CVE-2019-9578

NameCVE-2019-9578
DescriptionIn devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs923874

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libu2f-host (PTS)bookworm, bullseye1.1.10-3fixed
sid, trixie1.1.10-3.2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libu2f-hostsourcestretch1.1.2-2+deb9u2
libu2f-hostsource(unstable)1.1.9-1low923874

Notes

https://github.com/Yubico/libu2f-host/commit/e4bb58cc8b6202a421e65f8230217d8ae6e16eb5

Search for package or bug name: Reporting problems