Security update for espeak-ng

2024-07-3007:13:18

Google

osv.dev

espeak-ng

security update

cve-2023-49990

buffer overflow

synthdata.c

cve-2023-49991

stack buffer underflow

synthdata.c

cve-2023-49992

stack buffer overflow

dictionary.c

cve-2023-49993

buffer overflow

readclause.c

cve-2023-49994

floating point exception

wavegen.c

software

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

7.7

Confidence

High

This update for espeak-ng fixes the following issues:

CVE-2023-49990: Fixed buffer overflow in SetUpPhonemeTable function at synthdata.c (bsc#1218010)
CVE-2023-49991: Fixed stack-buffer-underflow exists in the function CountVowelPosition in synthdata.c (bsc#1218006)
CVE-2023-49992: Fixed stack-buffer-overflow exists in the function RemoveEnding in dictionary.c (bsc#1218007)
CVE-2023-49993: Fixed buffer overflow in ReadClause function at readclause.c (bsc#1218008)
CVE-2023-49994: Fixed floating point exception in PeaksToHarmspect at wavegen.c (bsc#1218009)