Submitted by: Joe Locash Date: 2026-10-10 Initial Package Version: 0.60.8.2 Upstream Status: Applied Origin: Commits: https://github.com/GNUAspell/aspell/commit/15b188437f9e0192d4ac4472ad66a4e2f62a782f https://github.com/GNUAspell/aspell/commit/941953b25031bc9104e83f58e138a664b8dedc3f https://github.com/GNUAspell/aspell/commit/782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d Description: Fixes CVE-2026-75818, 75819, 75820 From 15b188437f9e0192d4ac4472ad66a4e2f62a782f Mon Sep 17 00:00:00 2001 From: Kevin Atkinson Date: Sun, 20 Sep 2026 23:09:03 -0400 Subject: [PATCH] prezip: correctly detect bad input MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes CVE-2026-75818 identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team. --- prog/prezip.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/prog/prezip.c b/prog/prezip.c index 3835114a..bbd0772f 100644 --- a/prog/prezip.c +++ b/prog/prezip.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2004 + * Copyright (c) 2004,2026 * Kevin Atkinson * * Permission to use, copy, modify, distribute and sell this software @@ -47,7 +47,7 @@ #endif -#define HEAD "prezip, a prefix delta compressor. Version 0.1.1, 2004-11-06" +#define HEAD "prezip, a prefix delta compressor. Version 0.1.2, 2026-09-20" typedef struct Word { char * str; @@ -65,7 +65,7 @@ typedef struct Word { #define ADV(w, c) do {char * s = w + c;\ while(w != s) {\ - if (*w == 0) ret = 3;\ + if (*w == 0) {ret = 3; goto error;}\ ++w;}} while (0) int main (int argc, const char *argv[]) { @@ -227,6 +227,7 @@ int main (int argc, const char *argv[]) { assert(ret >= 0); if (ret > 0 && argc > 2) fputs(argv[2], stderr); + error: if (ret == 2) fputs("unknown format\n", stderr); else if (ret == 3) From 941953b25031bc9104e83f58e138a664b8dedc3f Mon Sep 17 00:00:00 2001 From: Kevin Atkinson Date: Mon, 21 Sep 2026 22:53:56 -0400 Subject: [PATCH] speller/readonly_ws.cpp: check that offsets are valid in dictionary header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes CVE-2026-75819 identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team. --- modules/speller/default/readonly_ws.cpp | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/modules/speller/default/readonly_ws.cpp b/modules/speller/default/readonly_ws.cpp index d30ed30..0b99bd0 100644 --- a/modules/speller/default/readonly_ws.cpp +++ b/modules/speller/default/readonly_ws.cpp @@ -487,6 +487,15 @@ namespace { block_size = data_head.block_size; int offset = data_head.head_size; + + if (data_head.word_offset > block_size + || data_head.hash_offset > block_size + || data_head.jump1_offset > block_size + || data_head.jump2_offset > block_size + || data_head.word_offset + data_head.first_word_offset > block_size) + return make_err(bad_file_format, fn, + _("Invalid offset in dictionary header.")); + mmaped_block = mmap_open(block_size + offset, f, 0); if( mmaped_block != (char *)MAP_FAILED) { block = mmaped_block + offset; From 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d Mon Sep 17 00:00:00 2001 From: Kevin Atkinson Date: Mon, 21 Sep 2026 01:05:16 -0400 Subject: [PATCH] Limit length of words added to the personal dictionary to 250 characters. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes CVE-2026-75820 identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team. --- modules/speller/default/writable.cpp | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/modules/speller/default/writable.cpp b/modules/speller/default/writable.cpp index 63172a48..b3b2990e 100644 --- a/modules/speller/default/writable.cpp +++ b/modules/speller/default/writable.cpp @@ -16,6 +16,8 @@ #include "language.hpp" #include "getdata.hpp" +#include "gettext.h" + namespace { ////////////////////////////////////////////////////////////////////// @@ -511,10 +513,14 @@ PosibErr WritableDict::add(ParmString w, ParmString s) { SensitiveCompare c(lang()); WordEntry we; if (WritableDict::lookup(w,&c,we)) return no_err; + if (w.size() > 250) + return make_err(invalid_word, + MsgConv(*lang())(w), + _("Word larger than 250 characters.")); byte * w2; w2 = (byte *)buffer.alloc(w.size() + 3); *w2++ = lang()->get_word_info(w); - *w2++ = w.size(); + *w2++ = (byte)w.size(); memcpy(w2, w.str(), w.size() + 1); word_lookup->insert((char *)w2); if (use_soundslike) {