Buffer Over-Read Vulnerability in GNU Aspell by GNU
CVE-2019-20433

9.1CRITICAL

Key Information:

Vendor

Gnu
Status
Aspell
Vendor
CVE Published:
27 January 2020

What is CVE-2019-20433?

The GNU Aspell library, specifically libaspell.a, contains a buffer over-read vulnerability affecting versions prior to 0.60.8. This issue arises when using string encodings of ucs-2 or ucs-4, which can lead to unexpected behavior in applications. This vulnerability is exploitable when the encoding is incorrectly set externally, such as via the ASPELL_CONF environment variable, potentially allowing unauthorized access to sensitive data during operations.

References

http://aspell.net/buffer-overread-ucs.txt
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.