Out-of-bounds read in LibSass - CVE-2019-6284
Published: January 17, 2019
Vulnerability identifier: #VU17069
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-6284
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in Sass::Prelexer::alternatives in prelexer.hpp. A remote attacker can pass specially specially crafted data to the application, trigger out-of-bounds read error and read contents of memory on the system.
Affected software
LibSass
IBM Watson Machine Learning Accelerator
IBM Security Verify Information Queue
IBM Edge Application Manager
IBM Watson Machine Learning on CP4D
QRadar User Behavior Analytics
IBM Watson Machine Learning Accelerator
IBM Security Verify Information Queue
IBM Edge Application Manager
IBM Watson Machine Learning on CP4D
QRadar User Behavior Analytics
How to mitigate CVE-2019-6284
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
IBM Watson Machine Learning on CP4D - update to 2.6.0
QRadar User Behavior Analytics - update to 4.1.11
IBM Security Verify Information Queue - update to 10.0.0
QRadar User Behavior Analytics - update to 4.1.11
IBM Security Verify Information Queue - update to 10.0.0
External References
Related Security Bulletins
- Multiple vulnerabilities in LibSass
- Multiple vulnerabilities in IBM Security Verify Information Queue
- Multiple vulnerabilities in IBM Edge Application Manager
- Multiple vulnerabilities in IBM QRadar User Behavior Analytics
- Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
- Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data