Critical Buffer Over-read Vulnerability in Aspell Package
Summary
ALPINE-CVE-2019-17544: libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ character. Affects aspell versions < 0.60.6.1-r14. Fixed in 0.60.6.1-r14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Aspell is a widely used spell checker designed for various programming languages and applications. It provides a robust library for spell checking and is integrated into numerous software projects. The vulnerability in question affects multiple versions of Aspell, making it crucial for users to be aware of its implications and necessary actions.
Vulnerability Detail
The vulnerability identified as CVE-2019-17544 is a stack-based buffer over-read in the libaspell.a library of GNU Aspell prior to version 0.60.8. This flaw arises from improper handling of an isolated backslash character in the common/getdata.cpp file, which can lead to potential information disclosure or application crashes. The CVSS score for this vulnerability is 9.1, indicating a high severity level that could be exploited by attackers to gain unauthorized access to sensitive data.
How To Fix
Minimum fixed version
0.60.6.1-r14
This is the first release that contains the fix.
sudo apk add --upgrade aspellTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the affected functions that handle input with isolated backslash characters until the package is updated. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The CVE-2019-17544 vulnerability in the Aspell package poses a significant risk due to its potential for exploitation. Users are strongly advised to update to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for aspell →
FAQ
CVE-2019-17544 is a vulnerability in the Aspell package that allows for a stack-based buffer over-read, potentially leading to information disclosure.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access to sensitive information or application crashes, posing a significant risk to users.
Yes, patched versions of Aspell are available. Users should update to version 0.60.6.1-r14 or 0.60.8-r0 depending on their Alpine version.
If immediate updates are not possible, avoid using the affected functions that handle isolated backslash characters as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for aspell.
