Red Hat Security Advisory

RHSA-2017:3111

liblouis security update

Released 2017-11-02 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) liblouis-2.5.2-11.el7_4, liblouis-python-2.5.2-11.el7_4
Red Hat Enterprise Linux Client Optional (v. 7) liblouis-devel-2.5.2-11.el7_4, liblouis-doc-2.5.2-11.el7_4, liblouis-utils-2.5.2-11.el7_4
Red Hat Enterprise Linux Server (v. 7) liblouis-2.5.2-11.el7_4, liblouis-2.5.2-11.el7_4.ppc, liblouis-python-2.5.2-11.el7_4
Red Hat Enterprise Linux Server Optional (v. 7) liblouis-devel-2.5.2-11.el7_4, liblouis-devel-2.5.2-11.el7_4.ppc, liblouis-doc-2.5.2-11.el7_4 +1
Red Hat Enterprise Linux Workstation (v. 7) liblouis-2.5.2-11.el7_4, liblouis-python-2.5.2-11.el7_4
Red Hat Enterprise Linux Workstation Optional (v. 7) liblouis-devel-2.5.2-11.el7_4, liblouis-doc-2.5.2-11.el7_4, liblouis-utils-2.5.2-11.el7_4

Fixes 7 records

TI-2017-10015 CVE-2017-13740 · GHSA-72qw-xhg7-3mhv

There is a stack-based buffer overflow in Liblouis 3.2.0, triggered in the function…

MEDIUM 41

There is a stack-based buffer overflow in Liblouis 3.2.0, triggered in the function parseChars() in compileTranslationTable.c, that will lead to denial of service or possibly unspecified other impact.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01594 Published 2017-08-29 Fixed CWE-119

TI-2017-10013 CVE-2017-13738 · GHSA-3542-5g2c-wpgm

There is an illegal address access in the _lou_getALine function in compileTranslationTable.c:346 in Liblouis 3.2.0.

MEDIUM 41

There is an illegal address access in the _lou_getALine function in compileTranslationTable.c:346 in Liblouis 3.2.0.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01505 Published 2017-08-29 Fixed CWE-125

TI-2014-06799 CVE-2014-8184 · GHSA-4v7c-4xff-r4v7

Stack-based buffer overflow in liblouis

LOW 37

A vulnerability was found in liblouis, versions 2.5.x before 2.5.4.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01549 Published 2019-08-02 Fixed in 2.5.4 CWE-121

TI-2017-10018 CVE-2017-13743 · GHSA-6frw-vhvg-c77r

There is a buffer overflow in Liblouis 3.2.0, triggered in the function _lou_showString()…

LOW 33

There is a buffer overflow in Liblouis 3.2.0, triggered in the function _lou_showString() in utils.c, that will lead to a remote denial of service attack.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.01845 Published 2017-08-29 Fixed CWE-119

TI-2017-10017 CVE-2017-13742 · GHSA-vfmv-mrqv-497v

There is a stack-based buffer overflow in Liblouis 3.2.0, triggered in the function…

LOW 33

There is a stack-based buffer overflow in Liblouis 3.2.0, triggered in the function includeFile() in compileTranslationTable.c, that will lead to a remote denial of service attack.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.01845 Published 2017-08-29 Fixed CWE-119

TI-2017-10019 CVE-2017-13744 · GHSA-cj9f-x33q-pr9r

There is an illegal address access in the function _lou_getALine() in compileTranslationTable.c:343 in Liblouis 3.2.0.

LOW 32

There is an illegal address access in the function _lou_getALine() in compileTranslationTable.c:343 in Liblouis 3.2.0.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.01357 Published 2017-08-29 Fixed CWE-125

TI-2017-10016 CVE-2017-13741 · GHSA-j298-5j4f-cw2m

There is a use-after-free in the function compileBrailleIndicator() in…

LOW 32

There is a use-after-free in the function compileBrailleIndicator() in compileTranslationTable.c in Liblouis 3.2.0 that will lead to a remote denial of service attack.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.01756 Published 2017-08-29 Fixed CWE-416