A biWidth*biBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows attackers to provide an unexpected input value to malloc via a malformed bitmap image.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A biWidth*biBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows attackers to provide an     unexpected input value to malloc via a malformed bitmap image. (CVE-2019-19004)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-004 advisory.

    A biWidth*biBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows attackers to provide an     unexpected input value to malloc via a malformed bitmap image. (CVE-2019-19004)

    A bitmap double free in main.c in autotrace 0.31.1 allows attackers to cause an unspecified impact via a     malformed bitmap image. This may occur after the use-after-free in CVE-2017-9182. (CVE-2019-19005)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1929 advisory.

    Heap-based buffer overflow in the pstoedit_suffix_table_init function in output-pstoedit.c in AutoTrace     0.31.1 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted bmp image     file. (CVE-2016-7392)

    A biWidth*biBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows attackers to provide an     unexpected input value to malloc via a malformed bitmap image. (CVE-2019-19004)

    A bitmap double free in main.c in autotrace 0.31.1 allows attackers to cause an unspecified impact via a     malformed bitmap image. This may occur after the use-after-free in CVE-2017-9182. (CVE-2019-19005)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-160 advisory.

    A biWidth*biBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows attackers to provide an     unexpected input value to malloc via a malformed bitmap image. (CVE-2019-19004)

    A bitmap double free in main.c in autotrace 0.31.1 allows attackers to cause an unspecified impact via a     malformed bitmap image. This may occur after the use-after-free in CVE-2017-9182. (CVE-2019-19005)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2021:4519 advisory.

  - A biWidth*biBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows attackers to provide an     unexpected input value to malloc via a malformed bitmap image. (CVE-2019-19004)

  - A bitmap double free in main.c in autotrace 0.31.1 allows attackers to cause an unspecified impact via a     malformed bitmap image. This may occur after the use-after-free in CVE-2017-9182. (CVE-2019-19005)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4519 advisory.

    AutoTrace is a program for converting bitmaps to vector graphics.

    Security Fix(es):

    * autotrace: bitmap double free in main.c allows attackers to cause an unspecified impact (CVE-2019-19005)

    * autotrace: integer overflow in input-bmp.c (CVE-2019-19004)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2021:4519 advisory.

  - autotrace: integer overflow in input-bmp.c (CVE-2019-19004)

  - autotrace: bitmap double free in main.c allows attackers to cause an unspecified impact (CVE-2019-19005)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
253284	Linux Distros Unpatched Vulnerability : CVE-2019-19004	Nessus	Misc.	low
173078	Amazon Linux 2023 : autotrace, autotrace-devel (ALAS2023-2023-004)	Nessus	Amazon Linux Local Security Checks	high
171047	Amazon Linux 2 : autotrace, autotrace-devel (ALAS-2023-1929)	Nessus	Amazon Linux Local Security Checks	high
166994	Amazon Linux 2022 : autotrace, autotrace-devel (ALAS2022-2022-160)	Nessus	Amazon Linux Local Security Checks	high
157661	AlmaLinux 8 : autotrace (ALSA-2021:4519)	Nessus	Alma Linux Local Security Checks	high
155107	RHEL 8 : autotrace (RHSA-2021:4519)	Nessus	Red Hat Local Security Checks	high
155078	CentOS 8 : autotrace (CESA-2021:4519)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2019-19004

low

Tenable Plugins

low

high

high

high

high

high

high