7.8

CVE-2019-18397: debian debian_linux Classic Buffer Overflow

CVSS: 7.8v3.1HighModified
AliasesALPINE-CVE-2019-18397MGASA-2019-0325SUSE-SU-2021:1655-1
Published 13-11-2019Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2019-18397 is a high (CVSS 7.8) Classic Buffer Overflow vulnerability in debian debian_linux. EPSS estimates a 2.18% chance of exploitation in the next 30 days, higher than 82.1% of scored vulnerabilities.

Overall risk
32/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (NVD)
EPSS score
2.18%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 13-11-2019
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code by delivering crafted text content to a user, when this content is then rendered by an application that uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in HexChat.

CVSS metrics

6 scores · 5 sources · 3 versions

EPSS trend

Probability

2.18%

Chance of exploitation in the next 30 days

Percentile

82%

Versus all other CVEs

30-day change

0.00 pp

From 2.18% on 20-09-2026

20-09-202620-10-2026
EPSS score
2.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse5 products
  • fribidi&distro=SUSE Linux Enterprise Micro 5.0< 1.0.5-3.3.1
  • fribidi&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 1.0.5-3.3.1
  • fribidi&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 1.0.5-3.3.1
  • fribidi&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP2< 1.0.5-3.3.1
  • fribidi&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP3< 1.0.5-3.3.1
Redhat4 products
  • fribidi< 0:1.0.2-1.el7_7.1 | < 0:1.0.4-7.el8_1 | < 0:1.0.4-6.el8_0.1
  • fribidi-debuginfo< 0:1.0.2-1.el7_7.1 | < 0:1.0.4-7.el8_1 | < 0:1.0.4-6.el8_0.1
  • fribidi-debugsource< 0:1.0.4-7.el8_1 | < 0:1.0.4-6.el8_0.1
  • fribidi-devel< 0:1.0.2-1.el7_7.1 | < 0:1.0.4-7.el8_1 | < 0:1.0.4-6.el8_0.1
Opensuse3 products
  • fribidi&distro=openSUSE Leap 15.2< 1.0.5-lp152.2.3.1
  • fribidi&distro=openSUSE Leap 15.3< 1.0.5-3.3.1
  • fribidi&distro=openSUSE Tumbleweed< 1.0.10-2.1
Debian2 products
  • fribidi< 1.0.7-1.1 | < 1.0.5-3.1+deb10u1
  • debian_linuxEOL10.0 | 8.0 | 9.0
Alpine1 product
  • fribidi≥ 1.0.0, < 1.0.5-r2 | ≥ 1.0.0, < 1.0.7-r1 | ≥ 1.0.0, < 1.0.2-r1 | ≥ 1.0.0, < 1.0.5-r1
Gnu1 product
Mageia1 product
  • fribidi< 1.0.5-2.1.mga7
Ubuntu1 product
  • fribidi< 0.19.7-1 | < 0.19.7-2

8 vendors · 18 products

References

29 links
Show all 29 references