PT-2019-6338 · Libsixel+2 · Stb Image.H+2

Sleicaspero · Publicado 2019-12-29 · Atualizado 2020-01-08 · CVE-2019-20056

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions stb image.h versions 2.23

Description The issue is related to an insufficient use of the assert() function in the stb image.h component of the Libsixel library for C/C++. This allows a remote attacker to cause a denial of service.

Recommendations For version 2.23, consider disabling the stbi shiftsigned function as a temporary workaround until a patch is available.

Exploit

Correção

Assertion Failure

Enumeração de Fraquezas

CWE-617

Identificadores relacionados

BDU:2023-02639

CVE-2019-20056

Produtos afetados

Astra Linux

Debian

Stb Image.H

Referências · 16

• 🔥 https://github.com/saitoha/libsixel/issues/126 · Exploit
• https://github.com/nothings/stb/pull/960#pullrequestreview-615017993 · Nota
• https://github.com/nothings/stb/issues/886 · Nota
• https://github.com/nothings/stb/commit/bfaccab17a648b315543d366c63aee575a0756b7 · Nota
• https://github.com/saitoha/libsixel/commit/814f831555ea2492d442e784ab5d594f6a8e2e8d · Nota
• https://cve.org/CVERecord?id=CVE-2019-20056 · Nota de Segurança
• https://ubuntu.com/security/CVE-2019-20056 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-20056 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-20056 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-02639 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-20056 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-20056 · Aviso do Fabricante
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16 · Aviso do Fabricante
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0426SE17 · Aviso do Fabricante
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Aviso do Fabricante