An memory corruption vulnerability exists in the .SVG parsing functionality of Computerinsel Photoline 20.02. A specially crafted .SVG file can cause a vulnerability resulting in memory corruption, which can potentially lead to arbitrary code execution. An attacker can send a specific .SVG file to trigger this vulnerability.

The remote host is affected by the vulnerability described in GLSA-201908-26 (libofx: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libofx. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to process a specially crafted       file using an application linked against libofx, possibly resulting in       execution of arbitrary code with the privileges of the process or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for libofx fixes the following issues :

The following security vulnerabilities have been addressed :

  - CVE-2017-2920: Fixed an exploitable buffer overflow in     the tag parsing functionality, which could result in an     out of bounds write and could be triggered via a     specially crafted OFX file (boo#1061964)

  - CVE-2017-2816: Fixed another buffer overflow in the tag     parsing functionality, which could result in an stack     overflow and could be triggered via a specially crafted     OFX file (boo#1058673)

This update for libofx fixes the following issues: Security issues fixed :

  - CVE-2017-2816: Fix an exploitable buffer overflow     vulnerability in the tag parsing functionality     (bsc#1058673).

  - CVE-2017-2920: Fix a buffer overflow vulnerability in     sanitize_proprietary_tags in lib/ofx_preproc.cpp     (bsc#1061964).

  - CVE-2017-14731: Fix remote denial of service via a     crafted file in ofx_proc_file in ofx_preproc.cpp     (bsc#1060437).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
128441	GLSA-201908-26 : libofx: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
111585	openSUSE Security Update : libofx (openSUSE-2018-820)	Nessus	SuSE Local Security Checks	high
111368	SUSE SLED12 Security Update : libofx (SUSE-SU-2018:2064-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2017-2920

high

Tenable Plugins

high

high

high