CVE catalog

CVE-2019-20056

libstb affected and fixed versions

stb_image.h (aka the stb image loader) 2.23, as used in libsixel and other products, has an assertion failure in stbi__shiftsigned.

Severity: Medium
Published: Dec 29, 2019, 7:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.94% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	libsixel	`1.10.5-1`	Fixed	[CVE-2019-20056]
Debiantrixie	libsixel	`1.8.6-1`	FixedDistribution-reported fixed boundary	[CVE-2019-20056]
Debiantrixie	libstb	`0.0~git20220908.8b5f1f3+ds-1`	FixedDistribution-reported fixed boundary	[CVE-2019-20056]
Debiantrixie	libstb	`0.0~git20241109.5c20573+ds-1`	Fixed	[CVE-2019-20056]
Debiansid	libsixel	`1.8.6-1`	FixedDistribution-reported fixed boundary	[CVE-2019-20056]
Debiansid	libsixel	`1:1.8.7-r2-1`	Fixed	[CVE-2019-20056]
Debiansid	libstb	`0.0~git20220908.8b5f1f3+ds-1`	FixedDistribution-reported fixed boundary	[CVE-2019-20056]
Debiansid	libstb	`0.0~git20250907.fede005+ds-1`	Fixed	[CVE-2019-20056]
Debianforky	libsixel	`1.8.6-1`	FixedDistribution-reported fixed boundary	[CVE-2019-20056]
Debianforky	libsixel	`1:1.8.7-r2-1`	Fixed	[CVE-2019-20056]
Debianforky	libstb	`0.0~git20220908.8b5f1f3+ds-1`	FixedDistribution-reported fixed boundary	[CVE-2019-20056]
Debianforky	libstb	`0.0~git20250907.fede005+ds-1`	Fixed	[CVE-2019-20056]

