PT-2019-18078 · Netwide+2 · Netwide Assembler+2

Cheng Wen

·

Publicado

2019-01-15

·

Atualizado

2024-12-08

·

CVE-2019-6291

CVSS v3.1

5.5

Média

VetorAV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Netwide Assembler (NASM) versions prior to 2.14.03
Description A stack exhaustion problem exists due to the expr6 function making recursive calls to itself in certain scenarios involving lots of '!' or '+' or '-' characters. This could allow remote attackers to cause a denial-of-service via a crafted asm file.
Recommendations For versions prior to 2.14.03, update to version 2.14.03 or later to resolve the issue. As a temporary workaround, consider restricting the use of the expr6 function in eval.c to minimize the risk of exploitation. Avoid using crafted asm files that could trigger the recursive calls until the issue is resolved.

Exploit

Correção

DoS

Uncontrolled Recursion

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-674

Identificadores relacionados

ALT-PU-2020-2243
ALT-PU-2024-16552
CVE-2019-6291

Produtos afetados

Alt Linux
Debian
Netwide Assembler