CVE-2019-9210

Vulnerability

In AdvanceCOMP 2.1, the png_compress function in pngex.cc of advpng contains an integer overflow vulnerability [1]. When processing a PNG file with an invalid size, the overflow causes an attempted memcpy to write into a buffer that is too small, resulting in a heap-based buffer overflow. Additionally, a heap-based buffer over-read occurs [1]. The vulnerable code path is reachable when advpng is invoked on a specially crafted PNG file.

Exploitation

An attacker must provide a crafted PNG file to the victim. No authentication or special privileges are required; the victim only needs to run advpng -z on the malicious file [1]. The integer overflow occurs during size calculation, leading to an undersized heap buffer allocation. Subsequent memcpy writes beyond the allocated buffer, corrupting heap metadata or adjacent data.

Impact

Successful exploitation can lead to arbitrary code execution in the context of the user running advpng [2]. The heap buffer overflow may allow an attacker to overwrite critical data structures, potentially gaining control of the program flow. The accompanying heap over-read could leak sensitive information from memory.

Mitigation

The vulnerability is fixed in later versions of AdvanceCOMP; the SourceForge bug report is marked as closed-fixed [1]. Ubuntu released USN-3936-2 on 23 April 2019, providing updated packages for Ubuntu 19.04 [2]. Users should upgrade to the patched version. As a workaround, avoid processing untrusted PNG files with advpng until the update is applied.