CVE-2019-8960: flexera flexnet_publisher

Vulnerability summary

CVE-2019-8960 is a high (CVSS 7.5) vulnerability in flexera flexnet_publisher. EPSS estimates a 1.31% chance of exploitation in the next 30 days, higher than 70.1% of scored vulnerabilities.

Timeline

1. 21-04-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A Denial of Service vulnerability related to command handling has been identified in FlexNet Publisher lmadmin.exe version 11.16.2. The message reading function used in lmadmin.exe can, given a certain message, call itself again and then wait for a further message. With a particular flag set in the original message, but no second message received, the function eventually return an unexpected value which leads to an exception being thrown. The end result can be process termination.

• CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.