The findnext function in decompose.c in potrace 1.13 allows remote attackers to cause a denial of service (invalid memory access and crash) via a crafted BMP image.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2016/10/08/17 | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2016/10/16/9 | Mailing List Third Party Advisory |
| http://www.securityfocus.com/bid/93470 | Third Party Advisory VDB Entry |
| https://blogs.gentoo.org/ago/2016/08/29/potrace-invalid-memory-access-in-findnext-decompose-c/ | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2016/10/08/17 | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2016/10/16/9 | Mailing List Third Party Advisory |
| http://www.securityfocus.com/bid/93470 | Third Party Advisory VDB Entry |
| https://blogs.gentoo.org/ago/2016/08/29/potrace-invalid-memory-access-in-findnext-decompose-c/ | Third Party Advisory |
Configurations
History
21 Nov 2024, 02:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2016/10/08/17 - Mailing List, Third Party Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2016/10/16/9 - Mailing List, Third Party Advisory | |
| References | () http://www.securityfocus.com/bid/93470 - Third Party Advisory, VDB Entry | |
| References | () https://blogs.gentoo.org/ago/2016/08/29/potrace-invalid-memory-access-in-findnext-decompose-c/ - Third Party Advisory |
Information
Published : 2017-01-31 22:59
Updated : 2024-11-21 02:59
NVD link : CVE-2016-8685
Mitre link : CVE-2016-8685
CVE.ORG link : CVE-2016-8685
JSON object : View
Products Affected
potrace_project
- potrace
CWE
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer