Heap-based buffer overflow in libMirage - CVE-2019-15540

Detailed vulnerability description

The vulnerability allows a local attacker to execute arbitrary code on the target system.

The vulnerability exists in the "filters/filter-cso/filter-stream.c" in the CSO filter due to a boundary error when the software does not validate the part size. A local authenticated attacker can trigger heap-based buffer overflow, gain root access and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

How to mitigate CVE-2019-15540

Sources

• https://gist.github.com/andreafioraldi/baa79cd78131888d98d6ba680d5f514e
• https://sourceforge.net/p/cdemu/bugs/119/
• https://sourceforge.net/p/cdemu/code/ci/0e9292c9aa34bf545f43f7efe5f0b94faba94962/