PT-2019-4972 · Libmysofa+1 · Libmysofa+1

Published 2019-03-31 · Updated 2020-01-08 · CVE-2019-10672

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libmysofa versions prior to 0.7

Description The issue arises from insufficient validation of multiplications and additions in the treeRead component of the libmysofa library. This could potentially allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 0.7, update to version 0.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the treeRead component in hdf/btree.c until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-01592

CVE-2019-10672

OPENSUSE-SU-2024:10960-1

USN-4033-1

Affected Products

Ubuntu

Libmysofa

References · 15

• https://github.com/hoene/libmysofa/commit/d39a171e9c6a1c44dbdf43f9db6c3fbd887e38c1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-10672 · Security Note
• https://usn.ubuntu.com/4033-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10672 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10672 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4033-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10672 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10672 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-10672 · Security Note
• https://osv.dev/vulnerability/USN-4033-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01592 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-10672 · Vendor Advisory
• https://github.com/hoene/libmysofa/compare/49aa1c7...2ed84bb · Note
• https://github.com/hoene/libmysofa/releases/tag/v0.7 · Note
• https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-10672.html?_ga=2.34889249.1216040612.1561352109-1618695258.1547637860 · Note