CVE-2019-18391

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00028.htmlMailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2019-18391Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1765589Issue Tracking, Patch, Third Party Advisory
https://gitlab.freedesktop.org/virgl/virglrenderer/commit/2abeb1802e3c005b17a7123e382171b3fb665971Patch, Third Party Advisory
https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=8c9cfb4e425542e96f0717189fe4658555baaf08Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00017.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00028.htmlMailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2019-18391Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1765589Issue Tracking, Patch, Third Party Advisory
https://gitlab.freedesktop.org/virgl/virglrenderer/commit/2abeb1802e3c005b17a7123e382171b3fb665971Patch, Third Party Advisory
https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=8c9cfb4e425542e96f0717189fe4658555baaf08Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00017.htmlMailing List, Third Party Advisory

Timeline

Published: Dec 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-183935.3PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home direct CVE-2019-183949.8A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send CVE-2019-183967.2An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the CVE-2019-183977.8A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU FriBidi through 1.0.7 allows an attacke CVE-2019-18407.5A vulnerability in the DHCPv6 input packet processor of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to res CVE-2019-184087.5archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_CVE-2019-184097.8The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if th CVE-2019-18418.1A vulnerability in the Software Image Management feature of Cisco DNA Center could allow an authenticated, remote attacker to access to inte CVE-2019-184118.8Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vuln CVE-2019-184127.5JetBrains IDETalk plugin before version 193.4099.10 allows XXE CVE-2019-184139.8In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via CVE-2019-184148.8Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lac