Upstream information
Description
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex* functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having moderate severity.
National Vulnerability Database | |
---|---|
Base Score | 7.5 |
Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Access Vector | Network |
Access Complexity | Low |
Authentication | None |
Confidentiality Impact | Partial |
Integrity Impact | Partial |
Availability Impact | Partial |
National Vulnerability Database | |
---|---|
Base Score | 9.8 |
Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Access Vector | Network |
Access Complexity | Low |
Privileges Required | None |
User Interaction | None |
Scope | Unchanged |
Confidentiality Impact | High |
Integrity Impact | High |
Availability Impact | High |
CVSSv3 Version | 3 |
- SUSE-SU-2019:0228-1, published Tue Feb 5 07:09:04 MST 2019
- openSUSE-SU-2019:0165-1, published Wed, 13 Feb 2019 18:17:22 +0100 (CET)
- openSUSE-SU-2019:0171-1, published Wed, 13 Feb 2019 21:12:44 +0100 (CET)
List of released packages
Product(s) | Fixed package version(s) | References |
---|---|---|
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 |
| Patchnames: SUSE-SLE-Module-Development-Tools-OBS-15-2019-228 |
openSUSE Leap 15.0 |
| Patchnames: openSUSE-2019-165 |