CVE-2018-19198

Critical

Description

An issue was discovered in uriparser before 0.9.0. UriQuery.c allows an out-of-bounds write via a uriComposeQuery* or uriComposeQueryEx* function because the '&' character is mishandled in certain contexts.

SeverityCritical

CVSS9.8

Exploit probability—

Product

Uriparser

PublishedNov 12, 2018

First seenNov 12, 2018

How to fix

Update

uriparser_project uriparser0.9.0 or later

Vendor advisories

access.redhat.com/errata/RHSA-2019:2280

Affected products

Product	Affected versions	Fixed in
uriparser_project uriparser	v < 0.9.0	0.9.0
debian debian_linux	8.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.