PT-2019-15805 · Gnome · Gnome-Font-Viewer

Published 2019-11-27 · Updated 2024-02-28 · CVE-2019-19308

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions gnome-font-viewer version 3.34.0

Description The issue arises from a NULL pointer dereference in the text to glyphs function in sushi-font-widget.c while parsing a TTF font file that lacks a name section. This occurs due to a g strconcat call that returns NULL.

Recommendations For gnome-font-viewer version 3.34.0, consider avoiding the use of TTF font files that lack a name section until a patch is available. As a temporary workaround, restrict the parsing of such files to minimize the risk of exploitation.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2019-19308

OESA-2022-2074

Affected Products

Gnome-Font-Viewer

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2019-19308 · Security Note
• https://osv.dev/vulnerability/OESA-2022-2074 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19308 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19308 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-19308 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-19308 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19308 · Vendor Advisory
• https://gitlab.gnome.org/GNOME/gnome-font-viewer/issues/17 · Patch
• https://cve.org/CVERecord?id=CVE-2019-19308 · Security Note
• https://github.com/GNOME/gnome-font-viewer/blob/919dfbe684b75904563b8c6723c9778a4e00aad7/src/sushi-font-widget.c#L115-L117 · Note
• https://twitter.com/Esparta6108713/status/1762937635851669583 · Twitter Post
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2074 · Note