{"id":"CVE-2019-6246","aliases":["DEBIAN-CVE-2019-6246","EUVD-2019-15813","GHSA-p32g-q42f-c4jr","UBUNTU-CVE-2019-6246","USN-6178-1"],"status":"published","title":"An issue was discovered in SVG++ (aka svgpp) 1.2.3. After calling the gil::get_color function in...","description":"An issue was discovered in SVG++ (aka svgpp) 1.2.3. After calling the gil::get_color function in Generic Image Library in Boost, the return code is used as an address, leading to an Access Violation because of an out-of-bounds read.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01843,"percentile":0.79176,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2019-01-13T00:00:00Z","modified":"2026-10-20T10:51:40Z","fixes":[{"ecosystem":"Debian:12","package":"svgpp","fixed_in":["1.2.3+dfsg1-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"svgpp","fixed_in":["1.2.3+dfsg1-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"svgpp","fixed_in":["1.2.3+dfsg1-5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"svgpp","fixed_in":["1.2.3+dfsg1-3ubuntu1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"svgpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3+dfsg1-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"svgpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3+dfsg1-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"svgpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3+dfsg1-5"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"svgpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3+dfsg1-3ubuntu1+esm1"}]}],"versions":["1.2.3+dfsg1-3","1.2.3+dfsg1-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"svgpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3+dfsg1-3ubuntu1+esm1"}]}],"versions":["1.2.3+dfsg1-3","1.2.3+dfsg1-3ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"svgpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0+dfsg1-3ubuntu2.22.04.1"}]}],"versions":["1.3.0+dfsg1-3ubuntu2"],"bundled":2}],"products":[{"vendor":"svgpp","product":"svgpp"}],"references":[{"url":"https://github.com/svgpp/svgpp/issues/70","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-6246"},{"url":"https://github.com/advisories/GHSA-p32g-q42f-c4jr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-6246","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-6246","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6178-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-6246","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-44960","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-6246","description":"An issue was discovered in SVG++ (aka svgpp) 1.2.3. After calling the gil::get_color function in Generic Image Library in Boost, the return code is used as an address, leading to an Access Violation because of an out-of-bounds read.","status":"published","published":"2019-01-13T00:00:00Z","modified":"2024-09-16T23:05:50.236Z","updated_at":"2026-11-02T14:20:23.697579Z"}],"euvd":[{"id":"EUVD-2019-15813","description":"An issue was discovered in SVG++ (aka svgpp) 1.2.3. After calling the gil::get_color function in Generic Image Library in Boost, the return code is used as an address, leading to an Access Violation because of an out-of-bounds read.","status":"published","published":"2019-01-13T00:00:00Z","modified":"2024-09-16T23:05:50Z","updated_at":"2026-11-03T00:54:56.752396Z"}],"ghsa":[{"id":"GHSA-p32g-q42f-c4jr","title":"An issue was discovered in SVG++ (aka svgpp) 1.2.3. After calling the gil::get_color function in...","description":"An issue was discovered in SVG++ (aka svgpp) 1.2.3. After calling the gil::get_color function in Generic Image Library in Boost, the return code is used as an address, leading to an Access Violation because of an out-of-bounds read.","status":"published","published":"2022-05-14T01:38:18Z","modified":"2023-02-02T05:04:15Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:51:49.55689Z"}],"nvd":[{"id":"CVE-2019-6246","description":"An issue was discovered in SVG++ (aka svgpp) 1.2.3. After calling the gil::get_color function in Generic Image Library in Boost, the return code is used as an address, leading to an Access Violation because of an out-of-bounds read.","status":"published","published":"2019-01-13T00:29:00.523Z","modified":"2026-06-17T02:38:52.867Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:05:02.989216Z"}],"osv":[{"id":"CVE-2019-6246","description":"An issue was discovered in SVG++ (aka svgpp) 1.2.3. After calling the gil::get_color function in Generic Image Library in Boost, the return code is used as an address, leading to an Access Violation because of an out-of-bounds read.","status":"published","published":"2019-01-13T00:29:00.523Z","modified":"2026-10-20T10:51:40.721248921Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"DEBIAN-CVE-2019-6246","description":"An issue was discovered in SVG++ (aka svgpp) 1.2.3. After calling the gil::get_color function in Generic Image Library in Boost, the return code is used as an address, leading to an Access Violation because of an out-of-bounds read.","status":"published","published":"2019-01-13T00:29:00.523Z","modified":"2026-09-21T07:02:38.189595674Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"UBUNTU-CVE-2019-6246","description":"An issue was discovered in SVG++ (aka svgpp) 1.2.3. After calling the gil::get_color function in Generic Image Library in Boost, the return code is used as an address, leading to an Access Violation because of an out-of-bounds read.","status":"published","published":"2019-01-13T00:29:00Z","modified":"2026-02-04T02:13:28.404808Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:21.741399Z"},{"id":"USN-6178-1","title":"Several security issues were fixed in SVG++ library","description":"It was discovered that in SVG++ library that the demo application incorrectly \nmanaged memory resulting in a memory access violation \nunder certain circumstances. An attacker could possibly use this issue \nto leak memory information or run a denial of service attack.\nThis issue only affected Ubuntu 18.04 LTS. (CVE-2019-6246)\n\nIt was discovered that in SVG++ library that the demo application \nincorrectly handled null pointers under certain circumstances. \nAn attacker could possibly use this issue to cause \ndenial of service, leak memory information or manipulate \nprogram execution flow. (CVE-2021-44960)\n","status":"published","published":"2023-06-19T18:38:42Z","modified":"2026-04-27T16:47:17.142553772Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}