CVE Vulnerabilities

CVE-2019-19451

Loop with Unreachable Exit Condition ('Infinite Loop')

Published: Nov 29, 2019 | Modified: Nov 07, 2023
CVSS 3.x
5.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
4.9 MEDIUM
AV:L/AC:L/Au:N/C:N/I:N/A:C
RedHat/V2
RedHat/V3
Ubuntu
LOW

When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the systems logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.

Weakness

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Software

Name Vendor Start Version End Version
Dia Gnome * 2019-11-27 (excluding)
Dia Ubuntu bionic *
Dia Ubuntu devel *
Dia Ubuntu disco *
Dia Ubuntu eoan *
Dia Ubuntu esm-apps/bionic *
Dia Ubuntu esm-apps/focal *
Dia Ubuntu esm-apps/jammy *
Dia Ubuntu esm-apps/noble *
Dia Ubuntu focal *
Dia Ubuntu groovy *
Dia Ubuntu hirsute *
Dia Ubuntu impish *
Dia Ubuntu jammy *
Dia Ubuntu kinetic *
Dia Ubuntu lunar *
Dia Ubuntu mantic *
Dia Ubuntu noble *
Dia Ubuntu oracular *
Dia Ubuntu trusty *
Dia Ubuntu upstream *
Dia Ubuntu xenial *

References