CVE-2019-15142

Reference Links

• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00086.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00087.html
• https://lists.debian.org/debian-lts-announce/2019/08/msg00036.html
• https://lists.debian.org/debian-lts-announce/2021/05/msg00022.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FPMG3VY33XGMIKE6QDYIUVS6A7GNTHTK/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JO65AWU7LEWNF6DDCZPRFTR2ZPP5XK6L/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M7F7544WASYMOTFDR2WUEOQLN3ZEXNU4/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QUEME45HVGTMDOYODAZYQOGWSZ2CEFWZ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYZTGKWY3NAKMIMTFYGN4ZO5XEQWPYRL/
• https://security.gentoo.org/glsa/202007-36
• https://sourceforge.net/p/djvu/bugs/296/
• https://sourceforge.net/p/djvu/djvulibre-git/ci/970fb11a296b5bbdc5e8425851253d2c5913c45e/
• https://usn.ubuntu.com/4198-1/
• https://www.debian.org/security/2021/dsa-5032
• https://launchpad.net/bugs/cve/CVE-2019-15142
• https://security-tracker.debian.org/tracker/CVE-2019-15142
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPMG3VY33XGMIKE6QDYIUVS6A7GNTHTK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JO65AWU7LEWNF6DDCZPRFTR2ZPP5XK6L/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7F7544WASYMOTFDR2WUEOQLN3ZEXNU4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QUEME45HVGTMDOYODAZYQOGWSZ2CEFWZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RYZTGKWY3NAKMIMTFYGN4ZO5XEQWPYRL/
• https://ubuntu.com/security/notices/USN-4198-1
• https://www.cve.org/CVERecord?id=CVE-2019-15142
• https://nvd.nist.gov/vuln/detail/CVE-2019-15142
• https://ubuntu.com/security/CVE-2019-15142

Parent vulnerabilities

(Appears in the following advisories)

• USN-4198-1

Frequently Asked Questions

• What is the severity of CVE-2019-15142?

  The severity of CVE-2019-15142 is medium with a severity value of 5.5.

• How can attackers exploit CVE-2019-15142?

  Attackers can exploit CVE-2019-15142 by crafting a malicious DJVU file that triggers a heap-based buffer over-read in the DJVU reader component of DjVuLibre, causing a denial-of-service (application crash).

• Which software versions are affected by CVE-2019-15142?

  The affected software versions include DjVuLibre 3.5.27 up to but not including 3.5.27.1-8ubuntu0.1, DjVuLibre 3.5.27 up to but not including 3.5.27.1-10ubuntu0.1, DjVuLibre 3.5.27 up to but not including 3.5.27.1-11, DjVuLibre 3.5.27 up to but not including 3.5.27.1-5ubuntu0.1, DjVuLibre 3.5.27 up to but not including 3.5.28-2, Djvulibre Project Djvulibre 3.5.27, Debian Debian Linux 8.0, Debian Debian Linux 9.0, Debian Debian Linux 10.0, Debian Debian Linux 11.0, Fedoraproject Fedora 29, Fedoraproject Fedora 30, Fedoraproject Fedora 31, Canonical Ubuntu Linux 16.04 (ESM), Canonical Ubuntu Linux 18.04 (LTS), Canonical Ubuntu Linux 19.04, Canonical Ubuntu Linux 19.10, openSUSE Leap 15.0, and openSUSE Leap 15.1.

• How do I fix CVE-2019-15142 in DjVuLibre?

  To fix CVE-2019-15142 in DjVuLibre, update to version 3.5.27.1-8ubuntu0.1, 3.5.27.1-10ubuntu0.1, 3.5.27.1-11, 3.5.27.1-5ubuntu0.1, or 3.5.28-2 depending on the specific affected version.

• Where can I find more information about CVE-2019-15142?

  You can find more information about CVE-2019-15142 from the following sources: [link1], [link2], [link3].