Summary
It was discovered that eSpeak NG did not properly manage memory under certain
circumstances. An attacker could possibly use this issue to cause a denial
of service, or execute arbitrary code. (CVE-2023-49990, CVE-2023-49991,
CVE-2023-49992, CVE-2023-49993, CVE-2023-49994)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | espeak-ng | 1.50+dfsg-6ubuntu0.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | espeak-ng | 1.50+dfsg-10ubuntu0.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | espeak-ng | 1.49.2+dfsg-1ubuntu0.1~esm1 |
Vulnerabilities 5
-
Medium 5.3
Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.
-
Unscored —
Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.…
-
Unscored —
Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Overflow via the function RemoveEnding at dictionary.c.
-
Unscored —
Espeak-ng 1.52-dev was discovered to contain a Buffer Overflow via the function ReadClause at readclause.c.
-
Unscored —
Espeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c.