[ GLSA 201708-09 ] AutoTrace

[GLSA]

Gentoo Linux Security Advisory

Title: AutoTrace: Multiple vulnerabilities (GLSA 201708-09)
Severity: normal
Exploitable: remote
Date: 2017-08-26
Bug(s): #613992, #619040
ID: 201708-09

Synopsis

Multiple vulnerabilities have been found in AutoTrace, the worst of
which could cause a Denial of Service condition.


Background

AutoTrace converts bitmap to vector graphics.

Affected Packages

Package: media-gfx/autotrace
Vulnerable: <= 0.31.1-r8
Architectures: All supported architectures


Description

Heap-based buffer overflows have been discovered in the
pstoedit_suffix_table_init and pnm_load_rawpbm functions of AutoTrace.


Impact

Remote attackers, by enticing a user to process a crafted bmp image
file, could cause a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

Gentoo has discontinued support for AutoTrace. We recommend that users
unmerge AutoTrace: