRt6knb0e1PBVXBPr0hGk
SQU1tpna1oYIcO5QB5v3Rb3gkRqXwgFVMXIXU+Lv3BJWBRxwcznrJxQI2sB8q0mv
BV+G6fvR5XgYK1ThqzgL1uOnh1UuyEsYeMOkWI1rCywJquHDfPei8EHxStuLB0KJ
rtzYmfqkqpq2IThyv9NImS1xPn6JgE/QhdVryhsppWt2vMt78PNyOf3bOCKIhxt2
NYiBWh3xAFWESPRUycYz+vHfoj3PbpSiwHKzpZfhAg4ljzv/IRy+dPbrsD4+Tf9N
LFhCEj5fT7SgB5I20X2e9gKhHCh451VaskUUssNAm3sXEsyAb85K8AHgBype6/s1
HN374ht6PYZBrMuTtKijwwTgzNz53DWkf9GntrB/UKwh8/lIWFir3syS0qo5+ZC2
l4QgFp089eKwqIqDmq5/
=Zt0d
—–END PGP SIGNATURE—–
—
