CVE-2019-5785: Stack buffer overflow in Skia

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1525433
• https://googleprojectzero.blogspot.com/2019/02/the-curious-case-of-convexity-confusion.html
• https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/
• https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.html (Advisory)
• https://crbug.com/899689
• https://launchpad.net/bugs/cve/CVE-2019-5785
• https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/
• https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/#CVE-2019-5785
• https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/#CVE-2019-5785
• https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/#CVE-2019-5785
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1676994
• https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1676995
• https://access.redhat.com/errata/RHSA-2019:0373
• https://access.redhat.com/errata/RHSA-2019:0374
• https://bugzilla.redhat.com/show_bug.cgi?id=1676991
• https://www.mozilla.org/en-US/security/advisories/mfsa2019-04/
• https://security-tracker.debian.org/tracker/CVE-2019-5785
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5785
• https://nvd.nist.gov/vuln/detail/CVE-2019-5785
• https://ubuntu.com/security/CVE-2019-5785

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2019-05
• MFSA2019-06
• 6268810185140219955
• MFSA2019-04

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2018-18356
• CVE-2019-5785
• CVE-2018-18335
• CVE-2018-18509
• CVE-2019-5754
• CVE-2019-5782
• CVE-2019-5755
• CVE-2019-5756
• CVE-2019-5757
• CVE-2019-5758
• CVE-2019-5759
• CVE-2019-5760
• CVE-2019-5761
• CVE-2019-5762
• CVE-2019-5763
• CVE-2019-5764
• CVE-2019-13768
• CVE-2019-5765
• CVE-2019-5766
• CVE-2019-5767
• CVE-2019-5768
• CVE-2019-5769
• CVE-2019-5770
• CVE-2019-5771
• CVE-2019-5772
• CVE-2019-5773
• CVE-2019-5774
• CVE-2019-5775
• CVE-2019-5776
• CVE-2019-5777
• CVE-2018-20073
• CVE-2019-5778
• CVE-2019-5779
• CVE-2019-5780
• CVE-2019-5783
• CVE-2019-5781
• CVE-2019-13684
• CVE-2018-18511

Frequently Asked Questions

• What is CVE-2019-5785?

  CVE-2019-5785 is an integer overflow vulnerability in the Skia library that can occur after specific transform operations in Google Chrome prior to 72.0.3626.81.

• How severe is CVE-2019-5785?

  CVE-2019-5785 has a severity rating of 6.5, which is considered high.

• What software is affected by CVE-2019-5785?

  CVE-2019-5785 affects Google Chrome prior to 72.0.3626.81, Mozilla Firefox versions up to 65.0.1, and Mozilla Firefox ESR versions up to 60.5.1.

• How can I fix CVE-2019-5785?

  To fix CVE-2019-5785, update your software to Google Chrome version 72.0.3626.81 or later, Mozilla Firefox version 65.0.1 or later, or Mozilla Firefox ESR version 60.5.1 or later.

• Where can I find more information about CVE-2019-5785?

  You can find more information about CVE-2019-5785 on the following websites: [Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1525433), [Google Project Zero Blog](https://googleprojectzero.blogspot.com/2019/02/the-curious-case-of-convexity-confusion.html), [Mozilla Security Advisories](https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/).