An issue was discovered in uriparser before 0.9.0. UriCommon.c allows attempted operations on NULL input via a uriResetUri* function.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Uriparser | Uriparser_project | * | 0.9.0 (excluding) |
| Uriparser | Ubuntu | bionic | * |
| Uriparser | Ubuntu | cosmic | * |
| Uriparser | Ubuntu | disco | * |
| Uriparser | Ubuntu | esm-apps/bionic | * |
| Uriparser | Ubuntu | esm-apps/xenial | * |
| Uriparser | Ubuntu | esm-infra-legacy/trusty | * |
| Uriparser | Ubuntu | trusty | * |
| Uriparser | Ubuntu | trusty/esm | * |
| Uriparser | Ubuntu | upstream | * |
| Uriparser | Ubuntu | xenial | * |
Potential Mitigations
References
- https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog
- https://github.com/uriparser/uriparser/commit/f58c25069cf4a986fe17a80c5b38687e31feb539
- https://lists.debian.org/debian-lts-announce/2018/11/msg00019.html
- https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog
- https://github.com/uriparser/uriparser/commit/f58c25069cf4a986fe17a80c5b38687e31feb539
- https://lists.debian.org/debian-lts-announce/2018/11/msg00019.html