CVE-2019-11071

Published: Apr 10, 2019Modified: Nov 21, 2024

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri is mishandled.

Affected (3)

Products: Spip: Spip · Debian: Debian Linux

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Spip Spip	From 3.1.0 to 3.1.10
Spip Spip	From 3.2.0 to 3.2.4

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (12)

https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-1-10-et-SPIP-3-2-4.html

Source: cve@mitre.org

PatchVendor Advisory

https://github.com/spip/SPIP/commit/3ef87c525bc0768c926646f999a54222b37b5d36

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/spip/SPIP/commit/824d17f424bf77d17af89c18c3dc807a3199567e

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/spip/SPIP/compare/1e3872c...9861a47

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4536-1/

Source: cve@mitre.org

https://www.debian.org/security/2019/dsa-4429

Source: cve@mitre.org

Third Party Advisory

https://blog.spip.net/Mise-a-jour-CRITIQUE-de-securite-Sortie-de-SPIP-3-1-10-et-SPIP-3-2-4.html