PT-2019-15051 · Libyal+1 · Liblnk+1

Published 2019-10-06 · Updated 2024-08-05 · CVE-2019-17264

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions libyal liblnk versions prior to 20191006

Description The issue is related to a heap-based buffer over-read in the liblnk location information read data function, located in liblnk location information.c, due to the use of an incorrect variable name for a certain offset. The vendor has disputed this issue, as described in the GitHub issue.

Recommendations For versions prior to 20191006, update to a version released after 20191006 to resolve the issue. At the moment, there is no information about additional mitigation measures for this issue.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-682

CWE-125

Related Identifiers

CVE-2019-17264

Affected Products

Debian

Liblnk

References · 12

• 🔥 https://github.com/libyal/liblnk/issues/38 · Exploit
• https://github.com/libyal/liblnk/compare/20181227...20191006 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-17264 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-17264 · Security Note
• https://osv.dev/vulnerability/CVE-2019-17264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17264 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17264 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-17264 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17264 · Vendor Advisory
• https://github.com/libyal/liblnk/commit/c4d04de2c76f62129677c90a616d049be9c52482 · Note
• https://t.me/cvenotify/89101 · Telegram Post
• https://t.me/cvenotify/89100 · Telegram Post