CVE-2019-19451

NameCVE-2019-19451
DescriptionWhen GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs945876

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
dia (PTS)jessie0.97.3-1vulnerable
stretch0.97.3+git20160930-6vulnerable
buster0.97.3+git20160930-8.1vulnerable
bullseye0.97.3+git20160930-9vulnerable
bookworm0.97.3+git20220525-5fixed
sid, trixie0.98+git20240130-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
diasourcewheezy(unfixed)end-of-life
diasource(unstable)0.97.3+git20220525-1unimportant945876

Notes

https://gitlab.gnome.org/GNOME/dia/issues/428
Introduced by: https://gitlab.gnome.org/GNOME/dia/commit/9a5f438d4b3e718c8ab0efe01d08ee2c3a0d9a86
Fixed by: https://gitlab.gnome.org/GNOME/dia/commit/baa2df853f9fb770eedcf3d94c7f5becebc90bb9
Negligible security impact, hang in end user tool

Search for package or bug name: Reporting problems