PT-2021-9015 · Autotrace+5 · Autotrace+5

Matthewpruett · Published 2021-02-11 · Updated 2024-07-04 · CVE-2019-19004

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions autotrace version 0.31.1

Description A biWidth*biBitCnt integer overflow in input-bmp.c allows attackers to provide an unexpected input value to malloc via a malformed bitmap image. This issue can be exploited by providing a specially crafted bitmap image.

Recommendations For autotrace version 0.31.1, update to a newer version that fixes the biWidth*biBitCnt integer overflow issue in input-bmp.c to prevent attackers from providing unexpected input values to malloc.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALSA-2021:4519

ALT-PU-2024-9579

CESA-2021_4519

CVE-2019-19004

OPENSUSE-SU-2022_0141-1

OPENSUSE-SU-2024:12090-1

RHSA-2021:4519

RHSA-2021_4519

Affected Products

Alt Linux

Almalinux

Centos

Red Hat

Suse

Autotrace

References · 15

• https://github.com/autotrace/autotrace/pull/40 · Patch
• https://github.com/autotrace/autotrace/commits/master · Patch
• https://github.com/autotrace/autotrace/commits/master/src/input-bmp.c · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NC6MUH2RLVEA634LHBNZ2KO7MQKI2RDZ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19004 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19004 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2021:4519 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2021-4519.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-19004 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19004 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-19004 · Security Note
• https://vulners.com/cve/CVE-2019-19004 · Note
• https://vulners.com/cve/CVE-2019-19005 · Note
• https://t.me/cibsecurity/23499 · Telegram Post
• https://t.me/cvenotify/9817 · Telegram Post