An update for aspell is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP2
Security Advisory
openeuler-security@openeuler.org
openEuler security committee
openEuler-SA-2021-1290
Final
1.0
1.0
2021-07-31
Initial
2021-07-31
2021-07-31
openEuler SA Tool V1.0
2021-07-31
aspell security update
An update for aspell is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP2.
GNU Aspell is a spell checker intended to replace Ispell. It can be used as a library and spell checker. Its main feature is that it provides much better suggestions than other inspectors, including Ispell and Microsoft Word. It also has many other technical enhancements to Ispell, such as the use of shared memory to store dictionaries, and intelligent processing of personal dictionaries when multiple Aspell processes are opened at one time.
Security Fix(es):
libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ character.(CVE-2019-17544)
An update for aspell is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP2.
openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.
Critical
aspell
https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1290
https://openeuler.org/en/security/cve/detail.html?id=CVE-2019-17544
https://nvd.nist.gov/vuln/detail/CVE-2019-17544
openEuler-20.03-LTS-SP1
openEuler-20.03-LTS-SP2
aspell-debugsource-0.60.6.1-27.oe1.aarch64.rpm
aspell-0.60.6.1-27.oe1.aarch64.rpm
aspell-devel-0.60.6.1-27.oe1.aarch64.rpm
aspell-help-0.60.6.1-27.oe1.aarch64.rpm
aspell-debuginfo-0.60.6.1-27.oe1.aarch64.rpm
aspell-debuginfo-0.60.6.1-27.oe1.aarch64.rpm
aspell-devel-0.60.6.1-27.oe1.aarch64.rpm
aspell-debugsource-0.60.6.1-27.oe1.aarch64.rpm
aspell-help-0.60.6.1-27.oe1.aarch64.rpm
aspell-0.60.6.1-27.oe1.aarch64.rpm
aspell-0.60.6.1-27.oe1.src.rpm
aspell-0.60.6.1-27.oe1.src.rpm
aspell-debugsource-0.60.6.1-27.oe1.x86_64.rpm
aspell-0.60.6.1-27.oe1.x86_64.rpm
aspell-debuginfo-0.60.6.1-27.oe1.x86_64.rpm
aspell-help-0.60.6.1-27.oe1.x86_64.rpm
aspell-devel-0.60.6.1-27.oe1.x86_64.rpm
aspell-0.60.6.1-27.oe1.x86_64.rpm
aspell-devel-0.60.6.1-27.oe1.x86_64.rpm
aspell-help-0.60.6.1-27.oe1.x86_64.rpm
aspell-debuginfo-0.60.6.1-27.oe1.x86_64.rpm
aspell-debugsource-0.60.6.1-27.oe1.x86_64.rpm
libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ character.
2021-07-31
CVE-2019-17544
openEuler-20.03-LTS-SP1
openEuler-20.03-LTS-SP2
Critical
9.1
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
aspell security update
2021-07-31
https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1290