CVE-2019-5087

Name of the Vulnerable Software and Affected Versions xcftools version 1.0.7

Description An integer overflow vulnerability exists in the flattenIncrementally function in the xcf2png and xcf2pnm binaries. This vulnerability can occur while calculating the row's allocation size, potentially allowing memory corruption and arbitrary code execution. A victim would need to open a specially crafted XCF file to trigger this issue.

Recommendations For version 1.0.7, consider disabling the flattenIncrementally function as a temporary workaround until a patch is available. Restrict access to the xcf2png and xcf2pnm binaries to minimize the risk of exploitation. Avoid opening specially crafted XCF files with the affected binaries until the issue is resolved.