Heap-based Buffer Overflow in Fribidi Package

CVE-2022-25309

What is CVE-2022-25309?

A heap-based buffer overflow flaw exists in the Fribidi package, specifically in the fribidi_cap_rtl_to_unicode() function located in fribidi-char-sets-cap-rtl.c. By supplying a specially crafted file with the '--caprtl' option to the Fribidi application, an attacker can trigger this vulnerability, which may result in a crash and consequently lead to a Denial of Service. This security flaw could affect the availability and reliability of systems relying on this package.

References