CVE-2019-13445

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3. parseOptions() in tools/rosbag/src/record.cpp has an integer overflow when a crafted split option can be entered on the command line.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/ros/ros_comm/blob/melodic-devel/tools/rosbag/src/record.cpp#L129Exploit, Third Party Advisory
https://github.com/ros/ros_comm/issues/1738Exploit, Third Party Advisory
https://github.com/ros/ros_comm/pull/1741Patch, Third Party Advisory
https://github.com/ros/ros_comm/blob/melodic-devel/tools/rosbag/src/record.cpp#L129Exploit, Third Party Advisory
https://github.com/ros/ros_comm/issues/1738Exploit, Third Party Advisory
https://github.com/ros/ros_comm/pull/1741Patch, Third Party Advisory

Timeline

Published: Dec 30, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-134479.8An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could access t CVE-2019-134486.1An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could exploit CVE-2019-134496.5In the Zoom Client before 4.4.2 on macOS, remote attackers can cause a denial of service (continual focus grabs) via a sequence of invalid l CVE-2019-13455.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information CVE-2019-134506.5In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the v CVE-2019-134519.8In Xymon through 4.3.28, a buffer overflow vulnerability exists in history.c.CVE-2019-134529.8In Xymon through 4.3.28, a buffer overflow vulnerability exists in reportlog.c.CVE-2019-134536.5Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. T CVE-2019-134546.5ImageMagick 7.0.1-0 to 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.CVE-2019-134559.8In Xymon through 4.3.28, a stack-based buffer overflow vulnerability exists in the alert acknowledgment CGI tool because of   expansion CVE-2019-134566.5In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 CVE-2019-134574.3An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.8. A customer user can use the search results to disclose inf