PT-2021-3689 · Gnu+9 · Gnu Aspell+9
Published
2021-07-20
·
Updated
2024-06-28
·
CVE-2019-25051
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
GNU Aspell version 0.60.8
Description
The issue is related to a heap-based buffer overflow in the
acomon::ObjStack::dup top function, which can be called from acomon::StringMap::add and acomon::Config::lookup list. This can allow a remote attacker to execute arbitrary code. The vulnerability is also described as a buffer overflow in the heap region of the memory, which can be exploited to execute arbitrary code.Recommendations
For GNU Aspell version 0.60.8, consider disabling the
acomon::ObjStack::dup top function as a temporary workaround until a patch is available. Restrict access to the acomon::StringMap::add and acomon::Config::lookup list functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Memory Corruption
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Gnu Aspell
Linuxmint
Red Hat
Rocky Linux
Suse
Ubuntu