Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2019-8383: AdvanceCOMP may crash when opening malicious PNG files
CVE-2019-8383 · published 7 years ago
Summary
The AdvanceCOMP package (up to version 2.1) can hit an invalid memory address when it processes specially crafted PNG files. This could cause the program to stop working, denying service to users. Update to the latest package version or avoid opening untrusted PNG files until a fix is applied.
What to do
- Update debian advancecomp to version 2.1-2.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | advancecomp |
< 2.1-2.1 Fix: upgrade to 2.1-2.1
|
| Debian:13 | debian | advancecomp |
< 2.1-2.1 Fix: upgrade to 2.1-2.1
|
| Debian:14 | debian | advancecomp |
< 2.1-2.1 Fix: upgrade to 2.1-2.1
|
| – | advancemame | advancecomp |
<= 2.1 cpe:2.3:a:advancemame:advancecomp:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
9.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
30 cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_for_power_little_endian |
7.0 cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_server |
7.0 cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_workstation |
7.0 cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered in AdvanceCOMP through 2.1. An invalid memory address occurs in the function adv_png_unfilter_8 in lib/png.c. It can be triggered by sending a crafted file to a binary. It a...
An issue was discovered in AdvanceCOMP through 2.1. An invalid memory address occurs in the function adv_png_unfilter_8 in lib/png.c. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file.
References
- https://security-tracker.debian.org/tracker/CVE-2019-8383 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:2332 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/12/msg00034.html Mailing List Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://research.loginsoft.com/bugs/invalid-memory-access-in-adv_png_unfilter_8-... Exploit Third Party Advisory
- https://sourceforge.net/p/advancemame/bugs/272/ Exploit Third Party Advisory
Severity
7.8
High
Type
CWE-119Buffer Overflow
Timeline
Published17 Feb 2019
Updated4 Nov 2026
First seen21 Sep 2026
Track software like this
Free during beta