CVE-2019-5087

 

Published at: - 21-11-2019 05:15

Last modified: - 21-06-2022 09:21

Total changes: - 10

Description

An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools 1.0.7. An integer overflow can occur while calculating the row's allocation size, that could be exploited to corrupt memory and eventually execute arbitrary code. In order to trigger this vulnerability, a victim would need to open a specially crafted XCF file.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0879
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0879
• [debian-lts-announce] 20210210 [SECURITY] [DLA 2553-1] xcftools security update-Mailing List, Third Party Advisory
• [debian-lts-announce] 20210308 [SECURITY] [DLA 2553-2] xcftools regression update-Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2019-5087

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures