CVE-2019-16707
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
6.5 MediumFix available
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
1.65%Up 0.4 points since Apr 14, 2021
What each source reports
NVD Score used
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
- Record
CVE-2019-16707- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
- Record
CVE-2019-16707- Updated
- 2026-11-02
EUVDEUVD-2019-7257 No score
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
- Record
EUVD-2019-7257- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q3gq-ffrv-w3c5
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
- Record
GHSA-q3gq-ffrv-w3c5- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSVALPINE-CVE-2019-16707
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
- Record
ALPINE-CVE-2019-16707- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2019-16707
CVE-2019-16707 does not affect BellSoft software
- Record
BELL-CVE-2019-16707- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 11 moreShow less
OSV
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
- Record
CVE-2019-16707- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-16707
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
- Record
DEBIAN-CVE-2019-16707- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2021-1023
hunspell security update
Hunspell is a free spell checker and morphological analyzer library and command-line tool, licensed under LGPL/GPL/MPL tri-license.\r\n\r\n Security Fix(es):\r\n\r\n Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.(CVE-2019-16707)\r\n\r\n
- Record
OESA-2021-1023- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2020:3971
Red Hat Security Advisory: hunspell security update
- Record
RHSA-2020:3971- CVSS 3.0
- 5.8 Medium
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-16707
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx.
- Record
UBUNTU-CVE-2019-16707- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0421 No score
Updated hunspell packages fix security vulnerability
Updated hunspell packages fix security vulnerability:
Hunspell 1.7.0 has an invalid read operation in SuggestMgr::leftcommonsubstring in suggestmgr.cxx (CVE-2019-16707).
- Record
MGASA-2019-0421- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1717-1 No score
Security update for hunspell
This update for hunspell fixes the following issues:
- CVE-2019-16707: Fixed an invalid read in SuggestMgr:leftcommonsubstring (bsc#1151867).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:1717-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1719-1 No score
Security update for hunspell
This update for hunspell fixes the following issues:
- CVE-2019-16707: Fixed an invalid read in SuggestMgr:leftcommonsubstring (bsc#1151867).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:1719-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10851-1 No score
hunspell-1.7.0-2.6 on GA media
These are all security issues fixed in the hunspell-1.7.0-2.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10851-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2966-1 No score
Security update for hunspell
This update for hunspell fixes the following issues:
- CVE-2019-16707: Fixed an invalid read in SuggestMgr:leftcommonsubstring (bsc#1151867).
- Record
SUSE-SU-2020:2966-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2967-1 No score
Security update for hunspell
This update for hunspell fixes the following issues:
- CVE-2019-16707: Fixed an invalid read in SuggestMgr:leftcommonsubstring (bsc#1151867).
- Record
SUSE-SU-2020:2967-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hunspellAlpine:v3.10 |
before 1.7.0-r1 | 1.7.0-r1 |
hunspellAlpine:v3.11 |
before 1.7.0-r1 | 1.7.0-r1 |
hunspellAlpine:v3.12 |
before 1.7.0-r1 | 1.7.0-r1 |
hunspellAlpine:v3.13 |
before 1.7.0-r1 | 1.7.0-r1 |
hunspellAlpine:v3.14 |
before 1.7.0-r1 | 1.7.0-r1 |
hunspellAlpine:v3.15 |
before 1.7.0-r1 | 1.7.0-r1 |
hunspellAlpine:v3.16 |
before 1.7.0-r1 | 1.7.0-r1 |
hunspellAlpine:v3.17 |
before 1.7.0-r1 | 1.7.0-r1 |
hunspellAlpine:v3.18 |
before 1.7.0-r1 | 1.7.0-r1 |
hunspellAlpine:v3.19 |
before 1.7.0-r1 | 1.7.0-r1 |
Show 77 moreShow less
| Package | Affected | Fixed |
|---|---|---|
hunspellAlpine:v3.20 |
before 1.7.0-r1 | 1.7.0-r1 |
hunspellAlpine:v3.21 |
before 1.7.0-r1 | 1.7.0-r1 |
hunspellAlpine:v3.22 |
before 1.7.0-r1 | 1.7.0-r1 |
hunspellAlpine:v3.23 |
before 1.7.0-r1 | 1.7.0-r1 |
hunspellAlpine:v3.24 |
before 1.7.0-r1 | 1.7.0-r1 |
hunspellAlpine:v3.8 |
before 1.6.2-r2 | 1.6.2-r2 |
hunspellAlpine:v3.9 |
before 1.6.2-r2 | 1.6.2-r2 |
qt6-qtwebengineAlpine:v3.22 |
before 6.8.3-r1 | 6.8.3-r1 |
qt6-qtwebengineAlpine:v3.23 |
before 6.8.3-r1 | 6.8.3-r1 |
qt6-qtwebengineAlpine:v3.24 |
before 6.8.3-r1 | 6.8.3-r1 |
hunspellDebian:12 |
before 1.7.0-3 | 1.7.0-3 |
hunspellDebian:13 |
before 1.7.0-3 | 1.7.0-3 |
hunspellDebian:14 |
before 1.7.0-3 | 1.7.0-3 |
hunspellMageia:7 |
before 1.7.0-1.1.mga7 | 1.7.0-1.1.mga7 |
hunspellopenEuler:20.03-LTS |
before 1.7.0-6.oe1 | 1.7.0-6.oe1 |
hunspellopenEuler:20.03-LTS-SP1 |
before 1.7.0-6.oe1 | 1.7.0-6.oe1 |
hunspellRed Hat:enterprise_linux:7::client |
before 0:1.3.2-16.el7 | 0:1.3.2-16.el7 |
hunspell-debuginfoRed Hat:enterprise_linux:7::client |
before 0:1.3.2-16.el7 | 0:1.3.2-16.el7 |
hunspell-develRed Hat:enterprise_linux:7::client |
before 0:1.3.2-16.el7 | 0:1.3.2-16.el7 |
hunspellRed Hat:enterprise_linux:7::computenode |
before 0:1.3.2-16.el7 | 0:1.3.2-16.el7 |
hunspell-debuginfoRed Hat:enterprise_linux:7::computenode |
before 0:1.3.2-16.el7 | 0:1.3.2-16.el7 |
hunspell-develRed Hat:enterprise_linux:7::computenode |
before 0:1.3.2-16.el7 | 0:1.3.2-16.el7 |
hunspellRed Hat:enterprise_linux:7::server |
before 0:1.3.2-16.el7 | 0:1.3.2-16.el7 |
hunspell-debuginfoRed Hat:enterprise_linux:7::server |
before 0:1.3.2-16.el7 | 0:1.3.2-16.el7 |
hunspell-develRed Hat:enterprise_linux:7::server |
before 0:1.3.2-16.el7 | 0:1.3.2-16.el7 |
hunspellRed Hat:enterprise_linux:7::workstation |
before 0:1.3.2-16.el7 | 0:1.3.2-16.el7 |
hunspell-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:1.3.2-16.el7 | 0:1.3.2-16.el7 |
hunspell-develRed Hat:enterprise_linux:7::workstation |
before 0:1.3.2-16.el7 | 0:1.3.2-16.el7 |
hunspellSUSE:Linux Enterprise Module for Basesystem 15 SP1 |
before 1.6.2-3.3.7 | 1.6.2-3.3.7 |
hunspellSUSE:Linux Enterprise Module for Basesystem 15 SP2 |
before 1.6.2-3.3.7 | 1.6.2-3.3.7 |
hunspellSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 1.3.2-19.3.1 | 1.3.2-19.3.1 |
hunspellSUSE:Linux Enterprise Server 12 SP5 |
before 1.3.2-19.3.1 | 1.3.2-19.3.1 |
hunspellSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 1.3.2-19.3.1 | 1.3.2-19.3.1 |
hunspellUbuntu:14.04:LTS |
All versions, plus listed versions 1.3.2-4ubuntu11.3.2-6ubuntu11.3.2-6ubuntu21.3.2-6ubuntu2.1 |
None known |
enchantUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.0-10.1build11.6.0-10.1build2 |
None known |
hunspellUbuntu:16.04:LTS |
All versions, plus listed versions 1.3.3-3ubuntu31.3.3-3ubuntu41.3.3-4ubuntu1 |
None known |
calibreUbuntu:16.04:LTS |
All versions, plus listed versions 2.33.0+dfsg-1build12.38.0+dfsg-12.45.0+dfsg-12.45.0+dfsg-1build12.48.0+dfsg-1 Show 4 moreShow less2.48.0+dfsg-1build12.54.0+dfsg-12.55.0+dfsg-12.55.0+dfsg-1ubuntu0.2 |
None known |
focuswriterUbuntu:16.04:LTS |
All versions, plus listed versions 1.5.4.1-1build11.5.5-1 |
None known |
postbooksUbuntu:16.04:LTS |
All versions, plus listed versions 4.9.2-1 |
None known |
texmakerUbuntu:16.04:LTS |
All versions, plus listed versions 4.4.1-14.4.1-1.1 |
None known |
enchantUbuntu:18.04:LTS |
All versions, plus listed versions 1.6.0-11build21.6.0-11.1 |
None known |
hunspellUbuntu:18.04:LTS |
All versions, plus listed versions 1.6.2-1 |
None known |
calibreUbuntu:18.04:LTS |
All versions, plus listed versions 3.7.0+dfsg-23.7.0+dfsg-2build13.12.0+dfsg-13.13.0+dfsg-13.14.0+dfsg-1 Show 10 moreShow less3.15.0.1+dfsg-13.16.0+dfsg-13.16.0+dfsg-1build13.17.0+dfsg-13.17.0+dfsg-23.18.0+dfsg-1build13.19.0+dfsg-13.20.0+dfsg-13.21.0+dfsg-13.21.0+dfsg-1build1 |
None known |
focuswriterUbuntu:18.04:LTS |
All versions, plus listed versions 1.6.6-11.6.7-11.6.8-11.6.8-21.6.9-11.6.10-11.6.11-11.6.12-1 |
None known |
postbooksUbuntu:18.04:LTS |
All versions, plus listed versions 4.10.1-1 |
None known |
qtwebengine-opensource-srcUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 5.9.1+dfsg-45.9.1+dfsg-4ubuntu15.9.2+dfsg-2ubuntu15.9.3+dfsg-0ubuntu15.9.4+dfsg-0ubuntu15.9.5+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2+esm1 |
None known |
texmakerUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.5-15.0.2-15.0.2-1build15.0.2-1build25.0.2-1ubuntu0.1~esm1 |
None known |
hunspellUbuntu:20.04:LTS |
All versions, plus listed versions 1.7.0-2build11.7.0-2build2 |
None known |
calibreUbuntu:20.04:LTS |
All versions, plus listed versions 3.46.0+dfsg-14.2.0+dfsg-24.3.0+dfsg-14.3.0+dfsg-24.4.0+dfsg-1 Show 14 moreShow less4.5.0+dfsg-14.5.0+dfsg-24.5.0+dfsg-34.6.0+dfsg-14.7.0+dfsg-14.99.3+dfsg-24.99.4+dfsg-14.99.4+dfsg-1build14.99.4+dfsg+really4.10.0+py3-24.99.4+dfsg+really4.11.2-14.99.4+dfsg+really4.11.2-1build14.99.4+dfsg+really4.12.0-14.99.4+dfsg+really4.12.0-1build14.99.4+dfsg+really4.12.0-1ubuntu1 |
None known |
enchantUbuntu:20.04:LTS |
All versions, plus listed versions 1.6.0-11.1build11.6.0-11.31.6.0-11.3build1 |
None known |
focuswriterUbuntu:20.04:LTS |
All versions, plus listed versions 1.7.3-11.7.4-11.7.4-1build1 |
None known |
qtwebengine-opensource-srcUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5.12.4+dfsg-1ubuntu15.12.4+dfsg-1ubuntu35.12.5+dfsg-3ubuntu15.12.5+dfsg-6ubuntu25.12.5+dfsg-7 Show 4 moreShow less5.12.5+dfsg-7build15.12.8+dfsg-0ubuntu15.12.8+dfsg-0ubuntu1.15.12.8+dfsg-0ubuntu1.1+esm1 |
None known |
texmakerUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5.0.3-1build25.0.3-1build35.0.3-1build45.0.3-1build55.0.3-1ubuntu0.20.04.1~esm1 |
None known |
calibreUbuntu:22.04:LTS |
All versions, plus listed versions 5.25.0+dfsg-25.33.2+dfsg-15.34.0+dfsg-15.35.0+dfsg-1ubuntu25.37.0+dfsg-15.37.0+dfsg-1build1 |
None known |
focuswriterUbuntu:22.04:LTS |
All versions, plus listed versions 1.7.6-2 |
None known |
qtwebengine-opensource-srcUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 5.15.6+dfsg-15.15.6+dfsg-25.15.7+dfsg-25.15.8+dfsg-15.15.8+dfsg-1build1 Show 4 moreShow less5.15.8+dfsg-1build25.15.8+dfsg-25.15.9+dfsg-15.15.9+dfsg-1ubuntu0.1~esm1 |
None known |
texmakerUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 5.0.3-1build85.0.3-1build95.0.3-1ubuntu0.22.04.1~esm1 |
None known |
calibreUbuntu:24.04:LTS |
All versions, plus listed versions 6.24.0+ds-16.29.0+ds-17.0.0+ds-17.1.0+ds-17.1.0+ds-2 Show 9 moreShow less7.2.0+ds-17.2.0+ds-1build17.3.0+ds-17.4.0+ds-17.5.1+ds-17.5.1+ds-27.5.1+ds-37.6.0+ds-17.6.0+ds-1build1 |
None known |
focuswriterUbuntu:24.04:LTS |
All versions, plus listed versions 1.8.5-11.8.6-11.8.6-1build11.8.6-1build2 |
None known |
qtwebengine-opensource-srcUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 5.15.15+dfsg-25.15.15+dfsg-2build25.15.15+dfsg-2ubuntu15.15.16+dfsg-15.15.16+dfsg-1ubuntu25.15.16+dfsg-1ubuntu45.15.16+dfsg-35.15.16+dfsg-3ubuntu0.1~esm1 |
None known |
texmakerUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 5.1.3+dfsg-1build45.1.3+dfsg-1build55.1.3+dfsg-1build65.1.3+dfsg-1build75.1.3+dfsg-1build85.1.3+dfsg-1ubuntu0.1~esm1 |
None known |
calibreUbuntu:25.10 |
All versions, plus listed versions 7.26.0+ds-4build18.3.0+ds-18.4.0+ds-18.5.0+ds-18.6.0+ds-1 Show 4 moreShow less8.7.0+ds-18.8.0+ds-28.8.0+ds-38.8.0+ds-3build1 |
None known |
focuswriterUbuntu:25.10 |
All versions, plus listed versions 1.8.11-11.8.12-1 |
None known |
qtwebengine-opensource-srcUbuntu:25.10 |
All versions, plus listed versions 5.15.18+dfsg-25.15.18+dfsg-2build15.15.19+dfsg-15.15.19+dfsg2-1 |
None known |
texmakerUbuntu:25.10 |
All versions, plus listed versions 5.1.3+dfsg-35.1.3+dfsg-3build1 |
None known |
calibreUbuntu:26.10 |
All versions, plus listed versions 9.2.1+ds+~0.10.5-2build19.9.0+ds+~0.10.6-19.11.0+ds+~0.10.6-19.11.0+ds+~0.10.6-29.13.0+ds+~0.10.6-19.14.0+ds+~0.10.6-2build1 |
None known |
enchantUbuntu:26.10 |
All versions, plus listed versions 2.8.16+dfsg-32.8.16+dfsg-4 |
None known |
focuswriterUbuntu:26.10 |
All versions, plus listed versions 1.9.0-11.9.1-1 |
None known |
qtwebengine-opensource-srcUbuntu:26.10 |
All versions, plus listed versions 5.15.19+dfsg2-45.15.19+dfsg2-65.15.19+dfsg2-7 |
None known |
texmakerUbuntu:26.10 |
All versions, plus listed versions 6.0.1+dfsg-3build16.0.1+dfsg-3build2 |
None known |
calibreUbuntu:26.04:LTS |
All versions, plus listed versions 8.8.0+ds-3build18.13.0+ds+~0.10.5-38.14.0+ds+~0.10.5-18.15.0+ds+~0.10.5-18.16.0+ds+~0.10.5-2 Show 4 moreShow less8.16.2+ds+~0.10.5-18.16.2+ds+~0.10.5-28.16.2+ds+~0.10.5-39.2.1+ds+~0.10.5-2build1 |
None known |
focuswriterUbuntu:26.04:LTS |
All versions, plus listed versions 1.8.12-11.8.13-11.9.0-1 |
None known |
texmakerUbuntu:26.04:LTS |
All versions, plus listed versions 5.1.3+dfsg-3build16.0.1+dfsg-36.0.1+dfsg-3build1 |
None known |
qtwebengine-opensource-srcUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 5.15.19+dfsg2-15.15.19+dfsg2-1build15.15.19+dfsg2-25.15.19+dfsg2-35.15.19+dfsg2-45.15.19+dfsg2-4ubuntu0.1~esm1 |
None known |
hunspellopenSUSE:Leap 15.1 |
before 1.6.2-lp151.3.3.1 | 1.6.2-lp151.3.3.1 |
hunspellopenSUSE:Leap 15.2 |
before 1.6.2-lp152.4.3.1 | 1.6.2-lp152.4.3.1 |
hunspellopenSUSE:Tumbleweed |
before 1.7.0-2.6 | 1.7.0-2.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-16707 is a medium vulnerability (CVSS 6.5) in Hunspell Project Hunspell, published September 23, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.65%, the 76th percentile. Fixed in hunspell 1.7.0-r1.
References
github.com/butterflyhack/hunspell-crash
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UD4AJ4M74VT3I6L37E4P5DNYZYBZIOVM
nvd.nist.gov/vuln/detail/CVE-2019-16707
Show 26 moreShow less
security.alpinelinux.org/vuln/CVE-2019-16707
docs.bell-sw.com/security/cves/CVE-2019-16707
security-tracker.debian.org/tracker/CVE-2019-16707
advisories.mageia.org/MGASA-2019-0421.html
bugs.mageia.org/show_bug.cgi?id=25963
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1023
access.redhat.com/errata/RHSA-2020:3971
bugzilla.redhat.com/show_bug.cgi?id=1771026
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3971.json
cve.org/CVERecord?id=CVE-2019-16707
suse.com/support/update/announcement/2020/suse-su-20202966-1
bugzilla.suse.com/1151867
ubuntu.com/security/CVE-2019-16707
lists.opensuse.org/archives/list/[email protected]/thread/7ARK36GN54T2JM6Y2JVEQHZVXGX2ZPQD