Various security flaws were found in potrace: October 22, 2015: Release 1.13. Some critical bugs in the processing of BMP files were fixed. These bugs allowed the program to be crashed, or potentially to be abused in other ways, by feeding it specially crafted BMP files. Thanks to Tomasz Buchert and Agostino Sarubbo for reporting these bugs. Portability was improved for C99 and for MSVC++. Thanks to Peter Breitenlohner, Nelson Beebe, and Martin Gieseking for reporting portability issues. External References: http://potrace.sourceforge.net/#news
Created potrace tracking bugs for this issue: Affects: fedora-all [bug 1277875] Affects: epel-all [bug 1277876]
To be exactly, the vulnerabilities was: 6 heap overflow 3 null pointer dereference 1 divide by zero
Some of the builds of 1.13 got hit by build system issues https://fedorahosted.org/rel-eng/ticket/6288 Once I get everything build, I'll submit the updates.
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.