CVE-2019-19725
sysstat: double free in check_file_actlst() in sa_common.c may lead to arbitrary code execution
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Photon OS. Niedriger laut Red Hat (hoch), Ubuntu (mittel).
Beschreibung
sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 1.0 | sysstat | 12.2.0-1.ph1 |
| Photon OS 2.0 | sysstat | 12.2.0-1.ph2 |
| Photon OS 3.0 | sysstat | 12.2.0-1.ph3 |
| debian 10 | sysstat | 12.0.3-2+deb10u1 |
| debian 11 | sysstat | 12.2.0-2 |
| debian 12 | sysstat | 12.2.0-2 |
| debian 13 | sysstat | 12.2.0-2 |
| debian 14 | sysstat | 12.2.0-2 |
| echo | sysstat | 12.2.0-2 |
| ubuntu 16.04 | sysstat | 11.2.0-1ubuntu0.3 |
| ubuntu 16.04-ESM | sysstat | 11.2.0-1ubuntu0.3 |
| ubuntu 18.04 | sysstat | 11.6.1-1ubuntu0.1 |
Alle 15 Einträge aus 15 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| Photon OS 1.0 | sysstat | 12.2.0-1.ph1 |
| Photon OS 2.0 | sysstat | 12.2.0-1.ph2 |
| Photon OS 3.0 | sysstat | 12.2.0-1.ph3 |
| debian 10 | sysstat | 12.0.3-2+deb10u1 |
| debian 11 | sysstat | 12.2.0-2 |
| debian 12 | sysstat | 12.2.0-2 |
| debian 13 | sysstat | 12.2.0-2 |
| debian 14 | sysstat | 12.2.0-2 |
| echo | sysstat | 12.2.0-2 |
| ubuntu 16.04 | sysstat | 11.2.0-1ubuntu0.3 |
| ubuntu 16.04-ESM | sysstat | 11.2.0-1ubuntu0.3 |
| ubuntu 18.04 | sysstat | 11.6.1-1ubuntu0.1 |
| ubuntu 18.04-ESM | sysstat | 11.6.1-1ubuntu0.1 |
| ubuntu 19.04 | sysstat | 12.0.1-1ubuntu0.1 |
| ubuntu 19.10 | sysstat | 12.0.6-1ubuntu0.1 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2019-19725
- https://github.com/sysstat/sysstat/commit/a5c8abd4a481ee6e27a3acf00e6d9b0f023e20ed
- https://github.com/sysstat/sysstat/issues/242
- https://lists.debian.org/debian-lts-announce/2022/11/msg00014.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-19725
- https://security.gentoo.org/glsa/202007-22
- https://ubuntu.com/security/notices/USN-4242-1
- https://usn.ubuntu.com/4242-1/