Upstream information
Description
URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex* functions) for an incomplete URI with an IPv6 address containing an embedded IPv4 address, such as a "//[::44.1" address.SUSE information
Overall state of this security issue: Does not affect SUSE products
This issue is currently rated as having moderate severity.
| National Vulnerability Database | |
|---|---|
| Base Score | 7.5 |
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| Access Vector | Network |
| Access Complexity | Low |
| Authentication | None |
| Confidentiality Impact | Partial |
| Integrity Impact | Partial |
| Availability Impact | Partial |
| National Vulnerability Database | |
|---|---|
| Base Score | 9.8 |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Access Vector | Network |
| Access Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | High |
| CVSSv3 Version | 3 |
- SUSE-SU-2019:0228-1, published Tue Feb 5 07:09:04 MST 2019
- openSUSE-SU-2019:0165-1, published Wed, 13 Feb 2019 18:17:22 +0100 (CET)
- openSUSE-SU-2019:0171-1, published Wed, 13 Feb 2019 21:12:44 +0100 (CET)
List of released packages
| Product(s) | Fixed package version(s) | References |
|---|---|---|
| SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 |
| Patchnames: SUSE-SLE-Module-Development-Tools-OBS-15-2019-228 |
| openSUSE Leap 15.0 |
| Patchnames: openSUSE-2019-165 |
