PT-2019-11494 · David Tschumperle · Cimg Library

Published 2019-07-25 · Updated 2023-03-01 · CVE-2019-1010174

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: CImg Library versions prior to 2.3.4

Description: The issue allows for command injection, potentially leading to Remote Code Execution (RCE), due to a lack of string sanitization on user-controllable URLs when loading images using the load network() function.

Recommendations: For versions prior to 2.3.4, update to version 2.3.4 to resolve the issue. As a temporary workaround, consider restricting the use of the load network() function to minimize the risk of exploitation, or ensure that all URLs used for loading images are thoroughly sanitized and validated to prevent command injection.

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2019-1010174

DLA-1934-1

DLA-2421-1

Affected Products

Cimg Library

References · 12

• https://osv.dev/vulnerability/CVE-2019-1010174 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-1010174 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010174 · Security Note
• https://framagit.org/dtschump/CImg/commit/5ce7a426b77f814973e56182a0e76a2b04904146 · Patch
• https://osv.dev/vulnerability/DLA-1934-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2421-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-1010174 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-1010174 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-1010174 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-1010174 · Security Note
• https://lists.debian.org/debian-lts-announce/2019/09/msg00030.html · Note
• https://lists.debian.org/debian-lts-announce/2020/10/msg00033.html · Note