Every CVE Search/ Get API key

CVE-2019-25051

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top ...

7.8 HighFix available

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.55%Down 0.3 points since Jul 20, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).

Record
CVE-2019-25051
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-787
Updated
2026-11-02
CVE List No score

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).

Record
CVE-2019-25051
Updated
2026-11-02
EUVDEUVD-2019-11500 No score

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).

Record
EUVD-2019-11500
Updated
2026-11-03
GitHub AdvisoriesGHSA-vm7w-rc54-7m7r No score

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top ...

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).

Record
GHSA-vm7w-rc54-7m7r
Weakness
CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2019-25051 7.8

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).

Record
ALPINE-CVE-2019-25051
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-11363 7.8

CVE-2019-25051 affecting package aspell for versions less than 0.60.8-7

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).

Record
AZL-11363
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 18 moreShow less
OSVBELL-CVE-2019-25051 7.8

CVE-2019-25051 does not affect BellSoft software

Record
BELL-CVE-2019-25051
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.8

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).

Record
CVE-2019-25051
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-25051 7.8

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).

Record
DEBIAN-CVE-2019-25051
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2021-1351 7.8

aspell security update

GNU Aspell is a spell checker intended to replace Ispell. It can be used as a library and spell checker. Its main feature is that it provides much better suggestions than other inspectors, including Ispell and Microsoft Word. It also has many other technical enhancements to Ispell, such as the use of shared memory to store dictionaries, and intelligent processing of personal dictionaries when multiple Aspell processes are opened at one time.

Security Fix(es):

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).(CVE-2019-25051)

Record
OESA-2021-1351
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-1754 7.8

aspell security update

GNU Aspell is a spell checker intended to replace Ispell. It can be used as a library and spell checker. Its main feature is that it provides much better suggestions than other inspectors, including Ispell and Microsoft Word. It also has many other technical enhancements to Ispell, such as the use of shared memory to store dictionaries, and intelligent processing of personal dictionaries when multiple Aspell processes are opened at one time.

Security Fix(es):

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).(CVE-2019-25051)

Record
OESA-2024-1754
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2024-1755 7.8

aspell security update

GNU Aspell is a spell checker intended to replace Ispell. It can be used as a library and spell checker. Its main feature is that it provides much better suggestions than other inspectors, including Ispell and Microsoft Word. It also has many other technical enhancements to Ispell, such as the use of shared memory to store dictionaries, and intelligent processing of personal dictionaries when multiple Aspell processes are opened at one time.

Security Fix(es):

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).(CVE-2019-25051)

Record
OESA-2024-1755
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:1808 7.8

Red Hat Security Advisory: aspell security update

Record
RHSA-2022:1808
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2022:1808 7.8

Moderate: aspell security update

GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker.

Security Fix(es):

  • aspell: Heap-buffer-overflow in acommon::ObjStack::dup_top (CVE-2019-25051)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Record
RLSA-2022:1808
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-25051 7.8

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).

Record
UBUNTU-CVE-2019-25051
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2022:1808 No score

Moderate: aspell security update

GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker.

Security Fix(es):

  • aspell: Heap-buffer-overflow in acommon::ObjStack::dup_top (CVE-2019-25051)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2022:1808
Updated
2026-11-02
OSVMGASA-2021-0388 No score

Updated aspell packages fix security vulnerability

objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list) (CVE-2019-25051).

Record
MGASA-2021-0388
Updated
2026-11-02
OSVopenSUSE-SU-2021:1181-1 No score

Security update for aspell

This update for aspell fixes the following issues:

  • CVE-2019-25051: Fixed heap-buffer-overflow in acommon:ObjStack:dup_top (bsc#1188576).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:1181-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2794-1 No score

Security update for aspell

This update for aspell fixes the following issues:

  • CVE-2019-25051: Fixed heap-buffer-overflow in acommon:ObjStack:dup_top (bsc#1188576).
Record
openSUSE-SU-2021:2794-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10635-1 No score

aspell-0.60.8-4.2 on GA media

These are all security issues fixed in the aspell-0.60.8-4.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10635-1
Updated
2026-11-02
OSVSUSE-SU-2021:14783-1 No score

Security update for aspell

This update for aspell fixes the following issues:

