Security update for libofx SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:2229-1 Final 1 1 2018-08-07T09:13:26Z current 2018-08-07T09:13:26Z 2018-08-07T09:13:26Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libofx This update for libofx fixes the following issues: The following security vulnerabilities have been addressed: - CVE-2017-2920: Fixed an exploitable buffer overflow in the tag parsing functionality, which could result in an out of bounds write and could be triggered via a specially crafted OFX file (boo#1061964) - CVE-2017-2816: Fixed another buffer overflow in the tag parsing functionality, which could result in an stack overflow and could be triggered via a specially crafted OFX file (boo#1058673) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2018-08/msg00018.html E-Mail link for openSUSE-SU-2018:2229-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.3 libofx-0.9.10-7.3.1 libofx-devel-0.9.10-7.3.1 libofx6-0.9.10-7.3.1 libofx-0.9.10-7.3.1 as a component of openSUSE Leap 42.3 libofx-devel-0.9.10-7.3.1 as a component of openSUSE Leap 42.3 libofx6-0.9.10-7.3.1 as a component of openSUSE Leap 42.3 An exploitable buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack. An attacker can construct a malicious OFX file to trigger this vulnerability. CVE-2017-2816 openSUSE Leap 42.3:libofx-0.9.10-7.3.1 openSUSE Leap 42.3:libofx-devel-0.9.10-7.3.1 openSUSE Leap 42.3:libofx6-0.9.10-7.3.1 moderate 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-08/msg00018.html https://www.suse.com/security/cve/CVE-2017-2816.html CVE-2017-2816 https://bugzilla.suse.com/1058673 SUSE Bug 1058673 An memory corruption vulnerability exists in the .SVG parsing functionality of Computerinsel Photoline 20.02. A specially crafted .SVG file can cause a vulnerability resulting in memory corruption, which can potentially lead to arbitrary code execution. An attacker can send a specific .SVG file to trigger this vulnerability. CVE-2017-2920 openSUSE Leap 42.3:libofx-0.9.10-7.3.1 openSUSE Leap 42.3:libofx-devel-0.9.10-7.3.1 openSUSE Leap 42.3:libofx6-0.9.10-7.3.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-08/msg00018.html https://www.suse.com/security/cve/CVE-2017-2920.html CVE-2017-2920 https://bugzilla.suse.com/1061964 SUSE Bug 1061964