CVE-2018-19198

CRITICAL

uriparser < 0.9.0 - Out-of-bounds Write via Query Composition Function

Title source: llm

Description

An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an out-of-bounds write via a uriComposeQuery* or uriComposeQueryEx* function because the '&' character is mishandled in certain contexts.

References (4)

Core 4

Core References

Patch x_refsource_misc

https://github.com/uriparser/uriparser/commit/864f5d4c127def386dd5cc926ad96934b297f04e

View Patch ZIP pw:eip

Third Party Advisory mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2018/11/msg00019.html

Release Notes x_refsource_misc

https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog

View Writeup ZIP pw:eip

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2019:2280

Scores

CVSS v3 9.8

EPSS 0.0237

EPSS Percentile 81.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-787

Status published

Products (2)

debian/debian_linux 8.0

uriparser_project/uriparser < 0.9.0

Published Nov 12, 2018

Tracked Since Feb 18, 2026