Bug 1454714 (CVE-2017-9151, CVE-2017-9152, CVE-2017-9153, CVE-2017-9154, CVE-2017-9155, CVE-2017-9156, CVE-2017-9157, CVE-2017-9158, CVE-2017-9159, CVE-2017-9160, CVE-2017-9161, CVE-2017-9162, CVE-2017-9163, CVE-2017-9164, CVE-2017-9165, CVE-2017-9166, CVE-2017-9167, CVE-2017-9168, CVE-2017-9169, CVE-2017-9170, CVE-2017-9171, CVE-2017-9172, CVE-2017-9173, CVE-2017-9174, CVE-2017-9175, CVE-2017-9176, CVE-2017-9177, CVE-2017-9178, CVE-2017-9179, CVE-2017-9180, CVE-2017-9181, CVE-2017-9182, CVE-2017-9183, CVE-2017-9184, CVE-2017-9185, CVE-2017-9186, CVE-2017-9187, CVE-2017-9188, CVE-2017-9189, CVE-2017-9190, CVE-2017-9191, CVE-2017-9192, CVE-2017-9193, CVE-2017-9194, CVE-2017-9195, CVE-2017-9196, CVE-2017-9197, CVE-2017-9198, CVE-2017-9199, CVE-2017-9200)

Summary: CVE-2017-9151..CVE-2017-9200 autotrace: Multiple security issues
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: jskarvad, lemenkov
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-05-23 11:41:18 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1454715    
Bug Blocks:    

Description Andrej Nemec 2017-05-23 11:35:02 UTC 
Multiple vulnerabilities were found in autotrace.

CVE-2017-9200: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:528:63.
CVE-2017-9199: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:192:19.
CVE-2017-9198: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:508:18.
CVE-2017-9197: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:498:55.
CVE-2017-9196: libautotrace.a in AutoTrace 0.31.1 has a "negative-size-param" issue in the ReadImage function in input-tga.c:528:7.
CVE-2017-9195: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:620:27.
CVE-2017-9194: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:559:29.
CVE-2017-9193: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:538:33.
CVE-2017-9192: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-tga.c:528:7.
CVE-2017-9191: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the rle_fread function in input-tga.c:252:15.
CVE-2017-9190: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid free), related to the free_bitmap function in bitmap.c:24:5.
CVE-2017-9189: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and application crash), related to the GET_COLOR function in color.c:16:11.
CVE-2017-9188: libautotrace.a in AutoTrace 0.31.1 has a "left shift ... cannot be represented in type int" issue in input-bmp.c:516:63.
CVE-2017-9187: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:486:7.
CVE-2017-9186: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:326:17.
CVE-2017-9185: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:319:7.
CVE-2017-9184: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:314:7.
CVE-2017-9183: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:309:7.
CVE-2017-9182: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (use-after-free and invalid heap read), related to the GET_COLOR function in color.c:16:11.
CVE-2017-9181: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bmp.c.
CVE-2017-9180: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp.c:440:14.
CVE-2017-9179: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp.c:425:14.
CVE-2017-9178: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bmp.c:421:11.
CVE-2017-9177: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp.c:390:12.
CVE-2017-9176: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bmp.c:370:25.
CVE-2017-9175: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bmp.c:353:25.
CVE-2017-9174: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and SEGV), related to the GET_COLOR function in color.c:21:23.
CVE-2017-9173: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:497:29.
CVE-2017-9172: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:496:29.
CVE-2017-9171: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-bmp.c:492:24.
CVE-2017-9170: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:370:25.
CVE-2017-9169: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:355:25.
CVE-2017-9168: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:353:25.
CVE-2017-9167: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:337:25.
CVE-2017-9166: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the GET_COLOR function in color.c:18:11.
CVE-2017-9165: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the GET_COLOR function in color.c:17:11.
CVE-2017-9164: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the GET_COLOR function in color.c:16:11.
CVE-2017-9163: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in pxl-outline.c:106:54.
CVE-2017-9162: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in autotrace.c:191:2.
CVE-2017-9161: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in autotrace.c:188:23.
CVE-2017-9160: libautotrace.a in AutoTrace 0.31.1 has a stack-based buffer overflow in the pnmscanner_gettoken function in input-pnm.c:458:12.
CVE-2017-9159: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_rawpbm function in input-pnm.c:391:15.
CVE-2017-9158: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_raw function in input-pnm.c:336:11.
CVE-2017-9157: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_ascii function in input-pnm.c:306:14.
CVE-2017-9156: libautotrace.a in AutoTrace 0.31.1 allow attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_ascii function in input-pnm.c:303:12.
CVE-2017-9155: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and SEGV), related to the input_pnm_reader function in input-pnm.c:243:3.
CVE-2017-9154: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and SEGV), related to the GET_COLOR function in color.c:16:11.
CVE-2017-9153: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the pnm_load_rawpbm function in input-pnm.c:391:13.
CVE-2017-9152: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the pnm_load_raw function in input-pnm.c:346:41.
CVE-2017-9151: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the pnm_load_ascii function in input-pnm.c:303:12.
Comment 1 Andrej Nemec 2017-05-23 11:35:26 UTC 
Created autotrace tracking bugs for this issue:

Affects: fedora-all [bug 1454715]
Comment 2 Andrej Nemec 2017-05-23 11:40:03 UTC 
References:

https://blogs.gentoo.org/ago/2017/05/20/autotrace-multiple-vulnerabilities-the-autotrace-nightmare/
http://seclists.org/oss-sec/2017/q2/330
Comment 3 Andrej Nemec 2017-05-23 11:41:18 UTC 
Statement:

Red Hat Product Security has rated these issues as having Low security impact. These issues are not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.