Full Disclosure

Adium vulnerable to remote code execution via libpurple

Posted by erythronium23 on Mar 21

Adium is a popular instant messaging client for MacOS (OSX) that
incorporates libpurple. The current release (1.5.10.2) is vulnerable
to CVE-2017-2640 in libpurple, which permits execution of arbitrary
code on the client.

The Adium team has been aware of the vulnerability since at least
March 15, but has not released an advisory to its users, for reasons
unknown.

A post to the official developer’s mailing list, which included
vulnerability…

Ubuntu

USN-3237-1: FreeType vulnerability

Ubuntu Security Notice USN-3237-1

20th March, 2017

freetype vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 16.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS

Summary

FreeType could be made to crash or run programs if it opened a specially
crafted font file.

Software description

  • freetype
    – FreeType 2 is a font engine library

Details

It was discovered that FreeType did not correctly handle certain malformed
font files. If a user were tricked into using a specially crafted font
file, a remote attacker could cause FreeType to crash, resulting in a
denial of service, or possibly execute arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 16.10:
libfreetype6

2.6.3-3ubuntu1.1
Ubuntu 16.04 LTS:
libfreetype6

2.6.1-0.1ubuntu2.1
Ubuntu 14.04 LTS:
libfreetype6

2.5.2-1ubuntu2.6
Ubuntu 12.04 LTS:
libfreetype6

2.4.8-1ubuntu2.4

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart your session to make
all the necessary changes.

References

CVE-2016-10244

Software and Security Information