CVE-2019-9656

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in LibOFX 0.9.14. There is a NULL pointer dereference in the function OFXApplication::startElement in the file lib/ofx_sgml.cpp, as demonstrated by ofxdump.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/TeamSeri0us/pocs/tree/master/libofxExploit, Third Party Advisory
https://github.com/libofx/libofx/issues/22Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/11/msg00021.htmlMailing List, Third Party Advisory
https://usn.ubuntu.com/4523-1/Third Party Advisory
https://github.com/TeamSeri0us/pocs/tree/master/libofxExploit, Third Party Advisory
https://github.com/libofx/libofx/issues/22Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/11/msg00021.htmlMailing List, Third Party Advisory
https://usn.ubuntu.com/4523-1/Third Party Advisory

Timeline

Published: Mar 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-96577.8Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control, a different issue than CVE-2018-19588. This occurs because of incorrect p CVE-2019-96585.3Checkstyle before 8.18 loads external DTDs by default.CVE-2019-96599.1The Chuango 433 MHz burglar-alarm product line uses static codes in the RF remote control, allowing an attacker to arm, disarm, or trigger t CVE-2019-96604.8Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html "catname" parameter.CVE-2019-96614.8Stored XSS exists in YzmCMS 5.2 via the admin/system_manage/user_config_edit.html "value" parameter,CVE-2019-96627.5An issue was discovered in JTBC(PHP) 3.0.1.8. Its cache management module is flawed. An arbitrary file ending in "inc.php" can be deleted vi CVE-2019-96687.5An issue was discovered in rovinbhandari FTP through 2012-03-28. receive_file in file_transfer_functions.c allows remote attackers to cause CVE-2019-96696.1The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerab CVE-2019-96709.8mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as CVE-2019-96738.8Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI.CVE-2019-96747.5Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.CVE-2019-96758.1An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow v