This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote host is affected by the vulnerability described in GLSA-201708-09 (AutoTrace: Multiple vulnerabilities)

    Heap-based buffer overflows have been discovered in the       pstoedit_suffix_table_init and pnm_load_rawpbm functions of AutoTrace.
  Impact :

    Remote attackers, by enticing a user to process a crafted bmp image       file, could cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ..CVE-2017-9200 autotrace: Multiple security issues (CVE-2017-9200)

  - Heap-based buffer overflow in the pstoedit_suffix_table_init function in output-pstoedit.c in AutoTrace     0.31.1 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted bmp image     file. (CVE-2016-7392)

  - libautotrace.a in AutoTrace 0.31.1 has a heap-based buffer overflow in the pnm_load_ascii function in     input-pnm.c:303:12. (CVE-2017-9151)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1929 advisory.

  - Heap-based buffer overflow in the pstoedit_suffix_table_init function in output-pstoedit.c in AutoTrace     0.31.1 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted bmp image     file. (CVE-2016-7392)

  - A biWidth*biBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows attackers to provide an     unexpected input value to malloc via a malformed bitmap image. (CVE-2019-19004)

  - A bitmap double free in main.c in autotrace 0.31.1 allows attackers to cause an unspecified impact via a     malformed bitmap image. This may occur after the use-after-free in CVE-2017-9182. (CVE-2019-19005)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - autotrace: Out of bounds write when converting bmp image (CVE-2016-7392)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

Autotrace is a program for converting bitmaps to vector graphics. It had a bug that caused an out-of-bounds write. This was caused by not allocating sufficient memory to store the terminating NULL pointer in an array.

For Debian 7 'Wheezy', this problem have been fixed in version 0.31.1-16+deb7u1.

We recommend that you upgrade your autotrace packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
195435	RHEL 6 : autotrace (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	5/11/2024	5/31/2024	high
102798	GLSA-201708-09 : AutoTrace: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	8/28/2017	1/11/2021	critical
198685	RHEL 7 : autotrace (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	critical
171047	Amazon Linux 2 : (ALAS-2023-1929)	Nessus	Amazon Linux Local Security Checks	2/6/2023	2/6/2023	high
198644	RHEL 8 : autotrace (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	medium
93543	Debian DLA-621-1 : autotrace security update	Nessus	Debian Local Security Checks	9/16/2016	1/11/2021	medium

Detections

Analytics

Plugins Search

high

critical

critical

high

medium

medium