{"schemaVersion":3,"id":"OPENSUSE-SU-2022:0100-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for abcm2ps\n\nThis update for abcm2ps fixes the following issues:\n\nUpdate to 8.14.13:\n\n* fix: don't start/stop slurs above/below decorations\n* fix: crash when too many notes in a grace note sequence (#102)\n* fix: crash when too big value in M: (#103)\n* fix: loop or crash when too big width of y (space) (#104)\n* fix: bad font definition with SVG output when spaces in font name\n* fix: bad check of note length again (#106)\n* fix: handle %%staffscale at the global level (#108)\n* fix: bad vertical offset of lyrics when mysic line starts with empty staves\n\nUpdate to 8.14.12:\n\nFixes:\n\n* crash when '%%break 1' and no measure bar in the tune\n* crash when duplicated voice ending on %%staves with repeat variant\n* crash when voice duplication with symbols without width\n* crash or bad output when null value in %%scale\n* problem when only bars in 2 voices followed %%staves of the second voice only\n* crash when tuplet error in grace note sequence\n* crash when grace note with empty tuplet\n* crash when many broken rhythms after a single grace note\n* access outside the deco array when error in U:\n* crash when !xstem! with no note in the previous voice\n* crash on tuplet without any note/rest\n* crash when grace notes at end of line and voice overlay\n* crash when !trem2! at start of a grace note sequence\n* crash when wrong duration in 2 voice overlays and bad ties\n* crash when accidental without a note at start of line after K: (CVE-2021-32435)\n* array overflow when wrong duration in voice overlay (CVE-2021-32434, CVE-2021-32436)\n* loss of left margin after first page since previous commit\n* no respect of %%leftmargin with -E or -g\n* bad placement of chord symbols when in a music line with only invisible rests\n\nSyntax:\n\n* Accept and remove one or two '%'s at start of all %%beginxxx lines\n\nGeneration:\n\n* Move the CSS from XHTML to SVG\n\nUpdate to 8.14.11:\n\n* fix: error ''staffwidth' too small' when generating sample3.abc\n\nUpdate to 8.14.10:\n\n* fix: bad glyph when defined by SVG containing 'v' in\n* fix: bad check of note length since commit 191fa55\n* fix: memory corruption when error in %%staves/%%score\n* fix: crash when too big note duration\n* fix: crash when staff width too small\n\nUpdate to 8.14.9:\n\n* fix: bad natural accidental when %%MIDI temperamentequal\n\nUpdate to 8.14.8:\n\n* fix: no respect the width in %%staffbreak\n* fix: don't draw a staff when only %%staffbreak inside\n* fix: bad repeat bracket when continued on next line, line starting by a bar\n* fix: bad tuplet bracket again when at end of a voice overlay sequence\n* fix: bad tuplet bracket when at end of a voice overlay sequence\n* handle '%%MIDI temperamentequal '\n* accept '^1' and '_1' as microtone accidentals","dates":{"published":"2022-03-31T10:01:29.000Z","modified":"2026-02-04T04:02:37.291Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"opensuse","product":"abcm2ps&distro=openSUSE Leap 15.3","name":"abcm2ps","label":"abcm2ps&distro=openSUSE Leap 15.3","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/abcm2ps&distro=openSUSE Leap 15.3","purlType":"rpm","versions":[{"text":"< 8.14.13-bp153.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.14.13-bp153.2.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"abcm2ps&distro=SUSE Package Hub 15 SP3","name":"abcm2ps","label":"abcm2ps&distro=SUSE Package Hub 15 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/abcm2ps&distro=SUSE Package Hub 15 SP3","purlType":"rpm","versions":[{"text":"< 8.14.13-bp153.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.14.13-bp153.2.3.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ECLDK4M5WWVFFEXTUWXNEHKC3U2NNPCQ/","label":"lists.opensuse.org/archives/…","hostname":"lists.opensuse.org","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1197355","label":"bugzilla.suse.com/1197355","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32434","label":"www.suse.com/security/cve/CVE-2021-32434","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32435","label":"www.suse.com/security/cve/CVE-2021-32435","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32436","label":"www.suse.com/security/cve/CVE-2021-32436","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2021-32434","CVE-2021-32435","CVE-2021-32436"],"downstream":[],"duplicates":[],"related":["CVE-2021-32434","CVE-2021-32435","CVE-2021-32436"]},"timeline":[{"kind":"published","date":"2022-03-31T10:01:29.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T04:02:37.291Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T09:44:19.081Z","stale":false,"partial":false}}