Showing 12 fix observations. All 21 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	libsixel	`1.10.3-3`	Fixed	[CVE-2019-20056]
Debianbookworm	libsixel	`1.8.6-1`	FixedDistribution-reported fixed boundary	[CVE-2019-20056]
Debianbookworm	libstb	`0.0~git20220908.8b5f1f3+ds-1`	FixedDistribution-reported fixed boundary	[CVE-2019-20056]
Debianforky	libsixel	`1.8.6-1`	FixedDistribution-reported fixed boundary	[CVE-2019-20056]
Debianforky	libsixel	`1:1.8.7-r2-1`	Fixed	[CVE-2019-20056]
Debianforky	libstb	`0.0~git20220908.8b5f1f3+ds-1`	FixedDistribution-reported fixed boundary	[CVE-2019-20056]
Debianforky	libstb	`0.0~git20250907.fede005+ds-1`	Fixed	[CVE-2019-20056]
Debiansid	libsixel	`1.8.6-1`	FixedDistribution-reported fixed boundary	[CVE-2019-20056]
Debiansid	libsixel	`1:1.8.7-r2-1`	Fixed	[CVE-2019-20056]
Debiansid	libstb	`0.0~git20220908.8b5f1f3+ds-1`	FixedDistribution-reported fixed boundary	[CVE-2019-20056]
Debiansid	libstb	`0.0~git20250907.fede005+ds-1`	Fixed	[CVE-2019-20056]
Debiantrixie	libsixel	`1.10.5-1`	Fixed	[CVE-2019-20056]
Debiantrixie	libsixel	`1.8.6-1`	FixedDistribution-reported fixed boundary	[CVE-2019-20056]
Debiantrixie	libstb	`0.0~git20220908.8b5f1f3+ds-1`	FixedDistribution-reported fixed boundary	[CVE-2019-20056]
Debiantrixie	libstb	`0.0~git20241109.5c20573+ds-1`	Fixed	[CVE-2019-20056]
Ubuntu16.04	libsixel	`1.4.2-1`	Affected	[UBUNTU-CVE-2019-20056]Apr 22, 2026, 12:16:49 PM UTC
Ubuntu16.04	libsixel	`1.5.2-2`	Affected	[UBUNTU-CVE-2019-20056]Apr 22, 2026, 12:16:49 PM UTC
Ubuntu18.04	libsixel	`1.5.2-2`	Affected	[UBUNTU-CVE-2019-20056]Apr 22, 2026, 12:16:49 PM UTC
Ubuntu18.04	libsixel	`1.7.3-1`	Affected	[UBUNTU-CVE-2019-20056]Apr 22, 2026, 12:16:49 PM UTC
Ubuntu20.04	libsixel	`1.8.2-1`	Affected	[UBUNTU-CVE-2019-20056]Apr 22, 2026, 12:16:49 PM UTC
Ubuntu20.04	libsixel	`1.8.2-2.1`	Affected	[UBUNTU-CVE-2019-20056]Apr 22, 2026, 12:16:49 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "libstb",
      "status": "fixed",
      "release": "sid",
      "version": "0.0~git20250907.fede005+ds-1"
    },
    {
      "name": "libstb",
      "status": "fixed",
      "release": "forky",
      "version": "0.0~git20250907.fede005+ds-1"
    },
    {
      "name": "libstb",
      "status": "fixed",
      "release": "trixie",
      "version": "0.0~git20241109.5c20573+ds-1"
    },
    {
      "name": "libstb",
      "status": "fixed",
      "release": "bookworm",
      "version": "0.0~git20220908.8b5f1f3+ds-1"
    },
    {
      "name": "libsixel",
      "status": "fixed",
      "release": "sid",
      "version": "1:1.8.7-r2-1"
    },
    {
      "name": "libsixel",
      "status": "fixed",
      "release": "forky",
      "version": "1:1.8.7-r2-1"
    },
    {
      "name": "libsixel",
      "status": "fixed",
      "release": "trixie",
      "version": "1.10.5-1"
    },
    {
      "name": "libsixel",
      "status": "fixed",
      "release": "bookworm",
      "version": "1.10.3-3"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1014711,
      "name": "libstb",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "low",
      "fixed_version": "0.0~git20220908.8b5f1f3+ds-1"
    },
    {
      "bug": 1014711,
      "name": "libstb",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "low",
      "fixed_version": "0.0~git20220908.8b5f1f3+ds-1"
    },
    {
      "bug": 1014711,
      "name": "libstb",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "low",
      "fixed_version": "0.0~git20220908.8b5f1f3+ds-1"
    },
    {
      "bug": 1014711,
      "name": "libstb",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "low",
      "fixed_version": "0.0~git20220908.8b5f1f3+ds-1"
    },
    {
      "bug": 948103,
      "name": "libsixel",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "low",
      "fixed_version": "1.8.6-1"
    },
    {
      "bug": 948103,
      "name": "libsixel",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "low",
      "fixed_version": "1.8.6-1"
    },
    {
      "bug": 948103,
      "name": "libsixel",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "low",
      "fixed_version": "1.8.6-1"
    },
    {
      "bug": 948103,
      "name": "libsixel",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "low",
      "fixed_version": "1.8.6-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "libsixel",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "1.4.2-1",
        "1.5.2-2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-20056",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2019-20056",
      "provider_updated_at": "2026-04-22T12:16:49.016427Z"
    },
    {
      "name": "libsixel",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "1.5.2-2",
        "1.7.3-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-20056",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2019-20056",
      "provider_updated_at": "2026-04-22T12:16:49.016427Z"
    },
    {
      "name": "libsixel",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "1.8.2-1",
        "1.8.2-2.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-20056",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2019-20056",
      "provider_updated_at": "2026-04-22T12:16:49.016427Z"
    }
  ]
}

