CVE-2025-15536

A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.

A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.

Opencc is for between Traditional Chinese and Simplified Chinese characters and phrases conversion library.

Security Fix(es):

A vulnerability was found in BYVoid OpenCC up to 1.1.9 and classified as critical. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The exploit is available at github.com. It is declared as proof-of-concept. Applying the patch 345c9a50ab07018f1b4439776bad78a0d40778ec is able to eliminate this problem. The bugfix is ready for download at github.com.(CVE-2025-15536)

Opencc is for between Traditional Chinese and Simplified Chinese characters and phrases conversion library.

Security Fix(es):

A vulnerability was found in BYVoid OpenCC up to 1.1.9 and classified as critical. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The exploit is available at github.com. It is declared as proof-of-concept. Applying the patch 345c9a50ab07018f1b4439776bad78a0d40778ec is able to eliminate this problem. The bugfix is ready for download at github.com.(CVE-2025-15536)

Opencc is for between Traditional Chinese and Simplified Chinese characters and phrases conversion library.

Security Fix(es):

A vulnerability was found in BYVoid OpenCC up to 1.1.9 and classified as critical. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The exploit is available at github.com. It is declared as proof-of-concept. Applying the patch 345c9a50ab07018f1b4439776bad78a0d40778ec is able to eliminate this problem. The bugfix is ready for download at github.com.(CVE-2025-15536)

Opencc is for between Traditional Chinese and Simplified Chinese characters and phrases conversion library.

Security Fix(es):

A vulnerability was found in BYVoid OpenCC up to 1.1.9 and classified as critical. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The exploit is available at github.com. It is declared as proof-of-concept. Applying the patch 345c9a50ab07018f1b4439776bad78a0d40778ec is able to eliminate this problem. The bugfix is ready for download at github.com.(CVE-2025-15536)

Opencc is for between Traditional Chinese and Simplified Chinese characters and phrases conversion library.

Security Fix(es):

A vulnerability was found in BYVoid OpenCC up to 1.1.9 and classified as critical. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. The exploit is available at github.com. It is declared as proof-of-concept. Applying the patch 345c9a50ab07018f1b4439776bad78a0d40778ec is able to eliminate this problem. The bugfix is ready for download at github.com.(CVE-2025-15536)

A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.

A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.

A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. Patch name: 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is recommended to deploy a patch.

These are all security issues fixed in the libopencc1_2-1.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for opencc fixes the following issues:

Update to version 1.2.0.

Security issues fixed:

• CVE-2025-15536: specifically crafted string can lead to out-of-bounds read (bsc#1256930).

Other updates and bugfixes:

• Version 1.2.0:
  • Fix the crash issue when reading configuration files.
  • Add type definitions (Typing).
  • Fix two out-of-bounds reading issues when handling truncated UTF-8 input.

This update for opencc fixes the following issues:

Update to version 1.2.0.

Security issues fixed:

• CVE-2025-15536: specifically crafted string can lead to out-of-bounds read (bsc#1256930).

Other updates and bugfixes:

• Version 1.2.0:
  • Fix the crash issue when reading configuration files.
  • Add type definitions (Typing).
  • Fix two out-of-bounds reading issues when handling truncated UTF-8 input.

It was discovered that OpenCC incorrectly handled truncated UTF-8 input. An attacker could possibly use this issue to cause OpenCC to crash, resulting in a denial of service.

USN-7972-1 fixed a vulnerability in OpenCC. This update provides the corresponding update for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.

Original advisory details:

It was discovered that OpenCC incorrectly handled truncated UTF-8 input. An attacker could possibly use this issue to cause OpenCC to crash, resulting in a denial of service.