PT-2020-15198 · Sixel+2 · Libsixel+2

Peanuts62 · Published 2020-11-20 · Updated 2024-12-20 · CVE-2020-19668

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libsixel version 1.8.6

Description The issue arises from unverified indexes into an array, leading to out of bound access in the gif out code function located in fromgif.c in libsixel. This can potentially cause issues due to the unauthorized access beyond the array's boundaries.

Recommendations For libsixel version 1.8.6, consider restricting access to the gif out code function in fromgif.c until a patch is available. As a temporary workaround, avoid using the gif out code function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2023-1540

ALT-PU-2023-1591

ALT-PU-2024-17256

CVE-2020-19668

Affected Products

Alt Linux

Debian

Libsixel

References · 12

• 🔥 https://github.com/saitoha/libsixel/issues/136 · Exploit
• https://cve.org/CVERecord?id=CVE-2020-19668 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-19668 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-19668 · Security Note
• https://osv.dev/vulnerability/CVE-2020-19668 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-19668 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-19668 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-19668 · Vendor Advisory
• https://t.me/cvenotify/5938 · Telegram Post
• https://t.me/cibsecurity/17412 · Telegram Post
• https://t.me/cvenotify/6515 · Telegram Post
• https://t.me/cibsecurity/16666 · Telegram Post