Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 690194 (CVE-2019-1010065) - <app-forensics/sleuthkit-4.9.0: crafted disk image triggers crash in tsk/fs/hfs_dent.c:237 (CVE-2019-1010065)
Summary: <app-forensics/sleuthkit-4.9.0: crafted disk image triggers crash in tsk/fs/h...
Alias: CVE-2019-1010065
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
Whiteboard: B3 [noglsa cve]
Depends on: CVE-2019-14531, CVE-2019-14532, CVE-2020-10232, CVE-2020-10233 721154
  Show dependency tree
Reported: 2019-07-19 02:40 UTC by D'juan McDonald (domhnall)
Modified: 2020-06-20 01:12 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description D'juan McDonald (domhnall) 2019-07-19 02:40:08 UTC

The Sleuth Kit 4.6.0 and earlier is affected by: Integer Overflow. The impact is: Opening crafted disk image triggers crash in tsk/fs/hfs_dent.c:237. The component is: Overflow in fls tool used on HFS image. Bug is in tsk/fs/hfs.c file in function hfs_cat_traverse() in lines: 952, 1062. The attack vector is: Victim must open a crafted HFS filesystem image.

upstream fix:

Gentoo Security Padawan
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-03-19 20:42:24 UTC
@maintainer(s), ping - please advise if ready for stabilisation or call yourself
Comment 2 Yury German Gentoo Infrastructure gentoo-dev 2020-06-04 02:50:53 UTC
Bug stabilization in in linked bug 721154
Comment 3 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-06-10 21:50:15 UTC
@maintainer(s), please cleanup
Comment 4 Larry the Git Cow gentoo-dev 2020-06-20 01:11:51 UTC
The bug has been referenced in the following commit(s):

commit f51fa4ab5df227dd66c3979406ce194968ff329c
Author:     Aaron Bauman <>
AuthorDate: 2020-06-20 01:11:03 +0000
Commit:     Aaron Bauman <>
CommitDate: 2020-06-20 01:11:03 +0000

    app-forensics/sleuthkit: drop vulnerable
    Signed-off-by: Aaron Bauman <>

 app-forensics/sleuthkit/Manifest               |   7 -
 app-forensics/sleuthkit/sleuthkit-4.6.5.ebuild | 270 -----------------------
 app-forensics/sleuthkit/sleuthkit-4.6.6.ebuild | 270 -----------------------
 app-forensics/sleuthkit/sleuthkit-4.6.7.ebuild | 268 -----------------------
 app-forensics/sleuthkit/sleuthkit-4.7.0.ebuild | 289 ------------------------
 app-forensics/sleuthkit/sleuthkit-4.8.0.ebuild | 292 -------------------------
 6 files changed, 1396 deletions(-)