Every CVESearch/Get API key

CVE-2019-20326

gthumb - security update

7.8 HighPublic exploitFix available

A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in GNOME gThumb before 3.8.3 and Linux Mint Pix before 2.4.5 allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.19%Down 6.9 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used7.8

A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in GNOME gThumb before 3.8.3 and Linux Mint Pix before 2.4.5 allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file.

Record
CVE-2019-20326
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-787
Updated
2026-11-02
CVE ListNo score

A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in GNOME gThumb before 3.8.3 and Linux Mint Pix before 2.4.5 allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file.

Record
CVE-2019-20326
Updated
2026-11-02
EUVDEUVD-2019-10880No score

A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in GNOME gThumb before 3.8.3 and Linux Mint Pix before 2.4.5 allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file.

Record
EUVD-2019-10880
Updated
2026-11-03
OSV7.8

A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in GNOME gThumb before 3.8.3 and Linux Mint Pix before 2.4.5 allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file.

Record
CVE-2019-20326
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-203267.8

A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in GNOME gThumb before 3.8.3 and Linux Mint Pix before 2.4.5 allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file.

Record
DEBIAN-CVE-2019-20326
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-203267.8

A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in GNOME gThumb before 3.8.3 and Linux Mint Pix before 2.4.5 allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file.

Record
UBUNTU-CVE-2019-20326
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVMGASA-2020-0056No score

Updated gthumb packages fix security vulnerability

A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in gThumb and Pix allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file (CVE-2019-20326).

Record
MGASA-2020-0056
Updated
2026-11-02
OSVMGASA-2021-0090No score

Updated pix packages fix a security vulnerability

A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in Linux Mint Pix before 2.4.5 allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file (CVE-2019-20326).

Record
MGASA-2021-0090
Updated
2026-11-02
OSVUSN-5680-1No score

gThumb vulnerabilities

It was discovered that gThumb did not properly managed memory when processing certain image files. If a user were tricked into opening a specially crafted JPEG file, an attacker could possibly use this issue to cause gThumb to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-20326)

It was discovered that gThumb did not properly handled certain malformed image files. If a user were tricked into opening a specially crafted JPEG file, an attacker could possibly use this issue to cause gThumb to crash, resulting in a denial of service. (CVE-2020-36427)

Record
USN-5680-1
Updated
2026-11-02
OSVUSN-5681-1No score

gThumb vulnerabilities

It was discovered that gThumb did not properly managed memory under certain circumstances. An attacker could possibly use this issue to cause gThumb to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-18718)

It was discovered that gThumb did not properly managed memory when processing certain image files. If a user were tricked into opening a specially crafted JPEG file, an attacker could possibly use this issue to cause gThumb to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-20326)

It was discovered that gThumb did not properly handled certain malformed image files. If a user were tricked into opening a specially crafted JPEG file, an attacker could possibly use this issue to cause gThumb to crash, resulting in a denial of service. (CVE-2020-36427)

Record
USN-5681-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gthumb
Debian:12
before 3:3.8.3-0.1
3:3.8.3-0.1
gthumb
Debian:13
before 3:3.8.3-0.1
3:3.8.3-0.1
gthumb
Debian:14
before 3:3.8.3-0.1
3:3.8.3-0.1
gthumb
Debian:8
before 3:3.3.1-2.1+deb8u2, plus listed versions
3:3.3.1-23:3.3.1-2.1+deb8u1
3:3.3.1-2.1+deb8u2
gthumb
Debian:9
before 3:3.4.4.1-5+deb9u2, plus listed versions
3:3.4.4.1-53:3.4.4.1-5+deb9u1
3:3.4.4.1-5+deb9u2
gthumb
Mageia:7
before 3.7.2-2.1.mga7
3.7.2-2.1.mga7
pix
Mageia:7
before 2.4.11-1.mga7
2.4.11-1.mga7
gthumb
Ubuntu:Pro:16.04:LTS
before 3:3.4.3-1ubuntu0.1~esm1, plus listed versions
3:3.3.1.is.3.2.8-0ubuntu33:3.4.1-23:3.4.1-33:3.4.1-43:3.4.3-1
3:3.4.3-1ubuntu0.1~esm1
gthumb
Ubuntu:Pro:18.04:LTS
before 3:3.6.1-1ubuntu0.1~esm1, plus listed versions
3:3.5.2-2ubuntu13:3.5.3-13:3.5.4-13:3.6.0-13:3.6.0-23:3.6.0-33:3.6.0-43:3.6.1-1
3:3.6.1-1ubuntu0.1~esm1
gthumb
Ubuntu:20.04:LTS
before 3:3.8.0-2.1ubuntu0.1, plus listed versions
3:3.8.0-23:3.8.0-2.13:3.8.0-2.1build1
3:3.8.0-2.1ubuntu0.1
gthumb
Ubuntu:20.04:LTS
From an advisory covering 2 CVEs
before 3:3.8.0-2.1ubuntu0.1, plus listed versions
3:3.8.0-23:3.8.0-2.13:3.8.0-2.1build1
3:3.8.0-2.1ubuntu0.1
gthumb
Ubuntu:Pro:16.04:LTS
From an advisory covering 3 CVEs
before 3:3.4.3-1ubuntu0.1~esm1, plus listed versions
3:3.3.1.is.3.2.8-0ubuntu33:3.4.1-23:3.4.1-33:3.4.1-43:3.4.3-1
3:3.4.3-1ubuntu0.1~esm1
gthumb
Ubuntu:Pro:18.04:LTS
From an advisory covering 3 CVEs
before 3:3.6.1-1ubuntu0.1~esm1, plus listed versions
3:3.5.2-2ubuntu13:3.5.3-13:3.5.4-13:3.6.0-13:3.6.0-23:3.6.0-33:3.6.0-43:3.6.1-1
3:3.6.1-1ubuntu0.1~esm1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubFysac/CVE-2019-203262020-01-03

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-20326 is a high vulnerability (CVSS 7.8) in Debian Linux, published January 13, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.19%, the 82nd percentile. Fixed in gthumb 3:3.8.3-0.1.

References

Show 13 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open