PT-2019-14268 · Libflate · Libflate

Published 2019-07-04 · Updated 2021-08-25 · CVE-2019-15552

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libflate versions prior to 0.1.25

Description The issue is related to a use-after-free vulnerability in the MultiDecoder::read() function, which can lead to arbitrary code execution. This occurs when the execution of MultiDecoder::read() is interrupted by a panic in a caller-supplied Read implementation, causing drop() to be called on uninitialized memory of a generic type implementing Read. The vulnerability allows an attacker to potentially gain arbitrary code execution.

Recommendations For versions prior to 0.1.25, update to version 0.1.25 or later to resolve the issue. As a temporary workaround, consider aborting immediately instead of unwinding the stack in case of a panic within MultiDecoder::read().

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2019-15552

GHSA-RPCM-WHQC-JFW8

RUSTSEC-2019-0010

Affected Products

Libflate

References · 15

• https://ubuntu.com/security/CVE-2019-15552 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2019-0010 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15552 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15552 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-15552 · Security Note
• https://osv.dev/vulnerability/GHSA-rpcm-whqc-jfw8 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-15552 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-15552 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-15552 · Vendor Advisory
• https://github.com/sile/libflate/issues/35 · Note
• https://github.com/sile/libflate/pull/37 · Note
• https://github.com/sile/libflate/commit/ffeff7c65deac5a6f886db2a59bcae4e420e4706 · Note
• https://github.com/sile/libflate · Note
• https://crates.io/crates/libflate · Note
• https://rustsec.org/advisories/RUSTSEC-2019-0010.html · Note