Security update for libredwg SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2023:0201-1 Final 1 1 2023-08-02T09:53:16Z current 2023-08-02T09:53:16Z 2023-08-02T09:53:16Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libredwg This update for libredwg fixes the following issues: Update to version 0.12.5.5907 Security issues fixed: * CVE-2022-33025: Fixed multiple security issues [boo#1200898] * CVE-2023-36271: Fixed heap buffer overflow via the function bit_wcs2nlen [boo#1212709] * CVE-2023-36272: Fixed heap buffer overflow via the function bit_utf8_to_TU [boo#1212707] * CVE-2023-36273: Fixed heap buffer overflow via the function bit_calc_CRC [boo#1212706] * CVE-2023-36274: Fixed heap buffer overflow via the function bit_write_TF [boo#1212705] The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2023-201 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5EOM2KLYJEVITQUC3RNZBNGK6DL4RR4C/ E-Mail link for openSUSE-SU-2023:0201-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1200898 SUSE Bug 1200898 https://bugzilla.suse.com/1212705 SUSE Bug 1212705 https://bugzilla.suse.com/1212706 SUSE Bug 1212706 https://bugzilla.suse.com/1212707 SUSE Bug 1212707 https://bugzilla.suse.com/1212709 SUSE Bug 1212709 https://www.suse.com/security/cve/CVE-2022-33025/ SUSE CVE CVE-2022-33025 page https://www.suse.com/security/cve/CVE-2023-36271/ SUSE CVE CVE-2023-36271 page https://www.suse.com/security/cve/CVE-2023-36272/ SUSE CVE CVE-2023-36272 page https://www.suse.com/security/cve/CVE-2023-36273/ SUSE CVE CVE-2023-36273 page https://www.suse.com/security/cve/CVE-2023-36274/ SUSE CVE CVE-2023-36274 page SUSE Package Hub 15 SP5 openSUSE Leap 15.5 libredwg-devel-0.12.5.5907-bp155.3.3.1 libredwg-tools-0.12.5.5907-bp155.3.3.1 libredwg0-0.12.5.5907-bp155.3.3.1 libredwg-devel-0.12.5.5907-bp155.3.3.1 as a component of SUSE Package Hub 15 SP5 libredwg-tools-0.12.5.5907-bp155.3.3.1 as a component of SUSE Package Hub 15 SP5 libredwg0-0.12.5.5907-bp155.3.3.1 as a component of SUSE Package Hub 15 SP5 libredwg-devel-0.12.5.5907-bp155.3.3.1 as a component of openSUSE Leap 15.5 libredwg-tools-0.12.5.5907-bp155.3.3.1 as a component of openSUSE Leap 15.5 libredwg0-0.12.5.5907-bp155.3.3.1 as a component of openSUSE Leap 15.5 LibreDWG v0.12.4.4608 was discovered to contain a heap-use-after-free via the function decode_preR13_section at decode_r11.c. CVE-2022-33025 SUSE Package Hub 15 SP5:libredwg-devel-0.12.5.5907-bp155.3.3.1 SUSE Package Hub 15 SP5:libredwg-tools-0.12.5.5907-bp155.3.3.1 SUSE Package Hub 15 SP5:libredwg0-0.12.5.5907-bp155.3.3.1 openSUSE Leap 15.5:libredwg-devel-0.12.5.5907-bp155.3.3.1 openSUSE Leap 15.5:libredwg-tools-0.12.5.5907-bp155.3.3.1 openSUSE Leap 15.5:libredwg0-0.12.5.5907-bp155.3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5EOM2KLYJEVITQUC3RNZBNGK6DL4RR4C/ https://www.suse.com/security/cve/CVE-2022-33025.html CVE-2022-33025 https://bugzilla.suse.com/1200898 SUSE Bug 1200898 LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit_wcs2nlen at bits.c. CVE-2023-36271 SUSE Package Hub 15 SP5:libredwg-devel-0.12.5.5907-bp155.3.3.1 SUSE Package Hub 15 SP5:libredwg-tools-0.12.5.5907-bp155.3.3.1 SUSE Package Hub 15 SP5:libredwg0-0.12.5.5907-bp155.3.3.1 openSUSE Leap 15.5:libredwg-devel-0.12.5.5907-bp155.3.3.1 openSUSE Leap 15.5:libredwg-tools-0.12.5.5907-bp155.3.3.1 openSUSE Leap 15.5:libredwg0-0.12.5.5907-bp155.3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5EOM2KLYJEVITQUC3RNZBNGK6DL4RR4C/ https://www.suse.com/security/cve/CVE-2023-36271.html CVE-2023-36271 https://bugzilla.suse.com/1212709 SUSE Bug 1212709 LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit_utf8_to_TU at bits.c. CVE-2023-36272 SUSE Package Hub 15 SP5:libredwg-devel-0.12.5.5907-bp155.3.3.1 SUSE Package Hub 15 SP5:libredwg-tools-0.12.5.5907-bp155.3.3.1 SUSE Package Hub 15 SP5:libredwg0-0.12.5.5907-bp155.3.3.1 openSUSE Leap 15.5:libredwg-devel-0.12.5.5907-bp155.3.3.1 openSUSE Leap 15.5:libredwg-tools-0.12.5.5907-bp155.3.3.1 openSUSE Leap 15.5:libredwg0-0.12.5.5907-bp155.3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5EOM2KLYJEVITQUC3RNZBNGK6DL4RR4C/ https://www.suse.com/security/cve/CVE-2023-36272.html CVE-2023-36272 https://bugzilla.suse.com/1212707 SUSE Bug 1212707 LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit_calc_CRC at bits.c. CVE-2023-36273 SUSE Package Hub 15 SP5:libredwg-devel-0.12.5.5907-bp155.3.3.1 SUSE Package Hub 15 SP5:libredwg-tools-0.12.5.5907-bp155.3.3.1 SUSE Package Hub 15 SP5:libredwg0-0.12.5.5907-bp155.3.3.1 openSUSE Leap 15.5:libredwg-devel-0.12.5.5907-bp155.3.3.1 openSUSE Leap 15.5:libredwg-tools-0.12.5.5907-bp155.3.3.1 openSUSE Leap 15.5:libredwg0-0.12.5.5907-bp155.3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5EOM2KLYJEVITQUC3RNZBNGK6DL4RR4C/ https://www.suse.com/security/cve/CVE-2023-36273.html CVE-2023-36273 https://bugzilla.suse.com/1212706 SUSE Bug 1212706 LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit_write_TF at bits.c. CVE-2023-36274 SUSE Package Hub 15 SP5:libredwg-devel-0.12.5.5907-bp155.3.3.1 SUSE Package Hub 15 SP5:libredwg-tools-0.12.5.5907-bp155.3.3.1 SUSE Package Hub 15 SP5:libredwg0-0.12.5.5907-bp155.3.3.1 openSUSE Leap 15.5:libredwg-devel-0.12.5.5907-bp155.3.3.1 openSUSE Leap 15.5:libredwg-tools-0.12.5.5907-bp155.3.3.1 openSUSE Leap 15.5:libredwg0-0.12.5.5907-bp155.3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5EOM2KLYJEVITQUC3RNZBNGK6DL4RR4C/ https://www.suse.com/security/cve/CVE-2023-36274.html CVE-2023-36274 https://bugzilla.suse.com/1212705 SUSE Bug 1212705