openSUSE Security Update: Security update for libredwg
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2020:0096-1
Rating:             moderate
References:         #1160520 #1160522 #1160523 #1160524 #1160525 
                    #1160526 #1160527 
Cross-References:   CVE-2020-6609 CVE-2020-6610 CVE-2020-6611
                    CVE-2020-6612 CVE-2020-6613 CVE-2020-6614
                    CVE-2020-6615
Affected Products:
                    openSUSE Leap 15.1
______________________________________________________________________________

   An update that fixes 7 vulnerabilities is now available.

Description:

   This update for libredwg fixes the following issues:

   libredwg was updated to release 0.10:

   API breaking changes:

   * Added a new int *isnewp argument to all dynapi utf8text getters, if the
     returned string is freshly malloced or not.
   * removed the UNKNOWN supertype, there are only UNKNOWN_OBJ and
     UNKNOWN_ENT left, with common_entity_data.
   * renamed BLOCK_HEADER.preview_data to preview, preview_data_size to
     preview_size.
   * renamed SHAPE.shape_no to style_id.
   * renamed CLASS.wasazombie to is_zombie.

   Bugfixes:

   * Harmonized INDXFB with INDXF, removed extra src/in_dxfb.c.
   * Fixed encoding of added r2000 AUXHEADER address.
   * Fixed EED encoding from dwgrewrite.
   * Add several checks against [CVE-2020-6609, boo#1160520], [CVE-2020-6610,
     boo#1160522], [CVE-2020-6611, boo#1160523], [CVE-2020-6612,
     boo#1160524], [CVE-2020-6613, boo#1160525], [CVE-2020-6614,
     boo#1160526], [CVE-2020-6615, boo#1160527]


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.1:

      zypper in -t patch openSUSE-2020-96=1



Package List:

   - openSUSE Leap 15.1 (x86_64):

      libredwg-debuginfo-0.10-lp151.2.6.1
      libredwg-debugsource-0.10-lp151.2.6.1
      libredwg-devel-0.10-lp151.2.6.1
      libredwg-tools-0.10-lp151.2.6.1
      libredwg-tools-debuginfo-0.10-lp151.2.6.1
      libredwg0-0.10-lp151.2.6.1
      libredwg0-debuginfo-0.10-lp151.2.6.1


References:

   https://www.suse.com/security/cve/CVE-2020-6609.html
   https://www.suse.com/security/cve/CVE-2020-6610.html
   https://www.suse.com/security/cve/CVE-2020-6611.html
   https://www.suse.com/security/cve/CVE-2020-6612.html
   https://www.suse.com/security/cve/CVE-2020-6613.html
   https://www.suse.com/security/cve/CVE-2020-6614.html
   https://www.suse.com/security/cve/CVE-2020-6615.html
   https://bugzilla.suse.com/1160520
   https://bugzilla.suse.com/1160522
   https://bugzilla.suse.com/1160523
   https://bugzilla.suse.com/1160524
   https://bugzilla.suse.com/1160525
   https://bugzilla.suse.com/1160526
   https://bugzilla.suse.com/1160527

--