CVE-2019-15807

MediumCVSS 4.7/10Last modified Oct 8, 2026

Description

In the Linux kernel before 5.1.13, there is a memory leak in drivers/scsi/libsas/sas_expander.c when SAS expander discovery fails. This will cause a BUG and denial of service.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.13Release Notes
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3b0541791453fbe7f42867e310e0c9eb6295364dPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00014.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00015.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00025.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20191004-0001/Third Party Advisory
https://support.f5.com/csp/article/K52136304?utm_source=f5support&amp%3Butm_medium=RSS
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.13Release Notes
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3b0541791453fbe7f42867e310e0c9eb6295364dPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00014.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00015.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00025.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20191004-0001/Third Party Advisory
https://support.f5.com/csp/article/K52136304?utm_source=f5support&amp%3Butm_medium=RSS

Timeline

Published: Aug 29, 2019
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-158094.7Smart cards from the Athena SCS manufacturer, based on the Atmel Toolbox 00.03.11.05 and the AT90SC chip, contain a timing side channel in E CVE-2019-15819.8A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with netwo CVE-2019-158106.1Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter.CVE-2019-158116.1In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.CVE-2019-158138.8Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arbitrary code via a we CVE-2019-158145.4Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or HTML.CVE-2019-158156.5ZyXEL P-1302-T10D v3 devices with firmware version 2.00(ABBX.3) and earlier do not properly enforce access control and could allow an unauth CVE-2019-158167.5The wp-private-content-plus plugin before 2.0 for WordPress has no protection against option changes via save_settings_page and other save_ CVE-2019-158176.1The easy-property-listings plugin before 3.4 for WordPress has XSS.CVE-2019-158186.1The simple-301-redirects-addon-bulk-uploader plugin through 1.2.4 for WordPress has no requirement for authentication for action=bulk301expo CVE-2019-158199.8The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication.CVE-2019-15827.2Memory corruption in PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow an administrative user to cause arbitrary memory corr