CVE-2019-12175

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Zeek Network Security Monitor (formerly known as Bro) before 2.6.2, a NULL pointer dereference in the Kerberos (aka KRB) protocol parser leads to DoS because a case-type index is mishandled.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/zeek/zeek/releases/tag/v2.6.2Release Notes, Third Party Advisory
https://github.com/zeek/zeek/releases/tag/v2.6.2Release Notes, Third Party Advisory

Timeline

Published: Jul 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-121767.8Privilege escalation in the "HTC Account Service" and "ViveportDesktopService" in HTC VIVEPORT before 1.0.0.36 allows local attackers to esc CVE-2019-121777.8Privilege escalation due to insecure directory permissions affecting ViveportDesktopService in HTC VIVEPORT before 1.0.0.36 allows local att CVE-2019-12185.4A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. An authenticated attac CVE-2019-121807.8An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Scrip CVE-2019-121818.8A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux.CVE-2019-121829.8Directory Traversal in Safescan Timemoto and TA-8000 series version 1.0 allows unauthenticated remote attackers to execute code via the admi CVE-2019-121837.5Incorrect Access Control in Safescan Timemoto TM-616 and TA-8000 series allows remote attackers to read any file via the administrative API.CVE-2019-121845.4There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart,CVE-2019-121858.8eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote com CVE-2019-121864.8An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18, 1.1.x through 1.1.17, 1.2.x th CVE-2019-121896.1An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field.CVE-2019-12195.5An information disclosure vulnerability exists when the Windows Transaction Manager improperly handles objects in memory, aka 'Windows Trans