Security update for renderdoc SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2023:0253-1 Final 1 1 2023-09-25T10:02:37Z current 2023-09-25T10:02:37Z 2023-09-25T10:02:37Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for renderdoc This update for renderdoc fixes the following issues: Security issues fixed: * CVE-2023-33863: integer overflow to heap-based buffer overflow * CVE-2023-33864: integer underflow to heap-based buffer overflow * CVE-2023-33865: symlink vulnerability in /tmp/RenderDoc The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2023-253 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OUXFQKIACDXNDNRMXVBF6QD6SJQYGXBM/ E-Mail link for openSUSE-SU-2023:0253-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1212086 SUSE Bug 1212086 https://bugzilla.suse.com/1212088 SUSE Bug 1212088 https://bugzilla.suse.com/1212089 SUSE Bug 1212089 https://www.suse.com/security/cve/CVE-2023-33863/ SUSE CVE CVE-2023-33863 page https://www.suse.com/security/cve/CVE-2023-33864/ SUSE CVE CVE-2023-33864 page https://www.suse.com/security/cve/CVE-2023-33865/ SUSE CVE CVE-2023-33865 page SUSE Package Hub 15 SP5 openSUSE Leap 15.5 renderdoc-1.24-bp155.2.3.1 renderdoc-devel-1.24-bp155.2.3.1 renderdoc-1.24-bp155.2.3.1 as a component of SUSE Package Hub 15 SP5 renderdoc-devel-1.24-bp155.2.3.1 as a component of SUSE Package Hub 15 SP5 renderdoc-1.24-bp155.2.3.1 as a component of openSUSE Leap 15.5 renderdoc-devel-1.24-bp155.2.3.1 as a component of openSUSE Leap 15.5 SerialiseValue in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. 0xffffffff is sign-extended to 0xffffffffffffffff (SIZE_MAX) and then there is an attempt to add 1. CVE-2023-33863 SUSE Package Hub 15 SP5:renderdoc-1.24-bp155.2.3.1 SUSE Package Hub 15 SP5:renderdoc-devel-1.24-bp155.2.3.1 openSUSE Leap 15.5:renderdoc-1.24-bp155.2.3.1 openSUSE Leap 15.5:renderdoc-devel-1.24-bp155.2.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OUXFQKIACDXNDNRMXVBF6QD6SJQYGXBM/ https://www.suse.com/security/cve/CVE-2023-33863.html CVE-2023-33863 https://bugzilla.suse.com/1212086 SUSE Bug 1212086 StreamReader::ReadFromExternal in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. It uses uint32_t(m_BufferSize-m_InputSize) even though m_InputSize can exceed m_BufferSize. CVE-2023-33864 SUSE Package Hub 15 SP5:renderdoc-1.24-bp155.2.3.1 SUSE Package Hub 15 SP5:renderdoc-devel-1.24-bp155.2.3.1 openSUSE Leap 15.5:renderdoc-1.24-bp155.2.3.1 openSUSE Leap 15.5:renderdoc-devel-1.24-bp155.2.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OUXFQKIACDXNDNRMXVBF6QD6SJQYGXBM/ https://www.suse.com/security/cve/CVE-2023-33864.html CVE-2023-33864 https://bugzilla.suse.com/1212088 SUSE Bug 1212088 RenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownership. CVE-2023-33865 SUSE Package Hub 15 SP5:renderdoc-1.24-bp155.2.3.1 SUSE Package Hub 15 SP5:renderdoc-devel-1.24-bp155.2.3.1 openSUSE Leap 15.5:renderdoc-1.24-bp155.2.3.1 openSUSE Leap 15.5:renderdoc-devel-1.24-bp155.2.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OUXFQKIACDXNDNRMXVBF6QD6SJQYGXBM/ https://www.suse.com/security/cve/CVE-2023-33865.html CVE-2023-33865 https://bugzilla.suse.com/1212089 SUSE Bug 1212089