liblouis: CVE-2023-26767 CVE-2023-26768 CVE-2023-26769

Debian Bug report logs - #1033202
liblouis: CVE-2023-26767 CVE-2023-26768 CVE-2023-26769

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: liblouis: CVE-2023-26767 CVE-2023-26768 CVE-2023-26769

Date: Sun, 19 Mar 2023 17:09:09 +0100

Source: liblouis
Version: 3.24.0-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerabilities were published for liblouis.

CVE-2023-26767[0]:
| Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a
| remote attacker to cause a denial of service via the lou_logFile
| function at logginc.c endpoint.


CVE-2023-26768[1]:
| Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a
| remote attacker to cause a denial of service via the
| compileTranslationTable.c and lou_setDataPath functions.


CVE-2023-26769[2]:
| Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0
| allows a remote attacker to cause a denial of service via the
| resolveSubtable function at compileTranslationTabel.c.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-26767
    https://www.cve.org/CVERecord?id=CVE-2023-26767
[1] https://security-tracker.debian.org/tracker/CVE-2023-26768
    https://www.cve.org/CVERecord?id=CVE-2023-26768
[2] https://security-tracker.debian.org/tracker/CVE-2023-26769
    https://www.cve.org/CVERecord?id=CVE-2023-26769

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at submit@bugs.debian.org (full text, mbox, reply):

From: Samuel Thibault <sthibault@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 1033202@bugs.debian.org

Cc: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Re: Bug#1033202: liblouis: CVE-2023-26767 CVE-2023-26768 CVE-2023-26769

Date: Sun, 19 Mar 2023 17:27:39 +0100

Control: severity -1 normal

Hello,

I don't think any of these is an actual security issue.

Salvatore Bonaccorso, le dim. 19 mars 2023 17:09:09 +0100, a ecrit:
> The following vulnerabilities were published for liblouis.
> 
> CVE-2023-26767[0]:
> | Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a
> | remote attacker to cause a denial of service via the lou_logFile
> | function at logginc.c endpoint.

lou_logFile is not the kind of thing that is supposed to be usable
by attackers. If it was it would be *way* more serious than a buffer
overflow is.

> CVE-2023-26768[1]:
> | Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a
> | remote attacker to cause a denial of service via the
> | compileTranslationTable.c and lou_setDataPath functions.

It is the user that is in control of loading the translation table. The
content of the table *has* to be under the control of the user. If an
attacker was able to change the able, it would be *way* more problematic
than just buffer overflows.

> CVE-2023-26769[2]:
> | Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0
> | allows a remote attacker to cause a denial of service via the
> | resolveSubtable function at compileTranslationTabel.c.

lou_trace is a debugging tool.

Samuel

Message #24 received at 1033202@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Samuel Thibault <sthibault@debian.org>, 1033202@bugs.debian.org

Subject: Re: Bug#1033202: liblouis: CVE-2023-26767 CVE-2023-26768 CVE-2023-26769

Date: Sun, 19 Mar 2023 17:54:01 +0100

Hi Samuel,

On Sun, Mar 19, 2023 at 05:27:39PM +0100, Samuel Thibault wrote:
> Control: severity -1 normal
> 
> Hello,
> 
> I don't think any of these is an actual security issue.
> 
> Salvatore Bonaccorso, le dim. 19 mars 2023 17:09:09 +0100, a ecrit:
> > The following vulnerabilities were published for liblouis.
> > 
> > CVE-2023-26767[0]:
> > | Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a
> > | remote attacker to cause a denial of service via the lou_logFile
> > | function at logginc.c endpoint.
> 
> lou_logFile is not the kind of thing that is supposed to be usable
> by attackers. If it was it would be *way* more serious than a buffer
> overflow is.
> 
> > CVE-2023-26768[1]:
> > | Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a
> > | remote attacker to cause a denial of service via the
> > | compileTranslationTable.c and lou_setDataPath functions.
> 
> It is the user that is in control of loading the translation table. The
> content of the table *has* to be under the control of the user. If an
> attacker was able to change the able, it would be *way* more problematic
> than just buffer overflows.
> 
> > CVE-2023-26769[2]:
> > | Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0
> > | allows a remote attacker to cause a denial of service via the
> > | resolveSubtable function at compileTranslationTabel.c.
> 
> lou_trace is a debugging tool.

Thanks, makes all sense. I ammended the entries in security-tracker to
note the negligible security impact.

Regards,
Salvatore

Send a report that this bug log contains spam.