CVE-2019-20433 Memory corruption in n/a
A buffer over-read in GNU Aspell allows attackers to cause denial of service or disclose information when specific encoding settings are used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-20433?
CVE-2019-20433 is a critical memory corruption vulnerability in n/a, published on 27 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.
Weakness: CWE-125
Which versions are affected by CVE-2019-20433?
It affects 1 product.
Linux distribution packages (3)
aspell SUSE:Linux Enterprise Server 12 SP5 | All versions | 0.60.6.1-18.8.2 |
aspell SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 0.60.6.1-18.8.2 |
aspell SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 0.60.6.1-18.8.2 |
Products include Gnu Aspell.
How do I fix CVE-2019-20433?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2019-20433 being exploited?
There is no known exploitation of CVE-2019-20433 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2019-20433, GHSA-qcm5-23xv-7r79, OESA-2021-1388, SUSE-SU-2020:2807-1, UBUNTU-CVE-2019-20433.