Every CVE Search/ Get API key

CVE-2019-19451

When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid...

5.5 MediumFix available

CVE-2019-19451 is a medium vulnerability (CVSS 5.5) in Gnome Dia, published November 29, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in dia 0.97.3-r1.

When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.37%Down 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.5

When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.

Record
CVE-2019-19451
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
4.9 MediumAV:L/AC:L/Au:N/C:N/I:N/A:C
Weakness
CWE-835
Updated
2026-11-02
CVE List No score

When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.

Record
CVE-2019-19451
Updated
2026-11-02
EUVDEUVD-2019-9071 No score

When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.

Record
EUVD-2019-9071
Updated
2026-11-03
GitHub AdvisoriesGHSA-4vq3-2rwv-w7mg 5.5

When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid...

When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.

Record
GHSA-4vq3-2rwv-w7mg
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
OSVALPINE-CVE-2019-19451 5.5

When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.

Record
ALPINE-CVE-2019-19451
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSV 5.5

When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.

Record
CVE-2019-19451
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2019-19451 5.5

When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.

Record
DEBIAN-CVE-2019-19451
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-19451 5.5

When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.

Record
UBUNTU-CVE-2019-19451
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2020-0022 No score

Updated dia packages fix security vulnerability

Updated dia package fixes security vulnerability:

An endless loop on filenames with invalid encoding (CVE-2019-19451).

Record
MGASA-2020-0022
Updated
2026-11-02
OSVopenSUSE-SU-2020:0021-1 No score

Security update for dia

This update for dia fixes the following issue:

  • CVE-2019-19451: Fixed an endless loop on filenames with invalid encoding (bsc#1158194).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:0021-1
Updated
2026-11-02
OSVSUSE-SU-2019:3390-1 No score

Security update for dia

This update for dia fixes the following issue:

  • CVE-2019-19451: Fixed an endless loop on filenames with invalid encoding (bsc#1158194).
Record
SUSE-SU-2019:3390-1
Updated
2026-11-02
OSVSUSE-SU-2019:3391-1 No score

Security update for dia

This update for dia fixes the following issue:

  • CVE-2019-19451: Fixed an endless loop on filenames with invalid encoding (bsc#1158194).
Record
SUSE-SU-2019:3391-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dia
Alpine:v3.11
before 0.97.3-r1
0.97.3-r1
dia
Alpine:v3.12
before 0.97.3-r1
0.97.3-r1
dia
Alpine:v3.13
before 0.97.3-r1
0.97.3-r1
dia
Alpine:v3.14
before 0.97.3-r1
0.97.3-r1
dia
Alpine:v3.15
before 0.97.3-r1
0.97.3-r1
dia
Alpine:v3.16
before 0.97.3-r1
0.97.3-r1
dia
Alpine:v3.17
before 0.97.3-r1
0.97.3-r1
dia
Debian:12
before 0.97.3+git20220525-1
0.97.3+git20220525-1
dia
Debian:13
before 0.97.3+git20220525-1
0.97.3+git20220525-1
dia
Debian:14
before 0.97.3+git20220525-1
0.97.3+git20220525-1
Show 17 moreShow less
Affected packages
PackageAffectedFixed
dia
Mageia:7
before 0.97.3-8.1.mga7
0.97.3-8.1.mga7
dia
SUSE:Linux Enterprise Desktop 12 SP4
before 0.97.3-17.4.1
0.97.3-17.4.1
dia
SUSE:Linux Enterprise Software Development Kit 12 SP4
before 0.97.3-17.4.1
0.97.3-17.4.1
dia
SUSE:Linux Enterprise Software Development Kit 12 SP5
before 0.97.3-17.4.1
0.97.3-17.4.1
dia
SUSE:Linux Enterprise Workstation Extension 12 SP4
before 0.97.3-17.4.1
0.97.3-17.4.1
dia
SUSE:Linux Enterprise Workstation Extension 12 SP5
before 0.97.3-17.4.1
0.97.3-17.4.1
dia
SUSE:Linux Enterprise Workstation Extension 15
before 0.97.3-4.3.3
0.97.3-4.3.3
dia
SUSE:Linux Enterprise Workstation Extension 15 SP1
before 0.97.3-4.3.3
0.97.3-4.3.3
dia
Ubuntu:16.04:LTS
All versions, plus listed versions
0.97.3-1
None known
dia
Ubuntu:18.04:LTS
All versions, plus listed versions
0.97.3+git20160930-60.97.3+git20160930-70.97.3+git20160930-8
None known
dia
Ubuntu:20.04:LTS
All versions, plus listed versions
0.97.3+git20160930-8.10.97.3+git20160930-8.20.97.3+git20160930-9
None known
dia
Ubuntu:22.04:LTS
All versions, plus listed versions
0.97.3+git20160930-90.97.3+git20160930-9build1
None known
dia
Ubuntu:24.04:LTS
All versions, plus listed versions
0.97.3+git20220525-5build10.97.3+git20220525-5build20.97.3+git20220525-5build30.98+git20240130-10.98+git20240130-1build20.98+git20240130-1build30.98+git20240130-1build4
None known
dia
Ubuntu:25.10
All versions, plus listed versions
0.98+git20250126-1build10.98+git20250126-1build20.98+git20250126-20.98+git20250126-2ubuntu10.98+git20250902-0ubuntu1
None known
dia
Ubuntu:26.10
All versions, plus listed versions
0.98+git20260221-10.98+git20260221-20.98+git20260221-3
None known
dia
Ubuntu:26.04:LTS
All versions, plus listed versions
0.98+git20250902-0ubuntu10.98+git20250902-0ubuntu20.98+git20260221-1
None known
dia
openSUSE:Leap 15.1
before 0.97.3-lp151.4.3.1
0.97.3-lp151.4.3.1

History

History
WhenChangedSources
2026-11-03affected, aliases, referencesOSV
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 14 moreShow less
MoveEnter Open