CVE-2019-19917
Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c.
Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c.
- Record
CVE-2019-19917- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-120
- Updated
- 2026-11-02
CVE List No score
Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c.
- Record
CVE-2019-19917- Updated
- 2026-11-02
EUVDEUVD-2019-9508 No score
Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c.
- Record
EUVD-2019-9508- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g859-9cjp-r2w8 No score
Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c.
Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c.
- Record
GHSA-g859-9cjp-r2w8- Weakness
- CWE-120
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-19917
Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c.
- Record
UBUNTU-CVE-2019-19917- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2020-0411 No score
Updated lout packages fix security vulnerabilities
Lout 3.40 has a buffer overflow in the StringQuotedWord() function in z39.c. (CVE-2019-19917)
Lout 3.40 has a heap-based buffer overflow in the srcnext() function in z02.c. (CVE-2019-19918)
- Record
MGASA-2020-0411- Updated
- 2026-11-02
Show 5 moreShow less
OSVopenSUSE-SU-2020:1771-1 No score
Security update for lout
This update for lout fixes the following issues:
- CVE-2019-19918: Fixed buffer overflow in srcnext() (boo#1159713).
- CVE-2019-19917: Fixed buffer overflow in StringQuotedWord() (boo#1159714).
- Record
openSUSE-SU-2020:1771-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1772-1 No score
Security update for lout
This update for lout fixes the following issues:
- CVE-2019-19918: Fixed buffer overflow in srcnext() (boo#1159713).
- CVE-2019-19917: Fixed buffer overflow in StringQuotedWord() (boo#1159714).
- Record
openSUSE-SU-2020:1772-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1812-1 No score
Security update for lout
This update for lout fixes the following issues:
- CVE-2019-19918: Fixed buffer overflow in srcnext() (boo#1159713).
- CVE-2019-19917: Fixed buffer overflow in StringQuotedWord() (boo#1159714).
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2020:1812-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1813-1 No score
Security update for lout
This update for lout fixes the following issues:
- CVE-2019-19918: Fixed buffer overflow in srcnext() (boo#1159713).
- CVE-2019-19917: Fixed buffer overflow in StringQuotedWord() (boo#1159714).
This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2020:1813-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11027-1 No score
lout-3.42-1.3 on GA media
These are all security issues fixed in the lout-3.42-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11027-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
loutMageia:7 From an advisory covering 2 CVEs |
before 3.40-9.1.mga7 | 3.40-9.1.mga7 |
loutUbuntu:16.04:LTS |
All versions, plus listed versions 3.39-1 |
None known |
loutUbuntu:18.04:LTS |
All versions, plus listed versions 3.39-3 |
None known |
loutUbuntu:20.04:LTS |
All versions, plus listed versions 3.39-3 |
None known |
loutopenSUSE:Leap 15.2 From an advisory covering 2 CVEs |
before 3.40-lp152.3.3.1 | 3.40-lp152.3.3.1 |
loutopenSUSE:Leap 15.1 From an advisory covering 2 CVEs |
before 3.40-lp151.2.3.1 | 3.40-lp151.2.3.1 |
loutSUSE:Package Hub 15 SP1 From an advisory covering 2 CVEs |
before 3.40-bp151.2.3.1 | 3.40-bp151.2.3.1 |
loutSUSE:Package Hub 15 SP2 From an advisory covering 2 CVEs |
before 3.40-bp152.4.3.1 | 3.40-bp152.4.3.1 |
loutopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 3.42-1.3 | 3.42-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-19917 is a high vulnerability (CVSS 7.8) in Lout Project Lout, published December 20, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.68%, the 77th percentile. No source names a fixed version.
References
lists.gnu.org/archive/html/lout-users/2019-12/msg00002.html
lists.opensuse.org/opensuse-security-announce/2020-10/msg00069.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5OXECUBSXEO7S3TCLSBCITLQIMOCL6MV
Show 20 moreShow less
nvd.nist.gov/vuln/detail/CVE-2019-19917
github.com/advisories/GHSA-g859-9cjp-r2w8
advisories.mageia.org/MGASA-2020-0411.html
bugs.mageia.org/show_bug.cgi?id=27492
ubuntu.com/security/CVE-2019-19917
cve.org/CVERecord?id=CVE-2019-19917
bugzilla.suse.com/1159713
suse.com/security/cve/CVE-2019-19917