Red Hat Bugzilla – Bug 1454714
CVE-2017-9151..CVE-2017-9200 autotrace: Multiple security issues
Last modified: 2017-05-23 07:41:18 EDT
Multiple vulnerabilities were found in autotrace. CVE-2017-9200: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:528:63. CVE-2017-9199: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:192:19. CVE-2017-9198: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:508:18. CVE-2017-9197: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:498:55. CVE-2017-9196: libautotrace.a in AutoTrace 0.31.1 has a "negative-size-param" issue in the ReadImage function in input-tga.c:528:7. CVE-2017-9195: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:620:27. CVE-2017-9194: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:559:29. CVE-2017-9193: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:538:33. CVE-2017-9192: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-tga.c:528:7. CVE-2017-9191: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the rle_fread function in input-tga.c:252:15. CVE-2017-9190: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid free), related to the free_bitmap function in bitmap.c:24:5. CVE-2017-9189: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and application crash), related to the GET_COLOR function in color.c:16:11. CVE-2017-9188: libautotrace.a in AutoTrace 0.31.1 has a "left shift ... cannot be represented in type int" issue in input-bmp.c:516:63. CVE-2017-9187: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:486:7. CVE-2017-9186: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:326:17. CVE-2017-9185: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:319:7. CVE-2017-9184: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:314:7. CVE-2017-9183: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:309:7. CVE-2017-9182: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (use-after-free and invalid heap read), related to the GET_COLOR function in color.c:16:11. CVE-2017-9181: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bmp.c. CVE-2017-9180: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp.c:440:14. CVE-2017-9179: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp.c:425:14. CVE-2017-9178: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bmp.c:421:11. CVE-2017-9177: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp.c:390:12. CVE-2017-9176: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bmp.c:370:25. CVE-2017-9175: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bmp.c:353:25. CVE-2017-9174: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and SEGV), related to the GET_COLOR function in color.c:21:23. CVE-2017-9173: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:497:29. CVE-2017-9172: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:496:29. CVE-2017-9171: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-bmp.c:492:24. CVE-2017-9170: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:370:25. CVE-2017-9169: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:355:25. CVE-2017-9168: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:353:25. CVE-2017-9167: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:337:25. CVE-2017-9166: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the GET_COLOR function in color.c:18:11. CVE-2017-9165: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the GET_COLOR function in color.c:17:11. CVE-2017-9164: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the GET_COLOR function in color.c:16:11. CVE-2017-9163: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in pxl-outline.c:106:54. CVE-2017-9162: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in autotrace.c:191:2. CVE-2017-9161: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in autotrace.c:188:23. CVE-2017-9160: libautotrace.a in AutoTrace 0.31.1 has a stack-based buffer overflow in the pnmscanner_gettoken function in input-pnm.c:458:12. CVE-2017-9159: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_rawpbm function in input-pnm.c:391:15. CVE-2017-9158: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_raw function in input-pnm.c:336:11. CVE-2017-9157: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_ascii function in input-pnm.c:306:14. CVE-2017-9156: libautotrace.a in AutoTrace 0.31.1 allow attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_ascii function in input-pnm.c:303:12. CVE-2017-9155: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and SEGV), related to the input_pnm_reader function in input-pnm.c:243:3. CVE-2017-9154: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and SEGV), related to the GET_COLOR function in color.c:16:11. CVE-2017-9153: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the pnm_load_rawpbm function in input-pnm.c:391:13. CVE-2017-9152: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the pnm_load_raw function in input-pnm.c:346:41. CVE-2017-9151: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the pnm_load_ascii function in input-pnm.c:303:12.
Created autotrace tracking bugs for this issue: Affects: fedora-all [bug 1454715]
References: https://blogs.gentoo.org/ago/2017/05/20/autotrace-multiple-vulnerabilities-the-autotrace-nightmare/ http://seclists.org/oss-sec/2017/q2/330
Statement: Red Hat Product Security has rated these issues as having Low security impact. These issues are not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.