Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

libu2f-host may expose leftover memory to device

CVE-2019-9578 · published 7 years ago
Summary

The libu2f-host library used on Debian systems prior to version 1.1.8 can accidentally send leftover computer memory back to a connected security key. This could let the key see information that should stay private. Update libu2f-host to version 1.1.8 or later to stop the leak.

What to do
  • Update debian libu2f-host to version 1.1.9-1.
  • Update yubico libu2f-host to version 1.1.8 or later.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian libu2f-host < 1.1.9-1
Fix: upgrade to 1.1.9-1
Debian:13 debian libu2f-host < 1.1.9-1
Fix: upgrade to 1.1.9-1
Debian:14 debian libu2f-host < 1.1.9-1
Fix: upgrade to 1.1.9-1
– yubico libu2f-host < 1.1.8
cpe:2.3:a:yubico:libu2f-host:*:*:*:*:*:*:*:*
Original advisory text
In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device.
In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device.
References
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-908Use of Uninitialized Resource
Timeline
Published5 Mar 2019
Updated29 Oct 2026
First seen21 Sep 2026
Sources
DEBIAN-CVE-2019-9578 · OSV
CVE-2019-9578 · NVD
Track software like this
Free during beta