Critical Security Advisory: Graphite2 Vulnerabilities in Red Hat Enterprise Linux
Summary
RHSA-2016:0594: Red Hat Security Advisory: graphite2 security, bug fix, and enhancement update. Affects graphite2 versions < 0:1.3.6-1.el7_2. Fixed in 0:1.3.6-1.el7_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Graphite2 is a library designed for handling font rendering and text shaping. It is widely used in various applications within the Red Hat Enterprise Linux ecosystem, including client, server, workstation, and compute node environments. The library's functionality is crucial for applications that require precise text display and manipulation. However, recent vulnerabilities have been identified that could potentially compromise the security and stability of systems utilizing this library.
Vulnerability Detail
The vulnerabilities identified in Graphite2, specifically CVE-2016-1521, CVE-2016-1522, CVE-2016-1523, and CVE-2016-1526, stem from flaws in the library's handling of certain font files. These vulnerabilities could allow an attacker to execute arbitrary code, leading to unauthorized access or denial of service. The issues arise from improper validation of input data, which can be exploited by maliciously crafted font files. Systems running affected versions of Graphite2 are at risk, particularly those that process untrusted font data.
How To Fix
Minimum fixed version
0:1.3.6-1.el7_2
This is the first release that contains the fix.
sudo dnf update graphite2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to applications that utilize Graphite2, particularly those that handle untrusted font files. This can mitigate the risk of exploitation until the package can be updated.
Conclusion
In summary, the vulnerabilities in Graphite2 pose significant risks to systems running Red Hat Enterprise Linux. It is imperative to update to the patched version to safeguard against potential exploits. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for graphite2 →
FAQ
The main vulnerabilities include CVE-2016-1521, CVE-2016-1522, CVE-2016-1523, and CVE-2016-1526, which can lead to arbitrary code execution and denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If you cannot update the package, restrict access to applications that utilize Graphite2 to minimize the risk of exploitation.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Updating to the patched version (0:1.3.6-1.el7_2) is crucial as it resolves the identified vulnerabilities, protecting your system from potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for graphite2.
