CVE-2019-19451

 

Published at: - 30-11-2019 12:15

Last modified: - 07-10-2022 07:52

Total changes: - 4

Description

When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

 

Verification logic

 

Reference

• https://gitlab.gnome.org/GNOME/dia/issues/428
• openSUSE-SU-2020:0021-Broken Link, Mailing List, Third Party Advisory
• FEDORA-2020-cbc0754798-Mailing List, Third Party Advisory
• FEDORA-2020-1fe0e08c8d-Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2019-19451

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures