Bug 25640

Summary: aspell new security issue CVE-2019-17544
Product: Mageia Reporter: David Walser <luigiwalser>
Component: SecurityAssignee: QA Team <qa-bugs>
Status: RESOLVED FIXED QA Contact: Sec team <security>
Severity: major    
Priority: Normal CC: geiger.david68210, herman.viaene, sysadmin-bugs, tmb
Version: 7Keywords: advisory, validated_update
Target Milestone: ---   
Hardware: All   
OS: Linux   
Whiteboard: MGA7-64-OK
Source RPM: aspell-0.60.6.1-12.mga7.src.rpm CVE:
Status comment: Fixed upstream in 0.60.8

Description David Walser 2019-10-31 04:59:06 CET
Ubuntu has issued an advisory on October 15:
https://usn.ubuntu.com/4155-1/

The issue was fixed upstream in 0.60.8.
David Walser 2019-10-31 04:59:21 CET

Status comment: (none) => Fixed upstream in 0.60.8

Comment 1 David GEIGER 2019-10-31 06:55:19 CET
Done!

CC: (none) => geiger.david68210

Comment 2 Lewis Smith 2019-10-31 09:42:47 CET
Assigning to Shlomi as 'aspell' maintainer.

Assignee: bugsquad => shlomif

Comment 3 David Walser 2019-10-31 13:08:17 CET
Advisory:
========================

Updated aspell packages fix security vulnerability:

libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in
acommon::unescape in common/getdata.cpp via an isolated \ character
(CVE-2019-17544).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17544
https://usn.ubuntu.com/4155-1/
========================

Updated packages in core/updates_testing:
========================
aspell-0.60.8-1.mga7
libaspell15-0.60.8-1.mga7
libaspell-devel-0.60.8-1.mga7

from aspell-0.60.8-1.mga7.src.rpm

Assignee: shlomif => qa-bugs

Comment 4 Herman Viaene 2019-11-02 14:52:04 CET
MGA7-64 Plasma on Lenovo B50
No installation issues.
Looking for dependents found sonnet.
At CLI:
$ strace -o aspell.txt kwrite xslt/output.xml 
Hspell: can't open /usr/share/hspell/hebrew.wgz.sizes.
sonnet.plugins.hspell: HSpellDict::HSpellDict: Init failed
sonnet.core: No language dictionaries for the language: "nl_BE"
sonnet.core: No language dictionaries for the language: "nl_BE"
sonnet.core: No language dictionaries for the language: "nl_BE"
sonnet.core: No language dictionaries for the language: "nl_BE"
sonnet.core: No language dictionaries for the language: "nl_BE"
sonnet.core: No language dictionaries for the language: "nl_BE"
sonnet.core: No language dictionaries for the language: "nl_BE"
sonnet.core: No language dictionaries for the language: "nl_BE"
sonnet.core: No language dictionaries for the language: "nl_BE"
sonnet.core: No language dictionaries for the language: "nl_BE"
sonnet.core: No language dictionaries for the language: "nl_BE"
sonnet.core: Missing trigrams for languages: QSet("en_GB", "en_CA", "en_AU")
sonnet.core: No language dictionaries for the language: "nl_BE"
sonnet.core: No language dictionaries for the language: "nl_BE"
sonnet.core: No language dictionaries for the language: "nl_BE"
sonnet.core: No language dictionaries for the language: "nl_BE"
sonnet.core: No language dictionaries for the language: "nl_BE"
sonnet.core: No language dictionaries for the language: "nl_BE"
sonnet.core: No language dictionaries for the language: "nl_BE"

In kwrite I could change the dictionary to Nederlands(Nederland) and switch on automatic spelling, Worked OK.
Loads of refs to aspell in the trace file.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA7-64-OK

Thomas Backlund 2019-11-02 16:49:13 CET

Keywords: (none) => advisory, validated_update
CC: (none) => tmb, sysadmin-bugs

Comment 5 Mageia Robot 2019-11-02 17:56:14 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0311.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 6 David Walser 2019-12-27 01:31:44 CET
This update fixed another (non-CVE) security issue:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/5K5EOERW4QNXFRZ7JETMYKOQ7LUKYE57/
Comment 7 David Walser 2020-10-13 20:07:52 CEST
(In reply to David Walser from comment #6)
> This update fixed another (non-CVE) security issue:
> https://lists.fedoraproject.org/archives/list/package-announce@lists.
> fedoraproject.org/thread/5K5EOERW4QNXFRZ7JETMYKOQ7LUKYE57/

Now this issue has CVE-2019-20433:
https://lists.suse.com/pipermail/sle-security-updates/2020-September/007507.html