Lout 3.40 has a heap-based buffer overflow in the srcnext() function in z02.c.

Add lout-3.40-cve.patch from https://lists.nongnu.org/archive/html/lout-users/2020-10/msg00013.html fixing rhbz#1787383 and rhbz#1787386 (CVE-2019-19918 and CVE-2019-19917), two buffer overflows.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for lout fixes the following issues :

  - CVE-2019-19918: Fixed buffer overflow in srcnext()     (boo#1159713).

  - CVE-2019-19917: Fixed buffer overflow in     StringQuotedWord() (boo#1159714).

ID	Name	Product	Family	Severity
142205	Fedora 33 : lout (2020-81c80ff1ed)	Nessus	Fedora Local Security Checks	high
142193	Fedora 31 : lout (2020-88fb82d1cd)	Nessus	Fedora Local Security Checks	high
142171	Fedora 32 : lout (2020-869cd99560)	Nessus	Fedora Local Security Checks	high
142115	openSUSE Security Update : lout (openSUSE-2020-1771)	Nessus	SuSE Local Security Checks	high
142097	openSUSE Security Update : lout (openSUSE-2020-1772)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2019-19918

high

Tenable Plugins

high

high

high

high

high