Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2019-17263 Details

Description

In libyal libfwsi before 20191006, libfwsi_extension_block_copy_from_byte_stream in libfwsi_extension_block.c has a heap-based buffer over-read because rejection of an unsupported size only considers values less than 6, even though values of 6 and 7 are also unsupported. NOTE: the vendor has disputed this as described in the GitHub issue

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:3.3 LOWVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
http://packetstormsecurity.com/files/154774/libyal-libfwsi-Buffer-Overread.html CVEExploitThird Party AdvisoryVDB Entry
https://github.com/libyal/libfwsi/compare/20181227...20191006 CVEPatchThird Party Advisory
https://github.com/libyal/libfwsi/issues/13 CVEExploitThird Party Advisory
http://packetstormsecurity.com/files/154774/libyal-libfwsi-Buffer-Overread.html [email protected]ExploitThird Party AdvisoryVDB Entry
https://github.com/libyal/libfwsi/compare/20181227...20191006 [email protected]PatchThird Party Advisory

see all 6 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-125Out-of-bounds Read[email protected]

Affected Products

ProductVersions
libfwsi project libfwsi
< 20191006

CPE

  • cpe:2.3:a:libfwsi_project:libfwsi:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

12 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2019-17263
NVD Published Date:
Oct 6, 2019
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2019-17263 Details - Not Deferred