Out-of-bounds Read Affecting djvulibre package, versions <3.5.27.1-10+deb10u1
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN10-DJVULIBRE-459736
- published 18 Aug 2019
- disclosed 18 Aug 2019
Introduced: 18 Aug 2019
CVE-2019-15145 Open this link in a new tabHow to fix?
Upgrade Debian:10
djvulibre
to version 3.5.27.1-10+deb10u1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream djvulibre
package and not the djvulibre
package as distributed by Debian
.
See How to fix?
for Debian:10
relevant fixed versions and status.
DjVuLibre 3.5.27 allows attackers to cause a denial-of-service attack (application crash via an out-of-bounds read) by crafting a corrupted JB2 image file that is mishandled in JB2Dict::JB2Codec::get_direct_context in libdjvu/JB2Image.h because of a missing zero-bytes check in libdjvu/GBitmap.h.
References
- https://security-tracker.debian.org/tracker/CVE-2019-15145
- https://lists.debian.org/debian-lts-announce/2019/08/msg00036.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FPMG3VY33XGMIKE6QDYIUVS6A7GNTHTK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JO65AWU7LEWNF6DDCZPRFTR2ZPP5XK6L/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M7F7544WASYMOTFDR2WUEOQLN3ZEXNU4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QUEME45HVGTMDOYODAZYQOGWSZ2CEFWZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYZTGKWY3NAKMIMTFYGN4ZO5XEQWPYRL/
- https://security.gentoo.org/glsa/202007-36
- https://sourceforge.net/p/djvu/bugs/298/
- https://sourceforge.net/p/djvu/djvulibre-git/ci/9658b01431cd7ff6344d7787f855179e73fe81a7/
- https://lists.debian.org/debian-lts-announce/2021/05/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00086.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00087.html
- https://usn.ubuntu.com/4198-1/
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-15145
- https://www.debian.org/security/2021/dsa-5032
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPMG3VY33XGMIKE6QDYIUVS6A7GNTHTK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JO65AWU7LEWNF6DDCZPRFTR2ZPP5XK6L/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7F7544WASYMOTFDR2WUEOQLN3ZEXNU4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QUEME45HVGTMDOYODAZYQOGWSZ2CEFWZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RYZTGKWY3NAKMIMTFYGN4ZO5XEQWPYRL/