← Back to CVEs
CVE-2019-5087
HIGH8.8
Description
An exploitable integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries of xcftools 1.0.7. An integer overflow can occur while calculating the row's allocation size, that could be exploited to corrupt memory and eventually execute arbitrary code. In order to trigger this vulnerability, a victim would need to open a specially crafted XCF file.
CVE Details
CVSS v3.1 Score8.8
SeverityHIGH
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack VectorNETWORK
ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
Published11/21/2019
Last Modified11/21/2024
Sourcenvd
Honeypot Sightings0
Affected Products
debian:debian_linuxxcftools_project:xcftools
Weaknesses (CWE)
CWE-680CWE-190CWE-787
References
https://lists.debian.org/debian-lts-announce/2021/02/msg00014.html(talos-cna@cisco.com)
https://lists.debian.org/debian-lts-announce/2021/03/msg00008.html(talos-cna@cisco.com)
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0879(talos-cna@cisco.com)
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0879(talos-cna@cisco.com)
https://lists.debian.org/debian-lts-announce/2021/02/msg00014.html(af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2021/03/msg00008.html(af854a3a-2127-422b-91ae-364da2661108)
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0879(af854a3a-2127-422b-91ae-364da2661108)
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0879(af854a3a-2127-422b-91ae-364da2661108)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.