{"id":"CVE-2019-20433","aliases":["DEBIAN-CVE-2019-20433","EUVD-2019-10981","GHSA-qcm5-23xv-7r79","OESA-2021-1388","SUSE-SU-2020:0397-1","SUSE-SU-2020:14289-1","SUSE-SU-2020:2807-1","UBUNTU-CVE-2019-20433"],"status":"published","title":"libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single ...","description":"libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01739,"percentile":0.77918,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2020-01-27T14:03:26Z","modified":"2026-10-24T10:30:49Z","fixes":[{"ecosystem":"Debian:12","package":"aspell","fixed_in":["0.60.7-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"aspell","fixed_in":["0.60.7-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"aspell","fixed_in":["0.60.7-3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"aspell","fixed_in":["0.60.6.1-29.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"aspell","fixed_in":["0.60.6.1-29.oe1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"aspell","fixed_in":["0.60.6.1-18.8.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"aspell","fixed_in":["0.60.6.1-18.8.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"aspell","fixed_in":["0.60.6.1-18.8.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.7-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.7-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.7-3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-29.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-29.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"php72","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-1.37.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"php72","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-1.37.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"php72","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.5-1.37.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-112.79.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"php53","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.17-112.79.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-18.8.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-18.8.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-18.8.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.60.7~20110707-1build1","0.60.7~20110707-1ubuntu1","0.60.7~20110707-1ubuntu1+esm1","0.60.7~20110707-1ubuntu1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.60.7~20110707-3","0.60.7~20110707-3build1","0.60.7~20110707-3ubuntu0.1","0.60.7~20110707-3ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.60.7~20110707-4","0.60.7~20110707-4ubuntu0.1","0.60.7~20110707-4ubuntu0.2"]}],"products":[{"vendor":"gnu","product":"aspell"}],"references":[{"url":"http://aspell.net/buffer-overread-ucs.txt","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20433","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qcm5-23xv-7r79"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-20433","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1388","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200397-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1161982","tags":["report"]},{"url":"https://bugzilla.suse.com/1162629","tags":["report"]},{"url":"https://bugzilla.suse.com/1162632","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7060","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014289-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1159922","tags":["report"]},{"url":"https://bugzilla.suse.com/1159923","tags":["report"]},{"url":"https://bugzilla.suse.com/1159924","tags":["report"]},{"url":"https://bugzilla.suse.com/1159927","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11050","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202807-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-20433","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20433","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-20433","description":"libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.","status":"published","published":"2020-01-27T14:03:26Z","modified":"2024-08-05T02:39:09.989Z","updated_at":"2026-11-02T14:20:17.431882Z"}],"euvd":[{"id":"EUVD-2019-10981","description":"libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.","status":"published","published":"2020-01-27T14:03:26Z","modified":"2024-08-05T02:39:09Z","updated_at":"2026-11-03T02:40:22.238276Z"}],"ghsa":[{"id":"GHSA-qcm5-23xv-7r79","title":"libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single ...","description":"libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.","status":"published","published":"2022-05-24T17:07:27Z","modified":"2023-01-29T05:01:12Z","updated_at":"2026-11-02T14:44:45.404949Z"}],"nvd":[{"id":"CVE-2019-20433","description":"libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.","status":"published","published":"2020-01-27T15:15:12.15Z","modified":"2026-06-17T02:30:25.78Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:05:43.875329Z"}],"osv":[{"id":"CVE-2019-20433","description":"libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.","status":"published","published":"2020-01-27T15:15:12.15Z","modified":"2026-10-24T10:30:49.358914646Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-20433","description":"libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.","status":"published","published":"2020-01-27T15:15:12.15Z","modified":"2026-09-21T07:03:17.587671771Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"OESA-2021-1388","title":"aspell security update","description":"GNU Aspell is a spell checker intended to replace Ispell. It can be used as a library and spell checker. Its main feature is that it provides much better suggestions than other inspectors, including Ispell and Microsoft Word. It also has many other technical enhancements to Ispell, such as the use of shared memory to store dictionaries, and intelligent processing of personal dictionaries when multiple Aspell processes are opened at one time.\r\n\r\nSecurity Fix(es):\r\n\r\nlibaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single \u0026apos;\\0\u0026apos; byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.(CVE-2019-20433)","status":"published","published":"2021-10-15T11:04:39Z","modified":"2026-08-18T01:16:10.804563624Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2019-20433","description":"libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.","status":"published","published":"2020-01-27T15:15:00Z","modified":"2026-04-22T12:17:23.250689Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"SUSE-SU-2020:0397-1","title":"Security update for php72","description":"This update for php72 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-7059: Fixed an out-of-bounds read in php_strip_tags_ex (bsc#1162629).\n- CVE-2020-7060: Fixed a global buffer-overflow in mbfl_filt_conv_big5_wchar (bsc#1162632).\n- CVE-2019-20433: Fixed a buffer over-read when processing strings ending with a single '\\0' byte with ucs-2 and ucs-4 encoding (bsc#1161982).\n\n\n","status":"published","published":"2020-02-18T13:21:38Z","modified":"2026-02-04T04:17:53.634653Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:14289-1","title":"Security update for php53","description":"This update for php53 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-7059: Fixed an out-of-bounds read in php_strip_tags_ex (bsc#1162629).\n- CVE-2019-11045: Fixed an issue with the PHP DirectoryIterator class that accepts filenames with embedded \\0 bytes (bsc#1159923).\n- CVE-2019-11046: Fixed an out-of-bounds read in bc_shift_addsub (bsc#1159924).\n- CVE-2019-11047: Fixed an information disclosure in exif_read_data (bsc#1159922).\n- CVE-2019-11050: Fixed a buffer over-read in the EXIF extension (bsc#1159927).\n- CVE-2019-20433: Fixed a buffer over-read when processing strings ending with a single '\\0' byte with ucs-2 and ucs-4 encoding (bsc#1161982).\n","status":"published","published":"2020-02-24T11:00:37Z","modified":"2026-02-04T04:16:06.093541Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:2807-1","title":"Security update for aspell","description":"This update for aspell fixes the following security issue:\n\n- CVE-2019-20433: Fixed a buffer over-read when processing strings ending with a single '\\0' byte with ucs-2 and ucs-4 encoding (bsc#1161982).\n","status":"published","published":"2020-09-30T12:36:40Z","modified":"2026-02-04T03:25:38.469717Z","updated_at":"2026-11-02T15:53:48.11786Z"}]}}