Headline
Ubuntu Security Notice USN-6858-1
Ubuntu Security Notice 6858-1 - It was discovered that eSpeak NG did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code.
==========================================================================Ubuntu Security Notice USN-6858-1July 01, 2024espeak-ng vulnerabilities==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 23.10- Ubuntu 22.04 LTS- Ubuntu 20.04 LTS- Ubuntu 18.04 LTSSummary:Several security issues were fixed in eSpeak NG.Software Description:- espeak-ng: Multi-lingual software speech synthesizerDetails:It was discovered that eSpeak NG did not properly manage memory under certaincircumstances. An attacker could possibly use this issue to cause a denialof service, or execute arbitrary code. (CVE-2023-49990, CVE-2023-49991,CVE-2023-49992, CVE-2023-49993, CVE-2023-49994)Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 23.10 espeak-ng 1.51+dfsg-11ubuntu0.1 espeak-ng-espeak 1.51+dfsg-11ubuntu0.1Ubuntu 22.04 LTS espeak-ng 1.50+dfsg-10ubuntu0.1 espeak-ng-espeak 1.50+dfsg-10ubuntu0.1Ubuntu 20.04 LTS espeak-ng 1.50+dfsg-6ubuntu0.1 espeak-ng-espeak 1.50+dfsg-6ubuntu0.1Ubuntu 18.04 LTS espeak-ng 1.49.2+dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro espeak-ng-espeak 1.49.2+dfsg-1ubuntu0.1~esm1 Available with Ubuntu ProIn general, a standard system update will make all the necessary changes.References: https://ubuntu.com/security/notices/USN-6858-1 CVE-2023-49990, CVE-2023-49991, CVE-2023-49992, CVE-2023-49993, CVE-2023-49994Package Information: https://launchpad.net/ubuntu/+source/espeak-ng/1.51+dfsg-11ubuntu0.1 https://launchpad.net/ubuntu/+source/espeak-ng/1.50+dfsg-10ubuntu0.1 https://launchpad.net/ubuntu/+source/espeak-ng/1.50+dfsg-6ubuntu0.1Related news
Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.
Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c.
Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Overflow via the function RemoveEnding at dictionary.c.
Espeak-ng 1.52-dev was discovered to contain a Buffer Overflow via the function ReadClause at readclause.c.
Espeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c.