CVE-2019-7309

MediumCVSS 5.5/10Last modified Oct 14, 2026

Description

In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5

References

http://www.securityfocus.com/bid/106835Third Party Advisory, VDB Entry
https://security.gentoo.org/glsa/202006-04
https://sourceware.org/bugzilla/show_bug.cgi?id=24155Exploit, Issue Tracking, Third Party Advisory
https://sourceware.org/ml/libc-alpha/2019-02/msg00041.htmlMailing List, Third Party Advisory
http://www.securityfocus.com/bid/106835Third Party Advisory, VDB Entry
https://security.gentoo.org/glsa/202006-04
https://sourceware.org/bugzilla/show_bug.cgi?id=24155Exploit, Issue Tracking, Third Party Advisory
https://sourceware.org/ml/libc-alpha/2019-02/msg00041.htmlMailing List, Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Timeline

Published: Feb 3, 2019
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-73107.8In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remot CVE-2019-73117.8An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. A lack of encryption in how the user login cookie (admin-auth) is stored CVE-2019-73125.3Limited plaintext disclosure exists in PRIMX Zed Entreprise for Windows before 6.1.2240, Zed Entreprise for Windows (ANSSI qualification sub CVE-2019-73136.1www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect param CVE-2019-73149.8liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been set up, which could CVE-2019-73157.5Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.x are vulnerable to directory traversal via the web interfac CVE-2019-73169.8An issue was discovered in CSS-TRICKS Chat2 through 2015-05-05. The userid parameter in jumpin.php has a SQL injection vulnerability.CVE-2019-73175.3png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.CVE-2019-73198.3An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0. When using one of following authentication backends: LdapBackend, PamBackend, S CVE-2019-73219.8Usage of an uninitialized variable in the function fz_load_jpeg in Artifex MuPDF 1.14 can result in a heap overflow vulnerability that allow CVE-2019-73237.5GUP (generic update process) in LightySoft LogMX before 7.4.0 does not properly verify the authenticity of updates, which allows man-in-the-CVE-2019-73246.1app/Core/Paginator.php in Kanboard before 1.2.8 has XSS in pagination sorting.