CVE-2019-19725
sysstat: double free in check_file_actlst() in sa_common.c may lead to arbitrary code execution
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Photon OS. Daha düşük diyenler: Red Hat (yüksek), Ubuntu (orta).
Açıklama
sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Photon OS 1.0 | sysstat | 12.2.0-1.ph1 |
| Photon OS 2.0 | sysstat | 12.2.0-1.ph2 |
| Photon OS 3.0 | sysstat | 12.2.0-1.ph3 |
| debian 10 | sysstat | 12.0.3-2+deb10u1 |
| debian 11 | sysstat | 12.2.0-2 |
| debian 12 | sysstat | 12.2.0-2 |
| debian 13 | sysstat | 12.2.0-2 |
| debian 14 | sysstat | 12.2.0-2 |
| echo | sysstat | 12.2.0-2 |
| ubuntu 16.04 | sysstat | 11.2.0-1ubuntu0.3 |
| ubuntu 16.04-ESM | sysstat | 11.2.0-1ubuntu0.3 |
| ubuntu 18.04 | sysstat | 11.6.1-1ubuntu0.1 |
15 kaynaktaki 15 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Photon OS 1.0 | sysstat | 12.2.0-1.ph1 |
| Photon OS 2.0 | sysstat | 12.2.0-1.ph2 |
| Photon OS 3.0 | sysstat | 12.2.0-1.ph3 |
| debian 10 | sysstat | 12.0.3-2+deb10u1 |
| debian 11 | sysstat | 12.2.0-2 |
| debian 12 | sysstat | 12.2.0-2 |
| debian 13 | sysstat | 12.2.0-2 |
| debian 14 | sysstat | 12.2.0-2 |
| echo | sysstat | 12.2.0-2 |
| ubuntu 16.04 | sysstat | 11.2.0-1ubuntu0.3 |
| ubuntu 16.04-ESM | sysstat | 11.2.0-1ubuntu0.3 |
| ubuntu 18.04 | sysstat | 11.6.1-1ubuntu0.1 |
| ubuntu 18.04-ESM | sysstat | 11.6.1-1ubuntu0.1 |
| ubuntu 19.04 | sysstat | 12.0.1-1ubuntu0.1 |
| ubuntu 19.10 | sysstat | 12.0.6-1ubuntu0.1 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2019-19725
- https://github.com/sysstat/sysstat/commit/a5c8abd4a481ee6e27a3acf00e6d9b0f023e20ed
- https://github.com/sysstat/sysstat/issues/242
- https://lists.debian.org/debian-lts-announce/2022/11/msg00014.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-19725
- https://security.gentoo.org/glsa/202007-22
- https://ubuntu.com/security/notices/USN-4242-1
- https://usn.ubuntu.com/4242-1/