USN-8992-1: Shapelib CVE-2022-0699 Double Free Fix

Ubuntu has published USN-8992-1, a security notice for Shapelib, a library for reading and writing ESRI Shapefiles. The notice says the shpsort utility handled certain inputs incorrectly, leading to a double free. It references CVE-2022-0699.

If you run Ubuntu servers that process geospatial data, or that have the shapelib package installed for a mapping application, check your version and update. Most websites will not be affected, but it takes only a minute to confirm.

What happened

Ubuntu's notice describes the issue as a double free in the shpsort utility, which ships with Shapelib. A double free happens when a program releases the same block of memory twice. That corrupts the memory manager's bookkeeping and, depending on the situation, can crash the program or be steered into running attacker-chosen code.

Ubuntu's summary says Shapelib could be made to crash or run programs as your login if it opened a specially crafted file. In the details, Ubuntu says an attacker could possibly cause a denial of service, or possibly execute arbitrary code. The wording is cautious: it describes possibilities, not confirmed outcomes.

At the time of writing, only the Ubuntu notice is available as a source for this story. We have no CVSS score, no independent analysis and no report of exploitation, so we do not claim any.

Who is realistically exposed

The weakness sits in a command-line utility, and the trigger Ubuntu describes is opening a specially crafted file. That points to a narrower exposure than a network service flaw:

• Systems where shapelib is installed and shpsort is run on files from sources you do not control, for example uploaded or downloaded shapefiles.
• Web applications or batch jobs that call shapelib tools or link the library to process user-supplied geospatial data.
• Developer workstations and build servers with the package installed for GIS work.
• Long-lived Ubuntu 16.04, 18.04 and 20.04 machines, where the fix is delivered through Ubuntu Pro (ESM Apps) for 20.04 and 18.04.

If shapelib is not installed and nothing on the host processes shapefiles, this notice does not require action on that host.

How to check if you are affected

This read-only command lists the installed shapelib package and its version on Ubuntu. If it prints nothing, the package is not installed. If it prints a version, compare it with the fixed versions in the table below.

dpkg -l shapelib

Also look for code that depends on the library, since applications may use it without you installing it deliberately. This lists installed packages whose names mention shapelib, including development packages.

dpkg -l | grep -i shapelib

What to do now

Ubuntu says a standard system update will make the necessary changes. On a system with access to the relevant repositories, refresh the package lists and upgrade.

sudo apt update && sudo apt upgrade

After the upgrade, run the version check again and confirm the installed version matches or is newer than the one listed for your release.

Detection and monitoring

The research does not describe any indicators of compromise or exploitation, so there is nothing specific to hunt for. General hygiene still applies: review application logs for unexpected crashes of tools that handle geospatial files, and check that automated jobs handling uploads run under a low-privilege account, since Ubuntu's wording says code could run with the privileges of the user who opened the file.

For the web-facing side of your servers, a free security headers check and routine website scans help you notice configuration drift, though they cannot see which libraries are installed on the host. Our guide on small business website security covers keeping server packages current, and the security blog tracks other Ubuntu advisories as they are published.

Timeline

• 3 November 2026: Ubuntu publishes USN-8992-1 for shapelib, referencing CVE-2022-0699.

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

1. USN-8992-1: Shapelib vulnerability | Ubuntu security notices | Ubuntuubuntu.com · 3 November 2026

• Ubuntu
• USN
• Shapelib
• CVE-2022-0699
• patching