Test ID:	1.3.6.1.4.1.25623.1.1.12.2025.7198.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-7198-1)
Summary:	The remote host is missing an update for the 'rlottie' package(s) announced via the USN-7198-1 advisory.
Description:	Summary: The remote host is missing an update for the 'rlottie' package(s) announced via the USN-7198-1 advisory. Vulnerability Insight: Paolo Giai discovered a series of stack-based overflow vulnerabilities in the blit and gray_render_cubic functions of a custom fork of the rlottie library. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2021-31315, CVE-2021-31321) Paolo Giai discovered a series of type confusion vulnerabilities in the VDasher constructor and the LOTCompLayerItem::LOTCompLayerItem function of a custom fork of the rlottie library. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-31317, CVE-2021-31318) Paolo Giai discovered an integer overflow vulnerability in the LOTGradient::populate function of a custom fork of the rlottie library. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-31319) Paolo Giai discovered a series of heap buffer overflow vulnerabilities in the VGradientCache::generateGradientColorTable and LOTGradient::populate functions of a custom fork of the rlottie library. An attacker could possibly use this issue to achieve remote code execution. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-31320, CVE-2021-31322) Affected Software/OS: 'rlottie' package(s) on Ubuntu 20.04, Ubuntu 22.04. Solution: Please install the updated package(s). CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2021-31315 https://www.shielder.it/advisories/telegram-rlottie-blit-stack-buffer-overflow/ https://www.shielder.it/blog/2021/02/hunting-for-bugs-in-telegrams-animated-stickers-remote-attack-surface/ Common Vulnerability Exposure (CVE) ID: CVE-2021-31317 https://www.shielder.it/advisories/telegram-rlottie-vdasher-vdasher-type-confusion/ Common Vulnerability Exposure (CVE) ID: CVE-2021-31318 https://www.shielder.it/advisories/telegram-rlottie-lotcomplayeritem-lotcomplayeritem-type-confusion/ Common Vulnerability Exposure (CVE) ID: CVE-2021-31319 https://www.shielder.it/advisories/telegram-rlottie-lotgradient-populate-integer-overflow/ Common Vulnerability Exposure (CVE) ID: CVE-2021-31320 https://www.shielder.it/advisories/telegram-rlottie-vgradientcache-generategradientcolortable-heap-buffer-overflow/ Common Vulnerability Exposure (CVE) ID: CVE-2021-31321 https://www.shielder.it/advisories/telegram-rlottie-gray_split_cubic-stack-buffer-overflow/ Common Vulnerability Exposure (CVE) ID: CVE-2021-31322 https://www.shielder.it/advisories/telegram-rlottie-lotgradient-populate-heap-buffer-overflow/
Copyright	Copyright (C) 2025 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.