USN-7198-1

Dashboard / Vulnerabilities / USN-7198-1

USN-7198-1

Summary: rlottie vulnerabilities

Details: Paolo Giai discovered a series of stack-based overflow vulnerabilities in the blit and gray_render_cubic functions of a custom fork of the rlottie library. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2021-31315, CVE-2021-31321) Paolo Giai discovered a series of type confusion vulnerabilities in the VDasher constructor and the LOTCompLayerItem::LOTCompLayerItem function of a custom fork of the rlottie library. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-31317, CVE-2021-31318) Paolo Giai discovered an integer overflow vulnerability in the LOTGradient::populate function of a custom fork of the rlottie library. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-31319) Paolo Giai discovered a series of heap buffer overflow vulnerabilities in the VGradientCache::generateGradientColorTable and LOTGradient::populate functions of a custom fork of the rlottie library. An attacker could possibly use this issue to achieve remote code execution. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-31320, CVE-2021-31322)

References: https://ubuntu.com/security/notices/USN-7198-1, https://ubuntu.com/security/CVE-2021-31315, https://ubuntu.com/security/CVE-2021-31317, https://ubuntu.com/security/CVE-2021-31318, https://ubuntu.com/security/CVE-2021-31319, https://ubuntu.com/security/CVE-2021-31320, https://ubuntu.com/security/CVE-2021-31321, https://ubuntu.com/security/CVE-2021-31322