SUSE-SU-2021:14823-1
- Source
- https://www.suse.com/support/update/announcement/2021/suse-su-202114823-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:14823-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2021:14823-1
- Related
- Published
- 2021-10-06T14:42:40Z
- Modified
- 2021-10-06T14:42:40Z
- Summary
- Security update for transfig
- Details
-
This update for transfig fixes the following issues:
- CVE-2021-3561: Fixed global buffer overflow in fig2dev/read.c in function read_colordef() (bsc#1186329).
- CVE-2019-19797: Fixed out-of-bounds write in read_colordef in read.c (bsc#1159293).
- CVE-2019-19746: Fixed segmentation fault and out-of-bounds write because of an integer overflow via a large arrow type (bsc#1159130).
- CVE-2019-19555: Fixed stack-based buffer overflow because of an incorrect sscanf (bsc#1161698).
- CVE-2019-14275: Fixed stack-based buffer overflow in the calc_arrow function in bound.c (bsc#1143650).
- CVE-2020-21680: Fixed a stack-based buffer overflow in the put_arrow() component in genpict2e.c (bsc#1189343).
- CVE-2020-21681: Fixed a global buffer overflow in the set_color component in genge.c (bsc#1189345).
- CVE-2020-21682: Fixed a global buffer overflow in the set_fill component in genge.c (bsc#1189346).
CVE-2020-21683: Fixed a global buffer overflow in the shadeortintnameafterdeclarecolor in genpstricks.c (bsc#1189325).
Do hardening via compile and linker flags
- Fixed last added upstream commit (boo#1136882)
- References
-
- https://www.suse.com/support/update/announcement/2021/suse-su-202114823-1/
- https://bugzilla.suse.com/1136882
- https://bugzilla.suse.com/1143650
- https://bugzilla.suse.com/1159130
- https://bugzilla.suse.com/1159293
- https://bugzilla.suse.com/1161698
- https://bugzilla.suse.com/1186329
- https://bugzilla.suse.com/1189325
- https://bugzilla.suse.com/1189343
- https://bugzilla.suse.com/1189345
- https://bugzilla.suse.com/1189346
- https://www.suse.com/security/cve/CVE-2019-14275
- https://www.suse.com/security/cve/CVE-2019-19555
- https://www.suse.com/security/cve/CVE-2019-19746
- https://www.suse.com/security/cve/CVE-2019-19797
- https://www.suse.com/security/cve/CVE-2020-21680
- https://www.suse.com/security/cve/CVE-2020-21681
- https://www.suse.com/security/cve/CVE-2020-21682
- https://www.suse.com/security/cve/CVE-2020-21683
- https://www.suse.com/security/cve/CVE-2021-3561
Affected packages
SUSE:Linux Enterprise Point of Sale 11 SP3 / transfig
Package
- Name
- transfig
- Purl
- pkg:rpm/suse/transfig&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3