Bug 717968 – <app-text/hunspell-1.7.0-r2: Buffer overflow in SuggestMgr::leftcommonsubstring (CVE-2019-16707)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2020-04-18 00:12:31 UTC]

CVE-2019-16707 (https://nvd.nist.gov/vuln/detail/CVE-2019-16707):
  Hunspell 1.7.0 has an invalid read operation in
  SuggestMgr::leftcommonsubstring in suggestmgr.cxx.

[Comment 1 Lars Wendler (Polynomial-C) (RETIRED) 2020-04-19 18:01:43 UTC]

See URL for the upstream fix. Could be worth backporting...

[Comment 2 Sam James 2020-04-22 16:58:14 UTC]

(In reply to Lars Wendler (Polynomial-C) from comment #1)
> See URL for the upstream fix. Could be worth backporting...

Hmmm... I was thinking this, but there is a comment now:
https://github.com/hunspell/hunspell/commit/ac938e2ecb48ab4dd21298126c7921689d60571b#commitcomment-35927990

> this is an almost artificial test case. None of the Hunspell dictionaries uses COMPLEXPREFIXES (see here: https://github.com/wooorm/dictionaries), also the bad UTF-8 input word is likely filtered out by the applications with embedded Hunspell.

In theory, someone can use any dictionary with it. But most of them won't make this exploitable.

[Comment 3 Larry the Git Cow 2020-06-28 22:17:03 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4e89ec853a42dd375ccc12057c9376e6786d44ba

commit 4e89ec853a42dd375ccc12057c9376e6786d44ba
Author:     John Helmert III <[e-mail]>
AuthorDate: 2020-06-19 03:50:19 +0000
Commit:     Aaron Bauman <[e-mail]>
CommitDate: 2020-06-28 22:16:56 +0000

    app-text/hunspell: Patch CVE-2019-16707
    
    Bug: https://bugs.gentoo.org/717968
    Package-Manager: Portage-2.3.101, Repoman-2.3.22
    Signed-off-by: John Helmert III <[e-mail]>
    Closes: https://github.com/gentoo/gentoo/pull/16320
    Signed-off-by: Aaron Bauman <[e-mail]>

 .../files/hunspell-1.7.0-CVE-2019-16707.patch      | 22 ++++++
 app-text/hunspell/hunspell-1.7.0-r2.ebuild         | 89 ++++++++++++++++++++++
 2 files changed, 111 insertions(+)

[Comment 4 Aaron Bauman (RETIRED) 2020-06-28 22:17:55 UTC]

please call for stable when ready

[Comment 5 Sergei Trofimovich (RETIRED) 2020-07-06 07:28:20 UTC]

ppc/ppc64 stable

[Comment 6 Sam James 2020-07-09 00:25:19 UTC]

arm64 stable

[Comment 7 Sam James 2020-07-11 20:35:54 UTC]

sparc stable

[Comment 8 Sam James 2020-07-12 13:59:04 UTC]

arm stable

[Comment 9 Agostino Sarubbo 2020-07-17 07:25:38 UTC]

amd64 stable

[Comment 10 Agostino Sarubbo 2020-07-17 07:46:41 UTC]

x86 stable.

Maintainer(s), please cleanup.

[Comment 11 Larry the Git Cow 2020-07-18 00:00:18 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d9066914211115527d8e649624a8a64cb37fd787

commit d9066914211115527d8e649624a8a64cb37fd787
Author:     Sam James <[e-mail]>
AuthorDate: 2020-07-17 21:14:14 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2020-07-17 23:59:51 +0000

    app-text/hunspell: security cleanup
    
    Bug: https://bugs.gentoo.org/717968
    Package-Manager: Portage-2.3.103, Repoman-2.3.23
    Signed-off-by: Sam James <[e-mail]>

 app-text/hunspell/hunspell-1.7.0-r1.ebuild | 88 ------------------------------
 1 file changed, 88 deletions(-)

[Comment 12 Sam James 2020-07-18 00:04:44 UTC]

Cleanup done, noglsa, closing.