{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "gnu aspell: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/gnu--aspell/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/gnu--aspell/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103658/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103658/",
   "title": "CVE-2026-103658 · gnu aspell · disclosed",
   "content_text": "GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader. String::reserve() in common/string.hpp computes its capacity check with a signed int ((int)s + 1), so a requested size of 0x7FFFFFFF wraps negative and the backing buffer is never grown. ReadOnlyDict::load() in modules/speller/default/readonly_ws.cpp passes the unvalidated 32-bit size fields from a .rws dictionary header into this path, so a crafted .rws file with a valid endian marker (12345678) and an oversized length field (e.g. lang_name_size = 0x7FFFFFFF) causes attacker-controlled data to be written out of bounds past an undersized heap allocation. An attacker who induces a victim to load a malicious dictionary — for example via aspell dump master \u003cfile\u003e — can corrupt heap memory, resulting in denial of service and potentially code execution. Fixed in b830b6e and will be fixed in release 0.60.8.3.",
   "date_published": "2026-10-12T21:24:48Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103658/fixed/amazon-linux-2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103658/",
   "title": "CVE-2026-103658 · gnu aspell · fixed in Amazon Linux 2 (aspell 12:0.60.6.1-22.amzn2.0.1 and 1 more)",
   "content_text": "Fixed versions: aspell 12:0.60.6.1-22.amzn2.0.1, aspell-devel 12:0.60.6.1-22.amzn2.0.1.",
   "date_published": "2026-10-12T21:24:48Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103658/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103658/",
   "title": "CVE-2026-103658 · gnu aspell · fixed in Amazon Linux 2023 (aspell 12:0.60.8-7.amzn2023.0.3 and 1 more)",
   "content_text": "Fixed versions: aspell 12:0.60.8-7.amzn2023.0.3, aspell-devel 12:0.60.8-7.amzn2023.0.3.",
   "date_published": "2026-10-12T21:24:48Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103658/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103658/",
   "title": "CVE-2026-103658 · gnu aspell · fixed in openSUSE Tumbleweed (aspell 0.60.8.2-3.1)",
   "content_text": "Fixed versions: aspell 0.60.8.2-3.1.",
   "date_published": "2026-10-12T21:24:48Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75820/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75820/",
   "title": "CVE-2026-75820 · gnu aspell · disclosed",
   "content_text": "GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256. This leads to heap corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal wordlist containing such a word, resulting in denial of service.\n\n\n\nThis issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d which will be released in version 0.60.8.3.",
   "date_published": "2026-10-06T10:57:59Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75820/fixed/amazon-linux-2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75820/",
   "title": "CVE-2026-75820 · gnu aspell · fixed in Amazon Linux 2 (aspell 12:0.60.6.1-22.amzn2.0.1 and 1 more)",
   "content_text": "Fixed versions: aspell 12:0.60.6.1-22.amzn2.0.1, aspell-devel 12:0.60.6.1-22.amzn2.0.1.",
   "date_published": "2026-10-06T10:57:59Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75820/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75820/",
   "title": "CVE-2026-75820 · gnu aspell · fixed in Amazon Linux 2023 (aspell 12:0.60.8-7.amzn2023.0.3 and 1 more)",
   "content_text": "Fixed versions: aspell 12:0.60.8-7.amzn2023.0.3, aspell-devel 12:0.60.8-7.amzn2023.0.3.",
   "date_published": "2026-10-06T10:57:59Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75820/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75820/",
   "title": "CVE-2026-75820 · gnu aspell · fixed in openSUSE Tumbleweed (aspell 0.60.8.2-2.1)",
   "content_text": "Fixed versions: aspell 0.60.8.2-2.1.",
   "date_published": "2026-10-06T10:57:59Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75819/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75819/",
   "title": "CVE-2026-75819 · gnu aspell · disclosed",
   "content_text": "GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via application crash.\n\n\n\nThis issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version 0.60.8.3.",
   "date_published": "2026-10-06T10:57:56Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75819/fixed/amazon-linux-2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75819/",
   "title": "CVE-2026-75819 · gnu aspell · fixed in Amazon Linux 2 (aspell 12:0.60.6.1-22.amzn2.0.1 and 1 more)",
   "content_text": "Fixed versions: aspell 12:0.60.6.1-22.amzn2.0.1, aspell-devel 12:0.60.6.1-22.amzn2.0.1.",
   "date_published": "2026-10-06T10:57:56Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75819/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75819/",
   "title": "CVE-2026-75819 · gnu aspell · fixed in Amazon Linux 2023 (aspell 12:0.60.8-7.amzn2023.0.3 and 1 more)",
   "content_text": "Fixed versions: aspell 12:0.60.8-7.amzn2023.0.3, aspell-devel 12:0.60.8-7.amzn2023.0.3.",
   "date_published": "2026-10-06T10:57:56Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75819/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75819/",
   "title": "CVE-2026-75819 · gnu aspell · fixed in openSUSE Tumbleweed (aspell 0.60.8.2-2.1)",
   "content_text": "Fixed versions: aspell 0.60.8.2-2.1.",
   "date_published": "2026-10-06T10:57:56Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75818/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75818/",
   "title": "CVE-2026-75818 · gnu aspell · disclosed",
   "content_text": "GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a malicious compressed file with prezip-bin can trigger memory corruption, leading to a processs crash.\n\n\n\nThis issue was fixed in commit 15b188437f9e0192d4ac4472ad66a4e2f62a782f which will be released in version 0.60.8.3.",
   "date_published": "2026-10-06T10:57:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75818/fixed/amazon-linux-2",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75818/",
   "title": "CVE-2026-75818 · gnu aspell · fixed in Amazon Linux 2 (aspell 12:0.60.6.1-22.amzn2.0.1 and 1 more)",
   "content_text": "Fixed versions: aspell 12:0.60.6.1-22.amzn2.0.1, aspell-devel 12:0.60.6.1-22.amzn2.0.1.",
   "date_published": "2026-10-06T10:57:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75818/fixed/amazon-linux-2023",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75818/",
   "title": "CVE-2026-75818 · gnu aspell · fixed in Amazon Linux 2023 (aspell 12:0.60.8-7.amzn2023.0.3 and 1 more)",
   "content_text": "Fixed versions: aspell 12:0.60.8-7.amzn2023.0.3, aspell-devel 12:0.60.8-7.amzn2023.0.3.",
   "date_published": "2026-10-06T10:57:52Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-75818/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-75818/",
   "title": "CVE-2026-75818 · gnu aspell · fixed in openSUSE Tumbleweed (aspell 0.60.8.2-2.1)",
   "content_text": "Fixed versions: aspell 0.60.8.2-2.1.",
   "date_published": "2026-10-06T10:57:52Z"
  }
 ]
}