120 lines
8.3 KiB
XML
120 lines
8.3 KiB
XML
|
<?xml version="1.0" encoding="UTF-8"?>
|
||
|
|
<cvrfdoc xmlns="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1">
|
||
|
|
<DocumentTitle xml:lang="en">An update for aspell is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP2</DocumentTitle>
|
||
|
|
<DocumentType>Security Advisory</DocumentType>
|
||
|
|
<DocumentPublisher Type="Vendor">
|
||
|
|
<ContactDetails>openeuler-security@openeuler.org</ContactDetails>
|
||
|
|
<IssuingAuthority>openEuler security committee</IssuingAuthority>
|
||
|
|
</DocumentPublisher>
|
||
|
|
<DocumentTracking>
|
||
|
|
<Identification>
|
||
|
|
<ID>openEuler-SA-2021-1351</ID>
|
||
|
|
</Identification>
|
||
|
|
<Status>Final</Status>
|
||
|
|
<Version>1.0</Version>
|
||
|
|
<RevisionHistory>
|
||
|
|
<Revision>
|
||
|
|
<Number>1.0</Number>
|
||
|
|
<Date>2021-09-30</Date>
|
||
|
|
<Description>Initial</Description>
|
||
|
|
</Revision>
|
||
|
|
</RevisionHistory>
|
||
|
|
<InitialReleaseDate>2021-09-30</InitialReleaseDate>
|
||
|
|
<CurrentReleaseDate>2021-09-30</CurrentReleaseDate>
|
||
|
|
<Generator>
|
||
|
|
<Engine>openEuler SA Tool V1.0</Engine>
|
||
|
|
<Date>2021-09-30</Date>
|
||
|
|
</Generator>
|
||
|
|
</DocumentTracking>
|
||
|
|
<DocumentNotes>
|
||
|
|
<Note Title="Synopsis" Type="General" Ordinal="1" xml:lang="en">aspell security update</Note>
|
||
|
|
<Note Title="Summary" Type="General" Ordinal="2" xml:lang="en">An update for aspell is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP2.</Note>
|
||
|
|
<Note Title="Description" Type="General" Ordinal="3" xml:lang="en">GNU Aspell is a spell checker intended to replace Ispell. It can be used as a library and spell checker. Its main feature is that it provides much better suggestions than other inspectors, including Ispell and Microsoft Word. It also has many other technical enhancements to Ispell, such as the use of shared memory to store dictionaries, and intelligent processing of personal dictionaries when multiple Aspell processes are opened at one time.
|
||
|
|
|
||
|
|
Security Fix(es):
|
||
|
|
|
||
|
|
objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).(CVE-2019-25051)</Note>
|
||
|
|
<Note Title="Topic" Type="General" Ordinal="4" xml:lang="en">An update for aspell is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP2.
|
||
|
|
|
||
|
|
openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.</Note>
|
||
|
|
<Note Title="Severity" Type="General" Ordinal="5" xml:lang="en">High</Note>
|
||
|
|
<Note Title="Affected Component" Type="General" Ordinal="6" xml:lang="en">aspell</Note>
|
||
|
|
</DocumentNotes>
|
||
|
|
<DocumentReferences>
|
||
|
|
<Reference Type="Self">
|
||
|
|
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1351</URL>
|
||
|
|
</Reference>
|
||
|
|
<Reference Type="openEuler CVE">
|
||
|
|
<URL>https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2019-25051</URL>
|
||
|
|
</Reference>
|
||
|
|
<Reference Type="Other">
|
||
|
|
<URL>https://nvd.nist.gov/vuln/detail/CVE-2019-25051</URL>
|
||
|
|
</Reference>
|
||
|
|
</DocumentReferences>
|
||
|
|
<ProductTree xmlns="http://www.icasi.org/CVRF/schema/prod/1.1">
|
||
|
|
<Branch Type="Product Name" Name="openEuler">
|
||
|
|
<FullProductName ProductID="openEuler-20.03-LTS-SP1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">openEuler-20.03-LTS-SP1</FullProductName>
|
||
|
|
<FullProductName ProductID="openEuler-20.03-LTS-SP2" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">openEuler-20.03-LTS-SP2</FullProductName>
|
||
|
|
</Branch>
|
||
|
|
<Branch Type="Package Arch" Name="aarch64">
|
||
|
|
<FullProductName ProductID="aspell-help-0.60.6.1-28" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">aspell-help-0.60.6.1-28.oe1.aarch64.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-devel-0.60.6.1-28" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">aspell-devel-0.60.6.1-28.oe1.aarch64.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-debugsource-0.60.6.1-28" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">aspell-debugsource-0.60.6.1-28.oe1.aarch64.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-0.60.6.1-28" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">aspell-0.60.6.1-28.oe1.aarch64.