Lucene search

K
ubuntucveUbuntu.comUB:CVE-2019-5087
HistoryNov 21, 2019 - 12:00 a.m.

CVE-2019-5087

2019-11-2100:00:00
ubuntu.com
ubuntu.com
5

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

61.3%

An exploitable integer overflow vulnerability exists in the
flattenIncrementally function in the xcf2png and xcf2pnm binaries of
xcftools 1.0.7. An integer overflow can occur while calculating the row’s
allocation size, that could be exploited to corrupt memory and eventually
execute arbitrary code. In order to trigger this vulnerability, a victim
would need to open a specially crafted XCF file.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchxcftools< 1.0.7-6ubuntu0.1UNKNOWN
ubuntu20.04noarchxcftools< 1.0.7-6ubuntu0.20.04.1UNKNOWN
ubuntu16.04noarchxcftools< 1.0.7-5ubuntu0.1~esm1UNKNOWN

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

61.3%