by Kastro
Paper/Archive/CVE-2019-9169

CVE-2019-9169

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP — In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an att…

EPSS 5%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 91.8.918 × 2018.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
SIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIPLUS S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsecurityfocus.com/bid/107160advisorysecurity.gentoo.org/glsa/202006-04advisoryusn.ubuntu.com/4416-1refkc.mcafee.com/corporate/index?page=content&id=SB10278reforacle.com/security-alerts/cpuapr2022.htmlrefsourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9refsecurity.netapp.com/advisory/ntap-20190315-0002refsourceware.org/bugzilla/show_bug.cgi?id=24114refdebbugs.gnu.org/cgi/bugreport.cgi?bug=34142refdebbugs.gnu.org/cgi/bugreport.cgi?bug=34140refsupport.f5.com/csp/article/K54823184refcert-portal.siemens.com/productcert/html/ssa-398330.html