Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-17263: Debian libfwsi may read beyond intended data

CVE-2019-17263 · published 7 years ago

Summary

The libfwsi library used in Debian can accidentally read extra memory when it encounters certain unexpected sizes, which could cause a program to crash or behave incorrectly. This happens because the code only checks for sizes less than 6, while sizes 6 and 7 are also invalid. Update the library to a version released after October 6, 2019, or apply any available patches to stop the unsafe read.

What to do

Update libfwsi_project libfwsi to version 20191006 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	libfwsi	All versions
Debian:13	debian	libfwsi	All versions
Debian:14	debian	libfwsi	All versions
Debian:12	debian	liblnk	All versions
Debian:13	debian	liblnk	All versions
Debian:14	debian	liblnk	All versions
–	libfwsi_project	libfwsi	< 20191006 `cpe:2.3:a:libfwsi_project:libfwsi::::::::`

Original advisory text

In libyal libfwsi before 20191006, libfwsi_extension_block_copy_from_byte_stream in libfwsi_extension_block.c has a heap-based buffer over-read because rejection of an unsupported size only considers values less than 6, even though values of 6 and 7 are also unsupported. NOTE: the vendor has disputed this as described in the GitHub issue

References

https://security-tracker.debian.org/tracker/CVE-2019-17263 Vendor Advisory
http://packetstormsecurity.com/files/154774/libyal-libfwsi-Buffer-Overread.html Exploit Third Party Advisory VDB Entry
https://github.com/libyal/libfwsi/compare/20181227...20191006 Patch Third Party Advisory
https://github.com/libyal/libfwsi/issues/13 Exploit Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.3 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

Timeline

Published6 Oct 2019

Updated4 Nov 2026

First seen21 Sep 2026

Sources

DEBIAN-CVE-2019-17263 · OSV

CVE-2019-17263 · NVD

Track software like this

Free during beta