Bug 1984066 (CVE-2019-25051)

Summary:	CVE-2019-25051 aspell: Heap-buffer-overflow in acommon::ObjStack::dup_top
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jchaloup, nforro
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-11 02:16:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1984067, 1988497
Bug Blocks:	1984069

Description Michael Kaplan 2021-07-20 14:47:35 UTC

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).

References:

https://github.com/gnuaspell/aspell/commit/0718b375425aad8e54e1150313b862e4c6fd324a
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18462
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/aspell/OSV-2020-521.yaml

Comment 1 Michael Kaplan 2021-07-20 14:48:54 UTC

Created aspell tracking bugs for this issue:

Affects: fedora-all [bug 1984067]

Comment 3 Garrett Tucker 2021-07-30 20:27:36 UTC

After analysis, the flaw is caused by a lack of checking that an allocation size will fit within a chunk. It is trivial to cause the heap to overflow, and a significant amount is able to be written. This could potentially lead an attacker to execute arbitrary code on the affected system leading to complete exploitation of the system. The upstream patch is https://github.com/gnuaspell/aspell/commit/0718b375425aad8e54e1150313b862e4c6fd324a and can either be applied manually or by updating to the latest version of aspell

Comment 4 errata-xmlrpc 2022-05-10 13:33:18 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1808 https://access.redhat.com/errata/RHSA-2022:1808

Comment 5 Product Security DevOps Team 2022-05-11 02:16:25 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-25051