CVE-2013-1953
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows...
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.
Exploit likelihood
What each source reports
NVD Score used
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.
- Record
CVE-2013-1953- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.
- Record
CVE-2013-1953- Updated
- 2026-11-02
EUVDEUVD-2013-1943 No score
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.
- Record
EUVD-2013-1943- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j9fj-j92c-8fqr No score
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows...
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.
- Record
GHSA-j9fj-j92c-8fqr- Updated
- 2026-11-02
OSV No score
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.
- Record
CVE-2013-1953- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-1953 No score
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.
- Record
DEBIAN-CVE-2013-1953- Updated
- 2026-11-02
OSVMGASA-2013-0195 No score
Updated autotrace package fixes security vulnerability
Stack-based buffer overflow in bmp parser (CVE-2013-1953). Updated autotrace package corrects the issue.
- Record
MGASA-2013-0195- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-1953 No score
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.
- Record
UBUNTU-CVE-2013-1953- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gimpDebian:12 |
before 2.6.10-1 | 2.6.10-1 |
gimpDebian:13 |
before 2.6.10-1 | 2.6.10-1 |
gimpDebian:14 |
before 2.6.10-1 | 2.6.10-1 |
autotraceMageia:2 |
before 0.31.1-34.1.mga2 | 0.31.1-34.1.mga2 |
autotraceMageia:3 |
before 0.31.1-37.1.mga3 | 0.31.1-37.1.mga3 |
autotraceUbuntu:14.04:LTS |
before 0.31.1-16+deb7u1ubuntu0.1, plus listed versions 0.31.1-16build20.31.1-16+deb7u1build0.14.04.1 |
0.31.1-16+deb7u1ubuntu0.1 |
sam2pUbuntu:14.04:LTS |
All versions, plus listed versions 0.49.1-10.49.2-20.49.2-3+deb8u3build0.14.04.1 |
None known |
sam2pUbuntu:16.04:LTS |
All versions, plus listed versions 0.49.2-30.49.2-3+deb8u3build0.16.04.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1953 is a medium vulnerability (CVSS 6.8) in Autotrace Project Autotrace, published July 1, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.72%, the 77th percentile. Fixed in gimp 2.6.10-1.
References
bugzilla.redhat.com/show_bug.cgi?id=951257
openwall.com/lists/oss-security/2013/04/16/3
mandriva.com/security/advisories?name=MDVSA-2013:190
nvd.nist.gov/vuln/detail/CVE-2013-1953
github.com/advisories/GHSA-j9fj-j92c-8fqr
security-tracker.debian.org/tracker/CVE-2013-1953
Show 8 moreShow less
advisories.mageia.org/MGASA-2013-0195.html
bugs.mageia.org/show_bug.cgi?id=10566
lists.opensuse.org/opensuse-updates/2013-06/msg00168.html
ubuntu.com/security/CVE-2013-1953
git.gnome.org/browse/gimp/commit?h=d9c6f88141aecf956c5d7
cve.org/CVERecord?id=CVE-2013-1953