GNU Libextractor through 1.9 has a heap-based buffer over-read in the function EXTRACTOR_dvi_extract_method in plugins/dvi_extractor.c.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GNU Libextractor through 1.9 has a heap-based buffer over-read in the function     EXTRACTOR_dvi_extract_method in plugins/dvi_extractor.c. (CVE-2019-15531)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2851 advisory.

    Invalid read for malformed DVI files was fixed in GNU libextractor, a library that extracts meta-data from     files of arbitrary type. For Debian 9 stretch, this problem has been fixed in version 1:1.3-4+deb9u4. We     recommend that you upgrade your libextractor packages. For the detailed security status of libextractor     please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libextractor     Further information about Debian LTS security advisories, how to apply these updates to your system and     frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Patch for CVE-2019-15531

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

jianglin found an issue in libextractor, a library that extracts meta-data from files of arbitrary type.

A crafted file could result in a heap-buffer-overflow vulnerability in function EXTRACTOR_dvi_extract_method in dvi_extractor.c.

For Debian 8 'Jessie', this problem has been fixed in version 1:1.3-2+deb8u5.

We recommend that you upgrade your libextractor packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
257577	Linux Distros Unpatched Vulnerability : CVE-2019-15531	Nessus	Misc.	medium
156314	Debian DLA-2851-1 : libextractor - LTS security update	Nessus	Debian Local Security Checks	medium
129643	Fedora 31 : libextractor (2019-b467cab3c8)	Nessus	Fedora Local Security Checks	medium
128787	Fedora 30 : libextractor (2019-62b65ed7f6)	Nessus	Fedora Local Security Checks	medium
128785	Fedora 29 : libextractor (2019-5628767261)	Nessus	Fedora Local Security Checks	medium
128424	Debian DLA-1904-1 : libextractor security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2019-15531

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium