Description
Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | lout | No fix yet | — |
| Ubuntu 18.04 LTS | lout | No fix yet | — |
| Ubuntu 16.04 LTS | lout | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP2 | lout | 3.40-bp152.4.3.1 | openSUSE-SU-2020:1813-1 |
| SUSE Package Hub 15 SP1 | lout | 3.40-bp151.2.3.1 | openSUSE-SU-2020:1812-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | lout | 3.42-1.3 | openSUSE-SU-2024:11027-1 |
| openSUSE Leap 15.2 | lout | 3.40-lp152.3.3.1 | openSUSE-SU-2020:1771-1 |
| openSUSE Leap 15.1 | lout | 3.40-lp151.2.3.1 | openSUSE-SU-2020:1772-1 |
Advisories 5
- openSUSE-SU-2024:11027-1 lout-3.42-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1813-1 Security update for lout SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1771-1 Security update for lout SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1812-1 Security update for lout SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1772-1 Security update for lout SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://lists.gnu.org/archive/html/lout-users/2019-12/msg00002.html
- openSUSE-SU-2020:1772 vendor-advisory
- openSUSE-SU-2020:1771 vendor-advisory
- FEDORA-2020-88fb82d1cd vendor-advisory
- FEDORA-2020-869cd99560 vendor-advisory
- FEDORA-2020-81c80ff1ed vendor-advisory
- openSUSE-SU-2020:1813 vendor-advisory
- openSUSE-SU-2020:1812 vendor-advisory