CVE-2019-8379
Fixed in a distro release EPSS 1%
An issue was discovered in AdvanceCOMP through 2.1. A NULL pointer dereference exists in the function be_uint32_read() located in endianrw.h. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file.
Products: advancemame advancecomp, debian_linux, fedoraproject fedora, redhat enterprise_linux_for_power_little_endian, redhat enterprise_linux_server, redhat enterprise_linux_workstation
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | advancecomp | 1.15-21.amzn2 |
| Amazon Linux 2 | emacs-mercurial | 2.6.2-10.amzn2 |
| Amazon Linux 2 | emacs-mercurial-el | 2.6.2-10.amzn2 |
| Amazon Linux 2 | mercurial | 2.6.2-10.amzn2 |
| Amazon Linux 2 | mercurial-hgk | 2.6.2-10.amzn2 |
| Debian 12 | advancecomp | 2.1-2.1 |
| Debian 13 | advancecomp | 2.1-2.1 |
| Debian 14 | advancecomp | 2.1-2.1 |
| Debian 9 | advancecomp | 1.20-1+deb9u1 |
| Red Hat Enterprise Linux 7 | advancecomp | 0:1.15-21.el7 |
| Red Hat Enterprise Linux 7 | advancecomp-debuginfo | 0:1.15-21.el7 |
| Ubuntu 18.04 LTS | advancecomp | 2.1-1ubuntu0.18.04.2 |
| Ubuntu Pro 16.04 LTS | advancecomp | 1.20-1ubuntu0.2+esm1 |