CVE-2019-20433

Name of the Vulnerable Software and Affected Versions GNU Aspell versions prior to 0.60.8

Description The issue is caused by a buffer over-read in the libaspell.a component of GNU Aspell. This occurs when a string ends with a single '0' byte and the encoding is set to ucs-2 or ucs-4 outside of the application, such as through the ASPELL CONF environment variable. This could allow a remote attacker to disclose protected information or cause a denial of service.

Recommendations For versions prior to 0.60.8, update to version 0.60.8 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ucs-2 and ucs-4 encodings outside of the application to minimize the risk of exploitation. Avoid using the ASPELL CONF environment variable to set these encodings until the issue is resolved.