CVE-2019-20326: debian debian_linux Out-of-bounds Write
CVSS: 7.8v3.1HighModified
AliasesMGASA-2020-0056MGASA-2021-0090UBUNTU-CVE-2019-20326DEBIAN-CVE-2019-20326DLA-2066-1DLA-2749-1
Published 16-03-2020Last modified 05-08-2024
Vulnerability summary
CVE-2019-20326 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 2.19% chance of exploitation in the next 30 days, higher than 82.1% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.8/10
010
High · v3.1 (NVD)EPSS score
2.19%
0%100%
Low · +0.04 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 16-03-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in GNOME gThumb before 3.8.3 and Linux Mint Pix before 2.4.5 allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
2.19%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
+0.04 pp
From 2.15% on 18-09-2026
18-09-202618-10-2026
EPSS score2.19%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCve 2019 20326
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian2 products
- gthumb< 3:3.8.3-0.1 | < 3:3.4.4.1-5+deb9u2 | < 3:3.3.1-2.1+deb8u2
- debian_linuxEOL9.0
Mageia2 products
- gthumb< 3.7.2-2.1.mga7
- pix< 2.4.11-1.mga7
Gnome1 product
- gthumb< 3.8.3
Linuxmint1 product
- pix< 2.4.5
Ubuntu1 product
- gthumb< 3:3.4.3-1ubuntu0.1~esm1 | < 3:3.6.1-1ubuntu0.1~esm1 | < 3:3.8.0-2.1ubuntu0.1
5 vendors · 7 products
References
17 links- gitlab.gnome.org/GNOME/gthumb/commit/4faa5ce2358812d23a1147953ee76f59631590adX Refsource CONFIRMREPORTPatchVendor Advisory
- gitlab.gnome.org/GNOME/gthumb/commit/ca8f528209ab78935c30e42fe53bdf1a24f3cb44X Refsource CONFIRMVendor Advisory
- gitlab.gnome.org/GNOME/gthumb/commits/master/extensions/cairo_io/cairo-image-surface-jpeg.cX Refsource CONFIRMVendor Advisory
lists.debian.org/debian-lts-announce/2021/08/msg00027.htmlMailing ListX Refsource MLISTThird Party Advisory