CVE-2019-13351

{"id": "CVE-2019-13351", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2019-07-05T20:15:14.200", "references": [{"url": "https://github.com/jackaudio/jack2/pull/480", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/xbmc/xbmc/issues/16258", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/jackaudio/jack2/pull/480", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/xbmc/xbmc/issues/16258", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "posix/JackSocket.cpp in libjack in JACK2 1.9.1 through 1.9.12 (as distributed with alsa-plugins 1.1.7 and later) has a \"double file descriptor close\" issue during a failed connection attempt when jackd2 is not running. Exploitation success depends on multithreaded timing of that double close, which can result in unintended information disclosure, crashes, or file corruption due to having the wrong file associated with the file descriptor."}, {"lang": "es", "value": "El archivo posix/JackSocket.cpp en libjack en JACK2 versi\u00f3n 1.9.1 hasta 1.9.12 (tal como es distribuido con alsa-plugins versi\u00f3n 1.1.7 y posteriores), presenta un problema de \"double file descriptor close\" durante un intento de conexi\u00f3n fallida cuando jackd2 no est\u00e1 ejecut\u00e1ndose. El \u00e9xito de la explotaci\u00f3n depende de la sincronizaci\u00f3n de multihilado de ese cierre doble, que puede resultar en la divulgaci\u00f3n de informaci\u00f3n no deseada, bloqueos, o corrupci\u00f3n del archivo debido a que el archivo incorrecto est\u00e1 asociado con el descriptor de archivo."}], "lastModified": "2024-11-21T04:24:46.307", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jackaudio:jack2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "851CD74B-ADD4-4DBE-AFB7-68262333D2F2", "versionEndIncluding": "1.9.12", "versionStartIncluding": "1.9.1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:alsa-project:alsa:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CFAEA5BB-5C0B-4711-A2F2-BEBC3C9A7CAF", "versionEndIncluding": "1.1.7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}