PT-2019-16641 · Microsoft+1 · Windows+1

Published 2019-08-21 · Updated 2022-12-13 · CVE-2019-3634

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions McAfee Data Loss Prevention (DLPe) for Windows versions prior to 11.3.2.8

Description The issue allows a local user to cause the Windows operating system to crash via an encrypted message sent to DLPe, which when decrypted results in DLPe reading unallocated memory. This is achieved by exploiting a buffer overflow in the software.

Recommendations For versions prior to 11.3.2.8, update to version 11.3.2.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the encrypted message handling functionality in DLPe to minimize the risk of exploitation.

Fix

Buffer Overflow

Out of bounds Read

Weakness Enumeration

CWE-119

CWE-125

Related Identifiers

CVE-2019-3634

Affected Products

Mcafee Data Loss Prevention

Windows

References · 4

• https://osv.dev/vulnerability/CVE-2019-3634 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3634 · Security Note
• https://t.me/cvenotify/39708 · Telegram Post
• https://kc.mcafee.com/corporate/index?page=content&id=SB10295 · Note