CVE-2019-8383

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in AdvanceCOMP through 2.1. An invalid memory address occurs in the function adv_png_unfilter_8 in lib/png.c. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://access.redhat.com/errata/RHSA-2019:2332Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00034.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J23C6QSTJMQ467KAI6QG54AE4MZRLPQV/
https://research.loginsoft.com/bugs/invalid-memory-access-in-adv_png_unfilter_8-advancecomp/Exploit, Third Party Advisory
https://sourceforge.net/p/advancemame/bugs/272/Exploit, Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2332Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/12/msg00034.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J23C6QSTJMQ467KAI6QG54AE4MZRLPQV/
https://research.loginsoft.com/bugs/invalid-memory-access-in-adv_png_unfilter_8-advancecomp/Exploit, Third Party Advisory
https://sourceforge.net/p/advancemame/bugs/272/Exploit, Third Party Advisory

Timeline

Published: Feb 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-83859.8An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358. An unauthenticated directory traversal and local file inclusion vul CVE-2019-83879.8MASTER IPCAMERA01 3.3.4.2103 devices allow Remote Command Execution, related to the thttpd component.CVE-2019-83898.1A file-read vulnerability was identified in the Wi-Fi transfer feature of Musicloud 1.6. By default, the application runs a transfer service CVE-2019-83906.1qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter.CVE-2019-83916.1qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter.CVE-2019-83927.5An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03. There is incorrect access control allowing remote attackers to ena CVE-2019-83939.8Hotels_Server through 2018-11-05 has SQL Injection via the API because the controller/api/login.php telephone parameter is mishandled.CVE-2019-83946.5Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customizat CVE-2019-83959.8An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an a CVE-2019-83966.5A buffer overflow in H5O__layout_encode in H5Olayout.c in the HDF HDF5 through 1.10.4 library allows attackers to cause a denial of service CVE-2019-83976.5An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5T_close_real in H5T.c.CVE-2019-83986.5An issue was discovered in the HDF HDF5 1.10.4 library. There is an out of bounds read in the function H5T_get_size in H5T.c.