UBUNTU-CVE-2019-14283

In the Linux kernel before 5.2.3, setgeometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy...

Skia - Incorrect Convexity Assumptions Leading to Buffer Overflows

Skia - Incorrect Convexity Assumptions Leading to Buffer Overflows I was looking into the root cause of https://bugs.chromium.org/p/chromium/issues/detail?id=850350. In that bug, due to precision errors, Skia generated a concave RRect, but declared it convex. Later, the RRect was transformed with...

Skia - Incorrect Convexity Assumptions Leading to Buffer Overflows

I was looking into the root cause of https://bugs.chromium.org/p/chromium/issues/detail?id=850350. In that bug, due to precision errors, Skia generated a concave RRect, but declared it convex. Later, the RRect was transformed with an affine transform and used as a clipping region for drawing...

The Curious Case of Convexity Confusion

Posted by Ivan Fratric, Google Project Zero Intro Some time ago, I noticed a tweet about an externally reported vulnerability in Skia graphics library used by Chrome, Firefox and Android, among others. The vulnerability caught my attention for several reasons: Firstly, I looked at Skia before...

Denial Of Service (DoS)

mysql is vulnerable to denial of service DoS attacks. The vulnerability exists as Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a denial of service crash via a crafted geometry feature that specifies a large number of points, which is...

SVG++ Buffer Overflow Vulnerability

SVG++ aka Ssvgpp is a C++ framework that includes an SVG syntax parser, adapters for handling parsed data, and various utilities. The framework includes an SVG syntax parser, adapters for handling parsed data, and a variety of utilities.Anti-Grain Geometry AGG is a 2D rendering library used in it...

CVE-2019-6245

An issue was discovered in Anti-Grain Geometry AGG 2.4 as used in SVG++ aka svgpp 1.2.3. In the function agg::cellaa::notequal, dx is assigned to x2 - x1. If dx = dxlimit, which is 16384 polysubpixelshift, this function will call itself recursively. There can be a situation where x2 - x1 is alway...

Heap overflow

An issue was discovered in Anti-Grain Geometry AGG 2.4 as used in SVG++ aka svgpp 1.2.3. A heap-based buffer overflow bug in svgppaggrender may lead to code execution. In the renderscanlinesaasolid function, the blendhline function is called repeatedly multiple times. blendhline is equivalent to ...

CVE-2019-6245

An issue was discovered in Anti-Grain Geometry AGG 2.4 as used in SVG++ aka svgpp 1.2.3. In the function agg::cellaa::notequal, dx is assigned to x2 - x1. If dx = dxlimit, which is 16384 polysubpixelshift, this function will call itself recursively. There can be a situation where x2 - x1 is alway...

UBUNTU-CVE-2019-6245

An issue was discovered in Anti-Grain Geometry AGG 2.4 as used in SVG++ aka svgpp 1.2.3. In the function agg::cellaa::notequal, dx is assigned to x2 - x1. If dx = dxlimit, which is 16384 polysubpixelshift, this function will call itself recursively. There can be a situation where x2 - x1 is alway...

CVE-2019-6247

An issue was discovered in Anti-Grain Geometry AGG 2.4 as used in SVG++ aka svgpp 1.2.3. A heap-based buffer overflow bug in svgppaggrender may lead to code execution. In the renderscanlinesaasolid function, the blendhline function is called repeatedly multiple times. blendhline is equivalent to ...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write. An issue was discovered in Anti-Grain Geometry AGG 2.4 as used in SVG++ aka svgpp 1.2.3. A heap-based buffer overflow bug in svgppaggrender may lead to code execution. In the renderscanlinesaasolid function, the...

CVE-2019-6247

An issue was discovered in Anti-Grain Geometry AGG 2.4 as used in SVG++ aka svgpp 1.2.3. A heap-based buffer overflow bug in svgppaggrender may lead to code execution. In the renderscanlinesaasolid function, the blendhline function is called repeatedly multiple times. blendhline is equivalent to ...

DEBIAN-CVE-2019-6245

An issue was discovered in Anti-Grain Geometry AGG 2.4 as used in SVG++ aka svgpp 1.2.3. In the function agg::cellaa::notequal, dx is assigned to x2 - x1. If dx = dxlimit, which is 16384 polysubpixelshift, this function will call itself recursively. There can be a situation where x2 - x1 is alway...

UBUNTU-CVE-2019-6247

An issue was discovered in Anti-Grain Geometry AGG 2.4 as used in SVG++ aka svgpp 1.2.3. A heap-based buffer overflow bug in svgppaggrender may lead to code execution. In the renderscanlinesaasolid function, the blendhline function is called repeatedly multiple times. blendhline is equivalent to ...

Buffer Overflow

Overview Affected versions of this package are vulnerable to Buffer Overflow. An issue was discovered in Anti-Grain Geometry AGG 2.4 as used in SVG++ aka svgpp 1.2.3. In the function agg::cellaa::notequal, dx is assigned to x2 - x1. If dx = dxlimit, which is 16384 polysubpixelshift, this function...

Design/Logic Flaw

An issue was discovered in Anti-Grain Geometry AGG 2.4 as used in SVG++ aka svgpp 1.2.3. In the function agg::cellaa::notequal, dx is assigned to x2 - x1. If dx = dxlimit, which is 16384 polysubpixelshift, this function will call itself recursively. There can be a situation where x2 - x1 is alway...

PT-2019-18052 · Agg +2 · Anti-Grain Geometry +2

Name of the Vulnerable Software and Affected Versions: Anti-Grain Geometry AGG version 2.4 svgpp aka svgpp version 1.2.3 Description: A heap-based buffer overflow bug in svgpp agg render may lead to code execution. The issue arises in the render scanlines aa solid function, where the blend hline...

PT-2019-18050 · Anti Grain Geometry +2 · Anti-Grain Geometry +2

Name of the Vulnerable Software and Affected Versions: svgpp version 1.2.3 Anti-Grain Geometry AGG version 2.4 Description: A problem exists in the agg::cell aa::not equal function where dx is assigned the value of x2 - x1. If dx is greater than or equal to dx limit, which is calculated as 16384...

CVE-2019-6247

An issue was discovered in Anti-Grain Geometry AGG 2.4 as used in SVG++ aka svgpp 1.2.3. A heap-based buffer overflow bug in svgppaggrender may lead to code execution. In the renderscanlinesaasolid function, the blendhline function is called repeatedly multiple times. blendhline is equivalent to ...