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-debuginfo-0.60.6.1-28" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">aspell-debuginfo-0.60.6.1-28.oe1.aarch64.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-debuginfo-0.60.6.1-29" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">aspell-debuginfo-0.60.6.1-29.oe1.aarch64.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-0.60.6.1-29" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">aspell-0.60.6.1-29.oe1.aarch64.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-devel-0.60.6.1-29" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">aspell-devel-0.60.6.1-29.oe1.aarch64.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-debugsource-0.60.6.1-29" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">aspell-debugsource-0.60.6.1-29.oe1.aarch64.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-help-0.60.6.1-29" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">aspell-help-0.60.6.1-29.oe1.aarch64.rpm</FullProductName>
|
||
|
|
</Branch>
|
||
|
|
<Branch Type="Package Arch" Name="src">
|
||
|
|
<FullProductName ProductID="aspell-0.60.6.1-28" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">aspell-0.60.6.1-28.oe1.src.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-0.60.6.1-29" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">aspell-0.60.6.1-29.oe1.src.rpm</FullProductName>
|
||
|
|
</Branch>
|
||
|
|
<Branch Type="Package Arch" Name="x86_64">
|
||
|
|
<FullProductName ProductID="aspell-0.60.6.1-28" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">aspell-0.60.6.1-28.oe1.x86_64.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-devel-0.60.6.1-28" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">aspell-devel-0.60.6.1-28.oe1.x86_64.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-help-0.60.6.1-28" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">aspell-help-0.60.6.1-28.oe1.x86_64.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-debuginfo-0.60.6.1-28" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">aspell-debuginfo-0.60.6.1-28.oe1.x86_64.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-debugsource-0.60.6.1-28" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">aspell-debugsource-0.60.6.1-28.oe1.x86_64.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-help-0.60.6.1-29" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">aspell-help-0.60.6.1-29.oe1.x86_64.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-0.60.6.1-29" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">aspell-0.60.6.1-29.oe1.x86_64.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-debugsource-0.60.6.1-29" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">aspell-debugsource-0.60.6.1-29.oe1.x86_64.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-devel-0.60.6.1-29" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">aspell-devel-0.60.6.1-29.oe1.x86_64.rpm</FullProductName>
|
||
|
|
<FullProductName ProductID="aspell-debuginfo-0.60.6.1-29" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">aspell-debuginfo-0.60.6.1-29.oe1.x86_64.rpm</FullProductName>
|
||
|
|
</Branch>
|
||
|
|
</ProductTree>
|
||
|
|
<Vulnerability Ordinal="1" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
|
||
|
|
<Notes>
|
||
|
|
<Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).</Note>
|
||
|
|
</Notes>
|
||
|
|
<ReleaseDate>2021-09-30</ReleaseDate>
|
||
|
|
<CVE>CVE-2019-25051</CVE>
|
||
|
|
<ProductStatuses>
|
||
|
|
<Status Type="Fixed">
|
||
|
|
<ProductID>openEuler-20.03-LTS-SP1</ProductID>
|
||
|
|
<ProductID>openEuler-20.03-LTS-SP2</ProductID>
|
||
|
|
</Status>
|
||
|
|
</ProductStatuses>
|
||
|
|
<Threats>
|
||
|
|
<Threat Type="Impact">
|
||
|
|
<Description>High</Description>
|
||
|
|
|
||
|
|
</Threat>
|
||
|
|
</Threats>
|
||
|
|
<CVSSScoreSets>
|
||
|
|
<ScoreSet>
|
||
|
|
<BaseScore>7.8</BaseScore>
|
||
|
|
<Vector>AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</Vector>
|
||
|
|
</ScoreSet>
|
||
|
|
</CVSSScoreSets>
|
||
|
|
<Remediations>
|
||
|
|
<Remediation Type="Vendor Fix">
|
||
|
|
<Description>aspell security update</Description>
|
||
|
|
<DATE>2021-09-30</DATE>
|
||
|
|
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1351</URL>
|
||
|
|
</Remediation>
|
||
|
|
</Remediations>
|
||
|
|
</Vulnerability>
|
||
|
|
</cvrfdoc>
|