Bug 1141435 (CVE-2019-1010011)

Summary:	VUL-1: CVE-2019-1010011: abcm2ps: stack-based buffer overflow in functions get_key (parse.c) and delayed_output (music.c)
Product:	[openSUSE] openSUSE Distribution	Reporter:	Alexander Bergmann <abergmann>
Component:	Other	Assignee:	Security Team bot <security-team>
Status:	NEW ---	QA Contact:	Security Team bot <security-team>
Severity:	Minor
Priority:	P4 - Low
Version:	Leap 15.1
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/237128/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Alexander Bergmann 2019-07-15 08:40:49 UTC

CVE-2019-1010011

moinejf abcm2ps 8.13.16 and after is affected by: CWE-121: Stack-based Buffer
Overflow. The impact is: This vulnerability allows remote attackers to cause a
denial of service via a crafted file. The component is: parse.c / function:
get_key and music.c/ function: delayed_output.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1010011
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010011
https://drive.google.com/drive/folders/1xiVrcB1lTE_mSd_mL7akjpscH4CUahYU?usp=sharing
https://drive.google.com/drive/folders/1nAL-B_I5Y7SKX0AeIurGkTzNHMazoyzP?usp=sharing

Comment 1 Michael Vetter 2019-07-18 13:07:32 UTC

We are not affected by this.

It seems CVE-2019-1010011 is just a duplicate of already existing CVEs.

CVE-2018-10771: https://github.com/leesavide/abcm2ps/commit/dc0372993674d0b50fedfbf7b9fad1239b8efc5f
contained in releases since v8.13.21.

CVE-2018-10753: https://github.com/leesavide/abcm2ps/commit/fd956e19f88ee32f8ec4aece5901400b06e80bcc
contained in releases since v8.13.21

Also see upstream issue https://github.com/leesavide/abcm2ps/issues/55