{ "document":{ "aggregate_severity":{ "namespace":"https://nvd.nist.gov/vuln-metrics/cvss", "text":"High" }, "category":"csaf_vex", "csaf_version":"2.0", "distribution":{ "tlp":{ "label":"WHITE", "url":"https:/www.first.org/tlp/" } }, "lang":"en", "notes":[ { "text":"aspell security update", "category":"general", "title":"Synopsis" }, { "text":"An update for aspell is now available for openEuler-24.03-LTS-SP1", "category":"general", "title":"Summary" }, { "text":"GNU Aspell is a spell checker intended to replace Ispell. It can be used as a library and spell checker. Its main feature is that it provides much better suggestions than other inspectors, including Ispell and Microsoft Word. It also has many other technical enhancements to Ispell, such as the use of shared memory to store dictionaries, and intelligent processing of personal dictionaries when multiple Aspell processes are opened at one time.\n\nSecurity Fix(es):\n\nGNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be fixed in release 0.60.8.3.(CVE-2026-103658)\n\nGNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash.\n\n\n\nThis issue was fixed in commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f which will be released in version 0.60.8.3.(CVE-2026-75818)\n\nGNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via application crash.\n\n\n\nThis issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version 0.60.8.3.(CVE-2026-75819)\n\nGNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal wordlist containing such a word, resulting in denial of service.\n\n\n\nThis issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version 0.60.8.3.(CVE-2026-75820)", "category":"general", "title":"Description" }, { "text":"An update for aspell is now available for openEuler-24.03-LTS-SP1.\n\nopenEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.", "category":"general", "title":"Topic" }, { "text":"High", "category":"general", "title":"Severity" }, { "text":"aspell", "category":"general", "title":"Affected Component" } ], "publisher":{ "issuing_authority":"openEuler security committee", "name":"openEuler", "namespace":"https://www.openeuler.org", "contact_details":"openeuler-security@openeuler.org", "category":"vendor" }, "references":[ { "summary":"openEuler-SA-2026-4629", "category":"self", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4629" }, { "summary":"CVE-2026-103658", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-103658&packageName=aspell" }, { "summary":"CVE-2026-75818", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-75818&packageName=aspell" }, { "summary":"CVE-2026-75819", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-75819&packageName=aspell" }, { "summary":"CVE-2026-75820", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-75820&packageName=aspell" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103658" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75818" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75819" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75820" }, { "summary":"openEuler-SA-2026-4629 vex file", "category":"self", "url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-4629.json" } ], "title":"An update for aspell is now available for openEuler-24.03-LTS-SP1", "tracking":{ "initial_release_date":"2026-10-30T11:13:45+08:00", "revision_history":[ { "date":"2026-10-30T11:13:45+08:00", "summary":"Initial", "number":"1.0.0" } ], "generator":{ "date":"2026-10-30T11:13:45+08:00", "engine":{ "name":"openEuler CSAF Tool V1.0" } }, "current_release_date":"2026-10-30T11:13:45+08:00", "id":"openEuler-SA-2026-4629", "version":"1.0.0", "status":"final" } }, "product_tree":{ "branches":[ { "name":"openEuler", "category":"vendor", "branches":[ { "name":"openEuler", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"openEuler-24.03-LTS-SP1", "name":"openEuler-24.03-LTS-SP1" }, "name":"openEuler-24.03-LTS-SP1", "category":"product_version" } ], "category":"product_name" }, { "name":"src", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"aspell-0.60.8.1-2.oe2403sp1.src.rpm", "name":"aspell-0.60.8.1-2.oe2403sp1.src.rpm" }, "name":"aspell-0.60.8.1-2.oe2403sp1.src.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"x86_64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"aspell-0.60.8.1-2.oe2403sp1.x86_64.rpm", "name":"aspell-0.60.8.1-2.oe2403sp1.x86_64.rpm" }, "name":"aspell-0.60.8.1-2.oe2403sp1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"aspell-debuginfo-0.60.8.1-2.oe2403sp1.x86_64.rpm", "name":"aspell-debuginfo-0.60.8.1-2.oe2403sp1.x86_64.rpm" }, "name":"aspell-debuginfo-0.60.8.1-2.oe2403sp1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"aspell-debugsource-0.60.8.1-2.oe2403sp1.x86_64.rpm", "name":"aspell-debugsource-0.60.8.1-2.oe2403sp1.x86_64.rpm" }, "name":"aspell-debugsource-0.60.8.1-2.oe2403sp1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"aspell-devel-0.60.8.1-2.oe2403sp1.x86_64.rpm", "name":"aspell-devel-0.60.8.1-2.oe2403sp1.x86_64.rpm" }, "name":"aspell-devel-0.60.8.1-2.oe2403sp1.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"aspell-help-0.60.8.1-2.oe2403sp1.x86_64.rpm", "name":"aspell-help-0.60.8.1-2.oe2403sp1.x86_64.rpm" }, "name":"aspell-help-0.60.8.1-2.oe2403sp1.x86_64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"aarch64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"aspell-0.60.8.1-2.oe2403sp1.aarch64.rpm", "name":"aspell-0.60.8.1-2.oe2403sp1.aarch64.rpm" }, "name":"aspell-0.60.8.1-2.oe2403sp1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"aspell-debuginfo-0.60.8.1-2.oe2403sp1.aarch64.rpm", "name":"aspell-debuginfo-0.60.8.1-2.oe2403sp1.aarch64.rpm" }, "name":"aspell-debuginfo-0.60.8.1-2.oe2403sp1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"aspell-debugsource-0.60.8.1-2.oe2403sp1.aarch64.rpm", "name":"aspell-debugsource-0.60.8.1-2.oe2403sp1.aarch64.rpm" }, "name":"aspell-debugsource-0.60.8.1-2.oe2403sp1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"aspell-devel-0.60.8.1-2.oe2403sp1.aarch64.rpm", "name":"aspell-devel-0.60.8.1-2.oe2403sp1.aarch64.rpm" }, "name":"aspell-devel-0.60.8.1-2.oe2403sp1.