Security update for editorconfig-core-c SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2023:0102-1 Final 1 1 2023-05-04T10:31:23Z current 2023-05-04T10:31:23Z 2023-05-04T10:31:23Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for editorconfig-core-c This update for editorconfig-core-c fixes the following issues: Update to version 0.12.6: - CVE-2023-0341: Fixed a buffer overflow in ec_blob (boo#1211032) - Update property key, value length limits per spec change The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2023-102 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PFRY22273IZL5F7JS7P3P2H4OJHOP3ZA/ E-Mail link for openSUSE-SU-2023:0102-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1211032 SUSE Bug 1211032 https://www.suse.com/security/cve/CVE-2023-0341/ SUSE CVE CVE-2023-0341 page SUSE Package Hub 15 SP4 openSUSE Leap 15.4 editorconfig-0.12.6-bp154.2.3.1 libeditorconfig-devel-0.12.6-bp154.2.3.1 libeditorconfig-devel-32bit-0.12.6-bp154.2.3.1 libeditorconfig-devel-64bit-0.12.6-bp154.2.3.1 libeditorconfig0-0.12.6-bp154.2.3.1 libeditorconfig0-32bit-0.12.6-bp154.2.3.1 libeditorconfig0-64bit-0.12.6-bp154.2.3.1 editorconfig-0.12.6-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 libeditorconfig-devel-0.12.6-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 libeditorconfig-devel-32bit-0.12.6-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 libeditorconfig-devel-64bit-0.12.6-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 libeditorconfig0-0.12.6-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 libeditorconfig0-32bit-0.12.6-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 libeditorconfig0-64bit-0.12.6-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 editorconfig-0.12.6-bp154.2.3.1 as a component of openSUSE Leap 15.4 libeditorconfig-devel-0.12.6-bp154.2.3.1 as a component of openSUSE Leap 15.4 libeditorconfig-devel-32bit-0.12.6-bp154.2.3.1 as a component of openSUSE Leap 15.4 libeditorconfig-devel-64bit-0.12.6-bp154.2.3.1 as a component of openSUSE Leap 15.4 libeditorconfig0-0.12.6-bp154.2.3.1 as a component of openSUSE Leap 15.4 libeditorconfig0-32bit-0.12.6-bp154.2.3.1 as a component of openSUSE Leap 15.4 libeditorconfig0-64bit-0.12.6-bp154.2.3.1 as a component of openSUSE Leap 15.4 A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer. CVE-2023-0341 SUSE Package Hub 15 SP4:editorconfig-0.12.6-bp154.2.3.1 SUSE Package Hub 15 SP4:libeditorconfig-devel-0.12.6-bp154.2.3.1 SUSE Package Hub 15 SP4:libeditorconfig-devel-32bit-0.12.6-bp154.2.3.1 SUSE Package Hub 15 SP4:libeditorconfig-devel-64bit-0.12.6-bp154.2.3.1 SUSE Package Hub 15 SP4:libeditorconfig0-0.12.6-bp154.2.3.1 SUSE Package Hub 15 SP4:libeditorconfig0-32bit-0.12.6-bp154.2.3.1 SUSE Package Hub 15 SP4:libeditorconfig0-64bit-0.12.6-bp154.2.3.1 openSUSE Leap 15.4:editorconfig-0.12.6-bp154.2.3.1 openSUSE Leap 15.4:libeditorconfig-devel-0.12.6-bp154.2.3.1 openSUSE Leap 15.4:libeditorconfig-devel-32bit-0.12.6-bp154.2.3.1 openSUSE Leap 15.4:libeditorconfig-devel-64bit-0.12.6-bp154.2.3.1 openSUSE Leap 15.4:libeditorconfig0-0.12.6-bp154.2.3.1 openSUSE Leap 15.4:libeditorconfig0-32bit-0.12.6-bp154.2.3.1 openSUSE Leap 15.4:libeditorconfig0-64bit-0.12.6-bp154.2.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PFRY22273IZL5F7JS7P3P2H4OJHOP3ZA/ https://www.suse.com/security/cve/CVE-2023-0341.html CVE-2023-0341 https://bugzilla.suse.com/1211032 SUSE Bug 1211032