{"id":"CVE-2019-19451","aliases":["ALPINE-CVE-2019-19451","DEBIAN-CVE-2019-19451","EUVD-2019-9071","GHSA-4vq3-2rwv-w7mg","MGASA-2020-0022","SUSE-SU-2019:3390-1","SUSE-SU-2019:3391-1","UBUNTU-CVE-2019-19451","openSUSE-SU-2020:0021-1"],"status":"published","title":"When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid...","description":"When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0037,"percentile":0.3126,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2019-11-29T22:54:03Z","modified":"2026-11-03T06:31:55Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"dia","fixed_in":["0.97.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"dia","fixed_in":["0.97.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"dia","fixed_in":["0.97.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"dia","fixed_in":["0.97.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"dia","fixed_in":["0.97.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"dia","fixed_in":["0.97.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"dia","fixed_in":["0.97.3-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"dia","fixed_in":["0.97.3+git20220525-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dia","fixed_in":["0.97.3+git20220525-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dia","fixed_in":["0.97.3+git20220525-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"dia","fixed_in":["0.97.3-8.1.mga7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"dia","fixed_in":["0.97.3-17.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"dia","fixed_in":["0.97.3-17.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"dia","fixed_in":["0.97.3-17.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"dia","fixed_in":["0.97.3-17.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"dia","fixed_in":["0.97.3-17.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15","package":"dia","fixed_in":["0.97.3-4.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP1","package":"dia","fixed_in":["0.97.3-4.3.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"dia","fixed_in":["0.97.3-lp151.4.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3+git20220525-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3+git20220525-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3+git20220525-1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3-8.1.mga7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3-17.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3-17.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3-17.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3-17.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3-17.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3-4.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP1","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3-4.3.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.97.3-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.97.3+git20160930-6","0.97.3+git20160930-7","0.97.3+git20160930-8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.97.3+git20160930-8.1","0.97.3+git20160930-8.2","0.97.3+git20160930-9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.97.3+git20160930-9","0.97.3+git20160930-9build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.97.3+git20220525-5build1","0.97.3+git20220525-5build2","0.97.3+git20220525-5build3","0.98+git20240130-1","0.98+git20240130-1build2","0.98+git20240130-1build3","0.98+git20240130-1build4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.98+git20250126-1build1","0.98+git20250126-1build2","0.98+git20250126-2","0.98+git20250126-2ubuntu1","0.98+git20250902-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.98+git20260221-1","0.98+git20260221-2","0.98+git20260221-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.98+git20250902-0ubuntu1","0.98+git20250902-0ubuntu2","0.98+git20260221-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"dia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.97.3-lp151.4.3.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnome","product":"dia"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://gitlab.gnome.org/GNOME/dia/issues/428","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00019.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKLQU2XBM4BGRKOF3L4C5QCPBUNTKEUN/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KTGLGWHINMTDRFL7RZAJZJM5YSVXUXWW/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19451"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KTGLGWHINMTDRFL7RZAJZJM5YSVXUXWW/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKLQU2XBM4BGRKOF3L4C5QCPBUNTKEUN/"},{"url":"https://github.com/advisories/GHSA-4vq3-2rwv-w7mg"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-19451","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-19451","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0022.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25995","tags":["report"]},{"url":"http://lists.suse.com/pipermail/sle-security-updates/2019-December/006293.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193390-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1158194","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19451","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193391-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-19451","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19451","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WWHLCBQWAFNK3TKCBR2HORDXGYOHJCPL/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-19451","description":"When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.","status":"published","published":"2019-11-29T22:54:03Z","modified":"2024-08-05T02:16:47.11Z","updated_at":"2026-11-02T14:20:20.74896Z"}],"euvd":[{"id":"EUVD-2019-9071","description":"When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.","status":"published","published":"2019-11-29T22:54:03Z","modified":"2024-08-05T02:16:47Z","updated_at":"2026-11-03T02:40:25.391321Z"}],"ghsa":[{"id":"GHSA-4vq3-2rwv-w7mg","title":"When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid...","description":"When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.","status":"published","published":"2022-05-24T17:02:27Z","modified":"2023-01-28T05:08:30Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:44:37.39101Z"}],"nvd":[{"id":"CVE-2019-19451","description":"When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.","status":"published","published":"2019-11-29T23:15:10.96Z","modified":"2026-06-17T02:26:40.683Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:05:38.993437Z"}],"osv":[{"id":"ALPINE-CVE-2019-19451","description":"When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.","status":"published","published":"2019-11-29T23:15:10.96Z","modified":"2026-11-03T06:31:55.068205248Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2019-19451","description":"When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.","status":"published","published":"2019-11-29T23:15:10.96Z","modified":"2026-04-16T04:39:48.355312222Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-19451","description":"When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.","status":"published","published":"2019-11-29T23:15:10.96Z","modified":"2026-09-21T07:03:14.773231707Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"UBUNTU-CVE-2019-19451","description":"When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.","status":"published","published":"2019-11-29T23:15:00Z","modified":"2026-10-17T12:56:54.231608733Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"MGASA-2020-0022","title":"Updated dia packages fix security vulnerability","description":"Updated dia package fixes security vulnerability:\n\nAn endless loop on filenames with invalid encoding (CVE-2019-19451).\n","status":"published","published":"2020-01-05T15:37:51Z","modified":"2026-04-16T04:43:25.150344824Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0021-1","title":"Security update for dia","description":"This update for dia fixes the following issue:\n\n- CVE-2019-19451: Fixed an endless loop on filenames with invalid encoding (bsc#1158194).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-01-13T15:18:06Z","modified":"2026-02-04T03:56:41.685892Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"SUSE-SU-2019:3390-1","title":"Security update for dia","description":"This update for dia fixes the following issue:\n  \n- CVE-2019-19451: Fixed an endless loop on filenames with invalid encoding (bsc#1158194).\n","status":"published","published":"2019-12-27T12:33:09Z","modified":"2026-02-04T03:26:30.222193Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:3391-1","title":"Security update for dia","description":"This update for dia fixes the following issue:\n\n- CVE-2019-19451: Fixed an endless loop on filenames with invalid encoding (bsc#1158194).\n","status":"published","published":"2019-12-27T12:33:18Z","modified":"2026-02-04T03:04:05.539135Z","updated_at":"2026-11-02T15:53:47.06185Z"}]}}