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1" }, "product_id":"aspell-help-0.60.8.1-2.oe2403sp1.aarch64.rpm", "name":"aspell-help-0.60.8.1-2.oe2403sp1.aarch64.rpm" }, "name":"aspell-help-0.60.8.1-2.oe2403sp1.aarch64.rpm", "category":"product_version" } ], "category":"architecture" } ] } ], "relationships":[ { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"aspell-0.60.8.1-2.oe2403sp1.src.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.src", "name":"aspell-0.60.8.1-2.oe2403sp1.src as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"aspell-0.60.8.1-2.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.x86_64", "name":"aspell-0.60.8.1-2.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"aspell-debuginfo-0.60.8.1-2.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.x86_64", "name":"aspell-debuginfo-0.60.8.1-2.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"aspell-debugsource-0.60.8.1-2.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.x86_64", "name":"aspell-debugsource-0.60.8.1-2.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"aspell-devel-0.60.8.1-2.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.x86_64", "name":"aspell-devel-0.60.8.1-2.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"aspell-help-0.60.8.1-2.oe2403sp1.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.x86_64", "name":"aspell-help-0.60.8.1-2.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"aspell-0.60.8.1-2.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.aarch64", "name":"aspell-0.60.8.1-2.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"aspell-debuginfo-0.60.8.1-2.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.aarch64", "name":"aspell-debuginfo-0.60.8.1-2.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"aspell-debugsource-0.60.8.1-2.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.aarch64", "name":"aspell-debugsource-0.60.8.1-2.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"aspell-devel-0.60.8.1-2.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.aarch64", "name":"aspell-devel-0.60.8.1-2.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP1", "product_reference":"aspell-help-0.60.8.1-2.oe2403sp1.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.aarch64", "name":"aspell-help-0.60.8.1-2.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1" }, "category":"default_component_of" } ] }, "vulnerabilities":[ { "cve":"CVE-2026-103658", "notes":[ { "text":"GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be fixed in release 0.60.8.3.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.src", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.aarch64" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.src", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.aarch64" ], "details":"aspell security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4629" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":5.9, "vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.src", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.aarch64" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-103658" }, { "cve":"CVE-2026-75818", "notes":[ { "text":"GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash.\n\n\n\nThis issue was fixed in commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f which will be released in version 0.60.8.3.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.src", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.aarch64" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.src", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.aarch64" ], "details":"aspell security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4629" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.8, "vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.src", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.aarch64" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-75818" }, { "cve":"CVE-2026-75819", "notes":[ { "text":"GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via application crash.\n\n\n\nThis issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version 0.60.8.3.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.src", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.aarch64" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.src", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.aarch64" ], "details":"aspell security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4629" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":5.5, "vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.src", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.aarch64" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-75819" }, { "cve":"CVE-2026-75820", "notes":[ { "text":"GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal wordlist containing such a word, resulting in denial of service.\n\n\n\nThis issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version 0.60.8.3.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.src", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.aarch64" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.src", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.aarch64" ], "details":"aspell security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4629" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":5.0, "vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.src", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.x86_64", "openEuler-24.03-LTS-SP1:aspell-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debuginfo-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-debugsource-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-devel-0.60.8.1-2.oe2403sp1.aarch64", "openEuler-24.03-LTS-SP1:aspell-help-0.60.8.1-2.oe2403sp1.aarch64" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-75820" } ] }