Every CVE Search/ Get API key

CVE-2019-20433

libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single ...

9.1 CriticalFix available

libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
High

Exploit likelihood

1.74%Up 1.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.1

libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.

Record
CVE-2019-20433
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0
6.4 MediumAV:N/AC:L/Au:N/C:P/I:N/A:P
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.

Record
CVE-2019-20433
Updated
2026-11-02
EUVDEUVD-2019-10981 No score

libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.

Record
EUVD-2019-10981
Updated
2026-11-03
GitHub AdvisoriesGHSA-qcm5-23xv-7r79 No score

libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single ...

libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.

Record
GHSA-qcm5-23xv-7r79
Updated
2026-11-02
OSV 9.1

libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.

Record
CVE-2019-20433
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-20433 9.1

libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.

Record
DEBIAN-CVE-2019-20433
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVOESA-2021-1388 5.8

aspell security update

GNU Aspell is a spell checker intended to replace Ispell. It can be used as a library and spell checker. Its main feature is that it provides much better suggestions than other inspectors, including Ispell and Microsoft Word. It also has many other technical enhancements to Ispell, such as the use of shared memory to store dictionaries, and intelligent processing of personal dictionaries when multiple Aspell processes are opened at one time.

Security Fix(es):

libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.(CVE-2019-20433)

Record
OESA-2021-1388
CVSS 3.1
5.8 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-20433 9.1

libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.

Record
UBUNTU-CVE-2019-20433
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVSUSE-SU-2020:0397-1 No score

Security update for php72

This update for php72 fixes the following issues:

Security issues fixed:

  • CVE-2020-7059: Fixed an out-of-bounds read in php_strip_tags_ex (bsc#1162629).
  • CVE-2020-7060: Fixed a global buffer-overflow in mbfl_filt_conv_big5_wchar (bsc#1162632).
  • CVE-2019-20433: Fixed a buffer over-read when processing strings ending with a single '\0' byte with ucs-2 and ucs-4 encoding (bsc#1161982).
Record
SUSE-SU-2020:0397-1
Updated
2026-11-02
OSVSUSE-SU-2020:14289-1 No score

Security update for php53

This update for php53 fixes the following issues:

Security issues fixed:

  • CVE-2020-7059: Fixed an out-of-bounds read in php_strip_tags_ex (bsc#1162629).
  • CVE-2019-11045: Fixed an issue with the PHP DirectoryIterator class that accepts filenames with embedded \0 bytes (bsc#1159923).
  • CVE-2019-11046: Fixed an out-of-bounds read in bc_shift_addsub (bsc#1159924).
  • CVE-2019-11047: Fixed an information disclosure in exif_read_data (bsc#1159922).
  • CVE-2019-11050: Fixed a buffer over-read in the EXIF extension (bsc#1159927).
  • CVE-2019-20433: Fixed a buffer over-read when processing strings ending with a single '\0' byte with ucs-2 and ucs-4 encoding (bsc#1161982).
Record
SUSE-SU-2020:14289-1
Updated
2026-11-02
OSVSUSE-SU-2020:2807-1 No score

Security update for aspell

This update for aspell fixes the following security issue:

  • CVE-2019-20433: Fixed a buffer over-read when processing strings ending with a single '\0' byte with ucs-2 and ucs-4 encoding (bsc#1161982).
Record
SUSE-SU-2020:2807-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
aspell
Debian:12
 before 0.60.7-3
0.60.7-3
aspell
Debian:13
 before 0.60.7-3
0.60.7-3
aspell
Debian:14
 before 0.60.7-3
0.60.7-3
aspell
openEuler:20.03-LTS-SP1
 before 0.60.6.1-29.oe1
0.60.6.1-29.oe1
aspell
openEuler:20.03-LTS-SP2
 before 0.60.6.1-29.oe1
0.60.6.1-29.oe1
php72
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 7.2.5-1.37.1
7.2.5-1.37.1
php72
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 7.2.5-1.37.1
7.2.5-1.37.1
php72
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 7.2.5-1.37.1
7.2.5-1.37.1
php53
SUSE:Linux Enterprise Point of Sale 11 SP3
 before 5.3.17-112.79.1
5.3.17-112.79.1
php53
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 5.3.17-112.79.1
5.3.17-112.79.1
Show 6 moreShow less
Affected packages
PackageAffectedFixed
aspell
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 0.60.6.1-18.8.2
0.60.6.1-18.8.2
aspell
SUSE:Linux Enterprise Server 12 SP5
 before 0.60.6.1-18.8.2
0.60.6.1-18.8.2
aspell
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 0.60.6.1-18.8.2
0.60.6.1-18.8.2
aspell
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.60.7~20110707-1build10.60.7~20110707-1ubuntu10.60.7~20110707-1ubuntu1+esm10.60.7~20110707-1ubuntu1+esm2
 None known
aspell
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.60.7~20110707-30.60.7~20110707-3build10.60.7~20110707-3ubuntu0.10.60.7~20110707-3ubuntu0.1+esm1
 None known
aspell
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.60.7~20110707-40.60.7~20110707-4ubuntu0.10.60.7~20110707-4ubuntu0.2
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-20433 is a critical vulnerability (CVSS 9.1) in Gnu Aspell, published January 27, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.74%, the 77th percentile. Fixed in aspell 0.60.7-3.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open