CVE-2019-15540

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that can lead to root access by a local Linux user.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00086.html
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00089.html
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00017.html
https://gist.github.com/andreafioraldi/baa79cd78131888d98d6ba680d5f514eExploit, Third Party Advisory
https://sourceforge.net/p/cdemu/bugs/119/Exploit, Third Party Advisory
https://sourceforge.net/p/cdemu/code/ci/0e9292c9aa34bf545f43f7efe5f0b94faba94962/Patch, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00086.html
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00089.html
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00017.html
https://gist.github.com/andreafioraldi/baa79cd78131888d98d6ba680d5f514eExploit, Third Party Advisory
https://sourceforge.net/p/cdemu/bugs/119/Exploit, Third Party Advisory
https://sourceforge.net/p/cdemu/code/ci/0e9292c9aa34bf545f43f7efe5f0b94faba94962/Patch, Third Party Advisory

Timeline

Published: Aug 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-155417.5rustls-mio/examples/tlsserver.rs in the rustls crate before 0.16.0 for Rust allows attackers to cause a denial of service (loop of conn_even CVE-2019-155427.5An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.CVE-2019-155439.8An issue was discovered in the slice-deque crate before 0.2.0 for Rust. There is memory corruption in certain allocation cases.CVE-2019-155447.5An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve calls.CVE-2019-155457.5An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Attackers can spoof ed25519 signatures.CVE-2019-155467.5An issue was discovered in the pancurses crate through 0.16.1 for Rust. printw and mvprintw have format string vulnerabilities.CVE-2019-155477.5An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are format string issues in printw functions because C format ar CVE-2019-155489.8An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are instr and mvwinstr buffer overflows because interaction with CVE-2019-155497.5An issue was discovered in the asn1_der crate before 0.6.2 for Rust. Attackers can trigger memory exhaustion by supplying a large value in a CVE-2019-155507.5An issue was discovered in the simd-json crate before 0.1.15 for Rust. There is an out-of-bounds read and an incorrect crossing of a page bo CVE-2019-155519.8An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is a double free for certain grow attempts with the current capa CVE-2019-155529.8An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code exe