Vulnerability Details : CVE-2019-1010006
Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail.
Vulnerability category: OverflowMemory CorruptionDenial of service
Products affected by CVE-2019-1010006
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:gnome:evince:3.26.0:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
- cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-1010006
0.19%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 57 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-1010006
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
|
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST | |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST | 2024-02-02 |
CWE ids for CVE-2019-1010006
-
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.Assigned by: nvd@nist.gov (Primary)
-
The product writes data past the end, or before the beginning, of the intended buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-1010006
-
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00046.html
[security-announce] openSUSE-SU-2019:1908-1: important: Security updateMailing List;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2019/08/msg00014.html
[SECURITY] [DLA 1882-1] atril security updateMailing List;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2019/08/msg00013.html
[SECURITY] [DLA 1881-1] evince security updateMailing List;Third Party Advisory
-
https://bugzilla.gnome.org/show_bug.cgi?id=788980
Bug 788980 – Multiple out of bound write and segfaultExploit;Issue Tracking;Third Party Advisory
-
https://seclists.org/bugtraq/2020/Feb/18
Bugtraq: [SECURITY] [DSA 4624-1] evince security updateMailing List;Third Party Advisory
-
https://www.debian.org/security/2020/dsa-4624
Debian -- Security Information -- DSA-4624-1 evinceThird Party Advisory
-
https://usn.ubuntu.com/4067-1/
USN-4067-1: Evince vulnerability | Ubuntu security noticesThird Party Advisory
-
http://bugzilla.maptools.org/show_bug.cgi?id=2745
Bug 2745 – Multiple out of bound writeExploit;Issue Tracking;Third Party Advisory
Jump to