CVE-2024-37676

An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function.

An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function.

An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function.

An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function.

An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function.

An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function.

An issue in htop-dev htop v.2.20 allows a local attacker to cause an out-of-bounds access in the Header_populateFromSettings function.

These are all security issues fixed in the htop-3.5.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for htop fixes the following issues:

Changes in htop:

• Update to version 3.5.3:
  • Improve the htoprc settings parser to avoid segfaults on tampered configuration files (sanitised sort keys, validated configuration invariants, NULL safety for header columns and screens)
  • Add zswap pool usage meters
  • Fix out-of-bounds access when parsing the power supply type (Linux)
  • Mark a CPU offline when it is unplugged from the middle and release its data on hot-unplug (Linux)
  • Fix a Clang MemorySanitizer-reported issue
  • Exit follow mode when a search or filter is cancelled
  • Fix blank STARTTIME and wrong ELAPSED for threads (Darwin)
  • Use strchr instead of strstr in XUtils
  • Document the CPU meter segments in the man page and add an External Libraries section covering libnl-3/libnl-genl-3
• CVE-2024-37676: out-of-bounds access in Header_populateFromSettings reachable from a tampered htoprc; the settings parser hardening above is what upstream lists as covering it. openSUSE is assessed not affected (boo#1226729)