CVE-2019-19451 — Infinite Loop in DIA
Severity
5.5MEDIUMNVD
EPSS
0.2%
top 64.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 29
Latest updateMay 24
Description
When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect a…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages4 packages
Also affects: Fedora 32, 33
🔴Vulnerability Details
2GHSA▶
GHSA-4vq3-2rwv-w7mg: When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop↗2022-05-24
OSV▶
CVE-2019-19451: When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop↗2019-11-29
📋Vendor Advisories
1Debian▶
CVE-2019-19451: dia - When GNOME Dia before 2019-11-27 is launched with a filename argument that is no...↗2019