Security Update for libextractor
Summary
DLA-2851-1: libextractor - security update. Affects libextractor versions < 1:1.3-4+deb9u4. Fixed in 1:1.3-4+deb9u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libextractor is a library that extracts meta-data from files of arbitrary type. It is commonly used to extract information such as author, title, and keywords from various file formats. This library is widely utilized in applications that require file analysis and metadata extraction.
Vulnerability Detail
The vulnerability in libextractor is related to invalid read for malformed DVI (Device Independent) files. An attacker can exploit this vulnerability by crafting a specially crafted DVI file, which could lead to an invalid read operation. This could potentially result in information disclosure or a denial of service (DoS) attack. The issue has been addressed in version 1:1.3-4+deb9u4 of libextractor.
How To Fix
Minimum fixed version
1:1.3-4+deb9u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libextractorTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in libextractor has been addressed in version 1:1.3-4+deb9u4. It is crucial to upgrade the libextractor package to ensure the security of applications that rely on this library. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libextractor →
FAQ
libextractor is a library that extracts meta-data from files of arbitrary type. It is commonly used in applications that require file analysis and metadata extraction.
The vulnerability in libextractor could potentially lead to information disclosure or a denial of service (DoS) attack if exploited by an attacker.
To fix the vulnerability, you should upgrade the libextractor package to version 1:1.3-4+deb9u4 or later. Instructions for upgrading can be found in the 'how_to_fix' section of this report.
No specific workarounds have been mentioned for this vulnerability. It is recommended to apply the fix by upgrading the libextractor package.
You can find more information about libextractor security updates on the Debian Security Tracker page for libextractor.
Related vulnerabilities
Recent vulnerabilities recorded for libextractor.
