PT-2019-18052 · Agg+2 · Anti-Grain Geometry+2

Ghost · Publicado 2019-01-13 · Atualizado 2023-04-01 · CVE-2019-6247

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Anti-Grain Geometry (AGG) version 2.4 svgpp (aka svgpp) version 1.2.3

Description A heap-based buffer overflow bug in svgpp agg render may lead to code execution. The issue arises in the render scanlines aa solid function, where the blend hline function is called repeatedly, overwriting heap data. This is equivalent to a loop containing write operations, with each call writing a piece of heap data.

Recommendations For Anti-Grain Geometry (AGG) version 2.4, consider disabling the blend hline function as a temporary workaround until a patch is available. For svgpp (aka svgpp) version 1.2.3, restrict access to the svgpp agg render function to minimize the risk of exploitation.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2019-6247

DLA-3376-1

Produtos afetados

Anti-Grain Geometry

Debian

Svgpp

Referências · 11

• 🔥 https://github.com/svgpp/svgpp/issues/70 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-6247 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-6247 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-6247 · Nota de Segurança
• https://ubuntu.com/security/CVE-2019-6247 · Aviso do Fabricante
• https://t.me/cvenotify/47337 · Publicação no Telegram
• https://cve.org/CVERecord?id=CVE-2019-6247 · Nota de Segurança
• https://osv.dev/vulnerability/DLA-3376-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-6247 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-6247 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2023/04/msg00001.html · Nota