CVE-2019-19725 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitre	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 42%

Vendor	Product	Version
sysstat_project	sysstat	𝑥 ≤ 12.2.0
debian	debian_linux	10.0
canonical	ubuntu_linux	16.04
canonical	ubuntu_linux	18.04
canonical	ubuntu_linux	19.04
canonical	ubuntu_linux	19.10

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

sysstat

bullseye	12.5.2-2 fixed
stretch	not-affected
jessie	not-affected
bookworm	12.6.1-1 fixed
sid	12.7.5-2 fixed
trixie	12.7.5-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

sysstat

eoan	Fixed 12.0.6-1ubuntu0.1 released
disco	Fixed 12.0.1-1ubuntu0.1 released
bionic	Fixed 11.6.1-1ubuntu0.1 released
xenial	Fixed 11.2.0-1ubuntu0.3 released
trusty	not-affected

Known Exploits!

Common Weakness Enumeration

CWE-415 - Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References

https://github.com/sysstat/sysstat/issues/242

https://lists.debian.org/debian-lts-announce/2022/11/msg00014.html

https://security.gentoo.org/glsa/202007-22

https://usn.ubuntu.com/4242-1/

https://github.com/sysstat/sysstat/issues/242

https://lists.debian.org/debian-lts-announce/2022/11/msg00014.html

https://security.gentoo.org/glsa/202007-22

https://usn.ubuntu.com/4242-1/