SB2022120702 - Ubuntu update for numpy

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2021-33430)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the PyArray_NewFromDescr_int() function of ctors.c. A remote attacker can pass specially crafted data to the library and perform a denial of service (DoS) attack.

2) Incorrect Comparison (CVE-ID: CVE-2021-34141)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incomplete string comparison in the numpy.core component in NumPy. A remote attacker can pass specific string objects to the library and perform a denial of service (DoS) attack.

3) NULL pointer dereference (CVE-ID: CVE-2021-41495)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in numpy.sort in NumPy. A remote attacker can perform a denial of service (DoS) attack.

4) Buffer overflow (CVE-ID: CVE-2021-41496)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the array_from_pyobj() function in fortranobject.c. A remote user can pass an array with negative values to the application and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-5763-1