CVE-2019-12265medium
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IPNET security vulnerability: IGMP Information leak via IGMPv3 specific membership report.
References
https://cert-portal.siemens.com/productcert/pdf/ssa-189842.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-352504.pdf
https://cert-portal.siemens.com/productcert/pdf/ssa-632562.pdf
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0009
https://security.netapp.com/advisory/ntap-20190802-0001/
https://support.f5.com/csp/article/K41190253
https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2019-12265
https://support2.windriver.com/index.php?page=security-notices
https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/
Details
Source: MITRE
Published: 2019-08-09
Updated: 2020-08-24
Type: CWE-401
Risk Information
CVSS v2
Base Score: 5
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Impact Score: 2.9
Exploitability Score: 10
Severity: MEDIUM
CVSS v3
Base Score: 5.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Impact Score: 1.4
Exploitability Score: 3.9
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
cpe:2.3:o:windriver:vxworks:6.5:*:*:*:*:*:*:*
cpe:2.3:o:windriver:vxworks:6.6:*:*:*:*:*:*:*
cpe:2.3:o:windriver:vxworks:6.7:*:*:*:*:*:*:*
cpe:2.3:o:windriver:vxworks:6.8:*:*:*:*:*:*:*
Configuration 2
OR
cpe:2.3:o:netap:e-series_santricity_os_controller:*:*:*:*:*:*:*:* versions from 8.00 to 8.40.50.00 (inclusive)
Configuration 3
OR
cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from 5.9.0.0 to 5.9.0.7 (inclusive)
cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from 5.9.1.0. to 5.9.1.12 (inclusive)
cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from 6.2.0.0 to 6.2.3.1 (inclusive)
cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from 6.2.4.0 to 6.2.4.3 (inclusive)
cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from 6.2.5.0 to 6.2.5.3 (inclusive)
cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from 6.2.6.0 to 6.2.6.1 (inclusive)
cpe:2.3:o:sonicwall:sonicos:6.2.7.0:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sonicos:6.2.7.1:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sonicos:6.2.7.7:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from 6.2.9.0 to 6.2.9.2 (inclusive)
cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from 6.5.0.0 to 6.5.0.3 (inclusive)
cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from 6.5.1.0 to 6.5.1.4 (inclusive)
cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from 6.5.2.0 to 6.5.2.3 (inclusive)
cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from 6.5.3.0 to 6.5.3.3 (inclusive)
cpe:2.3:o:sonicwall:sonicos:*:*:*:*:*:*:*:* versions from 6.5.4.0. to 6.5.4.3 (inclusive)
Configuration 4
AND
OR
OR
Configuration 5
AND
OR
OR
Configuration 6
AND
OR
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 500056 | Windriver Vxworks Unspecified Vulnerability | Tenable.ot | SCADA | medium |
| 701083 | VxWorks 6.9.x < 6.9.4.12 / 7 (SR540) / 7 (SR610) Multiple Vulnerabilities (URGENT/11) | Nessus Network Monitor | IoT | critical |
| 127109 | Xerox WorkCentre Multiple Vulnerabilities (XRX19-016) (URGENT/11) | Nessus | Misc. | critical |
| 127108 | Wind River VxWorks Multiple Vulnerabilities (URGENT/11) | Nessus | Misc. | critical |
| 127107 | SonicWall SonicOS Firewall Multiple Management Vulnerabilities (URGENT/11) | Nessus | Firewalls | critical |