CVE-2019-18603

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to information leakage upon certain error conditions because uninitialized RPC output variables are sent over the network to a peer.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-908

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://lists.debian.org/debian-lts-announce/2019/11/msg00002.htmlMailing List, Third Party Advisory
https://openafs.org/pages/security/OPENAFS-SA-2019-001.txtVendor Advisory
https://lists.debian.org/debian-lts-announce/2019/11/msg00002.htmlMailing List, Third Party Advisory
https://openafs.org/pages/security/OPENAFS-SA-2019-001.txtVendor Advisory

Timeline

Published: Oct 29, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-186049.8In axohelp.c before 1.3 in axohelp in axodraw2 before 2.1.1b, as distributed in TeXLive and other collections, sprintf is mishandled.CVE-2019-186087.5Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting CVE-2019-186099.8An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer overflow that leads to heap memor CVE-2019-18617.2A vulnerability in the software update feature of Cisco Industrial Network Director could allow an authenticated, remote attacker to execute CVE-2019-186108.8An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote CVE-2019-186116.5An issue was discovered in the CheckUser extension through 1.34 for MediaWiki. Certain sensitive information within oversighted edit summari CVE-2019-186125.3An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Previously hidden (restricted) AbuseFilter filters were vie CVE-2019-186147.8On the Cypress CYW20735 evaluation board, any data that exceeds 384 bytes is copied and causes an overflow. This is because the maximum BLOC CVE-2019-186154.9In CloudVision Portal (CVP) for all releases in the 2018.2 Train, under certain conditions, the application logs user passwords in plain tex CVE-2019-186186.0Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash (all versions prior to CVE-2019-186197.8Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) all CVE-2019-18627.2A vulnerability in the web-based user interface (Web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to execute c