CVE-2019-12519

Katalog CVE

CVSS 9.8 · Critical EPSS 6,7%

Kerentanan Out-of-bounds Write pada squid-cache squid, debian linux +2 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that the stack won't overflow.

Rincian

Terbit di NVD

15 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

6,7% peluang dieksploitasi; lebih tinggi dari 93,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00018.html mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2020/04/23/1 mailing list · advisory pihak ketiga
• https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12519.txt advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202005-05 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210205-0006/ advisory pihak ketiga
• https://usn.ubuntu.com/4356-1/ advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4682 advisory pihak ketiga