CVE-2019-18960

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0. This can result in potentially exploitable crashes.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2019/12/10/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/09/11/2Mailing List, Third Party Advisory
https://github.com/firecracker-microvm/firecracker/issues/1462Third Party Advisory
https://github.com/firecracker-microvm/firecracker/releasesRelease Notes, Third Party Advisory
https://github.com/firecracker-microvm/firecracker/releases/tag/v0.18.1Release Notes, Third Party Advisory
https://github.com/firecracker-microvm/firecracker/releases/tag/v0.19.1Release Notes, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/12/10/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/09/11/2Mailing List, Third Party Advisory
https://github.com/firecracker-microvm/firecracker/issues/1462Third Party Advisory
https://github.com/firecracker-microvm/firecracker/releasesRelease Notes, Third Party Advisory
https://github.com/firecracker-microvm/firecracker/releases/tag/v0.18.1Release Notes, Third Party Advisory
https://github.com/firecracker-microvm/firecracker/releases/tag/v0.19.1Release Notes, Third Party Advisory

Timeline

Published: Dec 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-18975.3A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote att CVE-2019-189767.5An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invi CVE-2019-189785.3An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access p CVE-2019-189797.8Adaware antivirus 12.6.1005.11662 and 12.7.1055.0 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS director CVE-2019-18985.3A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote att CVE-2019-189807.5On Signify Philips Taolight Smart Wi-Fi Wiz Connected LED Bulb 9290022656 devices, an unprotected API lets remote users control the bulb's o CVE-2019-189819.8Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.CVE-2019-189826.1bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window bec CVE-2019-189859.8Pimcore before 6.2.2 lacks brute force protection for the 2FA token.CVE-2019-189867.5Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns disti CVE-2019-189875.3An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Once a specific abuse filter has (accidentally or otherwise CVE-2019-189887.0TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for different customers' in