CVE-2019-19451

Name	CVE-2019-19451
Description	When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	945876

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
dia (PTS)	bullseye	0.97.3+git20160930-9	vulnerable
	bookworm	0.97.3+git20220525-5	fixed
	sid, trixie	0.98+git20240814-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
dia	source	(unstable)	0.97.3+git20220525-1	unimportant		945876

Notes

https://gitlab.gnome.org/GNOME/dia/issues/428
Introduced by: https://gitlab.gnome.org/GNOME/dia/commit/9a5f438d4b3e718c8ab0efe01d08ee2c3a0d9a86
Fixed by: https://gitlab.gnome.org/GNOME/dia/commit/baa2df853f9fb770eedcf3d94c7f5becebc90bb9
Negligible security impact, hang in end user tool