Lout 3.40 has a heap-based buffer overflow in the srcnext() function in z02.c.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Lout 3.40 has a heap-based buffer overflow in the srcnext() function in z02.c. (CVE-2019-19918)

Note that Nessus relies on the presence of the package as reported by the vendor.

Add lout-3.40-cve.patch from https://lists.nongnu.org/archive/html/lout-users/2020-10/msg00013.html fixing rhbz#1787383 and rhbz#1787386 (CVE-2019-19918 and CVE-2019-19917), two buffer overflows.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for lout fixes the following issues :

  - CVE-2019-19918: Fixed buffer overflow in srcnext()     (boo#1159713).

  - CVE-2019-19917: Fixed buffer overflow in     StringQuotedWord() (boo#1159714).

ID	Name	Product	Family	Severity
261109	Linux Distros Unpatched Vulnerability : CVE-2019-19918	Nessus	Misc.	high
142205	Fedora 33 : lout (2020-81c80ff1ed)	Nessus	Fedora Local Security Checks	high
142193	Fedora 31 : lout (2020-88fb82d1cd)	Nessus	Fedora Local Security Checks	high
142171	Fedora 32 : lout (2020-869cd99560)	Nessus	Fedora Local Security Checks	high
142115	openSUSE Security Update : lout (openSUSE-2020-1771)	Nessus	SuSE Local Security Checks	high
142097	openSUSE Security Update : lout (openSUSE-2020-1772)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2019-19918

high

Tenable Plugins

high

high

high

high

high

high