CVE-2019-25051: Buffer Overflow

Q: What is CVE-2019-25051?

CVE-2019-25051 is a vulnerability in GNU Aspell 0.60.8 that allows a heap-based buffer overflow in acommon::ObjStack::dup_top.

Q: What is the severity rating of CVE-2019-25051?

CVE-2019-25051 has a severity rating of 7.8 (high).

Q: How does CVE-2019-25051 affect GNU Aspell?

CVE-2019-25051 affects GNU Aspell 0.60.8 by allowing a heap-based buffer overflow in acommon::ObjStack::dup_top, which can be triggered from acommon::StringMap::add and acommon::Config::lookup_list.

Q: Which software versions are affected by CVE-2019-25051?

CVE-2019-25051 affects GNU Aspell 0.60.8, Debian Debian Linux 9.0 and 10.0, and Fedora 34.

Q: How can I fix the vulnerability CVE-2019-25051 in GNU Aspell?

To fix CVE-2019-25051 in GNU Aspell, you should update to one of the following versions: 0.60.7~20110707-6+deb10u1, 0.60.8-3, 0.60.8-4, 0.60.8-6.

Published Jul 20, 2021

Updated

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::duptop (called from acommon::StringMap::add and acommon::Config::lookuplist).

Affected Software

6 affected componentsFixes available

debian/aspell<=0.60.8-2, <=0.60.7~20110707-6, <=0.60.7~20110707-3

0.60.8-30.60.7~20110707-6+deb10u1

debian/aspell

0.60.7~20110707-6+deb10u10.60.8-30.60.8-40.60.8.1-1

GNU aspell=0.60.8

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Fedoraproject Fedora=34

Remediation

Patch Available

https://github.com/gnuaspell/aspell/commit/0718b375425aad8e54e1150313b862e4c6fd324a

Event History

Jul 20, 2021

CVE Published

via MITRE·06:46 AM

Data Sourced

via MITRE·06:46 AM

Description

Frequently Asked Questions

What is CVE-2019-25051?

CVE-2019-25051 is a vulnerability in GNU Aspell 0.60.8 that allows a heap-based buffer overflow in acommon::ObjStack::dup_top.

What is the severity rating of CVE-2019-25051?

CVE-2019-25051 has a severity rating of 7.8 (high).

How does CVE-2019-25051 affect GNU Aspell?