CVE-2019-15548

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are instr and mvwinstr buffer overflows because interaction with C functions is mishandled.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://rustsec.org/advisories/RUSTSEC-2019-0006.htmlVendor Advisory
https://rustsec.org/advisories/RUSTSEC-2019-0006.htmlVendor Advisory

Timeline

Published: Aug 26, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-155497.5An issue was discovered in the asn1_der crate before 0.6.2 for Rust. Attackers can trigger memory exhaustion by supplying a large value in a CVE-2019-155507.5An issue was discovered in the simd-json crate before 0.1.15 for Rust. There is an out-of-bounds read and an incorrect crossing of a page bo CVE-2019-155519.8An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is a double free for certain grow attempts with the current capa CVE-2019-155529.8An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free, leading to arbitrary code exe CVE-2019-155537.5An issue was discovered in the memoffset crate before 0.5.0 for Rust. offset_of and span_of can cause exposure of uninitialized memory.CVE-2019-155549.8An issue was discovered in the smallvec crate before 0.6.10 for Rust. There is memory corruption for certain grow attempts with less than th CVE-2019-155559.8FredReinink Wellness-app before 2019-06-19 allows SQL injection, related to dietTrack.php, exerciseGenerator.php, fitnessTrack.php, and serv CVE-2019-155569.8Pvanloon1983 social_network before 2019-07-03 allows SQL injection in includes/form_handlers/register_handler.php.CVE-2019-155579.8XM^online 2 User Account and Authentication server 1.0.0 allows SQL injection via a tenant key.CVE-2019-155589.8XM^online 2 Common Utils and Endpoints 0.2.1 allows SQL injection, related to Constants.java, DropSchemaResolver.java, and SchemaChangeResol CVE-2019-155599.8DianoxDragon Hawn before 2019-07-10 allows SQL injection.CVE-2019-155609.8The Reviews Module before 2019-06-14 for OpenSource Table allows SQL injection in database/index.js.