CVE-2019-9210 — Out-of-bounds Read in Advancecomp
Severity
7.8HIGHNVD
EPSS
0.4%
top 37.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 27
Latest updateMay 13
Description
In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages2 packages
Also affects: Debian Linux 8.0, 9.0, Fedora 30, Ubuntu Linux 14.04, 16.04, 18.04, 18.10, 19.04
🔴Vulnerability Details
3📋Vendor Advisories
5Microsoft▶
In AdvanceCOMP 2.1 png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size which results in an attempted memcpy to write into a buffer that is too small. (Ther↗2019-02-12
Debian▶
CVE-2019-9210: advancecomp - In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow u...↗2019