Security update for liblouis SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:3107-1 Final 1 1 2020-10-30T09:55:50Z current 2020-10-30T09:55:50Z 2020-10-30T09:55:50Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for liblouis This update for liblouis, python-luis and python3-louis fixes the following issue: Security issue fixed: - CVE-2018-17294: Fixed an out of bounds read in matchCurrentInput function which could allow a remote attacker to cause Denail of Service (bsc#1109319). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-3107,SUSE-SLE-SDK-12-SP5-2020-3107,SUSE-SLE-SERVER-12-SP5-2020-3107 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20203107-1/ Link for SUSE-SU-2020:3107-1 https://lists.suse.com/pipermail/sle-security-updates/2020-October/007676.html E-Mail link for SUSE-SU-2020:3107-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1109319 SUSE Bug 1109319 https://www.suse.com/security/cve/CVE-2018-17294/ SUSE CVE CVE-2018-17294 page SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 liblouis-data-2.6.4-6.9.24 liblouis-devel-2.6.4-6.9.24 liblouis-doc-2.6.4-6.9.24 liblouis-tools-2.6.4-6.9.24 liblouis9-2.6.4-6.9.24 python-louis-2.6.4-6.9.39 python3-louis-2.6.4-6.9.41 liblouis-data-2.6.4-6.9.24 as a component of SUSE Linux Enterprise Server 12 SP5 liblouis9-2.6.4-6.9.24 as a component of SUSE Linux Enterprise Server 12 SP5 python-louis-2.6.4-6.9.39 as a component of SUSE Linux Enterprise Server 12 SP5 python3-louis-2.6.4-6.9.41 as a component of SUSE Linux Enterprise Server 12 SP5 liblouis-data-2.6.4-6.9.24 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 liblouis9-2.6.4-6.9.24 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python-louis-2.6.4-6.9.39 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 python3-louis-2.6.4-6.9.41 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 liblouis-devel-2.6.4-6.9.24 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 The matchCurrentInput function inside lou_translateString.c of Liblouis prior to 3.7 does not check the input string's length, allowing attackers to cause a denial of service (application crash via out-of-bounds read) by crafting an input file with certain translation dictionaries. CVE-2018-17294 SUSE Linux Enterprise Server 12 SP5:liblouis-data-2.6.4-6.9.24 SUSE Linux Enterprise Server 12 SP5:liblouis9-2.6.4-6.9.24 SUSE Linux Enterprise Server 12 SP5:python-louis-2.6.4-6.9.39 SUSE Linux Enterprise Server 12 SP5:python3-louis-2.6.4-6.9.41 SUSE Linux Enterprise Server for SAP Applications 12 SP5:liblouis-data-2.6.4-6.9.24 SUSE Linux Enterprise Server for SAP Applications 12 SP5:liblouis9-2.6.4-6.9.24 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python-louis-2.6.4-6.9.39 SUSE Linux Enterprise Server for SAP Applications 12 SP5:python3-louis-2.6.4-6.9.41 SUSE Linux Enterprise Software Development Kit 12 SP5:liblouis-devel-2.6.4-6.9.24 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203107-1/ https://www.suse.com/security/cve/CVE-2018-17294.html CVE-2018-17294 https://bugzilla.suse.com/1109319 SUSE Bug 1109319