Bug 1454714 (CVE-2017-9151, CVE-2017-9152, CVE-2017-9153, CVE-2017-9154, CVE-2017-9155, CVE-2017-9156, CVE-2017-9157, CVE-2017-9158, CVE-2017-9159, CVE-2017-9160, CVE-2017-9161, CVE-2017-9162, CVE-2017-9163, CVE-2017-9164, CVE-2017-9165, CVE-2017-9166, CVE-2017-9167, CVE-2017-9168, CVE-2017-9169, CVE-2017-9170, CVE-2017-9171, CVE-2017-9172, CVE-2017-9173, CVE-2017-9174, CVE-2017-9175, CVE-2017-9176, CVE-2017-9177, CVE-2017-9178, CVE-2017-9179, CVE-2017-9180, CVE-2017-9181, CVE-2017-9182, CVE-2017-9183, CVE-2017-9184, CVE-2017-9185, CVE-2017-9186, CVE-2017-9187, CVE-2017-9188, CVE-2017-9189, CVE-2017-9190, CVE-2017-9191, CVE-2017-9192, CVE-2017-9193, CVE-2017-9194, CVE-2017-9195, CVE-2017-9196, CVE-2017-9197, CVE-2017-9198, CVE-2017-9199, CVE-2017-9200) - CVE-2017-9151..CVE-2017-9200 autotrace: Multiple security issues
Summary: CVE-2017-9151..CVE-2017-9200 autotrace: Multiple security issues
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2017-9151, CVE-2017-9152, CVE-2017-9153, CVE-2017-9154, CVE-2017-9155, CVE-2017-9156, CVE-2017-9157, CVE-2017-9158, CVE-2017-9159, CVE-2017-9160, CVE-2017-9161, CVE-2017-9162, CVE-2017-9163, CVE-2017-9164, CVE-2017-9165, CVE-2017-9166, CVE-2017-9167, CVE-2017-9168, CVE-2017-9169, CVE-2017-9170, CVE-2017-9171, CVE-2017-9172, CVE-2017-9173, CVE-2017-9174, CVE-2017-9175, CVE-2017-9176, CVE-2017-9177, CVE-2017-9178, CVE-2017-9179, CVE-2017-9180, CVE-2017-9181, CVE-2017-9182, CVE-2017-9183, CVE-2017-9184, CVE-2017-9185, CVE-2017-9186, CVE-2017-9187, CVE-2017-9188, CVE-2017-9189, CVE-2017-9190, CVE-2017-9191, CVE-2017-9192, CVE-2017-9193, CVE-2017-9194, CVE-2017-9195, CVE-2017-9196, CVE-2017-9197, CVE-2017-9198, CVE-2017-9199, CVE-2017-9200
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1454715
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-05-23 11:35 UTC by Andrej Nemec
Modified: 2021-02-17 02:06 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-05-23 11:41:18 UTC
Embargoed:

Attachments (Terms of Use)

Description Andrej Nemec 2017-05-23 11:35:02 UTC 
Multiple vulnerabilities were found in autotrace.

CVE-2017-9200: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:528:63.
CVE-2017-9199: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:192:19.
CVE-2017-9198: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:508:18.
CVE-2017-9197: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-tga.c:498:55.
CVE-2017-9196: libautotrace.a in AutoTrace 0.31.1 has a "negative-size-param" issue in the ReadImage function in input-tga.c:528:7.
CVE-2017-9195: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:620:27.
CVE-2017-9194: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:559:29.
CVE-2017-9193: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:538:33.
CVE-2017-9192: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-tga.c:528:7.
CVE-2017-9191: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the rle_fread function in input-tga.c:252:15.
CVE-2017-9190: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid free), related to the free_bitmap function in bitmap.c:24:5.
CVE-2017-9189: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and application crash), related to the GET_COLOR function in color.c:16:11.
CVE-2017-9188: libautotrace.a in AutoTrace 0.31.1 has a "left shift ... cannot be represented in type int" issue in input-bmp.c:516:63.
CVE-2017-9187: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:486:7.
CVE-2017-9186: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:326:17.
CVE-2017-9185: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:319:7.
CVE-2017-9184: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:314:7.
CVE-2017-9183: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in input-bmp.c:309:7.
CVE-2017-9182: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (use-after-free and invalid heap read), related to the GET_COLOR function in color.c:16:11.
CVE-2017-9181: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bmp.c.
CVE-2017-9180: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp.c:440:14.
CVE-2017-9179: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp.c:425:14.
CVE-2017-9178: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bmp.c:421:11.
CVE-2017-9177: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and SEGV), related to the ReadImage function in input-bmp.c:390:12.
CVE-2017-9176: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bmp.c:370:25.
CVE-2017-9175: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the ReadImage function in input-bmp.c:353:25.
CVE-2017-9174: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and SEGV), related to the GET_COLOR function in color.c:21:23.
CVE-2017-9173: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:497:29.
CVE-2017-9172: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:496:29.
CVE-2017-9171: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-bmp.c:492:24.
CVE-2017-9170: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:370:25.
CVE-2017-9169: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:355:25.
CVE-2017-9168: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:353:25.
CVE-2017-9167: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the ReadImage function in input-bmp.c:337:25.
CVE-2017-9166: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the GET_COLOR function in color.c:18:11.
CVE-2017-9165: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the GET_COLOR function in color.c:17:11.
CVE-2017-9164: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the GET_COLOR function in color.c:16:11.
CVE-2017-9163: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in pxl-outline.c:106:54.
CVE-2017-9162: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in autotrace.c:191:2.
CVE-2017-9161: libautotrace.a in AutoTrace 0.31.1 has a "cannot be represented in type int" issue in autotrace.c:188:23.
CVE-2017-9160: libautotrace.a in AutoTrace 0.31.1 has a stack-based buffer overflow in the pnmscanner_gettoken function in input-pnm.c:458:12.
CVE-2017-9159: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_rawpbm function in input-pnm.c:391:15.
CVE-2017-9158: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_raw function in input-pnm.c:336:11.
CVE-2017-9157: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_ascii function in input-pnm.c:306:14.
CVE-2017-9156: libautotrace.a in AutoTrace 0.31.1 allow attackers to cause a denial of service (invalid write and SEGV), related to the pnm_load_ascii function in input-pnm.c:303:12.
CVE-2017-9155: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and SEGV), related to the input_pnm_reader function in input-pnm.c:243:3.
CVE-2017-9154: libautotrace.a in AutoTrace 0.31.1 allows attackers to cause a denial of service (invalid read and SEGV), related to the GET_COLOR function in color.c:16:11.
CVE-2017-9153: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the pnm_load_rawpbm function in input-pnm.c:391:13.
CVE-2017-9152: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the pnm_load_raw function in input-pnm.c:346:41.
CVE-2017-9151: libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the pnm_load_ascii function in input-pnm.c:303:12.
Comment 1 Andrej Nemec 2017-05-23 11:35:26 UTC 
Created autotrace tracking bugs for this issue:

Affects: fedora-all [bug 1454715]
Comment 2 Andrej Nemec 2017-05-23 11:40:03 UTC 
References:

https://blogs.gentoo.org/ago/2017/05/20/autotrace-multiple-vulnerabilities-the-autotrace-nightmare/
http://seclists.org/oss-sec/2017/q2/330
Comment 3 Andrej Nemec 2017-05-23 11:41:18 UTC 
Statement:

Red Hat Product Security has rated these issues as having Low security impact. These issues are not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Note You need to log in before you can comment on or make changes to this bug.