CVE-2019-19451
When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid...
CVE-2019-19451 is a medium vulnerability (CVSS 5.5) in Gnome Dia, published November 29, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in dia 0.97.3-r1.
When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
5.5
When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.
- Record
CVE-2019-19451- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.9 Medium
AV:L/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-835
- Updated
- 2026-11-02
CVE List No score
When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.
- Record
CVE-2019-19451- Updated
- 2026-11-02
EUVDEUVD-2019-9071 No score
When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.
- Record
EUVD-2019-9071- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4vq3-2rwv-w7mg
5.5
When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid...
When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.
- Record
GHSA-4vq3-2rwv-w7mg- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVALPINE-CVE-2019-19451
5.5
When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.
- Record
ALPINE-CVE-2019-19451- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
5.5
When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.
- Record
CVE-2019-19451- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2019-19451
5.5
When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.
- Record
DEBIAN-CVE-2019-19451- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-19451
5.5
When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.
- Record
UBUNTU-CVE-2019-19451- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2020-0022 No score
Updated dia packages fix security vulnerability
Updated dia package fixes security vulnerability:
An endless loop on filenames with invalid encoding (CVE-2019-19451).
- Record
MGASA-2020-0022- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0021-1 No score
Security update for dia
This update for dia fixes the following issue:
- CVE-2019-19451: Fixed an endless loop on filenames with invalid encoding (bsc#1158194).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:0021-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:3390-1 No score
Security update for dia
This update for dia fixes the following issue:
- CVE-2019-19451: Fixed an endless loop on filenames with invalid encoding (bsc#1158194).
- Record
SUSE-SU-2019:3390-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:3391-1 No score
Security update for dia
This update for dia fixes the following issue:
- CVE-2019-19451: Fixed an endless loop on filenames with invalid encoding (bsc#1158194).
- Record
SUSE-SU-2019:3391-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
diaAlpine:v3.11 |
before 0.97.3-r1 | 0.97.3-r1 |
diaAlpine:v3.12 |
before 0.97.3-r1 | 0.97.3-r1 |
diaAlpine:v3.13 |
before 0.97.3-r1 | 0.97.3-r1 |
diaAlpine:v3.14 |
before 0.97.3-r1 | 0.97.3-r1 |
diaAlpine:v3.15 |
before 0.97.3-r1 | 0.97.3-r1 |
diaAlpine:v3.16 |
before 0.97.3-r1 | 0.97.3-r1 |
diaAlpine:v3.17 |
before 0.97.3-r1 | 0.97.3-r1 |
diaDebian:12 |
before 0.97.3+git20220525-1 | 0.97.3+git20220525-1 |
diaDebian:13 |
before 0.97.3+git20220525-1 | 0.97.3+git20220525-1 |
diaDebian:14 |
before 0.97.3+git20220525-1 | 0.97.3+git20220525-1 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
diaMageia:7 |
before 0.97.3-8.1.mga7 | 0.97.3-8.1.mga7 |
diaSUSE:Linux Enterprise Desktop 12 SP4 |
before 0.97.3-17.4.1 | 0.97.3-17.4.1 |
diaSUSE:Linux Enterprise Software Development Kit 12 SP4 |
before 0.97.3-17.4.1 | 0.97.3-17.4.1 |
diaSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 0.97.3-17.4.1 | 0.97.3-17.4.1 |
diaSUSE:Linux Enterprise Workstation Extension 12 SP4 |
before 0.97.3-17.4.1 | 0.97.3-17.4.1 |
diaSUSE:Linux Enterprise Workstation Extension 12 SP5 |
before 0.97.3-17.4.1 | 0.97.3-17.4.1 |
diaSUSE:Linux Enterprise Workstation Extension 15 |
before 0.97.3-4.3.3 | 0.97.3-4.3.3 |
diaSUSE:Linux Enterprise Workstation Extension 15 SP1 |
before 0.97.3-4.3.3 | 0.97.3-4.3.3 |
diaUbuntu:16.04:LTS |
All versions, plus listed versions 0.97.3-1 |
None known |
diaUbuntu:18.04:LTS |
All versions, plus listed versions 0.97.3+git20160930-60.97.3+git20160930-70.97.3+git20160930-8 |
None known |
diaUbuntu:20.04:LTS |
All versions, plus listed versions 0.97.3+git20160930-8.10.97.3+git20160930-8.20.97.3+git20160930-9 |
None known |
diaUbuntu:22.04:LTS |
All versions, plus listed versions 0.97.3+git20160930-90.97.3+git20160930-9build1 |
None known |
diaUbuntu:24.04:LTS |
All versions, plus listed versions 0.97.3+git20220525-5build10.97.3+git20220525-5build20.97.3+git20220525-5build30.98+git20240130-10.98+git20240130-1build20.98+git20240130-1build30.98+git20240130-1build4 |
None known |
diaUbuntu:25.10 |
All versions, plus listed versions 0.98+git20250126-1build10.98+git20250126-1build20.98+git20250126-20.98+git20250126-2ubuntu10.98+git20250902-0ubuntu1 |
None known |
diaUbuntu:26.10 |
All versions, plus listed versions 0.98+git20260221-10.98+git20260221-20.98+git20260221-3 |
None known |
diaUbuntu:26.04:LTS |
All versions, plus listed versions 0.98+git20250902-0ubuntu10.98+git20250902-0ubuntu20.98+git20260221-1 |
None known |
diaopenSUSE:Leap 15.1 |
before 0.97.3-lp151.4.3.1 | 0.97.3-lp151.4.3.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected, aliases, references | OSV |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
gitlab.gnome.org/GNOME/dia/issues/428
lists.opensuse.org/opensuse-security-announce/2020-01/msg00019.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKLQU2XBM4BGRKOF3L4C5QCPBUNTKEUN
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KTGLGWHINMTDRFL7RZAJZJM5YSVXUXWW
nvd.nist.gov/vuln/detail/CVE-2019-19451
lists.fedoraproject.org/archives/list/[email protected]/message/KTGLGWHINMTDRFL7RZAJZJM5YSVXUXWW
Show 14 moreShow less
lists.fedoraproject.org/archives/list/[email protected]/message/PKLQU2XBM4BGRKOF3L4C5QCPBUNTKEUN
github.com/advisories/GHSA-4vq3-2rwv-w7mg
security.alpinelinux.org/vuln/CVE-2019-19451
security-tracker.debian.org/tracker/CVE-2019-19451
advisories.mageia.org/MGASA-2020-0022.html
bugs.mageia.org/show_bug.cgi?id=25995
lists.suse.com/pipermail/sle-security-updates/2019-December/006293.html
suse.com/support/update/announcement/2019/suse-su-20193390-1
bugzilla.suse.com/1158194
suse.com/security/cve/CVE-2019-19451
suse.com/support/update/announcement/2019/suse-su-20193391-1
ubuntu.com/security/CVE-2019-19451
cve.org/CVERecord?id=CVE-2019-19451
lists.opensuse.org/archives/list/[email protected]/thread/WWHLCBQWAFNK3TKCBR2HORDXGYOHJCPL