CVE-2019-18390

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_BLIT commands.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00028.htmlThird Party Advisory
https://access.redhat.com/security/cve/cve-2019-18390Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1765584Issue Tracking, Patch, Third Party Advisory
https://gitlab.freedesktop.org/virgl/virglrenderer/commit/24f67de7a9088a873844a39be03cee6882260ac9Patch, Third Party Advisory
https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=d2cdbcf6a8f2317f250fd54f08aa35dde2fa3e30#3cd772559e0d73afa136d6818023cfd0c4c8ecc0_0_151Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00017.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00028.htmlThird Party Advisory
https://access.redhat.com/security/cve/cve-2019-18390Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1765584Issue Tracking, Patch, Third Party Advisory
https://gitlab.freedesktop.org/virgl/virglrenderer/commit/24f67de7a9088a873844a39be03cee6882260ac9Patch, Third Party Advisory
https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=d2cdbcf6a8f2317f250fd54f08aa35dde2fa3e30#3cd772559e0d73afa136d6818023cfd0c4c8ecc0_0_151Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00017.htmlMailing List, Third Party Advisory

Timeline

Published: Dec 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-183915.5A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows gue CVE-2019-183935.3PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home direct CVE-2019-183949.8A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send CVE-2019-183967.2An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the CVE-2019-183977.8A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacke CVE-2019-18407.5A vulnerability in the DHCPv6 input packet processor of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to res CVE-2019-184087.5archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_CVE-2019-184097.8The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if th CVE-2019-18418.1A vulnerability in the Software Image Management feature of Cisco DNA Center could allow an authenticated, remote attacker to access to inte CVE-2019-184118.8Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vuln CVE-2019-184127.5JetBrains IDETalk plugin before version 193.4099.10 allows XXE CVE-2019-184139.8In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via