netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from nc4_get_att_tc and nc_get_att_text) and in uffd_cleanup (called from netCDFDataset::~netCDFDataset and netCDFDataset::~netCDFDataset).
References
Link | Resource |
---|---|
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15143 | Patch Third Party Advisory |
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15156 | Patch Third Party Advisory |
https://github.com/OSGeo/gdal/commit/27b9bf644bcf1208f7d6594bdd104cc8a8bb0646 | Patch Third Party Advisory |
https://github.com/OSGeo/gdal/commit/767e3a56144f676ca738ef8f700e0e56035bd05a | Patch Third Party Advisory |
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gdal/OSV-2020-392.yaml | Third Party Advisory |
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/gdal/OSV-2020-420.yaml | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2021-07-20T06:46:38
Updated: 2021-07-20T06:46:38
Reserved: 2021-07-20T00:00:00
Link: CVE-2019-25050
JSON object: View
NVD Information
Status : Analyzed
Published: 2021-07-20T07:15:07.603
Modified: 2021-07-29T18:27:38.640
Link: CVE-2019-25050
JSON object: View
Redhat Information
No data.
CWE