[Debian bug #1014711][Debian bug #948103]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libsixel1]Unknown
Source package: [libsixel]
Details (2)
- 1.10.3-3 · amd64 · bookworm
  Fixed · Fixed: 1.8.6-1
  dsa · libsixel · debian · bookworm; dsa · libsixel · debian · 12
- 1.10.3-3 · arm64 · bookworm
  Fixed · Fixed: 1.8.6-1
  dsa · libsixel · debian · bookworm; dsa · libsixel · debian · 12
[libsixel-bin]Unknown
Source package: [libsixel]
Details (2)
- 1.10.3-3 · amd64 · bookworm
  Fixed · Fixed: 1.8.6-1
  dsa · libsixel · debian · bookworm; dsa · libsixel · debian · 12
- 1.10.3-3 · arm64 · bookworm
  Fixed · Fixed: 1.8.6-1
  dsa · libsixel · debian · bookworm; dsa · libsixel · debian · 12
[libsixel-dev]Unknown
Source package: [libsixel]
Details (2)
- 1.10.3-3 · amd64 · bookworm
  Fixed · Fixed: 1.8.6-1
  dsa · libsixel · debian · bookworm; dsa · libsixel · debian · 12
- 1.10.3-3 · arm64 · bookworm
  Fixed · Fixed: 1.8.6-1
  dsa · libsixel · debian · bookworm; dsa · libsixel · debian · 12
[libsixel-examples]Unknown
Source package: [libsixel]
Details (2)
- 1.10.3-3 · all · bookworm
  Fixed · Fixed: 1.8.6-1
  dsa · libsixel · debian · bookworm; dsa · libsixel · debian · 12
- 1.10.3-3 · all · bookworm
  Fixed · Fixed: 1.8.6-1
  dsa · libsixel · debian · bookworm; dsa · libsixel · debian · 12
[libstb0]Unknown
Source package: [libstb]
Details (2)
- 0.0~git20220908.8b5f1f3+ds-1 · amd64 · bookworm
  Fixed · Fixed: 0.0~git20220908.8b5f1f3+ds-1
  dsa · libstb · debian · bookworm; dsa · libstb · debian · 12
- 0.0~git20220908.8b5f1f3+ds-1 · arm64 · bookworm
  Fixed · Fixed: 0.0~git20220908.8b5f1f3+ds-1
  dsa · libstb · debian · bookworm; dsa · libstb · debian · 12
[libstb-dev]Unknown
Source package: [libstb]
Details (2)
- 0.0~git20220908.8b5f1f3+ds-1 · amd64 · bookworm
  Fixed · Fixed: 0.0~git20220908.8b5f1f3+ds-1
  dsa · libstb · debian · bookworm; dsa · libstb · debian · 12
- 0.0~git20220908.8b5f1f3+ds-1 · arm64 · bookworm
  Fixed · Fixed: 0.0~git20220908.8b5f1f3+ds-1
  dsa · libstb · debian · bookworm; dsa · libstb · debian · 12

[Debian 13 (Trixie)]

[libsixel1]Unknown
Source package: [libsixel]
Details (2)
- 1.10.5-1 · amd64 · trixie
  Fixed · Fixed: 1.8.6-1
  dsa · libsixel · debian · 13
- 1.10.5-1 · arm64 · trixie
  Fixed · Fixed: 1.8.6-1
  dsa · libsixel · debian · 13
[libsixel-bin]Unknown
Source package: [libsixel]
Details (2)
- 1.10.5-1 · amd64 · trixie
  Fixed · Fixed: 1.8.6-1
  dsa · libsixel · debian · 13
- 1.10.5-1 · arm64 · trixie
  Fixed · Fixed: 1.8.6-1
  dsa · libsixel · debian · 13
[libsixel-dev]Unknown
Source package: [libsixel]
Details (2)
- 1.10.5-1 · amd64 · trixie
  Fixed · Fixed: 1.8.6-1
  dsa · libsixel · debian · 13
- 1.10.5-1 · arm64 · trixie
  Fixed · Fixed: 1.8.6-1
  dsa · libsixel · debian · 13
[libsixel-examples]Unknown
Source package: [libsixel]
Details (2)
- 1.10.5-1 · all · trixie
  Fixed · Fixed: 1.8.6-1
  dsa · libsixel · debian · 13
- 1.10.5-1 · all · trixie
  Fixed · Fixed: 1.8.6-1
  dsa · libsixel · debian · 13
[libstb0t64]Unknown
Source package: [libstb]
Details (2)
- 0.0~git20241109.5c20573+ds-1 · amd64 · trixie
  Fixed · Fixed: 0.0~git20220908.8b5f1f3+ds-1
  dsa · libstb · debian · 13
- 0.0~git20241109.5c20573+ds-1 · arm64 · trixie
  Fixed · Fixed: 0.0~git20220908.8b5f1f3+ds-1
  dsa · libstb · debian · 13
[libstb-dev]Unknown
Source package: [libstb]
Details (2)
- 0.0~git20241109.5c20573+ds-1 · amd64 · trixie
  Fixed · Fixed: 0.0~git20220908.8b5f1f3+ds-1
  dsa · libstb · debian · 13
- 0.0~git20241109.5c20573+ds-1 · arm64 · trixie
  Fixed · Fixed: 0.0~git20220908.8b5f1f3+ds-1
  dsa · libstb · debian · 13

Observed: Oct 23, 2026, 5:43:40 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]