Bugzilla – Bug 1156260
VUL-0: CVE-2019-18397: fribidi: Stack buffer overflow in GNU FriBidi
Last modified: 2024-05-06 11:58:41 UTC
CVE-2019-18397 Alex Murray discovered a stack-based buffer overflow vulnerability in fribidi, an implementation of the Unicode Bidirectional Algorithm algorithm, which could result in denial of service or potentially the execution of arbitrary code, when processing a large number of unicode isolate directional characters. For the stable distribution (buster), this problem has been fixed in version 1.0.5-3.1+deb10u1. We recommend that you upgrade your fribidi packages. For the detailed security status of fribidi please refer to its security tracker page at: https://security-tracker.debian.org/tracker/fribidi References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-18397 http://www.debian.org/security/-1/dsa-4561 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-18397.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=944327
I believe we are not affected, because our version is too old.
Leap 15.2 has libfribidi0-1.0.5-lp152.1.3.x86_64. lib/fribidi-bidi.c in libfribidi0-1.0.5-lp152.1.3.x86_64 appears to be missing the fix from https://github.com/fribidi/fribidi/commit/034c6e9a1d296286305f4cfd1e0072b879f52568 Do you plan to fix this in Leap 15.2?
assigning to maintainer
SLE15-SP2 is also affected. The package in Leap is inherited by SLE
SUSE-SU-2021:1655-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1156260 CVE References: CVE-2019-18397 JIRA References: Sources used: SUSE MicroOS 5.0 (src): fribidi-1.0.5-3.3.1 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (src): fribidi-1.0.5-3.3.1 SUSE Linux Enterprise Module for Desktop Applications 15-SP2 (src): fribidi-1.0.5-3.3.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): fribidi-1.0.5-3.3.1 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): fribidi-1.0.5-3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2021:0763-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1156260 CVE References: CVE-2019-18397 JIRA References: Sources used: openSUSE Leap 15.2 (src): fribidi-1.0.5-lp152.2.3.1
openSUSE-SU-2021:1655-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1156260 CVE References: CVE-2019-18397 JIRA References: Sources used: openSUSE Leap 15.3 (src): fribidi-1.0.5-3.3.1
All done, closing.