Vulnerability Details : CVE-2019-8379
An issue was discovered in AdvanceCOMP through 2.1. A NULL pointer dereference exists in the function be_uint32_read() located in endianrw.h. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file.
Vulnerability category: Memory CorruptionDenial of service
Products affected by CVE-2019-8379
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
- cpe:2.3:a:advancemame:advancecomp:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-8379
0.27%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 67 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-8379
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2019-8379
-
The product dereferences a pointer that it expects to be valid but is NULL.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-8379
-
https://access.redhat.com/errata/RHSA-2019:2332
RHSA-2019:2332 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-the-function-be_uint32_read-advancecomp/
CVE-2019-8379: Null pointer dereference vulnerability in the function be_uint32_read() - advancecomp - Loginsoft ResearchExploit;Third Party Advisory
-
https://sourceforge.net/p/advancemame/bugs/271/
AdvanceMAME / Bugs / #271 null pointer dereference in be_uint32_read()Exploit;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2021/12/msg00034.html
[SECURITY] [DLA 2868-1] advancecomp security updateMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J23C6QSTJMQ467KAI6QG54AE4MZRLPQV/
[SECURITY] Fedora 30 Update: advancecomp-2.1-11.fc30 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
Jump to