CVE-2019-1079: Input Validation

Published Jul 15, 2019

Updated

An information disclosure vulnerability exists when Visual Studio improperly parses XML input in certain settings files, aka 'Visual Studio Information Disclosure Vulnerability'.

Affected Software

4 affected components

Microsoft Visual Studio=2010-sp1

Microsoft Visual Studio=2012-update_5

Microsoft Visual Studio=2013-update_5

Microsoft Visual Studio=2015-update_3

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1079

Event History

Jul 15, 2019

CVE Published

via MITRE·06:56 PM

Data Sourced

via MITRE·06:56 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2019-1079?

CVE-2019-1079 is an information disclosure vulnerability that exists in Visual Studio when parsing XML input in certain settings files.

How severe is CVE-2019-1079?

CVE-2019-1079 has a severity rating of 6.5, which is considered medium.

Which versions of Visual Studio are affected by CVE-2019-1079?

CVE-2019-1079 affects the following versions of Visual Studio: 2010 SP1, 2012 Update 5, 2013 Update 5, and 2015 Update 3.

How can I fix CVE-2019-1079?

To fix CVE-2019-1079, Microsoft has released updates for the affected versions of Visual Studio. It is recommended to install these updates to mitigate the vulnerability.

What is the Common Weakness Enumeration (CWE) ID for CVE-2019-1079?

The Common Weakness Enumeration (CWE) ID for CVE-2019-1079 is CWE-20, which represents Improper Input Validation.