Integer overflow in autotrace - CVE-2019-19004

Vulnerability identifier: #VU95413

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-19004

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow in input-bmp.c. A remote attacker can trick the victim to pass specially crafted input to the application, trigger an integer overflow and crash the application.

autotrace
Amazon Linux AMI
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Fedora
autotrace (Red Hat package)
autotrace

Install updates from vendor's website.

autotrace - update to 0.31.9
autotrace (Red Hat package) - update to 0.31.1-53.el8
autotrace - update to 0.31.1-60.fc34
autotrace - update to 0.31.1-62

• https://github.com/autotrace/autotrace/pull/40
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NC6MUH2RLVEA634LHBNZ2KO7MQKI2RDZ/
• https://bugzilla.redhat.com/show_bug.cgi?id=1945031

• Multiple vulnerabilities in autotrace
• Amazon Linux AMI update for autotrace
• Red Hat Enterprise Linux 8 update for autotrace
• Fedora 34 update for autotrace