DATABASE RESOURCES PRICING ABOUT US

{"id": "UB:CVE-2019-12951", "vendorId": null, "type": "ubuntucve", "bulletinFamily": "info", "title": "CVE-2019-12951", "description": "An issue was discovered in Mongoose before 6.15. The parse_mqtt() function\nin mg_mqtt.c has a critical heap-based buffer overflow.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[amurray](<https://launchpad.net/~amurray>) | smplayer in &gt;= bionic contains an embedded copy of mongoose \n[ebarretto](<https://launchpad.net/~ebarretto>) | smplayer embeds a copy, which is unused in any released version and disabled since 18.5.0~ds1-1\n", "published": "2019-06-24T00:00:00", "modified": "2019-06-24T00:00:00", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {"acInsufInfo": false, "cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, "href": "https://ubuntu.com/security/CVE-2019-12951", "reporter": "ubuntu.com", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12951", "https://github.com/cesanta/mongoose/releases/tag/6.15", "https://nvd.nist.gov/vuln/detail/CVE-2019-12951", "https://launchpad.net/bugs/cve/CVE-2019-12951", "https://security-tracker.debian.org/tracker/CVE-2019-12951"], "cvelist": ["CVE-2019-12951"], "immutableFields": [], "lastseen": "2021-11-22T21:30:56", "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "checkpoint_advisories", "idList": ["CPAI-2019-1625"]}, {"type": "cve", "idList": ["CVE-2019-12951"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310142523"]}], "rev": 4}, "score": {"value": 5.8, "vector": "NONE"}, "backreferences": {"references": [{"type": "checkpoint_advisories", "idList": ["CPAI-2019-1625"]}, {"type": "cve", "idList": ["CVE-2019-12951"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310142523"]}]}, "exploitation": null, "vulnersScore": 5.8}, "affectedPackage": [{"OS": "ubuntu", "OSVersion": "Upstream", "arch": "noarch", "packageVersion": "any", "packageFilename": "UNKNOWN", "operator": "lt", "status": "needs triage", "packageName": "smplayer"}], "bugs": [], "_state": {"dependencies": 1645944682}}

{"checkpoint_advisories": [{"lastseen": "2021-12-17T11:17:19", "description": "A buffer overflow vulnerability exists in Cesanta Mongoose. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 5.9}, "published": "2020-03-01T00:00:00", "type": "checkpoint_advisories", "title": "Cesanta Mongoose Buffer Overflow (CVE-2019-12951)", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-12951"], "modified": "2020-03-01T00:00:00", "id": "CPAI-2019-1625", "href": "", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "cve": [{"lastseen": "2022-03-23T20:02:41", "description": "An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer overflow.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2019-06-24T23:15:00", "type": "cve", "title": "CVE-2019-12951", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-12951"], "modified": "2020-08-24T17:37:00", "cpe": [], "id": "CVE-2019-12951", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-12951", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": []}], "openvas": [{"lastseen": "2019-07-02T10:42:15", "bulletinFamily": "scanner", "cvelist": ["CVE-2019-12951"], "description": "Mongoose is prone to a heap-based buffer overflow in parse_mqtt().", "modified": "2019-07-01T00:00:00", "published": "2019-07-01T00:00:00", "id": "OPENVAS:1361412562310142523", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310142523", "type": "openvas", "title": "Mongoose < 6.15 Buffer Overflow Vulnerability", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nCPE = \"cpe:/a:cesanta:mongoose\";\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.142523\");\n script_version(\"2019-07-01T08:05:12+0000\");\n script_tag(name:\"last_modification\", value:\"2019-07-01 08:05:12 +0000 (Mon, 01 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-07-01 07:48:08 +0000 (Mon, 01 Jul 2019)\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_cve_id(\"CVE-2019-12951\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_name(\"Mongoose < 6.15 Buffer Overflow Vulnerability\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"This script is Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_mongoose_web_server_detect.nasl\");\n script_mandatory_keys(\"Cesanta/Mongoose/installed\");\n\n script_tag(name:\"summary\", value:\"Mongoose is prone to a heap-based buffer overflow in parse_mqtt().\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"affected\", value:\"Mongoose prior to version 6.15.\");\n\n script_tag(name:\"solution\", value:\"Update to version 6.15 or later.\");\n\n script_xref(name:\"URL\", value:\"https://github.com/cesanta/mongoose/releases/tag/6.15\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif (!port = get_app_port(cpe: CPE))\n exit(0);\n\nif (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))\n exit(0);\n\nversion = infos['version'];\nlocation = infos['location'];\n\nif (version_is_less(version: version, test_version: \"6.15\")) {\n report = report_fixed_ver(installed_version: version, fixed_version: \"6.15\", install_path: location);\n security_message(port: port, data: report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}