Critical severity · published Aug 2, 2019
CVE-2019-14531
An issue was discovered in The Sleuth Kit (TSK) 4.6.6
9.8
CVSS
2%
EPSS
No
On KEV
Description
An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an out of bounds read on iso9660 while parsing System Use Sharing Protocol data in fs/iso9660.c.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TS
The Sleuth Kit · Sleuthkit
4.6.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-14531
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-14531
Exploit
https://github.com/sleuthkit/sleuthkit/issues/1576
More from The Sleuth Kit
9.8
CVE-2020-10232
In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a stack buffer overflow vulnerability in the YAFFS file timestamp parsing logic in yaffsfs_istat() in fs/yaffs.c
9.8
CVE-2019-14532
An issue was discovered in The Sleuth Kit (TSK) 4.6.6
9.1
CVE-2020-10233
In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a heap-based buffer over-read in ntfs_dinode_lookup in fs/ntfs.c
8.1
CVE-2018-11740
An issue was discovered in libtskbase.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1
8.1
CVE-2018-11739
An issue was discovered in libtskimg.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1