libmysofa 0.9 dataobject.c readOHDRHeaderMessageDatatype out-of-bounds write

Summaryinfo

A vulnerability was found in libmysofa 0.9 and classified as problematic. This vulnerability affects the function readOHDRHeaderMessageDatatype of the file dataobject.c. Such manipulation leads to out-of-bounds write. This vulnerability is listed as CVE-2019-20016. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in libmysofa 0.9. It has been rated as problematic. Affected by this issue is the function readOHDRHeaderMessageDatatype of the file dataobject.c. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is availability. CVE summarizes:

libmysofa 0.9 does not properly restrict recursive function calls, as demonstrated by reports of stack consumption in readOHDRHeaderMessageDatatype in dataobject.c and directblockRead in fractalhead.c.

The weakness was presented 12/27/2019. This vulnerability is handled as CVE-2019-20016 since 12/27/2019. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• libmysofa

Version

• 0.9

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion