CVE-2019-3563

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Wangle's LineBasedFrameDecoder contains logic for identifying newlines which incorrectly advances a buffer, leading to a potential underflow. This affects versions of Wangle prior to v2019.04.22.00

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-126 CWE-787

Affected software

Vendor	Product	Versions
Facebook	Wangle	v2019.04.22.00; >= unspecified, < v2019.04.22.00

References

https://github.com/facebook/wangle/commit/5b3bceca875e4ea4ed9d14c20b20ce46c92c13c6Patch, Third Party Advisory
https://github.com/facebook/wangle/commit/5b3bceca875e4ea4ed9d14c20b20ce46c92c13c6Patch, Third Party Advisory

Timeline

Published: Apr 29, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-35647.5Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients CVE-2019-35657.5Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown CVE-2019-35665.9A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's acc CVE-2019-35678.1In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard link a parent folder CVE-2019-35689.8A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a CVE-2019-35697.5HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended CVE-2019-35709.8Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p). This happens if CVE-2019-35715.3An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that wo CVE-2019-35726.5An issue was discovered in libming 0.4.8. There is a heap-based buffer over-read in the function writePNG in the file util/dbl2png.c of the CVE-2019-35735.5In libsixel v1.8.2, there is an infinite loop in the function sixel_decode_raw_impl() in the file fromsixel.c, as demonstrated by sixel2png.CVE-2019-35747.8In libsixel v1.8.2, there is a heap-based buffer over-read in the function load_jpeg() in the file loader.c, as demonstrated by img2sixel.CVE-2019-35757.8Sqla_yaml_fixtures 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in sqla_yaml_fixtures.load.