Back to Database
Status published
Medium
CVE-2019-15145
DjVuLibre 3.5.27 allows attackers to cause a denial-of-service attack (application...
Vulnerability Description
DjVuLibre 3.5.27 allows attackers to cause a denial-of-service attack (application crash via an out-of-bounds read) by crafting a corrupted JB2 image file that is mishandled in JB2Dict::JB2Codec::get_direct_context in libdjvu/JB2Image.h because of a missing zero-bytes check in libdjvu/GBitmap.h.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-15145
Credits & Attribution
No credits recorded in the NVD database.
References
- https://sourceforge.net/p/djvu/bugs/298/
- https://sourceforge.net/p/djvu/djvulibre-git/ci/9658b01431cd7ff6344d7787f855179e73fe81a7/
- https://lists.debian.org/debian-lts-announce/2019/08/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00086.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00087.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPMG3VY33XGMIKE6QDYIUVS6A7GNTHTK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RYZTGKWY3NAKMIMTFYGN4ZO5XEQWPYRL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7F7544WASYMOTFDR2WUEOQLN3ZEXNU4/
- https://usn.ubuntu.com/4198-1/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QUEME45HVGTMDOYODAZYQOGWSZ2CEFWZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JO65AWU7LEWNF6DDCZPRFTR2ZPP5XK6L/
- https://security.gentoo.org/glsa/202007-36
- https://lists.debian.org/debian-lts-announce/2021/05/msg00022.html
- https://www.debian.org/security/2021/dsa-5032
More from djvulibre project
View All →CVE-2021-46312
An issue was discovered IW44EncodeCodec.cpp in djvulibre 3.5.28 in allows...
Medium
6.5
CVE-2021-46310
An issue was discovered IW44Image.cpp in djvulibre 3.5.28 in allows...
Medium
6.5
CVE-2019-18804
DjVuLibre 3.5.27 has a NULL pointer dereference in the function...
High
7.5
CVE-2019-15144
In DjVuLibre 3.5.27, the sorting functionality (aka GArrayTemplate<TYPE>::sort) allows attackers...
Medium
5.5
CVE-2019-15143
In DjVuLibre 3.5.27, the bitmap reader component allows attackers to...
Medium
5.5
Affected Vendor
djvulibre project
View all reports →Affected Software
djvulibre, debian linux, fedora, ubuntu linux, leap
Vulnerable Versions:
3.5.27, 8.0, 9.0, 10.0, 11.0, 29, 30, 31, 16.04, 18.04, 19.04, 19.10, 15.0, 15.1
Timeline
Official Publish:
August 18th, 2019
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.