CVE-2019-12594

DOSBox 0.74-2 has Incorrect Access Control.

Dosbox 0.74-3 is a security release:

• Fixed that a very long line inside a bat file would overflow the parsing buffer. (CVE-2019-7165 by Alexandre Bartel)
• Added a basic permission system so that a program running inside DOSBox can't access the contents of /proc (e.g. /proc/self/mem) when / or /proc were (to be) mounted. (CVE-2019-12594 by Alexandre Bartel)

It also brings several other fixes for out of bounds access and buffer overflows, and some fixes to the OpenGL rendering.

The game compatibility should be identical to 0.74 and 0.74-2. It is recommended to use config -securemode when dealing with untrusted files.

This update for dosbox fixes the following issues:

Security issues fixed:

• CVE-2019-7165: Fixed that a very long line inside a bat file would overflow the parsing buffer (bnc#1140254).
• CVE-2019-12594: Added a basic permission system so that a program running inside DOSBox can't access the contents of /proc (e.g. /proc/self/mem) when / or /proc were (to be) mounted (bnc#1140254).
• Several other fixes for out of bounds access and buffer overflows.

This update for dosbox fixes the following issues:

Security issues fixed:

• CVE-2019-7165: Fixed that a very long line inside a bat file would overflow the parsing buffer (bnc#1140254).
• CVE-2019-12594: Added a basic permission system so that a program running inside DOSBox can't access the contents of /proc (e.g. /proc/self/mem) when / or /proc were (to be) mounted (bnc#1140254).
• Several other fixes for out of bounds access and buffer overflows.

This update was imported from the openSUSE:Leap:15.0:Update update project.

These are all security issues fixed in the dosbox-0.74.3-5.2 package on the GA media of openSUSE Tumbleweed.

Alexandre Bartel discovered that DOSBox incorrectly handled long lines in certain files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2019-7165)

Alexandre Bartel discovered that DOSBox incorrectly performed access control over certain directories. An attacker could possibly use this issue to execute arbitrary code. (CVE-2019-12594)