SB2025052944 - Ubuntu update for tika

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Resource exhaustion (CVE-ID: CVE-2020-1950)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper resource management in "PSDParser". A remote attacker can use a specially crafted PSD file, trigger resource exhaustion and perform a denial of service (DoS) attack.

2) Infinite loop (CVE-ID: CVE-2020-1951)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in "PSDParser". A remote attacker can use a specially crafted PSD file, consume all available system resources and cause denial of service conditions.

3) Incorrect Regular Expression (CVE-ID: CVE-2022-30126)

The vulnerability allows a remote attacker to perform DoS attack.

The vulnerability exists due to improper validation in the StandardsText class. A remote attacker can pass specially crafted file to the application and perform a denial of service (DoS) attack.

4) Input validation error (CVE-ID: CVE-2022-30973)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the "StandardsText" class in the StandardsExtractingContentHandler. A remote attacker can trick a victim to open a specially crafted file and perform a denial of service (DoS) attack.

5) Incorrect Regular Expression (CVE-ID: CVE-2022-33879)

The vulnerability allows a remote attacker to perform DoS attack.

The vulnerability exists due to improper validation in the StandardsExtractingContentHandler. A remote attacker can pass specially crafted file to the application and perform a denial of service (DoS) attack.

The vulnerability exists due to incomplete fixes for #VU63404 (CVE-2022-30126) and #VU63904 (CVE-2022-30973).

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-7529-1