Negative-size-param in passDoAction in liblouis
Summary
OSV-2023-599: Negative-size-param in passDoAction. Affects liblouis versions >= bd2f5364d74bdc86af7a13fc690138c453c321de, < 878ef436e6cf401e5134899d70d5a8c0815cd549. Fixed in 878ef436e6cf401e5134899d70d5a8c0815cd549. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
liblouis is an open-source software library that provides braille translation services. It is commonly used to convert text into braille for visually impaired individuals. The library offers various functions for translating strings, including passDoAction. This vulnerability affects the passDoAction function in liblouis, leading to a negative-size-param crash.
Vulnerability Detail
The vulnerability occurs when a negative size parameter is passed to the passDoAction function. This can result in a crash in the translateString and _lou_translate functions. The issue was reported through OSS-Fuzz, and the crash state indicates that the crash occurs during the translation process. The impact of this vulnerability could include denial of service or potential exploitation of the crash to execute arbitrary code.
How To Fix
Minimum fixed version
878ef436e6cf401e5134899d70d5a8c0815cd549
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the liblouis library to the patched version.
Conclusion
The negative-size-param vulnerability in liblouis can lead to a crash during the translation process, potentially resulting in denial of service or arbitrary code execution. It is crucial to update the liblouis library to the latest version that includes the fix for this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for liblouis →
FAQ
liblouis is an open-source software library that provides braille translation services.
The impact could include denial of service or potential exploitation of the crash to execute arbitrary code.
This vulnerability was reported through OSS-Fuzz, a continuous fuzzing service for open-source software.
Yes, the developers of liblouis have addressed the vulnerability and released a fix. It is recommended to update to the latest version of the library.
There are no specific workarounds mentioned for this vulnerability. Updating to the patched version of the library is the recommended approach.
References
Related vulnerabilities
Recent vulnerabilities recorded for liblouis.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
