CVE-2019-16166
Publication date 9 September 2019
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
GNU cflow through 1.6 has a heap-based buffer over-read in the nexttoken function in parser.c.
Status
Package | Ubuntu Release | Status |
---|---|---|
cflow | 24.10 oracular |
Vulnerable
|
24.04 LTS noble |
Vulnerable
|
|
22.04 LTS jammy |
Vulnerable
|
|
20.04 LTS focal |
Vulnerable
|
|
18.04 LTS bionic |
Vulnerable
|
|
16.04 LTS xenial |
Vulnerable
|
|
14.04 LTS trusty | Not in release |
Notes
ccdm94
according to commit notes provided by upstream, the fix for this issue can be found in b9a7cd5e9d4. This is the same fix as the one for CVE-2019-16165. However, it seems like version 1.7, which would already include it, is still vulnerable to the issue, the reproducer file generating the same heap-based buffer overflow error when cflow is run with ASAN. Therefore, it seems like a patch for this vulnerability is still needed as of version 1.7.
Severity score breakdown
Parameter | Value |
---|---|
Base score |
|
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | Required |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | None |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |