CVE-2019-13032
An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in...
CVE-2019-13032 is a medium vulnerability (CVSS 5.5) in Flightcrew Project Flightcrew, published June 28, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.01%, the 63rd percentile. Fixed in flightcrew 0.7.2+dfsg-14.
An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in GetRelativePathToNcx() or GetRelativePathsToXhtmlDocuments() when a NULL pointer is passed to xc::XMLUri::isValidURI(). This affects third-party software (not Sigil) that uses FlightCrew as a library.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in GetRelativePathToNcx() or GetRelativePathsToXhtmlDocuments() when a NULL pointer is passed to xc::XMLUri::isValidURI(). This affects third-party software (not Sigil) that uses FlightCrew as a library.
- Record
CVE-2019-13032- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in GetRelativePathToNcx() or GetRelativePathsToXhtmlDocuments() when a NULL pointer is passed to xc::XMLUri::isValidURI(). This affects third-party software (not Sigil) that uses FlightCrew as a library.
- Record
CVE-2019-13032- Updated
- 2026-11-02
EUVDEUVD-2019-4600 No score
An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in GetRelativePathToNcx() or GetRelativePathsToXhtmlDocuments() when a NULL pointer is passed to xc::XMLUri::isValidURI(). This affects third-party software (not Sigil) that uses FlightCrew as a library.
- Record
EUVD-2019-4600- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qg8h-9c83-r4h2
An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in...
An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in GetRelativePathToNcx() or GetRelativePathsToXhtmlDocuments() when a NULL pointer is passed to xc::XMLUri::isValidURI(). This affects third-party software (not Sigil) that uses FlightCrew as a library.
- Record
GHSA-qg8h-9c83-r4h2- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSV
An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in GetRelativePathToNcx() or GetRelativePathsToXhtmlDocuments() when a NULL pointer is passed to xc::XMLUri::isValidURI(). This affects third-party software (not Sigil) that uses FlightCrew as a library.
- Record
CVE-2019-13032- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-13032
An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in GetRelativePathToNcx() or GetRelativePathsToXhtmlDocuments() when a NULL pointer is passed to xc::XMLUri::isValidURI(). This affects third-party software (not Sigil) that uses FlightCrew as a library.
- Record
DEBIAN-CVE-2019-13032- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-13032
An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in GetRelativePathToNcx() or GetRelativePathsToXhtmlDocuments() when a NULL pointer is passed to xc::XMLUri::isValidURI(). This affects third-party software (not Sigil) that uses FlightCrew as a library.
- Record
UBUNTU-CVE-2019-13032- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0396 No score
Updated flightcrew packages fix security vulnerabilities
The updated packages fix security vulnerabilities:
An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in GetRelativePathToNcx() or GetRelativePathsToXhtmlDocuments() when a NULL pointer is passed to xc::XMLUri::isValidURI(). This affects third-party software (not Sigil) that uses FlightCrew as a library. (CVE-2019-13032)
FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction. (CVE-2019-13241)
- Record
MGASA-2019-0396- Updated
- 2026-11-02
OSVUSN-4055-1 No score
flightcrew vulnerabilities
Mike Salvatore discovered that FlightCrew improperly handled certain malformed EPUB files. An attacker could potentially use this vulnerability to cause a denial of service. (CVE-2019-13032)
Mike Salvatore discovered that FlightCrew mishandled certain malformed EPUB files. An attacker could use this vulnerability to write arbitrary files to the filesystem. (CVE-2019-13241)
Mike Salvatore discovered that the version of Zipios included in FlightCrew mishandled certain malformed ZIP files. An attacker could use this vulnerability to cause a denial of service or consume system resources. (CVE-2019-13453)
- Record
USN-4055-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flightcrewDebian:12 |
before 0.7.2+dfsg-14 | 0.7.2+dfsg-14 |
flightcrewDebian:13 |
before 0.7.2+dfsg-14 | 0.7.2+dfsg-14 |
flightcrewDebian:14 |
before 0.7.2+dfsg-14 | 0.7.2+dfsg-14 |
flightcrewMageia:7 |
before 0.9.0-10.1.mga7 | 0.9.0-10.1.mga7 |
flightcrewUbuntu:16.04:LTS |
before 0.7.2+dfsg-6ubuntu0.1, plus listed versions 0.7.2+dfsg-20.7.2+dfsg-30.7.2+dfsg-40.7.2+dfsg-50.7.2+dfsg-6 |
0.7.2+dfsg-6ubuntu0.1 |
flightcrewUbuntu:18.04:LTS |
before 0.7.2+dfsg-10ubuntu0.1, plus listed versions 0.7.2+dfsg-90.7.2+dfsg-9build10.7.2+dfsg-9build20.7.2+dfsg-10 |
0.7.2+dfsg-10ubuntu0.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |