CVE-2016-7392

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Heap-based buffer overflow in the pstoedit_suffix_table_init function in output-pstoedit.c in AutoTrace 0.31.1 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted bmp image file.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/09/10/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/09/12/7Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/92907Third Party Advisory, VDB Entry
https://blogs.gentoo.org/ago/2016/09/10/autotrace-heap-based-buffer-overflow-in-pstoedit_suffix_table_init-output-pstoedit-c/Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1375255Issue Tracking
https://security.gentoo.org/glsa/201708-09
http://www.openwall.com/lists/oss-security/2016/09/10/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/09/12/7Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/92907Third Party Advisory, VDB Entry
https://blogs.gentoo.org/ago/2016/09/10/autotrace-heap-based-buffer-overflow-in-pstoedit_suffix_table_init-output-pstoedit-c/Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1375255Issue Tracking
https://security.gentoo.org/glsa/201708-09

Timeline

Published: Feb 15, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-73935.5Stack-based buffer overflow in the aac_sync function in aac_parser.c in Libav before 11.5 allows remote attackers to cause a denial of servi CVE-2016-73946.1tiki wiki cms groupware <=15.2 has a xss vulnerability, allow attackers steal user's cookie.CVE-2016-73958.8SkPath.cpp in Skia, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, does not properly val CVE-2016-73974.4The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information CVE-2016-73989.8A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlie CVE-2016-73999.8scripts/license.pl in Veritas NetBackup Appliance 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x allow rem CVE-2016-74009.8Multiple SQL injection vulnerabilities in Exponent CMS before 2.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) id CVE-2016-74017.5The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers CVE-2016-74029.8SAP ASE 16.0 SP02 PL03 and prior versions allow attackers who own SourceDB and TargetDB databases to elevate privileges to sa (system admini CVE-2016-74049.8OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving CVE-2016-74059.8The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injectio CVE-2016-74069.8Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in