Test ID:	1.3.6.1.4.1.25623.1.1.1.2.2016.675
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DLA-675-1)
Summary:	The remote host is missing an update for the Debian 'potrace' package(s) announced via the DLA-675-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'potrace' package(s) announced via the DLA-675-1 advisory. Vulnerability Insight: Multiple vulnerabilities have been found in potrace. CVE-2013-7437 Multiple integer overflows in potrace 1.11 allow remote attackers to cause a denial of service (crash) via large dimensions in a BMP image, which triggers a buffer overflow. This bug was reported by Murray McAllister of the Red Hat Security Response Team. CVE-2016-8694 / CVE-2016-8695 / CVE-2016-8696 Multiple NULL pointer dereferences in bm_readbody_bmp. This bug was discovered by Agostino Sarubbo of Gentoo. CVE-2016-8697 Division by zero in bm_new. This bug was discovered by Agostino Sarubbo of Gentoo. CVE-2016-8698 / CVE-2016-8699 / CVE-2016-8700 / CVE-2016-8701 / CVE-2016-8702 / CVE-2016-8703 Multiple heap-based buffer overflows in bm_readbody_bmp. This bug was discovered by Agostino Sarubbo of Gentoo. For Debian 7 Wheezy, these problems have been fixed in version 1.10-1+deb7u1. We recommend that you upgrade your potrace packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references] Affected Software/OS: 'potrace' package(s) on Debian 7. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-7437 [oss-security] 20150206 potrace: possible heap overflow http://www.openwall.com/lists/oss-security/2015/02/06/12 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=778646 https://bugzilla.redhat.com/show_bug.cgi?id=955808 openSUSE-SU-2015:1909 http://lists.opensuse.org/opensuse-updates/2015-11/msg00034.html Common Vulnerability Exposure (CVE) ID: CVE-2016-8694 BugTraq ID: 93778 http://www.securityfocus.com/bid/93778 https://blogs.gentoo.org/ago/2016/08/08/potrace-multiple-three-null-pointer-dereference-in-bm_readbody_bmp-bitmap_io-c/ http://www.openwall.com/lists/oss-security/2016/08/18/11 http://www.openwall.com/lists/oss-security/2016/10/16/12 Common Vulnerability Exposure (CVE) ID: CVE-2016-8695 Common Vulnerability Exposure (CVE) ID: CVE-2016-8696 Common Vulnerability Exposure (CVE) ID: CVE-2016-8697 https://blogs.gentoo.org/ago/2016/08/08/potrace-divide-by-zero-in-bm_new-bitmap-h/ Common Vulnerability Exposure (CVE) ID: CVE-2016-8698 https://blogs.gentoo.org/ago/2016/08/08/potrace-multiplesix-heap-based-buffer-overflow-in-bm_readbody_bmp-bitmap_io-c/ Common Vulnerability Exposure (CVE) ID: CVE-2016-8699 Common Vulnerability Exposure (CVE) ID: CVE-2016-8700 Common Vulnerability Exposure (CVE) ID: CVE-2016-8701 Common Vulnerability Exposure (CVE) ID: CVE-2016-8702 Common Vulnerability Exposure (CVE) ID: CVE-2016-8703
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.