PT-2019-6358 · Tex Live+3 · Axohelp+4

Publicado 2019-09-07 · Atualizado 2024-06-15 · CVE-2019-18604

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions axodraw2 versions prior to 2.1.1b axohelp version prior to 1.3

Description The issue is related to insufficient input validation in the axodraw2 component of the TeX Live system. This allows a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The problem is caused by mishandling of sprintf in axohelp.c.

Recommendations For axodraw2 versions prior to 2.1.1b, update to version 2.1.1b or later to resolve the issue. For axohelp version prior to 1.3, update to version 1.3 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2023-03811

CVE-2019-18604

DLA-3427-2

OPENSUSE-SU-2024:11431-1

USN-6695-1

Produtos afetados

Astra Linux

Linuxmint

Ubuntu

Axodraw2

Axohelp

Referências · 23

• https://github.com/TeX-Live/texlive-source/commit/9216833a3888a4105a18e8c349f65b045ddb1079#diff-987e40c0e27ee43f6a2414ada73a191a · Correção
• https://suse.com/security/cve/CVE-2019-18604 · Nota
• https://security-tracker.debian.org/tracker/CVE-2019-18604 · Aviso do Fabricante
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0630SE17MD · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-03811 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2024:11431-1 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-6695-1 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2023/05/msg00033.html · Nota
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0907SE47 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-18604 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-18604 · Nota de Segurança
• https://osv.dev/vulnerability/USN-6695-1 · Aviso do Fabricante
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.8 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-18604 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-18604 · Nota de Segurança