CVE-2019-12408

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow Arrays are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-909

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Arrow	Apache Arrow 0.14.0 to 0.14.1

References

Timeline

Published: Nov 8, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-124099.8The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default s CVE-2019-12417.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En CVE-2019-124107.5While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left CVE-2019-124127.5A flaw in the libapreq2 v2.07 to v2.13 multipart parser can deference a null pointer leading to a process crash. A remote attacker could sen CVE-2019-124135.3In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a spec CVE-2019-124145.3In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab CVE-2019-124155.5In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted docum CVE-2019-124166.1we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWi CVE-2019-124174.8A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page view CVE-2019-124187.0When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attac CVE-2019-124199.8Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There i CVE-2019-12427.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En