CVE-2013-1953
published 2013-12-09CVE-2013-1953: Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a…
PriorityP427medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
1.73%
75.1th percentile
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| autotrace_project | autotrace | — | — |
| debian | gimp | < gimp 2.6.10-1 (bookworm) | gimp 2.6.10-1 (bookworm) |
| gimp | gimp | >= 0 < 2.6.10-1 | 2.6.10-1 |
| gimp | gimp | >= 0 < 2.6.10-1 | 2.6.10-1 |
| gimp | gimp | >= 0 < 2.6.10-1 | 2.6.10-1 |
| gimp | gimp | >= 0 < 2.6.10-1 | 2.6.10-1 |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_debian6.8MEDIUM
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j9fj-j92c-8fqr: Integer underflow in the input_bmp_reader function in input-bmp
ghsa_unreviewed·2022-05-17
CVE-2013-1953 [MEDIUM] GHSA-j9fj-j92c-8fqr: Integer underflow in the input_bmp_reader function in input-bmp
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.
OSV
CVE-2013-1953: Integer underflow in the input_bmp_reader function in input-bmp
osv·2013-12-09·CVSS 6.8
CVE-2013-1953 [MEDIUM] CVE-2013-1953: Integer underflow in the input_bmp_reader function in input-bmp
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.
Red Hat
autotrace: buffer overflow when parsing BMP files
vendor_redhat·2013-04-16·CVSS 6.8
CVE-2013-1953 [MEDIUM] autotrace: buffer overflow when parsing BMP files
autotrace: buffer overflow when parsing BMP files
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.
Package: autotrace (Red Hat Enterprise Linux 6) - Will not fix
Package: autotrace (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2013-1953: gimp - Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0...
vendor_debian·2013·CVSS 6.8
CVE-2013-1953 [MEDIUM] CVE-2013-1953: gimp - Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0...
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.
Scope: local
bookworm: resolved (fixed in 2.6.10-1)
bullseye: resolved (fixed in 2.6.10-1)
forky: resolved (fixed in 2.6.10-1)
sid: resolved (fixed in 2.6.10-1)
trixie: resolved (fixed in 2.6.10-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-1953 autotrace: buffer overflow when parsing BMP files [fedora-all]
bugzilla·2013-04-16·CVSS 6.8
CVE-2013-1953 [MEDIUM] CVE-2013-1953 autotrace: buffer overflow when parsing BMP files [fedora-all]
CVE-2013-1953 autotrace: buffer overflow when parsing BMP files [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issue affe
Bugzilla
CVE-2013-1953 autotrace: buffer overflow when parsing BMP files
bugzilla·2013-04-11·CVSS 6.8
CVE-2013-1953 [MEDIUM] CVE-2013-1953 autotrace: buffer overflow when parsing BMP files
CVE-2013-1953 autotrace: buffer overflow when parsing BMP files
A buffer overflow flaw was reported in autotrace's input_bmp_reader() function. When autotrace is compiled with FORTIFY_SOURCE, this is caught and turned into a simple denial of service. As reported:
In input-bmp.c, the input_bmp_reader() function creates a buffer on the
stack:
91 unsigned char buffer[64];
Later on
169 else if (Bitmap_File_Head.biSize <= 64) /* Probably OS/2 2.x */
170 {
171 if (!ReadOK (fd, buffer, Bitmap_File_Head.biSize - 4))
We control Bitmap_File_Head.biSize. A value of 0 meets the <=64
requirements, and 0 - 4 should result in almost 4294967295 bytes being
read into the buffer.
Discussion:
Acknowledgements:
This issue was discovered by Murray McAllister of Red Hat Security Response Team.
---
Th
http://www.mandriva.com/security/advisories?name=MDVSA-2013:190http://www.openwall.com/lists/oss-security/2013/04/16/3https://bugzilla.redhat.com/show_bug.cgi?id=951257http://www.mandriva.com/security/advisories?name=MDVSA-2013:190http://www.openwall.com/lists/oss-security/2013/04/16/3https://bugzilla.redhat.com/show_bug.cgi?id=951257
2013-12-09
Published