New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2018-19761 #78

Closed

saitoha opened this issue Dec 4, 2018 · 3 comments

Owner

saitoha commented Dec 4, 2018

CVE-2018-19761
https://nvd.nist.gov/vuln/detail/CVE-2018-19761
https://bugzilla.redhat.com/show_bug.cgi?id=1649200

crabdancing commented Feb 27, 2019

Any input on this? It's been quite awhile.

Contributor

knok commented Aug 21, 2019

It seems not security issue, just un-freed memory allocation because of corrupted sixel input.
The following patch is force unreference sixel allocator:
https://salsa.debian.org/debian/libsixel/blob/debian-stretch/debian/patches/0004-force-free-memory-allocator.patch

Owner Author

saitoha commented Dec 17, 2019

POC3 on https://bugzilla.redhat.com/attachment.cgi?id=1505141 causes integer overflow on v1.8.2.
This problem is fixed on v1.8.3, with 1377517. Thanks.

saitoha closed this as completed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment