PT-2019-6338 · Libsixel+2 · Stb Image.H+2

Sleicaspero · Published 2019-12-29 · Updated 2020-01-08 · CVE-2019-20056

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions stb image.h versions 2.23

Description The issue is related to an insufficient use of the assert() function in the stb image.h component of the Libsixel library for C/C++. This allows a remote attacker to cause a denial of service.

Recommendations For version 2.23, consider disabling the stbi shiftsigned function as a temporary workaround until a patch is available.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

BDU:2023-02639

CVE-2019-20056

Affected Products

Astra Linux

Debian

Stb Image.H

References · 16

• 🔥 https://github.com/saitoha/libsixel/issues/126 · Exploit
• https://cve.org/CVERecord?id=CVE-2019-20056 · Security Note
• https://ubuntu.com/security/CVE-2019-20056 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-20056 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-20056 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02639 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-20056 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-20056 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0426SE17 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20056 · Security Note
• https://github.com/nothings/stb/pull/960#pullrequestreview-615017993 · Note
• https://github.com/nothings/stb/issues/886 · Note
• https://github.com/nothings/stb/commit/bfaccab17a648b315543d366c63aee575a0756b7 · Note