{"action":"Upgrade aspell to 0.60.7-3 or later.","affected":[{"fixed":"0.60.7-3","introduced":"0"}],"component":"aspell","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["0.60.7-3"],"id":"tcs_01M5NE4TYT1JYXZVEP5ERAN2MY","modified_at":"2026-09-21T07:03:17.587671771Z","published_at":"2020-01-27T15:15:12.150Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2019-20433","https://security-tracker.debian.org/tracker/CVE-2019-20433"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2019-20433#Debian:14/aspell","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2019-20433"}],"summary":"libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the"}