CVE-2019-17263 - Vulnerability Details - OpenCVE

In libyal libfwsi before 20191006, libfwsi_extension_block_copy_from_byte_stream in libfwsi_extension_block.c has a heap-based buffer over-read because rejection of an unsupported size only considers values less than 6, even though values of 6 and 7 are also unsupported. NOTE: the vendor has disputed this as described in the GitHub issue

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00163.

Key SSVC decision points have not yet been added.

Vendors	Products
Libfwsi Project Subscribe	Libfwsi Subscribe

Configuration 1 [-]

cpe:2.3:a:libfwsi_project:libfwsi:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://packetstormsecurity.com/files/154774/libyal-libfwsi-Buffer-Overread.html
https://github.com/libyal/libfwsi/compare/20181227...20191006
https://github.com/libyal/libfwsi/issues/13

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2019-10-06T21:16:50

Updated: 2024-08-05T01:33:17.368Z

Reserved: 2019-10-06T00:00:00

Link: CVE-2019-17263

Vulnrichment

Updated: 2024-08-05T01:33:17.368Z

NVD

Status : Modified

Published: 2019-10-06T22:15:10.227

Modified: 2024-11-21T04:31:59.103

Link: CVE-2019-17263

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-125

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "In libyal libfwsi before 20191006, libfwsi_extension_block_copy_from_byte_stream in libfwsi_extension_block.c has a heap-based buffer over-read because rejection of an unsupported size only considers values less than 6, even though values of 6 and 7 are also unsupported. NOTE: the vendor has disputed this as described in the GitHub issue"}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-10-14T12:59:24", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/libyal/libfwsi/issues/13"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/libyal/libfwsi/compare/20181227...20191006"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/154774/libyal-libfwsi-Buffer-Overread.html"}], "tags": ["disputed"], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-17263", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "** DISPUTED ** In libyal libfwsi before 20191006, libfwsi_extension_block_copy_from_byte_stream in libfwsi_extension_block.c has a heap-based buffer over-read because rejection of an unsupported size only considers values less than 6, even though values of 6 and 7 are also unsupported. NOTE: the vendor has disputed this as described in the GitHub issue."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/libyal/libfwsi/issues/13", "refsource": "MISC", "url": "https://github.com/libyal/libfwsi/issues/13"}, {"name": "https://github.com/libyal/libfwsi/compare/20181227...20191006", "refsource": "MISC", "url": "https://github.com/libyal/libfwsi/compare/20181227...20191006"}, {"name": "http://packetstormsecurity.com/files/154774/libyal-libfwsi-Buffer-Overread.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/154774/libyal-libfwsi-Buffer-Overread.html"}]}}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-18T20:47:01.962904Z", "id": "CVE-2019-17263", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-18T20:47:12.251Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T01:33:17.368Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/libyal/libfwsi/issues/13"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/libyal/libfwsi/compare/20181227...20191006"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/154774/libyal-libfwsi-Buffer-Overread.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-17263", "datePublished": "2019-10-06T21:16:50", "dateReserved": "2019-10-06T00:00:00", "dateUpdated": "2024-08-05T01:33:17.368Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/libyal/libfwsi/issues/13", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/libyal/libfwsi/compare/20181227...20191006", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "http://packetstormsecurity.com/files/154774/libyal-libfwsi-Buffer-Overread.html", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T01:33:17.368Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2019-17263", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-18T20:47:01.962904Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-18T20:47:06.008Z"}}], "cna": {"tags": ["disputed"], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/libyal/libfwsi/issues/13", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libyal/libfwsi/compare/20181227...20191006", "tags": ["x_refsource_MISC"]}, {"url": "http://packetstormsecurity.com/files/154774/libyal-libfwsi-Buffer-Overread.html", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "In libyal libfwsi before 20191006, libfwsi_extension_block_copy_from_byte_stream in libfwsi_extension_block.c has a heap-based buffer over-read because rejection of an unsupported size only considers values less than 6, even though values of 6 and 7 are also unsupported. NOTE: the vendor has disputed this as described in the GitHub issue"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2019-10-14T12:59:24"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "n/a"}]}, "product_name": "n/a"}]}, "vendor_name": "n/a"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/libyal/libfwsi/issues/13", "name": "https://github.com/libyal/libfwsi/issues/13", "refsource": "MISC"}, {"url": "https://github.com/libyal/libfwsi/compare/20181227...20191006", "name": "https://github.com/libyal/libfwsi/compare/20181227...20191006", "refsource": "MISC"}, {"url": "http://packetstormsecurity.com/files/154774/libyal-libfwsi-Buffer-Overread.html", "name": "http://packetstormsecurity.com/files/154774/libyal-libfwsi-Buffer-Overread.html", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "** DISPUTED ** In libyal libfwsi before 20191006, libfwsi_extension_block_copy_from_byte_stream in libfwsi_extension_block.c has a heap-based buffer over-read because rejection of an unsupported size only considers values less than 6, even though values of 6 and 7 are also unsupported. NOTE: the vendor has disputed this as described in the GitHub issue."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2019-17263", "STATE": "PUBLIC", "ASSIGNER": "cve@mitre.org"}}}}, "cveMetadata": {"cveId": "CVE-2019-17263", "state": "PUBLISHED", "dateUpdated": "2024-08-05T01:33:17.368Z", "dateReserved": "2019-10-06T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2019-10-06T21:16:50", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:libfwsi_project:libfwsi:*:*:*:*:*:*:*:*", "matchCriteriaId": "3BEFFB32-3619-412F-919B-16BBC1258601", "versionEndExcluding": "20191006", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [{"sourceIdentifier": "cve@mitre.org", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "In libyal libfwsi before 20191006, libfwsi_extension_block_copy_from_byte_stream in libfwsi_extension_block.c has a heap-based buffer over-read because rejection of an unsupported size only considers values less than 6, even though values of 6 and 7 are also unsupported. NOTE: the vendor has disputed this as described in the GitHub issue"}, {"lang": "es", "value": "** EN DISPUTA ** En libyal libfwsi versiones anteriores a 20191006, la funci\u00f3n libfwsi_extension_block_copy_from_byte_stream en el archivo libfwsi_extension_block.c, presenta una lectura excesiva de b\u00fafer en la regi\u00f3n heap de la memoria porque el rechazo de un tama\u00f1o no admitido solo considera valores inferiores a 6, aunque los valores de 6 y 7 tampoco son compatibles. NOTA: el fabricante ha disputado esto, tal y como se describe en los problemas de GitHub."}], "id": "CVE-2019-17263", "lastModified": "2024-11-21T04:31:59.103", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 2.1, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-10-06T22:15:10.227", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/154774/libyal-libfwsi-Buffer-Overread.html"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/libyal/libfwsi/compare/20181227...20191006"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/libyal/libfwsi/issues/13"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/154774/libyal-libfwsi-Buffer-Overread.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/libyal/libfwsi/compare/20181227...20191006"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/libyal/libfwsi/issues/13"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}