DjVuLibre 3.5.27 allows attackers to cause a denial-of-service attack (application crash via an out-of-bounds read) by crafting a corrupted JB2 image file that is mishandled in JB2Dict::JB2Codec::get_direct_context in libdjvu/JB2Image.h because of a missing zero-bytes check in libdjvu/GBitmap.h.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
29 Mar 2022, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | (DEBIAN) https://www.debian.org/security/2021/dsa-5032 - Third Party Advisory | |
| CPE | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
28 Dec 2021, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
27 May 2021, 16:10
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 5.5 |
| References | (UBUNTU) https://usn.ubuntu.com/4198-1/ - Third Party Advisory | |
| References | (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00087.html - Mailing List, Third Party Advisory | |
| References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M7F7544WASYMOTFDR2WUEOQLN3ZEXNU4/ - Mailing List, Third Party Advisory | |
| References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QUEME45HVGTMDOYODAZYQOGWSZ2CEFWZ/ - Mailing List, Third Party Advisory | |
| References | (MLIST) https://lists.debian.org/debian-lts-announce/2019/08/msg00036.html - Mailing List, Third Party Advisory | |
| References | (GENTOO) https://security.gentoo.org/glsa/202007-36 - Third Party Advisory | |
| References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYZTGKWY3NAKMIMTFYGN4ZO5XEQWPYRL/ - Mailing List, Third Party Advisory | |
| References | (SUSE) http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00086.html - Mailing List, Third Party Advisory | |
| References | (MLIST) https://lists.debian.org/debian-lts-announce/2021/05/msg00022.html - Mailing List, Third Party Advisory | |
| References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FPMG3VY33XGMIKE6QDYIUVS6A7GNTHTK/ - Mailing List, Third Party Advisory | |
| References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JO65AWU7LEWNF6DDCZPRFTR2ZPP5XK6L/ - Mailing List, Third Party Advisory |
26 May 2021, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2019-08-18 19:15
Updated : 2024-02-04 20:20
NVD link : CVE-2019-15145
Mitre link : CVE-2019-15145
CVE.ORG link : CVE-2019-15145
JSON object : View
Products Affected
debian
- debian_linux
djvulibre_project
- djvulibre
canonical
- ubuntu_linux
opensuse
- leap
fedoraproject
- fedora
CWE
CWE-125
Out-of-bounds Read