CVE-2019-17544

moderate-risk
Published 2019-10-14

libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp via an isolated \ character.

Do I need to act?

-
0.36% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.1/10 Critical
NETWORK / LOW complexity

Affected Products (6)

Aspell

Affected Vendors

Gnu Canonical

References (16)

Third Party Advisory https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16109
Patch https://github.com/GNUAspell/aspell/commit/80fa26c74279fced8d778351cff19d1d8f44f...
Third Party Advisory https://github.com/GNUAspell/aspell/compare/rel-0.60.7...rel-0.60.8
https://lists.debian.org/debian-lts-announce/2019/10/msg00027.html
https://lists.debian.org/debian-lts-announce/2021/07/msg00021.html
Third Party Advisory https://usn.ubuntu.com/4155-1/
https://usn.ubuntu.com/4155-2/
https://www.debian.org/security/2021/dsa-4948
Third Party Advisory https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16109
Patch https://github.com/GNUAspell/aspell/commit/80fa26c74279fced8d778351cff19d1d8f44f...
Third Party Advisory https://github.com/GNUAspell/aspell/compare/rel-0.60.7...rel-0.60.8
https://lists.debian.org/debian-lts-announce/2019/10/msg00027.html
https://lists.debian.org/debian-lts-announce/2021/07/msg00021.html
Third Party Advisory https://usn.ubuntu.com/4155-1/
https://usn.ubuntu.com/4155-2/
https://www.debian.org/security/2021/dsa-4948
45
/ 100
moderate-risk
Severity 31/34 · Critical
Exploitability 1/34 · Minimal
Exposure 13/34 · Low