CVE-2019-9070: canonical ubuntu_linux Out-of-bounds Read

CVSS: 7.8v3.1HighModified

AliasesUBUNTU-CVE-2019-9070DEBIAN-CVE-2019-9070

Published 24-02-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-9070 is a high (CVSS 7.8) Out-of-bounds Read vulnerability in canonical ubuntu_linux. EPSS estimates a 1.64% chance of exploitation in the next 30 days, higher than 75.9% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

42/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.8/10

010

High · v3.1 (NVD)

EPSS score

1.64%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 3 · Related 3

USN-4326-1 USN-4336-1 USN-4336-2

Timeline

24-02-2019
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. It is a heap-based buffer over-read in d_expression_1 in cp-demangle.c after many recursive calls.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.17.8v2.06.8

EPSS trend

Probability

1.64%

Chance of exploitation in the next 30 days

Percentile

76%

Versus all other CVEs

30-day change

0.00 pp

From 1.64% on 18-09-2026

18-09-202618-10-2026

EPSS score

1.64%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (gcc.gnu.org)
Maturity: unknown
referenceUnverified
Exploit Reference (sourceware.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.

Affected systems

Ubuntu2 products

binutilsAll versions (No fix recorded) | < 2.26.1-1ubuntu1~16.04.8+esm1 | < 2.30-21ubuntu1~18.04.3
libiberty< 20160215-1ubuntu0.3 | < 20170913-1ubuntu0.1

Canonical1 product