Shapelib vulnerability in shpsort utility fixed in Ubuntu security update

Ubuntu has released security updates to address a vulnerability in Shapelib, a library used for reading and writing ESRI Shapefiles. The flaw is located within the shpsort utility, which fails to correctly handle specific inputs.

This vulnerability, identified as CVE-2022-0699, can be exploited if a user opens a maliciously crafted file. Successful exploitation may result in a denial of service (DoS) or potentially allow an attacker to execute arbitrary code with the privileges of the logged-in user. The fix is available for several Ubuntu LTS releases, including 22.04, 20.04, 18.04, and 16.04.

Technical details of CVE-2022-0699

• Defect Class: The vulnerability is a double free error occurring during input processing.
• Attack Vector: An attacker can trigger the flaw by providing a specially crafted file to the shpsort utility.
• Impact Severity: Exploitation can lead to application crashes (denial of service) or arbitrary code execution under the current user's context.
• Affected Component: The issue is specifically isolated to the shpsort utility within the Shapelib package.

Why it matters

Users of GIS (Geographic Information System) software or any applications relying on Shapelib to process ESRI Shapefiles should apply these updates immediately. For system administrators managing older LTS environments like 18.04 or 16.04, the fix requires Ubuntu Pro via ESM Apps to ensure continued security coverage.