Security update for djvulibre SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:0759-1 Final 1 1 2021-05-22T05:03:36Z current 2021-05-22T05:03:36Z 2021-05-22T05:03:36Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for djvulibre This update for djvulibre fixes the following issues: - CVE-2021-32490 [bsc#1185895]: Out of bounds write in function DJVU:filter_bv() via crafted djvu file - CVE-2021-32491 [bsc#1185900]: Integer overflow in function render() in tools/ddjvu via crafted djvu file - CVE-2021-32492 [bsc#1185904]: Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file - CVE-2021-32493 [bsc#1185905]: Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file This update was imported from the SUSE:SLE-15-SP2:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2021-759 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VWUVFLJ5WIUYL2E7ZRZKXICPKCTWQHHD/ E-Mail link for openSUSE-SU-2021:0759-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1185895 SUSE Bug 1185895 https://bugzilla.suse.com/1185900 SUSE Bug 1185900 https://bugzilla.suse.com/1185904 SUSE Bug 1185904 https://bugzilla.suse.com/1185905 SUSE Bug 1185905 https://www.suse.com/security/cve/CVE-2021-32490/ SUSE CVE CVE-2021-32490 page https://www.suse.com/security/cve/CVE-2021-32491/ SUSE CVE CVE-2021-32491 page https://www.suse.com/security/cve/CVE-2021-32492/ SUSE CVE CVE-2021-32492 page https://www.suse.com/security/cve/CVE-2021-32493/ SUSE CVE CVE-2021-32493 page openSUSE Leap 15.2 djvulibre-3.5.27-lp152.7.3.1 djvulibre-doc-3.5.27-lp152.7.3.1 libdjvulibre-devel-3.5.27-lp152.7.3.1 libdjvulibre21-3.5.27-lp152.7.3.1 djvulibre-3.5.27-lp152.7.3.1 as a component of openSUSE Leap 15.2 djvulibre-doc-3.5.27-lp152.7.3.1 as a component of openSUSE Leap 15.2 libdjvulibre-devel-3.5.27-lp152.7.3.1 as a component of openSUSE Leap 15.2 libdjvulibre21-3.5.27-lp152.7.3.1 as a component of openSUSE Leap 15.2 A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds write in function DJVU::filter_bv() via crafted djvu file may lead to application crash and other consequences. CVE-2021-32490 openSUSE Leap 15.2:djvulibre-3.5.27-lp152.7.3.1 openSUSE Leap 15.2:djvulibre-doc-3.5.27-lp152.7.3.1 openSUSE Leap 15.2:libdjvulibre-devel-3.5.27-lp152.7.3.1 openSUSE Leap 15.2:libdjvulibre21-3.5.27-lp152.7.3.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VWUVFLJ5WIUYL2E7ZRZKXICPKCTWQHHD/ https://www.suse.com/security/cve/CVE-2021-32490.html CVE-2021-32490 https://bugzilla.suse.com/1185895 SUSE Bug 1185895 A flaw was found in djvulibre-3.5.28 and earlier. An integer overflow in function render() in tools/ddjvu via crafted djvu file may lead to application crash and other consequences. CVE-2021-32491 openSUSE Leap 15.2:djvulibre-3.5.27-lp152.7.3.1 openSUSE Leap 15.2:djvulibre-doc-3.5.27-lp152.7.3.1 openSUSE Leap 15.2:libdjvulibre-devel-3.5.27-lp152.7.3.1 openSUSE Leap 15.2:libdjvulibre21-3.5.27-lp152.7.3.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VWUVFLJ5WIUYL2E7ZRZKXICPKCTWQHHD/ https://www.suse.com/security/cve/CVE-2021-32491.html CVE-2021-32491 https://bugzilla.suse.com/1185900 SUSE Bug 1185900 A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds read in function DJVU::DataPool::has_data() via crafted djvu file may lead to application crash and other consequences. CVE-2021-32492 openSUSE Leap 15.2:djvulibre-3.5.27-lp152.7.3.1 openSUSE Leap 15.2:djvulibre-doc-3.5.27-lp152.7.3.1 openSUSE Leap 15.2:libdjvulibre-devel-3.5.27-lp152.7.3.1 openSUSE Leap 15.2:libdjvulibre21-3.5.27-lp152.7.3.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VWUVFLJ5WIUYL2E7ZRZKXICPKCTWQHHD/ https://www.suse.com/security/cve/CVE-2021-32492.html CVE-2021-32492 https://bugzilla.suse.com/1185904 SUSE Bug 1185904 A flaw was found in djvulibre-3.5.28 and earlier. A heap buffer overflow in function DJVU::GBitmap::decode() via crafted djvu file may lead to application crash and other consequences. CVE-2021-32493 openSUSE Leap 15.2:djvulibre-3.5.27-lp152.7.3.1 openSUSE Leap 15.2:djvulibre-doc-3.5.27-lp152.7.3.1 openSUSE Leap 15.2:libdjvulibre-devel-3.5.27-lp152.7.3.1 openSUSE Leap 15.2:libdjvulibre21-3.5.27-lp152.7.3.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VWUVFLJ5WIUYL2E7ZRZKXICPKCTWQHHD/ https://www.suse.com/security/cve/CVE-2021-32493.html CVE-2021-32493 https://bugzilla.suse.com/1185905 SUSE Bug 1185905