Main Vulnerability Database Vulnerabilities #VU31129

Input validation error in libmysofa - CVE-2019-10672

Published: March 31, 2019 / Updated: July 17, 2020

Vulnerability identifier: #VU31129

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-10672

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

treeRead in hdf/btree.c in libmysofa before 0.7 does not properly validate multiplications and additions.

Affected software

libmysofa
Ubuntu
libmysofa0 (Ubuntu package)

How to mitigate CVE-2019-10672

Install update from vendor's website.

libmysofa - update to 0.7
libmysofa0 (Ubuntu package) - addressed in versions 0.6~dfsg0-2ubuntu0.18.04.1, 0.6~dfsg0-2ubuntu0.18.10.1, 0.6~dfsg0-2ubuntu0.19.04.1

External References

https://github.com/hoene/libmysofa/commit/d39a171e9c6a1c44dbdf43f9db6c3fbd887e38c1
https://github.com/hoene/libmysofa/compare/49aa1c7...2ed84bb
https://github.com/hoene/libmysofa/releases/tag/v0.7
https://usn.ubuntu.com/4033-1/

Related Security Bulletins