CVE-2019-15144

Published: 18 August 2019

In DjVuLibre 3.5.27, the sorting functionality (aka GArrayTemplate<TYPE>::sort) allows attackers to cause a denial-of-service (application crash due to an Uncontrolled Recursion) by crafting a PBM image file that is mishandled in libdjvu/GContainer.h.

Priority

CVSS 3 base score: 5.5

Status

Package	Release	Status
djvulibre Launchpad, Ubuntu, Debian	Upstream	Released (3.5.27.1-11)




	Ubuntu 18.04 LTS (Bionic Beaver)	Released (3.5.27.1-8ubuntu0.1)
	Ubuntu 16.04 ESM (Xenial Xerus)	Released (3.5.27.1-5ubuntu0.1)
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist
	Patches: Upstream: https://sourceforge.net/p/djvu/djvulibre-git/ci/e15d51510048927f172f1bf1f27ede65907d940d/

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15144
https://ubuntu.com/security/notices/USN-4198-1
NVD
Launchpad
Debian

Bugs

https://sourceforge.net/p/djvu/bugs/299/

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›