PT-2018-12323 · Libsixel · Libsixel

Fcorleone · Published 2018-07-15 · Updated 2019-10-03 · CVE-2018-14072

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libsixel version 1.8.1

Description The issue is related to memory leaks found in the sixel decoder decode function in decoder.c, the image buffer resize function in fromsixel.c, and the sixel decode raw function in fromsixel.c.

Recommendations For libsixel version 1.8.1, consider applying a patch to fix the memory leaks in the sixel decoder decode, image buffer resize, and sixel decode raw functions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2018-14072

Affected Products

Libsixel

References · 8

• https://osv.dev/vulnerability/CVE-2018-14072 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14072 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-14072 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-14072 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-14072 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14072 · Vendor Advisory
• https://github.com/saitoha/libsixel/issues/67#issue-341198610 · Note