CVE-2021-32434

abcm2ps v8.14.11 was discovered to contain an out-of-bounds read in the function calculate_beam at draw.c.

abcm2ps v8.14.11 was discovered to contain an out-of-bounds read in the function calculate_beam at draw.c. (CVE-2021-32434) Stack-based buffer overflow in the function get_key in parse.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via unspecified vectors. (CVE-2021-32435) An out-of-bounds read in the function write_title() in subs.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via unspecified vectors. (CVE-2021-32436)

This update for abcm2ps fixes the following issues:

Update to 8.14.13:

• fix: don't start/stop slurs above/below decorations
• fix: crash when too many notes in a grace note sequence (#102)
• fix: crash when too big value in M: (#103)
• fix: loop or crash when too big width of y (space) (#104)
• fix: bad font definition with SVG output when spaces in font name
• fix: bad check of note length again (#106)
• fix: handle %%staffscale at the global level (#108)
• fix: bad vertical offset of lyrics when mysic line starts with empty staves

Update to 8.14.12:

Fixes:

• crash when '%%break 1' and no measure bar in the tune
• crash when duplicated voice ending on %%staves with repeat variant
• crash when voice duplication with symbols without width
• crash or bad output when null value in %%scale
• problem when only bars in 2 voices followed %%staves of the second voice only
• crash when tuplet error in grace note sequence
• crash when grace note with empty tuplet
• crash when many broken rhythms after a single grace note
• access outside the deco array when error in U:
• crash when !xstem! with no note in the previous voice
• crash on tuplet without any note/rest
• crash when grace notes at end of line and voice overlay
• crash when !trem2! at start of a grace note sequence
• crash when wrong duration in 2 voice overlays and bad ties
• crash when accidental without a note at start of line after K: (CVE-2021-32435)
• array overflow when wrong duration in voice overlay (CVE-2021-32434, CVE-2021-32436)
• loss of left margin after first page since previous commit
• no respect of %%leftmargin with -E or -g
• bad placement of chord symbols when in a music line with only invisible rests

Syntax:

• Accept and remove one or two '%'s at start of all %%beginxxx lines

Generation:

• Move the CSS from XHTML to SVG

Update to 8.14.11:

• fix: error ''staffwidth' too small' when generating sample3.abc

Update to 8.14.10:

• fix: bad glyph when defined by SVG containing 'v' in
• fix: bad check of note length since commit 191fa55
• fix: memory corruption when error in %%staves/%%score
• fix: crash when too big note duration
• fix: crash when staff width too small

Update to 8.14.9:

• fix: bad natural accidental when %%MIDI temperamentequal

Update to 8.14.8:

• fix: no respect the width in %%staffbreak
• fix: don't draw a staff when only %%staffbreak inside
• fix: bad repeat bracket when continued on next line, line starting by a bar
• fix: bad tuplet bracket again when at end of a voice overlay sequence
• fix: bad tuplet bracket when at end of a voice overlay sequence
• handle '%%MIDI temperamentequal '
• accept '^1' and '_1' as microtone accidentals

These are all security issues fixed in the abcm2ps-8.14.13-2.1 package on the GA media of openSUSE Tumbleweed.

It was discovered that abcm2ps incorrectly handled memory when parsing specially crafted ABC files. An attacker could use this issue to cause abcm2ps to crash, leading to a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2018-10753, CVE-2018-10771, CVE-2019-1010069)

Chiba of Topsec Alpha Lab discovered that abcm2ps incorrectly handled memory when parsing specially crafted ABC files. An attacker could use this issue to cause abcm2ps to crash, leading to a denial of service. (CVE-2021-32434, CVE-2021-32435, CVE-2021-32436)