An update for aspell is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP2 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2021-1388 Final 1.0 1.0 2021-10-15 Initial 2021-10-15 2021-10-15 openEuler SA Tool V1.0 2021-10-15 aspell security update An update for aspell is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP2. GNU Aspell is a spell checker intended to replace Ispell. It can be used as a library and spell checker. Its main feature is that it provides much better suggestions than other inspectors, including Ispell and Microsoft Word. It also has many other technical enhancements to Ispell, such as the use of shared memory to store dictionaries, and intelligent processing of personal dictionaries when multiple Aspell processes are opened at one time. Security Fix(es): libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.(CVE-2019-20433) An update for aspell is now available for openEuler-20.03-LTS-SP1 and openEuler-20.03-LTS-SP2. openEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Medium aspell https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1388 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2019-20433 https://nvd.nist.gov/vuln/detail/CVE-2019-20433 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP2 aspell-help-0.60.6.1-29.oe1.aarch64.rpm aspell-devel-0.60.6.1-29.oe1.aarch64.rpm aspell-debugsource-0.60.6.1-29.oe1.aarch64.rpm aspell-debuginfo-0.60.6.1-29.oe1.aarch64.rpm aspell-0.60.6.1-29.oe1.aarch64.rpm aspell-debuginfo-0.60.6.1-29.oe1.aarch64.rpm aspell-devel-0.60.6.1-29.oe1.aarch64.rpm aspell-0.60.6.1-29.oe1.aarch64.rpm aspell-help-0.60.6.1-29.oe1.aarch64.rpm aspell-debugsource-0.60.6.1-29.oe1.aarch64.rpm aspell-0.60.6.1-29.oe1.src.rpm aspell-0.60.6.1-29.oe1.src.rpm aspell-debuginfo-0.60.6.1-29.oe1.x86_64.rpm aspell-devel-0.60.6.1-29.oe1.x86_64.rpm aspell-help-0.60.6.1-29.oe1.x86_64.rpm aspell-debugsource-0.60.6.1-29.oe1.x86_64.rpm aspell-0.60.6.1-29.oe1.x86_64.rpm aspell-0.60.6.1-29.oe1.x86_64.rpm aspell-debuginfo-0.60.6.1-29.oe1.x86_64.rpm aspell-devel-0.60.6.1-29.oe1.x86_64.rpm aspell-debugsource-0.60.6.1-29.oe1.x86_64.rpm aspell-help-0.60.6.1-29.oe1.x86_64.rpm libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable. 2021-10-15 CVE-2019-20433 openEuler-20.03-LTS-SP1 openEuler-20.03-LTS-SP2 Medium 5.8 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H aspell security update 2021-10-15 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1388