CVE-2019-17544

Опубликовано: 14 окт. 2019

Источник: nvd

CVSS3: 9.1

CVSS2: 6.4

EPSS Низкий

Описание

libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ character.

Ссылки

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16109
Third Party Advisory
https://github.com/GNUAspell/aspell/commit/80fa26c74279fced8d778351cff19d1d8f44fe4e
Patch
Third Party Advisory
https://github.com/GNUAspell/aspell/compare/rel-0.60.7...rel-0.60.8
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/10/msg00027.html
https://lists.debian.org/debian-lts-announce/2021/07/msg00021.html
https://usn.ubuntu.com/4155-1/
Third Party Advisory
https://usn.ubuntu.com/4155-2/
https://www.debian.org/security/2021/dsa-4948
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16109
Third Party Advisory
https://github.com/GNUAspell/aspell/commit/80fa26c74279fced8d778351cff19d1d8f44fe4e
Patch
Third Party Advisory
https://github.com/GNUAspell/aspell/compare/rel-0.60.7...rel-0.60.8
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/10/msg00027.html
https://lists.debian.org/debian-lts-announce/2021/07/msg00021.html
https://usn.ubuntu.com/4155-1/
Third Party Advisory
https://usn.ubuntu.com/4155-2/
https://www.debian.org/security/2021/dsa-4948

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:gnu:aspell:*:*:*:*:*:*:*:*

Версия до 0.60.8 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

EPSS

Процентиль: 58%

0.0036

Низкий

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-125

Связанные уязвимости

CVE-2019-17544

CVSS3: 9.1

ubuntu

больше 6 лет назад

libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ character.

CVE-2019-17544

CVSS3: 6.6

redhat

больше 6 лет назад

libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ character.

CVE-2019-17544

CVSS3: 9.1

debian

больше 6 лет назад

libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over- ...

SUSE-SU-2019:3034-1

suse-cvrf

около 6 лет назад

Security update for aspell

GHSA-3f6h-6ch9-p8jv

github

больше 3 лет назад

libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ character.

EPSS

Процентиль: 58%

0.0036

Низкий

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-125