Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2018-17294 →

DEBIAN-CVE-2018-17294

The matchCurrentInput function inside lou_translateString.c of Liblouis prior to 3.7 does not check the input string's length, allowing attackers to c...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

The matchCurrentInput function inside lou_translateString.c of Liblouis prior to 3.7 does not check the input string's length, allowing attackers to cause a denial of service (application crash via out-of-bounds read) by crafting an input file with certain translation dictionaries.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 liblouis

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0-1"}]}]

Debian:13 liblouis

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0-1"}]}]

Debian:14 liblouis

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0-1"}]}]

Références

advisory security-tracker.debian.org