CVE-2019-6291 — Uncontrolled Recursion in Netwide Assembler
Severity
5.5MEDIUMNVD
EPSS
0.4%
top 40.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 15
Latest updateMay 24
Description
An issue was discovered in the function expr6 in eval.c in Netwide Assembler (NASM) through 2.14.02. There is a stack exhaustion problem caused by the expr6 function making recursive calls to itself in certain scenarios involving lots of '!' or '+' or '-' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted asm file.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages4 packages
🔴Vulnerability Details
4📋Vendor Advisories
5Microsoft▶
In Netwide Assembler (NASM) 2.14.02, stack consumption occurs in expr# functions in asm/eval.c. This potentially affects the relationships among expr0, expr1, expr2, expr3, expr4, expr5, and expr6 (an↗2020-01-14
Debian▶
CVE-2019-6291: nasm - An issue was discovered in the function expr6 in eval.c in Netwide Assembler (NA...↗2019
Debian▶
CVE-2019-20334: nasm - In Netwide Assembler (NASM) 2.14.02, stack consumption occurs in expr# functions...↗2019