PYSEC-2019-237
Vulnerability from pysec - Published: 2019-09-11 15:15 - Updated: 2021-12-14 08:17
VLAI?
Details
An issue was discovered in py-lmdb 0.97. For certain values of mp_flags, mdb_page_touch does not properly set up mc->mc_pg[mc->top], leading to an invalid write operation. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.
Impacted products
| Name | purl | lmdb | pkg:pypi/lmdb |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "lmdb",
"purl": "pkg:pypi/lmdb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.98"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.58",
"0.59",
"0.60",
"0.61",
"0.62",
"0.63",
"0.64",
"0.65",
"0.66",
"0.67",
"0.68",
"0.69",
"0.70",
"0.71",
"0.73",
"0.74",
"0.75",
"0.76",
"0.77",
"0.78",
"0.79",
"0.80",
"0.81",
"0.82",
"0.83",
"0.84",
"0.85",
"0.86",
"0.87",
"0.88",
"0.89",
"0.91",
"0.92",
"0.93",
"0.94",
"0.95",
"0.96",
"0.97"
]
}
],
"aliases": [
"CVE-2019-16225"
],
"details": "An issue was discovered in py-lmdb 0.97. For certain values of mp_flags, mdb_page_touch does not properly set up mc-\u003emc_pg[mc-\u003etop], leading to an invalid write operation. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.",
"id": "PYSEC-2019-237",
"modified": "2021-12-14T08:17:08.271573Z",
"published": "2019-09-11T15:15:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/TeamSeri0us/pocs/tree/master/lmdb/lmdb%20write%20to%20illegal%20address"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/lmdb"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16225"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…