  • CVE-2019-25051: Fixed heap-buffer-overflow in acommon:ObjStack:dup_top (bsc#1188576).
Record
SUSE-SU-2021:14783-1
Updated
2026-11-02
OSVSUSE-SU-2021:2794-1 No score

Security update for aspell

This update for aspell fixes the following issues:

  • CVE-2019-25051: Fixed heap-buffer-overflow in acommon:ObjStack:dup_top (bsc#1188576).
Record
SUSE-SU-2021:2794-1
Updated
2026-11-02
OSVSUSE-SU-2021:2848-1 No score

Security update for aspell

This update for aspell fixes the following issues:

  • CVE-2019-25051: Fixed heap-buffer-overflow in acommon:ObjStack:dup_top (bsc#1188576).
Record
SUSE-SU-2021:2848-1
Updated
2026-11-02
OSVUSN-5023-1 No score

aspell vulnerability

It was discovered that Aspell incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code or cause a crash.

Record
USN-5023-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
aspell
Alpine:v3.11
 before 0.60.8-r1
0.60.8-r1
aspell
Alpine:v3.12
 before 0.60.8-r1
0.60.8-r1
aspell
Alpine:v3.13
 before 0.60.8-r1
0.60.8-r1
aspell
Alpine:v3.14
 before 0.60.8-r1
0.60.8-r1
aspell
Alpine:v3.15
 before 0.60.8-r1
0.60.8-r1
aspell
Alpine:v3.16
 before 0.60.8-r1
0.60.8-r1
aspell
Alpine:v3.17
 before 0.60.8-r1
0.60.8-r1
aspell
Alpine:v3.18
 before 0.60.8-r1
0.60.8-r1
aspell
Alpine:v3.19
 before 0.60.8-r1
0.60.8-r1
aspell
Alpine:v3.20
 before 0.60.8-r1
0.60.8-r1
Show 50 moreShow less
Affected packages
PackageAffectedFixed
aspell
Alpine:v3.21
 before 0.60.8-r1
0.60.8-r1
aspell
Alpine:v3.22
 before 0.60.8-r1
0.60.8-r1
aspell
Alpine:v3.23
 before 0.60.8-r1
0.60.8-r1
aspell
Alpine:v3.24
 before 0.60.8-r1
0.60.8-r1
aspell
AlmaLinux:8
 before 12:0.60.6.1-22.el8
12:0.60.6.1-22.el8
aspell-devel
AlmaLinux:8
 before 12:0.60.6.1-22.el8
12:0.60.6.1-22.el8
aspell
Azure Linux:2
 before 0.60.8-7
0.60.8-7
aspell
Debian:12
 before 0.60.8-3
0.60.8-3
aspell
Debian:13
 before 0.60.8-3
0.60.8-3
aspell
Debian:14
 before 0.60.8-3
0.60.8-3
aspell
Debian:9
From an advisory covering 2 CVEs
 before 0.60.7~20110707-3+deb9u1, plus listed versions
0.60.7~20110707-3
0.60.7~20110707-3+deb9u1
aspell
Debian:10
From an advisory covering 2 CVEs
 before 0.60.7~20110707-6+deb10u1, plus listed versions
0.60.7~20110707-6
0.60.7~20110707-6+deb10u1
aspell
Mageia:8
 before 0.60.8-4.1.mga8
0.60.8-4.1.mga8
aspell
openEuler:20.03-LTS-SP1
 before 0.60.6.1-28.oe1
0.60.6.1-28.oe1
aspell
openEuler:20.03-LTS-SP2
 before 0.60.6.1-29.oe1
0.60.6.1-29.oe1
aspell
openEuler:22.03-LTS-SP3
 before 0.60.6.1-30.oe2203sp3
0.60.6.1-30.oe2203sp3
aspell
openEuler:22.03-LTS-SP1
 before 0.60.6.1-30.oe2203sp1
0.60.6.1-30.oe2203sp1
aspell
Red Hat:enterprise_linux:8::appstream
 before 12:0.60.6.1-22.el8
12:0.60.6.1-22.el8
aspell-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 12:0.60.6.1-22.el8
12:0.60.6.1-22.el8
aspell-debugsource
Red Hat:enterprise_linux:8::appstream
 before 12:0.60.6.1-22.el8
12:0.60.6.1-22.el8
aspell-debuginfo
Red Hat:enterprise_linux:8::crb
 before 12:0.60.6.1-22.el8
12:0.60.6.1-22.el8
aspell-debugsource
