#VU18572 Out-of-bounds read in Skia Graphics Library - CVE-2019-5798

Vulnerability identifier: #VU18572

Vulnerability risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-5798

CWE-ID: CWE-125

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Skia Graphics Library
Universal components / Libraries / Libraries used by multiple products

Vendor: Skia Project

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the Skia library during path transformations. A remote attacker can create a specially crafted email, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Skia Graphics Library: All versions

---

External links
https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.