{"id":"CVE-2019-19308","aliases":["DEBIAN-CVE-2019-19308","EUVD-2019-8932","GHSA-xr69-7fhc-h6vj","OESA-2022-2074","UBUNTU-CVE-2019-19308"],"status":"published","title":"In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer...","description":"In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer dereference while parsing a TTF font file that lacks a name section (due to a g_strconcat call that returns NULL).","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00908,"percentile":0.60171,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2019-11-27T14:37:38Z","modified":"2026-10-20T10:52:31Z","fixes":[{"ecosystem":"Debian:12","package":"gnome-font-viewer","fixed_in":["3.34.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnome-font-viewer","fixed_in":["3.34.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnome-font-viewer","fixed_in":["3.34.0-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gnome-sushi","fixed_in":["3.38.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnome-sushi","fixed_in":["3.38.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnome-sushi","fixed_in":["3.38.0-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"gnome-font-viewer","fixed_in":["3.34.0-2.oe2203"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"gnome-font-viewer","fixed_in":["3.34.0-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gnome-font-viewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.34.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gnome-font-viewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.34.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnome-font-viewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.34.0-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gnome-sushi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gnome-sushi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnome-sushi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.0-1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"gnome-font-viewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.34.0-2.oe2203"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gnome-font-viewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.16.2-1","3.16.2-1build1","3.16.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gnome-sushi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.16.0-1build1","3.18.0-1","3.18.0-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gnome-font-viewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.26.0-1","3.26.0-2","3.26.0-3","3.27.90-1","3.27.90-2","3.28.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gnome-sushi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.24.0-1build1","3.24.0-2","3.24.0-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gnome-font-viewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.34.0-2"}]}],"versions":["3.34.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gnome-sushi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.34.0-1","3.34.0-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gnome-sushi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.38.1-1","41.0-2","41.0-3","41.1-1","42.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gnome-sushi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["45.0-1","45.0-1build1","45.0-1build2","46.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gnome-sushi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["46.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gnome-sushi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["46.0-3","50.0-1","51~rc-0ubuntu1","51.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gnome-sushi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["46.0-2","46.0-2build1","46.0-3","50.0-0ubuntu0.1"]}],"products":[{"vendor":"gnome","product":"gnome-font-viewer"}],"references":[{"url":"https://github.com/GNOME/gnome-font-viewer/blob/919dfbe684b75904563b8c6723c9778a4e00aad7/src/sushi-font-widget.c#L115-L117","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://gitlab.gnome.org/GNOME/gnome-font-viewer/issues/17","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19308","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xr69-7fhc-h6vj"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-19308","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2074","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-19308","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19308","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-19308","description":"In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer dereference while parsing a TTF font file that lacks a name section (due to a g_strconcat call that returns NULL).","status":"published","published":"2019-11-27T14:37:38Z","modified":"2024-08-05T02:16:46.998Z","updated_at":"2026-11-02T14:20:20.74896Z"}],"euvd":[{"id":"EUVD-2019-8932","description":"In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer dereference while parsing a TTF font file that lacks a name section (due to a g_strconcat call that returns NULL).","status":"published","published":"2019-11-27T14:37:38Z","modified":"2024-08-05T02:16:46Z","updated_at":"2026-11-03T02:40:25.841101Z"}],"ghsa":[{"id":"GHSA-xr69-7fhc-h6vj","title":"In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer...","description":"In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer dereference while parsing a TTF font file that lacks a name section (due to a g_strconcat call that returns NULL).","status":"published","published":"2022-05-24T17:02:19Z","modified":"2023-01-28T05:08:27Z","updated_at":"2026-11-02T14:44:37.39101Z"}],"nvd":[{"id":"CVE-2019-19308","description":"In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer dereference while parsing a TTF font file that lacks a name section (due to a g_strconcat call that returns NULL).","status":"published","published":"2019-11-27T15:15:11.23Z","modified":"2026-06-17T02:26:28.43Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:05:38.993437Z"}],"osv":[{"id":"CVE-2019-19308","description":"In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer dereference while parsing a TTF font file that lacks a name section (due to a g_strconcat call that returns NULL).","status":"published","published":"2019-11-27T15:15:11.23Z","modified":"2026-10-20T10:52:31.676104809Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-19308","description":"In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer dereference while parsing a TTF font file that lacks a name section (due to a g_strconcat call that returns NULL).","status":"published","published":"2019-11-27T15:15:11.23Z","modified":"2026-09-21T07:01:18.720082768Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"OESA-2022-2074","title":"gnome-font-viewer security update","description":"The Font Viewer application has been rewritten to match the new design used for GNOME 3 applications.It can now show an overview of all installed fonts and optimizes screen space usage when the application is maximized.\r\n\r\nSecurity Fix(es):\r\n\r\nIn text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer dereference while parsing a TTF font file that lacks a name section (due to a g_strconcat call that returns NULL).(CVE-2019-19308)","status":"published","published":"2022-11-11T11:05:23Z","modified":"2026-08-18T01:17:21.632616071Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2019-19308","description":"In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer dereference while parsing a TTF font file that lacks a name section (due to a g_strconcat call that returns NULL).","status":"published","published":"2019-11-27T15:15:00Z","modified":"2026-10-17T12:55:25.121257999Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:20.325378Z"}]}}