Heap-based Buffer Overflow in GNU Recutils by Free Software Foundation
CVE-2019-11640

8.8HIGH

Key Information:

Vendor
Gnu
Status
Recutils
Vendor
CVE Published:
1 May 2019

Summary

A vulnerability has been identified in GNU Recutils 1.8 which allows for a heap-based buffer overflow. The flaw exists in the function rec_fex_parse_str_simple located within rec-fex.c of the librec.a library. Exploiting this vulnerability can lead to unexpected behavior or potential code execution, making it critical for users and developers to mitigate risks associated with this issue. For further technical details, you can refer to the provided links.

References

https://github.com/TeamSeri0us/pocs/tree/master/recutils/...
x_refsource_MISC
https://github.com/TeamSeri0us/pocs/blob/master/recutils/...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.