When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the     current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from     a thumbnailer service, this output will usually be written to disk via the system's logging facility     (potentially with elevated privileges), thus filling up the disk and eventually rendering the system     unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release,     but affects certain Linux distribution packages with version numbers such as 0.97.3. (CVE-2019-19451)

Note that Nessus relies on the presence of the package as reported by the vendor.

- Added upstream patch to avoid infinite loop on filenames     with invalid encoding (CVE-2019-19451, #1778767)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for dia fixes the following issue :

  - CVE-2019-19451: Fixed an endless loop on filenames with     invalid encoding (bsc#1158194).

This update was imported from the SUSE:SLE-15:Update update project.

This update for dia fixes the following issue :

CVE-2019-19451: Fixed an endless loop on filenames with invalid encoding (bsc#1158194).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
222754	Linux Distros Unpatched Vulnerability : CVE-2019-19451	Nessus	Misc.	medium
145016	Fedora 33 : 1:dia (2020-1fe0e08c8d)	Nessus	Fedora Local Security Checks	medium
144835	Fedora 32 : 1:dia (2020-cbc0754798)	Nessus	Fedora Local Security Checks	medium
132908	openSUSE Security Update : dia (openSUSE-2020-21)	Nessus	SuSE Local Security Checks	medium
132431	SUSE SLED12 Security Update : dia (SUSE-SU-2019:3390-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2019-19451

medium

Tenable Plugins

medium

medium

medium

medium

medium