PT-2019-18051 · Svgpp+3 · Svgpp+3

Ghost · Published 2019-01-13 · Updated 2023-06-19 · CVE-2019-6246

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions svgpp version 1.2.3

Description An issue was discovered in the Generic Image Library in Boost, where after calling the gil::get color function, the return code is used as an address. This leads to an Access Violation due to an out-of-bounds read.

Recommendations For svgpp version 1.2.3, consider restricting the use of the gil::get color function until a patch is available. As a temporary workaround, review the code to ensure that the return code from gil::get color is properly validated before being used as an address.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2019-6246

USN-6178-1

Affected Products

Boost

Linuxmint

Ubuntu

Svgpp

References · 11

• 🔥 https://github.com/svgpp/svgpp/issues/70 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-6246 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6178-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-6246 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-6246 · Security Note
• https://ubuntu.com/security/CVE-2019-6246 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6246 · Security Note
• https://osv.dev/vulnerability/USN-6178-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-6246 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-6246 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-44960 · Vendor Advisory