Описание
Security update for dia
This update for dia fixes the following issue:
- CVE-2019-19451: Fixed an endless loop on filenames with invalid encoding (bsc#1158194).
This update was imported from the SUSE:SLE-15:Update update project.
Список пакетов
openSUSE Leap 15.1
dia-0.97.3-lp151.4.3.1
dia-lang-0.97.3-lp151.4.3.1
Ссылки
- E-Mail link for openSUSE-SU-2020:0021-1
- SUSE Security Ratings
- SUSE Bug 1158194
- SUSE CVE CVE-2019-19451 page
Описание
When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.
Затронутые продукты
openSUSE Leap 15.1:dia-0.97.3-lp151.4.3.1
openSUSE Leap 15.1:dia-lang-0.97.3-lp151.4.3.1
Ссылки
- CVE-2019-19451
- SUSE Bug 1158194