PT-2019-6094 · Djvulibre+4 · Djvulibre+4
Hongxu Chen
·
Publicado
2019-08-18
·
Atualizado
2024-06-15
·
CVE-2019-15142
CVSS v3.1
5.5
Média
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
DjVuLibre versions 3.5.27 and earlier
Description
The issue is related to a buffer over-read in the DJVU reader component of DjVuLibre, which can cause a denial-of-service (application crash) when a crafted DJVU file is processed. This occurs due to a heap-based buffer over-read in the
GStringRep::strdup function in libdjvu/GString.cpp.Recommendations
For DjVuLibre version 3.5.27 and earlier, consider updating to a newer version to mitigate the risk of exploitation.
As a temporary workaround, consider restricting the use of the DJVU reader component until a patch is available.
Avoid using the
DjVmDir.cpp component in the DJVU reader to minimize the risk of exploitation.Exploit
Correção
DoS
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Djvulibre
Suse
Ubuntu