CVE-2019-17263

Name	CVE-2019-17263
Description	In libyal libfwsi before 20191006, libfwsi_extension_block_copy_from_byte_stream in libfwsi_extension_block.c has a heap-based buffer over-read because rejection of an unsupported size only considers values less than 6, even though values of 6 and 7 are also unsupported. NOTE: the vendor has disputed this as described in the GitHub issue
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libfwsi (PTS)	bookworm, bullseye	20181227-1.1	vulnerable
	sid, trixie	20181227-1.2	vulnerable
liblnk (PTS)	bookworm, bullseye	20181227-1.1	vulnerable
	sid, trixie	20181227-1.2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libfwsi	source	(unstable)	(unfixed)	unimportant
liblnk	source	(unstable)	(unfixed)	unimportant

Notes

https://github.com/libyal/libfwsi/issues/13
https://github.com/libyal/libfwsi/commit/54afa5c71d6c795a555dbcb1e160fea393b98fb3
Negligible/questionable security impact