Skip to main content

Database Server CVE-2019-12973

MEDIUM
Excessive Iteration (CWE-834)
2019-06-26 cve@mitre.org
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
CVE Published
Jun 26, 2019 - 18:15 nvd
MEDIUM 5.5

DescriptionNVD

In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.

AnalysisAI

In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-834. In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616. Affected products include: Uclouvain Openjpeg, Opensuse Leap, Debian Debian Linux, Oracle Database Server, Oracle Outside In Technology.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

CVE-2012-1675 HIGH POC
7.5 May 08

The TNS Listener, as used in Oracle Database 11g 11.1.0.7, 11.2.0.2, and 11.2.0.3, and 10g 10.2.0.3, 10.2.0.4, and 10.2.

CVE-2012-3137 MEDIUM POC
6.4 Sep 21

The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 all

CVE-2016-9054 CRITICAL POC
9.8 Jan 26

An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Serv

CVE-2016-9052 CRITICAL POC
9.8 Jan 26

An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Serv

CVE-2016-9053 CRITICAL POC
9.8 Feb 21

An exploitable out-of-bounds indexing vulnerability exists within the RW fabric message particle type of Aerospike Datab

CVE-2016-9051 CRITICAL POC
9.8 Feb 21

An exploitable out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospik

CVE-2016-2381 HIGH
7.5 Apr 08

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e

CVE-2016-9843 CRITICAL
9.8 May 23

The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via v

CVE-2016-9841 CRITICAL
9.8 May 23

inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointe

CVE-2014-6577 MEDIUM POC
6.8 Jan 21

Unspecified vulnerability in the XML Developer's Kit for C component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.

CVE-2016-9050 HIGH POC
8.2 Jan 26

An exploitable out-of-bounds read vulnerability exists in the client message-parsing functionality of Aerospike Database

CVE-2016-9049 HIGH POC
7.5 Feb 21

An exploitable denial-of-service vulnerability exists in the fabric-worker component of Aerospike Database Server 3.10.0

Share

CVE-2019-12973 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy