CVE-2018-19761

[saitoha]

CVE-2018-19761
https://nvd.nist.gov/vuln/detail/CVE-2018-19761
https://bugzilla.redhat.com/show_bug.cgi?id=1649200

[crabdancing]

Any input on this? It's been quite awhile.

[knok]

It seems not security issue, just un-freed memory allocation because of corrupted sixel input.
The following patch is force unreference sixel allocator:
https://salsa.debian.org/debian/libsixel/blob/debian-stretch/debian/patches/0004-force-free-memory-allocator.patch

[saitoha]

POC3 on https://bugzilla.redhat.com/attachment.cgi?id=1505141 causes integer overflow on v1.8.2.
This problem is fixed on v1.8.3, with 1377517. Thanks.