CVE-2019-20326: Buffer Overflow
First published: Mon Mar 16 2020(Updated: )
A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in GNOME gThumb before 3.8.3 and Linux Mint Pix before 2.4.5 allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GNOME gThumb | <3.8.3 | |
| Linuxmint Pix | <2.4.5 | |
| Debian Debian Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/Fysac/CVE-2019-20326
- https://gitlab.gnome.org/GNOME/gthumb/commit/4faa5ce2358812d23a1147953ee76f59631590ad
- https://gitlab.gnome.org/GNOME/gthumb/commit/ca8f528209ab78935c30e42fe53bdf1a24f3cb44
- https://gitlab.gnome.org/GNOME/gthumb/commits/master/extensions/cairo_io/cairo-image-surface-jpeg.c
- https://lists.debian.org/debian-lts-announce/2021/08/msg00027.html
- https://security.gentoo.org/glsa/202008-05
Frequently Asked Questions
What is CVE-2019-20326?
CVE-2019-20326 is a vulnerability that allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file in GNOME gThumb before 3.8.3 and Linux Mint Pix before 2.4.5.
What is the severity of CVE-2019-20326?
The severity of CVE-2019-20326 is high, with a severity value of 7.8.
What is the affected software for CVE-2019-20326?
The affected software for CVE-2019-20326 includes GNOME gThumb before version 3.8.3, Linux Mint Pix before version 2.4.5, and Debian Debian Linux version 9.0.
How does CVE-2019-20326 work?
CVE-2019-20326 works by exploiting a heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() function in GNOME gThumb and Linux Mint Pix, allowing attackers to potentially execute arbitrary code via a crafted JPEG file.
How do I fix CVE-2019-20326?
To fix CVE-2019-20326, users should update to the latest versions of GNOME gThumb and Linux Mint Pix, which are 3.8.3 and 2.4.5 respectively.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/tags
- agent/event
- agent/description
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- vendor/gnome
- canonical/gnome gthumb
- vendor/linuxmint
- canonical/linuxmint pix
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0