SB2019032208 - Ubuntu update for libsolv

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) NULL pointer dereference (CVE-ID: CVE-2018-20532)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input processed by the testcase_read function, as defined in the ext/testcase.c source code file of the affected software. A remote attacker can trick the victim into opening or executing a file that submits malicious input, trigger a NULL pointer dereference condition and cause the affected software to crash, resulting in a DoS condition.

2) NULL pointer dereference (CVE-ID: CVE-2018-20533)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input processed by the testcase_str2dep_complex function, as defined in the ext/testcase.c source code file of the affected software. A remote attacker can trick the victim into opening or executing a file that submits malicious input, trigger a NULL pointer dereference condition and cause the affected software to crash, resulting in a DoS condition.

3) Input validation error (CVE-ID: CVE-2018-20534)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input processed by the pool_whatprovides function, as defined in the ext/pool.h source code file of the affected software. A remote attacker can trick the victim into opening or executing a file that submits malicious input, trigger an illegal access address condition and cause the affected software to crash, resulting in a DoS condition.

Remediation

Install update from vendor's website.

References

• https://usn.ubuntu.com/3916-1/