CVE-2019-6975

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/106964Third Party Advisory, VDB Entry
https://docs.djangoproject.com/en/dev/releases/security/Patch, Vendor Advisory
https://groups.google.com/forum/#%21topic/django-announce/WTwEAprR0IQ
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/66WMXHGBXD7GSM3PEXVCMCAGLMQYHZCU/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVXDOVCXLD74SHR2BENGCE2OOYYYWJHZ/
https://seclists.org/bugtraq/2019/Jul/10
https://usn.ubuntu.com/3890-1/Third Party Advisory
https://www.debian.org/security/2019/dsa-4476
https://www.djangoproject.com/weblog/2019/feb/11/security-releases/Patch, Vendor Advisory
https://www.openwall.com/lists/oss-security/2019/02/11/1Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/106964Third Party Advisory, VDB Entry
https://docs.djangoproject.com/en/dev/releases/security/Patch, Vendor Advisory
https://groups.google.com/forum/#%21topic/django-announce/WTwEAprR0IQ
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/66WMXHGBXD7GSM3PEXVCMCAGLMQYHZCU/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVXDOVCXLD74SHR2BENGCE2OOYYYWJHZ/
https://seclists.org/bugtraq/2019/Jul/10
https://usn.ubuntu.com/3890-1/Third Party Advisory
https://www.debian.org/security/2019/dsa-4476
https://www.djangoproject.com/weblog/2019/feb/11/security-releases/Patch, Vendor Advisory
https://www.openwall.com/lists/oss-security/2019/02/11/1Mailing List, Patch, Third Party Advisory

Timeline

Published: Feb 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-69765.3libvips before 8.7.4 generates output images from uninitialized memory locations when processing corrupted input image data because iofuncs/CVE-2019-69778.8gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.CVE-2019-69789.8The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: CVE-2019-69796.1An issue was discovered in the User IP History Logs (aka IP_History_Logs) plugin 1.0.2 for MyBB. There is XSS via the admin/modules/tools/ip CVE-2019-69809.8Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.CVE-2019-69816.5Zimbra Collaboration Suite 8.7.x through 8.8.11 allows Blind SSRF in the Feed component.CVE-2019-69825.5An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. The application could encounter an Out-o CVE-2019-69836.5An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. The application could encounter an Integ CVE-2019-69846.5An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. The application could encounter a Use-Af CVE-2019-69858.8An issue was discovered in Foxit 3D Plugin Beta before 9.4.0.16807 for Foxit Reader and PhantomPDF. The application could encounter an Out-o CVE-2019-69867.5SPARQL Injection in VIVO Vitro v1.10.0 allows a remote attacker to execute arbitrary SPARQL via the uri parameter, leading to a regular expr CVE-2019-69886.5An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) i