{"id":"CVE-2019-9210","aliases":["ALPINE-CVE-2019-9210","AZL-6303","AZL-7167","DEBIAN-CVE-2019-9210","DLA-1702-1","DLA-2868-1","EUVD-2019-18586","GHSA-h34m-m7hc-cp2h","MGASA-2019-0128","RHSA-2020:1037","UBUNTU-CVE-2019-9210","USN-3936-1"],"status":"published","title":"In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering...","description":"In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01424,"percentile":0.73101,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-190"],"published":"2019-02-27T00:00:00Z","modified":"2026-11-03T06:32:23Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"advancecomp","fixed_in":["2.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"advancecomp","fixed_in":["2.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"advancecomp","fixed_in":["2.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"advancecomp","fixed_in":["2.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"advancecomp","fixed_in":["2.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"advancecomp","fixed_in":["2.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"advancecomp","fixed_in":["2.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"advancecomp","fixed_in":["2.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"advancecomp","fixed_in":["2.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"advancecomp","fixed_in":["2.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"advancecomp","fixed_in":["2.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"advancecomp","fixed_in":["2.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"advancecomp","fixed_in":["2.1-r2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"advancecomp","fixed_in":["2.1-14"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"advancecomp","fixed_in":["2.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"advancecomp","fixed_in":["2.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"advancecomp","fixed_in":["2.1-2"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"advancecomp","fixed_in":["1.20-3.3.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"advancecomp","fixed_in":["0:1.15-22.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"advancecomp-debuginfo","fixed_in":["0:1.15-22.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"advancecomp","fixed_in":["0:1.15-22.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"advancecomp-debuginfo","fixed_in":["0:1.15-22.el7"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"advancecomp","fixed_in":["1.18-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"advancecomp","fixed_in":["1.20-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"advancecomp","fixed_in":["2.1-1ubuntu0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-r2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-14"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-14"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-2"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19-1+deb8u1"}]}],"versions":["1.19-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20-1+deb9u1"}]}],"versions":["1.20-1"],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20-3.3.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15-22.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"advancecomp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15-22.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15-22.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"advancecomp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15-22.el7"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-1ubuntu0.2"}]}],"versions":["1.17-1","1.18-1","1.18-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20-1ubuntu0.2"}]}],"versions":["1.19-1","1.20-1","1.20-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-1ubuntu0.18.04.1"}]}],"versions":["2.0-1","2.1-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-1ubuntu0.2"}]}],"versions":["1.17-1","1.18-1","1.18-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20-1ubuntu0.2"}]}],"versions":["1.19-1","1.20-1","1.20-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"advancecomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-1ubuntu0.18.04.1"}]}],"versions":["2.0-1","2.1-1"]}],"products":[{"vendor":"advancemame","product":"advancecomp"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00004.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://sourceforge.net/p/advancemame/bugs/277/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R56LVWC7KUNXFRKQB3Y5NX2YHFJKYZB4/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://usn.ubuntu.com/3936-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3936-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/12/msg00034.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9210","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R56LVWC7KUNXFRKQB3Y5NX2YHFJKYZB4/"},{"url":"https://github.com/advisories/GHSA-h34m-m7hc-cp2h"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-9210","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-9210","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0128.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24535","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/DPZCDOUS5QYMW45SCXCDPCWKC4QVMPLU/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1037","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1684596","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1037.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9210","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9210","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2019-9210","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3936-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3936-2","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-9210","description":"In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)","status":"published","published":"2019-02-27T14:00:00Z","modified":"2024-08-04T21:38:46.577Z","updated_at":"2026-11-02T14:20:20.397093Z"}],"euvd":[{"id":"EUVD-2019-18586","description":"In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)","status":"published","published":"2019-02-27T14:00:00Z","modified":"2024-08-04T21:38:46Z","updated_at":"2026-11-03T03:06:39.848951Z"}],"ghsa":[{"id":"GHSA-h34m-m7hc-cp2h","title":"In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering...","description":"In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)","status":"published","published":"2022-05-13T01:02:46Z","modified":"2023-02-01T05:02:32Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:49:56.179573Z"}],"nvd":[{"id":"CVE-2019-9210","description":"In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)","status":"published","published":"2019-02-27T14:29:00.607Z","modified":"2026-06-17T02:43:21.7Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125","CWE-190"],"updated_at":"2026-11-02T14:05:04.689371Z"}],"osv":[{"id":"ALPINE-CVE-2019-9210","description":"In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)","status":"published","published":"2019-02-27T14:29:00.607Z","modified":"2026-11-03T06:32:23.012180383Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"AZL-6303","title":"CVE-2019-9210 affecting package advancecomp for versions less than 2.1-14","description":"In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)","status":"published","published":"2019-02-27T14:29:00Z","modified":"2026-04-21T04:32:07.957597Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"AZL-7167","title":"CVE-2019-9210 affecting package advancecomp for versions less than 2.1-14","description":"In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)","status":"published","published":"2019-02-27T14:29:00Z","modified":"2026-04-21T04:36:38.425655Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"CVE-2019-9210","description":"In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)","status":"published","published":"2019-02-27T14:29:00.607Z","modified":"2026-10-24T10:30:16.871634294Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.974481Z"},{"id":"DEBIAN-CVE-2019-9210","description":"In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)","status":"published","published":"2019-02-27T14:29:00.607Z","modified":"2026-09-21T07:03:25.52047923Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"RHSA-2020:1037","title":"Red Hat Security Advisory: advancecomp security update","status":"published","published":"2024-09-16T02:47:14Z","modified":"2026-06-26T10:46:51Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2019-9210","description":"In AdvanceCOMP 2.1, png_compress in pngex.cc in advpng has an integer overflow upon encountering an invalid PNG size, which results in an attempted memcpy to write into a buffer that is too small. (There is also a heap-based buffer over-read.)","status":"published","published":"2019-02-27T00:00:00Z","modified":"2026-02-04T04:01:11.031969Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"DLA-1702-1","title":"advancecomp - security update","status":"published","published":"2019-03-02T00:00:00Z","modified":"2026-03-09T01:21:28.988259Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-2868-1","title":"advancecomp - security update","status":"published","published":"2021-12-29T00:00:00Z","modified":"2026-03-09T01:23:19.198286Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2019-0128","title":"Updated advancecomp packages fix security vulnerability","description":"advancecomp has been updated to fix a security issue that could be\ntriggered when pressented with a malformed PNG file. advancecomp\ncontained an integer overflow upon encountering an invalid PNG size, which\ncould result in a buffer overflow (CVE-2019-9210), as well as a heap-based\nbuffer over-read.\n","status":"published","published":"2019-04-05T18:12:59Z","modified":"2026-04-16T04:42:11.081921674Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"USN-3936-1","title":"advancecomp vulnerability","description":"It was discovered that AdvanceCOMP incorrectly handled certain PNG files.\nAn attacker could possibly use this issue to execute arbitrary code.\n","status":"published","published":"2019-04-04T14:30:35Z","modified":"2026-02-10T04:41:31Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}