What is CVE-2019-19785?

CVE-2019-19785 is a high-severity software vulnerability (Out-of-bounds write) with a CVSS score of 7.8. ATasm 1.06 has a stack-based buffer overflow in the to_comma() function in asm.c via a crafted .m65 file.

Is CVE-2019-19785 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 1%.

What products does CVE-2019-19785 affect?

Tracked products affected include Fedora. Check the version you run to see whether it is affected.

How do I fix CVE-2019-19785?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

← All products

CVE-2019-19785

HIGH severity · CVSS 7.8 · Out-of-bounds write

7.8CVSS HIGH

Summary

ATasm 1.06 has a stack-based buffer overflow in the to_comma() function in asm.c via a crafted .m65 file.

Impact & exploitability

Attack vectorLocal

Attack complexityLow

Privileges requiredNone

User interactionRequired

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)1%

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products we track (1)

Fedora

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUABDG4CEAY2FVPM3CFFCZMOKSTEKGXX/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O6XQMOLMWHUDBN3PQJYGVULLNUBMGGJH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJYUV3PKSIGBZGJ6PXAGTT2LW6HLPMS/
https://sourceforge.net/p/atasm/bugs/8/Advisory