SB20200114166 - OpenSUSE Linux update for dia
Published: January 14, 2020 Updated: June 25, 2020
Security Bulletin ID
SB20200114166
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Infinite loop (CVE-ID: CVE-2019-19451)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop when launched with a filename argument that is not a valid codepoint in the current encoding. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable.
Remediation
Install update from vendor's website.