Advisory ROSA-SA-2021-1872

Software: libgxps 0.3.0
OS: Cobalt 7.9

CVE-ID: CVE-2018-10733
CVE-Crit: MEDIUM
CVE-DESC: There is a heap-based buffer overflow in the ft_font_face_hash function of the gxps-fonts.c file in libgxps before version 0.3.0. The input created will result in a remote denial of service attack.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2018-10767
CVE-Crit: MEDIUM
CVE-DESC: A GLib call to the gxps_images_guess_content_type function from gxps-images.c in libgxps prior to version 0.3.0 causes a stack-based buffer overread because it does not reject negative return values from the g_input_stream_read call. The input created will result in a remote denial of service attack.
CVE-STATUS: default
CVE-REV: default