Güvenlik Danışarlıklarına Dön

Shapelib Vulnerability — Ubuntu Security Update (USN-8992-1)

USN-8992-1 fixes CVE-2022-0699 in Shapelib on Ubuntu — a double free in the shpsort utility (CWE-416) when handling crafted shapefiles, causing denial of service or potentially arbitrary code execution (CVSS 9.8). Update: sudo apt update && sudo apt upgrade shapelib and restart any GIS tooling using the library.

Critical 9.8 CVSS
Ubuntu 20.04 Ubuntu 22.04

SharedLicense lisansı altında bunun anlamı

A double free in shapefile parsing is memory corruption reachable from uploaded GIS data — where shapefile processing is automated, crafted files become code execution in the processing service.

  1. Ubuntu Security Notices

  2. USN-8992-1

Publication date

3 November 2026

Overview

Shapelib could be made to crash or run programs as your login if it opened
a specially crafted file.

Releases


22.04 LTS


20.04 LTS


18.04 LTS


16.04 LTS

Packages

  • shapelib – Library for reading and writing ESRI Shapefiles

Details

It was discovered that the shpsort utility in Shapelib incorrectly handled
certain inputs, leading to a double free. An attacker could possibly use
this issue to cause a denial of service, or possibly execute arbitrary
code.

It was discovered that the shpsort utility in Shapelib incorrectly handled
certain inputs, leading to a double free. An attacker could possibly use
this issue to cause a denial of service, or possibly execute arbitrary
code.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
22.04

LTS jammy

 shapelib – 

1.5.0-2+deb11u1build0.22.04.1
20.04

LTS focal

 shapelib – 

1.5.0-1ubuntu0.1~esm1

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

18.04

LTS bionic

 shapelib – 

1.4.1-1ubuntu0.1~esm1

Ubuntu Pro
Fix available with Ubuntu Pro via ESM Apps. A community fix might become publicly available in the future.

16.04

LTS xenial

 shapelib – 

1.3.0-5ubuntu0.1~esm1

References

Sıkça Sorulan Sorular

What is CVE-2022-0699?
It is a double-free vulnerability (CWE-416) in Shapelib's shpsort utility when handling crafted shapefiles, leading to denial of service or potentially arbitrary code execution. CVSS 9.8; fixed in USN-8992-1 for Ubuntu's packaged version.
Who is affected?
Systems with Shapelib installed where shapefiles from untrusted sources get processed — GIS pipelines, data-conversion jobs and mapping services.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade shapelib and restart any GIS processing services or batch jobs that use the library.
Why is a GIS library rated 9.8?
Double-free memory corruption in a file parser is remote-code-execution class wherever the parser runs unattended on untrusted data — the score reflects the memory-corruption class, not the popularity of the format.

Referanslar

Güvenlik Danışarlıkları

İlgili Danışarlıklar

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Sisteminizi güvenlik açıkları açısından kontrol edin

Size uygun tam düzeltme komutlarını görmek için ürününüzü ve işletim sisteminizi seçin.

Sisteminizi Kontrol Edin