Security update for djvulibre SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:14728-1 Final 1 1 2021-05-19T11:50:03Z current 2021-05-19T11:50:03Z 2021-05-19T11:50:03Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for djvulibre This update for djvulibre fixes the following issues: Security issues fixed: - CVE-2021-32491 [bsc#1185900]: Integer overflow in function render() in tools/ddjvu via crafted djvu file - CVE-2021-32492 [bsc#1185904]: Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file - CVE-2021-32493 [bsc#1185905]: Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleposp3-djvulibre-14728,slessp4-djvulibre-14728 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-202114728-1/ Link for SUSE-SU-2021:14728-1 https://lists.suse.com/pipermail/sle-security-updates/2021-May/008785.html E-Mail link for SUSE-SU-2021:14728-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1185900 SUSE Bug 1185900 https://bugzilla.suse.com/1185904 SUSE Bug 1185904 https://bugzilla.suse.com/1185905 SUSE Bug 1185905 https://www.suse.com/security/cve/CVE-2021-32491/ SUSE CVE CVE-2021-32491 page https://www.suse.com/security/cve/CVE-2021-32492/ SUSE CVE CVE-2021-32492 page https://www.suse.com/security/cve/CVE-2021-32493/ SUSE CVE CVE-2021-32493 page SUSE Linux Enterprise Point of Sale 11 SP3 SUSE Linux Enterprise Server 11 SP4-LTSS libdjvulibre21-3.5.21-3.9.1 libdjvulibre21-3.5.21-3.9.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 libdjvulibre21-3.5.21-3.9.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS A flaw was found in djvulibre-3.5.28 and earlier. An integer overflow in function render() in tools/ddjvu via crafted djvu file may lead to application crash and other consequences. CVE-2021-32491 SUSE Linux Enterprise Point of Sale 11 SP3:libdjvulibre21-3.5.21-3.9.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libdjvulibre21-3.5.21-3.9.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114728-1/ https://www.suse.com/security/cve/CVE-2021-32491.html CVE-2021-32491 https://bugzilla.suse.com/1185900 SUSE Bug 1185900 A flaw was found in djvulibre-3.5.28 and earlier. An out of bounds read in function DJVU::DataPool::has_data() via crafted djvu file may lead to application crash and other consequences. CVE-2021-32492 SUSE Linux Enterprise Point of Sale 11 SP3:libdjvulibre21-3.5.21-3.9.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libdjvulibre21-3.5.21-3.9.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114728-1/ https://www.suse.com/security/cve/CVE-2021-32492.html CVE-2021-32492 https://bugzilla.suse.com/1185904 SUSE Bug 1185904 A flaw was found in djvulibre-3.5.28 and earlier. A heap buffer overflow in function DJVU::GBitmap::decode() via crafted djvu file may lead to application crash and other consequences. CVE-2021-32493 SUSE Linux Enterprise Point of Sale 11 SP3:libdjvulibre21-3.5.21-3.9.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libdjvulibre21-3.5.21-3.9.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114728-1/ https://www.suse.com/security/cve/CVE-2021-32493.html CVE-2021-32493 https://bugzilla.suse.com/1185905 SUSE Bug 1185905