CVE-2019-25013

MediumCVSS 5.9/10Last modified Oct 14, 2026

Description

The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Jan 4, 2021
Last modified
Oct 14, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-250146.5A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0. If a particular CVE-2019-250155.4LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID.CVE-2019-250168.8In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowedCVE-2019-250175.9An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server choosesCVE-2019-250187.5In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an emCVE-2019-250199.8LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model.CVE-2019-25024.9Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.13 and prioCVE-2019-250207.5An issue was discovered in Scytl sVote 2.1. Because the sdm-ws-rest API does not require authentication, an attacker can retrieve the adminiCVE-2019-250217.5An issue was discovered in Scytl sVote 2.1. Due to the implementation of the database manager, an attacker can access the OrientDB by providCVE-2019-250229.8An issue was discovered in Scytl sVote 2.1. An attacker can inject code that gets executed by creating an election-event and injecting a payCVE-2019-250236.5An issue was discovered in Scytl sVote 2.1. Because the IP address from an X-Forwarded-For header (which can be manipulated client-side) is CVE-2019-250249.8OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax_system.php post_servic