CVE-2019-6291
CVE-2019-6291
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue was discovered in the function expr6 in eval.c in Netwide Assembler (NASM) through 2.14.02. There is a stack exhaustion problem caused by the expr6 function making recursive calls to itself in certain scenarios involving lots of '!' or '+' or '-' characters. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted asm file.
CVSS 5.5 · Medium · EPSS 1.2%
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
nasm Debian:12
- Versions
- 2.16.01-1
- 2.16.03-1
- 3.01-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nasm Debian:13
- Versions
- 2.16.03-1
- 3.01-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nasm Debian:14
- Versions
- 2.16.03-1
- 3.01-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nasm Ubuntu:16.04:LTS
- Versions
- 2.11.06-1really2.11.05-1
- 2.11.08-1
- 2.11.08-1ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nasm Ubuntu:18.04:LTS
- Versions
- 2.13.01-2
- 2.13.02-0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nasm Ubuntu:20.04:LTS
- Versions
- 2.14.02-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nasm Ubuntu:Pro:22.04:LTS
- Versions
- 2.15.05-1
- 2.15.05-1ubuntu0.1~esm1
- 2.15.05-1ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nasm Ubuntu:Pro:24.04:LTS
- Versions
- 2.16.01-1
- 2.16.01-1build1
- 2.16.01-1ubuntu0.1~esm1
- 2.16.01-1ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nasm Ubuntu:25.10
- Versions
- 2.16.03-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nasm Ubuntu:26.10
- Versions
- 3.01-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nasm Ubuntu:26.04:LTS
- Versions
- 2.16.03-1
- 3.01-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published