CVE-2019-19308

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer dereference while parsing a TTF font file that lacks a name section (due to a g_strconcat call that returns NULL).

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/GNOME/gnome-font-viewer/blob/919dfbe684b75904563b8c6723c9778a4e00aad7/src/sushi-font-widget.c#L115-L117Third Party Advisory
https://gitlab.gnome.org/GNOME/gnome-font-viewer/issues/17Patch, Third Party Advisory
https://github.com/GNOME/gnome-font-viewer/blob/919dfbe684b75904563b8c6723c9778a4e00aad7/src/sushi-font-widget.c#L115-L117Third Party Advisory
https://gitlab.gnome.org/GNOME/gnome-font-viewer/issues/17Patch, Third Party Advisory

Timeline

Published: Nov 27, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-193094.3GitLab Enterprise Edition (EE) 8.90 and later through 12.5 has Incorrect Access Control.CVE-2019-19316.1Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center (FMC) could allow a CVE-2019-193104.9GitLab Enterprise Edition (EE) 9.0 and later through 12.5 allows Information Disclosure.CVE-2019-193115.4GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields.CVE-2019-193125.8GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 has Incorrect Access Control. After a project changed to private, previously forked reposito CVE-2019-193137.5GitLab EE 12.3 through 12.5, 12.4.3, and 12.3.6 allows Denial of Service. Certain characters were making it impossible to create, edit, or v CVE-2019-193147.5GitLab EE 8.4 through 12.5, 12.4.3, and 12.3.6 stored several tokens in plaintext.CVE-2019-193157.1NLSSRV32.EXE in Nalpeiron Licensing Service 7.3.4.0, as used with Nitro PDF and other products, allows Elevation of Privilege via the \\.\ma CVE-2019-193167.5When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snap CVE-2019-193179.8lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to ca CVE-2019-193184.4In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can CVE-2019-193196.5In the Linux kernel before 5.2, a setxattr operation, after a mount of a crafted ext4 image, can cause a slab-out-of-bounds write access bec