Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 580
Alerts This Week
Warning Icon 1 580

Gentoo: GLSA-201708-09 Normal: AutoTrace Denial Of Service Issues

gentoo
Calendar Grey August 26, 2017
Dist Gentoo Esm H88
Uncover weaknesses within AutoTrace impacting Gentoo users. Essential advice provided for the packages at risk.
Multiple vulnerabilities have been found in AutoTrace, the worst of which could cause a Denial of Service condition.

Summary

Heap-based buffer overflows have been discovered in the pstoedit_suffix_table_init and pnm_load_rawpbm functions of AutoTrace.

Topics%20covered

Topics Covered

security advisory denial of service gentoo buffer overflow autotrace

Resolution

Gentoo has discontinued support for AutoTrace. We recommend that usersunmerge AutoTrace: # emerge --unmerge "media-gfx/autotrace"

References

[ 1 ] CVE-2016-7392 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7392 [ 2 ] CVE-2017-9153 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9153

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201708-09
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: AutoTrace: Multiple vulnerabilities
Date: August 26, 2017
Bugs: #613992, #619040
ID: 201708-09

Topics%20covered

Topics Covered

security advisory denial of service gentoo buffer overflow autotrace

Synopsis

Multiple vulnerabilities have been found in AutoTrace, the worst of which could cause a Denial of Service condition.

Background

AutoTrace converts bitmap to vector graphics.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 media-gfx/autotrace <= 0.31.1-r8 Vulnerable! ------------------------------------------------------------------- NOTE: Certain packages are still vulnerable. Users should migrate to another package if one is available or wait for the existing packages to be marked stable by their architecture maintainers.

Impact

===== Remote attackers, by enticing a user to process a crafted bmp image file, could cause a Denial of Service condition.

Workaround

There is no known workaround at this time.