Vulnetix
Try Vulnetix Request Demo
CVE-2019-10192 PUBLISHED

A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4. By carefully corrupting a hyperloglog using the SETRANGE command, an attacker could trick Redis interpretation of dense HLL encoding to write up to 3 bytes beyond the end of a heap-allocated buffer.

EPSS 21.64% · 95.7th percentile

Risk Scores

EPSS Score
21.64%
95.7th percentile

Affected Products

VendorProductVersions
Ubuntu:18.04:LTSredis5:4.0.9-1ubuntu0.1, 4:4.0.2-6, 4:4.0.2-9
Ubuntu:16.04:LTSredis2:3.0.3-3, 2:3.0.5-1, 2:3.0.5-2

Timeline

References

Open in Interactive Console →