CyberRota Analysis
AI-GeneratedThe vulnerability affects F5 products utilizing GNU Aspell, specifically in the ReadOnlyDict::load() function, which improperly handles offset fields from binary .rws dictionary files, leading to potential heap memory disclosure or application crashes. Although classified as low severity, organizations using affected versions should prioritize patching to mitigate risks associated with potential exploitation through crafted dictionary files. Users should upgrade to version 0.60.8.3 or later to ensure protection against this issue.
Original NVD Description
GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via application crash. This issue was fixed in commit 941953b25031bc9104e83f58e138a664b8dedc3f which will be released in version 0.60.8.3.