PT-2019-6096 · Djvulibre+4 · Djvulibre+4

Hongxu Chen · Publicado 2019-08-18 · Atualizado 2024-06-15 · CVE-2019-15144

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions DjVuLibre version 3.5.27

Description The issue is related to the sorting functionality in DjVuLibre, which can be exploited by crafting a malicious PBM image file. This can cause an uncontrolled recursion, leading to a denial-of-service (application crash). The vulnerability can be exploited by a remote attacker to disrupt service.

Recommendations For DjVuLibre version 3.5.27, consider disabling the sorting functionality (GArrayTemplate::sort) as a temporary workaround until a patch is available. Restrict access to the libdjvu/GContainer.h module to minimize the risk of exploitation. Avoid using the sorting functionality with untrusted PBM image files until the issue is resolved.

Exploit

Correção

DoS

Uncontrolled Recursion

Enumeração de Fraquezas

CWE-674

Identificadores relacionados

ALT-PU-2022-1603

ALT-PU-2022-3240

BDU:2021-05254

CVE-2019-15144

DLA-1902-1

DLA-2667-1

DSA-5032-1

MGASA-2019-0346

OESA-2021-1034

OPENSUSE-SU-2019:2217-1

OPENSUSE-SU-2019:2219-1

OPENSUSE-SU-2019_2217-1

OPENSUSE-SU-2019_2219-1

OPENSUSE-SU-2024:10719-1

SUSE-SU-2019:2444-1

SUSE-SU-2019:2452-1

USN-4198-1

Produtos afetados

Alt Linux

Astra Linux

Djvulibre

Suse

Ubuntu

Referências · 67

• 🔥 https://sourceforge.net/p/djvu/bugs/299 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-15144 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RYZTGKWY3NAKMIMTFYGN4ZO5XEQWPYRL · Aviso do Fabricante
• https://usn.ubuntu.com/4198-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/OESA-2021-1034 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-15144 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-18804 · Nota de Segurança
• https://ubuntu.com/security/CVE-2019-18804 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-15145 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00086.html · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2021-05254 · Nota de Segurança
• https://lists.debian.org/debian-lts-announce/2021/05/msg00022.html · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QUEME45HVGTMDOYODAZYQOGWSZ2CEFWZ · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-18804 · Nota
• https://ubuntu.com/security/notices/USN-4198-1 · Aviso do Fabricante