Red Hat:enterprise_linux:8::crb
 before 12:0.60.6.1-22.el8
12:0.60.6.1-22.el8
aspell-devel
Red Hat:enterprise_linux:8::crb
 before 12:0.60.6.1-22.el8
12:0.60.6.1-22.el8
aspell
Rocky Linux:8
 before 2:0.60.6.1-22.el8
2:0.60.6.1-22.el8
aspell
SUSE:Linux Enterprise Point of Sale 11 SP3
 before 0.60.6-26.36.1
0.60.6-26.36.1
aspell
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 0.60.6-26.36.1
0.60.6-26.36.1
aspell
SUSE:Linux Enterprise Module for Basesystem 15 SP2
 before 0.60.8-3.3.1
0.60.8-3.3.1
aspell
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 0.60.8-3.3.1
0.60.8-3.3.1
aspell
SUSE:HPE Helion OpenStack 8
 before 0.60.6.1-18.11.1
0.60.6.1-18.11.1
aspell
SUSE:OpenStack Cloud 8
 before 0.60.6.1-18.11.1
0.60.6.1-18.11.1
aspell
SUSE:OpenStack Cloud 9
 before 0.60.6.1-18.11.1
0.60.6.1-18.11.1
aspell
SUSE:OpenStack Cloud Crowbar 8
 before 0.60.6.1-18.11.1
0.60.6.1-18.11.1
aspell
SUSE:OpenStack Cloud Crowbar 9
 before 0.60.6.1-18.11.1
0.60.6.1-18.11.1
aspell
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 0.60.6.1-18.11.1
0.60.6.1-18.11.1
aspell
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 0.60.6.1-18.11.1
0.60.6.1-18.11.1
aspell
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 0.60.6.1-18.11.1
0.60.6.1-18.11.1
aspell
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 0.60.6.1-18.11.1
0.60.6.1-18.11.1
aspell
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 0.60.6.1-18.11.1
0.60.6.1-18.11.1
aspell
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 0.60.6.1-18.11.1
0.60.6.1-18.11.1
aspell
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 0.60.6.1-18.11.1
0.60.6.1-18.11.1
aspell
SUSE:Linux Enterprise Server 12 SP5
 before 0.60.6.1-18.11.1
0.60.6.1-18.11.1
aspell
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 0.60.6.1-18.11.1
0.60.6.1-18.11.1
aspell
Ubuntu:Pro:14.04:LTS
 before 0.60.7~20110707-1ubuntu1+esm2, plus listed versions
0.60.7~20110707-1build10.60.7~20110707-1ubuntu10.60.7~20110707-1ubuntu1+esm1
0.60.7~20110707-1ubuntu1+esm2
aspell
Ubuntu:Pro:16.04:LTS
 before 0.60.7~20110707-3ubuntu0.1+esm1, plus listed versions
0.60.7~20110707-30.60.7~20110707-3build10.60.7~20110707-3ubuntu0.1
0.60.7~20110707-3ubuntu0.1+esm1
aspell
Ubuntu:18.04:LTS
 before 0.60.7~20110707-4ubuntu0.2, plus listed versions
0.60.7~20110707-40.60.7~20110707-4ubuntu0.1
0.60.7~20110707-4ubuntu0.2
aspell
Ubuntu:20.04:LTS
 before 0.60.8-1ubuntu0.1, plus listed versions
0.60.7-30.60.8-10.60.8-1build1
0.60.8-1ubuntu0.1
aspell
Ubuntu:22.04:LTS
 before 0.60.8-3
0.60.8-3
aspell
openSUSE:Leap 15.2
 before 0.60.8-lp152.2.3.1
0.60.8-lp152.2.3.1
aspell
openSUSE:Leap 15.3
 before 0.60.8-3.3.1
0.60.8-3.3.1
aspell
openSUSE:Tumbleweed
 before 0.60.8-4.2
0.60.8-4.2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-25051 is a high vulnerability (CVSS 7.8) in Gnu Aspell, published July 20, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in aspell 0.60.8-r1.

References

Show 31 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open