CVE-2019-11638

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in GNU recutils 1.8. There is a NULL pointer dereference in the function rec_field_name_equal_p at rec-field-name.c in librec.a, leading to a crash.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125 CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/TeamSeri0us/pocs/blob/master/recutils/bug-report-recutilsExploit, Third Party Advisory
https://github.com/TeamSeri0us/pocs/tree/master/recutils/bug-report-recutils/rec2csvThird Party Advisory
https://github.com/TeamSeri0us/pocs/blob/master/recutils/bug-report-recutilsExploit, Third Party Advisory
https://github.com/TeamSeri0us/pocs/tree/master/recutils/bug-report-recutils/rec2csvThird Party Advisory

Timeline

Published: May 1, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-116398.8An issue was discovered in GNU recutils 1.8. There is a stack-based buffer overflow in the function rec_type_check_enum at rec-types.c in li CVE-2019-11647.8An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfu CVE-2019-116408.8An issue was discovered in GNU recutils 1.8. There is a heap-based buffer overflow in the function rec_fex_parse_str_simple at rec-fex.c in CVE-2019-116417.5Anomali Agave (formerly Drupot) through 1.0.0 fails to avoid fingerprinting by including predictable data and minimal variation in size with CVE-2019-116428.8A log poisoning vulnerability has been discovered in the OneShield Policy (Dragon Core) framework before 5.1.10. Authenticated remote advers CVE-2019-116436.1Persistent XSS has been found in the OneShield Policy (Dragon Core) framework before 5.1.10. Remote adversaries can inject malicious JavaScr CVE-2019-116447.8In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6,CVE-2019-116468.8Remote unauthorized command execution and unauthorized disclosure of information in Micro Focus Service Manager, versions 9.30, 9.31, 9.32, CVE-2019-116476.1A potential XSS exists in Self Service Password Reset, in Micro Focus NetIQ Software all versions prior to version 4.4. The vulnerability co CVE-2019-116487.5An information leakage exists in Micro Focus NetIQ Self Service Password Reset Software all versions prior to version 4.4. The vulnerability CVE-2019-116495.4Cross-Site Scripting vulnerability in Micro Focus Fortify Software Security Center Server, versions 17.2, 18.1, 18.2, has been identified in CVE-2019-116505.9A potential Man in the Middle attack (MITM) was found in NetIQ Advanced Authentication Framework versions prior to 6.0.