Null Pointer Dereference in GNOME Font Viewer Affects TTF Font Files
CVE-2019-19308

5.5MEDIUM

Key Information:

Vendor

Gnome
Status
Gnome-font-viewer
Vendor
CVE Published:
27 November 2019

What is CVE-2019-19308?

A vulnerability exists in GNOME Font Viewer (version 3.34.0) where a NULL pointer dereference can occur while parsing a TrueType Font (TTF) file that lacks a name section. This issue arises from the g_strconcat function returning NULL, leading to potential application crashes and stability issues when handling certain font files.

References

https://github.com/GNOME/gnome-font-viewer/blob/919dfbe68...
x_refsource_MISC
https://gitlab.gnome.org/GNOME/gnome-font-viewer/issues/17
x_refsource_CONFIRM

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.