Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

AutoTrace may read beyond memory when processing TGA files

CVE-2017-9195 · published 9 years ago
Summary

AutoTrace version 0.31.1 can read past the end of a data buffer while handling TGA image files, which could cause the program to crash or be exploited by a specially crafted file. This risk mainly affects systems that open TGA images with AutoTrace. Apply any available updates or patches, and avoid processing TGA files from untrusted sources until the issue is fixed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
autotrace_project autotrace 0.31.1
cpe:2.3:a:autotrace_project:autotrace:0.31.1:*:*:*:*:*:*:*
Original advisory text
libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:620:27.
libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer over-read in the ReadImage function in input-tga.c:620:27.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published23 May 2017
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-9195 · NVD
Track software like this
Free during beta