CVE:CVE-2019-5087
CNNVD:CNNVD-201911-1221
xcftools是一款用于提取XCF文件信息的命令行工具。
xcftools 1.0.7版本中的xcf2png and xcf2pnm二进制文件的‘flattenIncrementally’函数存在输入验证错误漏洞。攻击者可借助特制的XCF文件利用该漏洞破坏内存并执行任意代码。
solution:Upgrade xcftools_project xcftools to a higher version than 1.0.7,and avoid the version 1.0.7; Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0