{"id":"CVE-2019-25051","aliases":["ALPINE-CVE-2019-25051","ALSA-2022:1808","AZL-11363","BELL-CVE-2019-25051","DEBIAN-CVE-2019-25051","DLA-2720-1","DSA-4948-1","EUVD-2019-11500","GHSA-vm7w-rc54-7m7r","MGASA-2021-0388","OESA-2021-1351","OESA-2024-1754","OESA-2024-1755","RHSA-2022:1808","RLSA-2022:1808","SUSE-SU-2021:14783-1","SUSE-SU-2021:2794-1","SUSE-SU-2021:2848-1","UBUNTU-CVE-2019-25051","USN-5023-1","openSUSE-SU-2021:1181-1","openSUSE-SU-2021:2794-1","openSUSE-SU-2024:10635-1"],"status":"published","title":"objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top ...","description":"objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00549,"percentile":0.46295,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2021-07-20T06:46:25Z","modified":"2026-10-29T11:01:17Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"aspell","fixed_in":["0.60.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"aspell","fixed_in":["0.60.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"aspell","fixed_in":["0.60.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"aspell","fixed_in":["0.60.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"aspell","fixed_in":["0.60.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"aspell","fixed_in":["0.60.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"aspell","fixed_in":["0.60.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"aspell","fixed_in":["0.60.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"aspell","fixed_in":["0.60.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"aspell","fixed_in":["0.60.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"aspell","fixed_in":["0.60.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"aspell","fixed_in":["0.60.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"aspell","fixed_in":["0.60.8-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"aspell","fixed_in":["0.60.8-r1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"aspell","fixed_in":["12:0.60.6.1-22.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"aspell-devel","fixed_in":["12:0.60.6.1-22.el8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"aspell","fixed_in":["0.60.8-7"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"aspell","fixed_in":["0.60.8-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"aspell","fixed_in":["0.60.8-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"aspell","fixed_in":["0.60.8-3"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"aspell","fixed_in":["0.60.8-4.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"aspell","fixed_in":["0.60.6.1-28.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"aspell","fixed_in":["0.60.6.1-29.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"aspell","fixed_in":["0.60.6.1-30.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"aspell","fixed_in":["0.60.6.1-30.oe2203sp1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspell","fixed_in":["12:0.60.6.1-22.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspell-debuginfo","fixed_in":["12:0.60.6.1-22.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspell-debugsource","fixed_in":["12:0.60.6.1-22.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"aspell-debuginfo","fixed_in":["12:0.60.6.1-22.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"aspell-debugsource","fixed_in":["12:0.60.6.1-22.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"aspell-devel","fixed_in":["12:0.60.6.1-22.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"aspell","fixed_in":["2:0.60.6.1-22.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"aspell","fixed_in":["0.60.6-26.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"aspell","fixed_in":["0.60.6-26.36.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"aspell","fixed_in":["0.60.8-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"aspell","fixed_in":["0.60.8-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"aspell","fixed_in":["0.60.6.1-18.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"aspell","fixed_in":["0.60.6.1-18.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"aspell","fixed_in":["0.60.6.1-18.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"aspell","fixed_in":["0.60.6.1-18.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"aspell","fixed_in":["0.60.6.1-18.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"aspell","fixed_in":["0.60.6.1-18.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"aspell","fixed_in":["0.60.6.1-18.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"aspell","fixed_in":["0.60.6.1-18.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"aspell","fixed_in":["0.60.6.1-18.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"aspell","fixed_in":["0.60.6.1-18.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"aspell","fixed_in":["0.60.6.1-18.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"aspell","fixed_in":["0.60.6.1-18.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"aspell","fixed_in":["0.60.6.1-18.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"aspell","fixed_in":["0.60.6.1-18.11.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"aspell","fixed_in":["0.60.7~20110707-1ubuntu1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"aspell","fixed_in":["0.60.7~20110707-3ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"aspell","fixed_in":["0.60.7~20110707-4ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"aspell","fixed_in":["0.60.8-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"aspell","fixed_in":["0.60.8-3"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"aspell","fixed_in":["0.60.8-lp152.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"aspell","fixed_in":["0.60.8-3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"aspell","fixed_in":["0.60.8-4.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-r1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12:0.60.6.1-22.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aspell-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12:0.60.6.1-22.el8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-3"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.7~20110707-3+deb9u1"}]}],"versions":["0.60.7~20110707-3"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.7~20110707-6+deb10u1"}]}],"versions":["0.60.7~20110707-6"],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-4.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-28.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-29.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-30.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-30.oe2203sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12:0.60.6.1-22.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspell-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12:0.60.6.1-22.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"aspell-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12:0.60.6.1-22.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"aspell-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12:0.60.6.1-22.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"aspell-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12:0.60.6.1-22.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"aspell-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12:0.60.6.1-22.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:0.60.6.1-22.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6-26.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6-26.36.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-18.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-18.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-18.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-18.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-18.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-18.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-18.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-18.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-18.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-18.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-18.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-18.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-18.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.6.1-18.11.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.7~20110707-1ubuntu1+esm2"}]}],"versions":["0.60.7~20110707-1build1","0.60.7~20110707-1ubuntu1","0.60.7~20110707-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.7~20110707-3ubuntu0.1+esm1"}]}],"versions":["0.60.7~20110707-3","0.60.7~20110707-3build1","0.60.7~20110707-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.7~20110707-4ubuntu0.2"}]}],"versions":["0.60.7~20110707-4","0.60.7~20110707-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-1ubuntu0.1"}]}],"versions":["0.60.7-3","0.60.8-1","0.60.8-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.7~20110707-1ubuntu1+esm2"}]}],"versions":["0.60.7~20110707-1build1","0.60.7~20110707-1ubuntu1","0.60.7~20110707-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.7~20110707-3ubuntu0.1+esm1"}]}],"versions":["0.60.7~20110707-3","0.60.7~20110707-3build1","0.60.7~20110707-3ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.7~20110707-4ubuntu0.2"}]}],"versions":["0.60.7~20110707-4","0.60.7~20110707-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-1ubuntu0.1"}]}],"versions":["0.60.7-3","0.60.8-1","0.60.8-1build1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"aspell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.8-4.2"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnu","product":"aspell"}],"references":[{"url":"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/aspell/OSV-2020-521.yaml","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","article","report"]},{"url":"https://github.com/gnuaspell/aspell/commit/0718b375425aad8e54e1150313b862e4c6fd324a","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","article","report"]},{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18462","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","article","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00021.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H7E4EI7F6TVN7K6XWU6HSANMCOKKEREE/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.debian.org/security/2021/dsa-4948","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25051","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H7E4EI7F6TVN7K6XWU6HSANMCOKKEREE/"},{"url":"https://github.com/advisories/GHSA-vm7w-rc54-7m7r"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-25051","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-1808.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-25051","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-25051","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-25051","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0388.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29294","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5023-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1351","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1754","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1755","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1808","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1984066","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1808.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-25051","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-25051","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2022:1808","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114783-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188576","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25051","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212794-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1177523","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212848-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-25051","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KFDL4ZU73CCA7DXOG7N2VKN4DXLIO7WL/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/52SJCPNULPFJAYMPRPDX7QYNTBFA4SXP/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-25051","description":"objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).","status":"published","published":"2021-07-20T06:46:25Z","modified":"2024-08-05T03:00:19.159Z","updated_at":"2026-11-02T14:20:19.737165Z"}],"euvd":[{"id":"EUVD-2019-11500","description":"objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).","status":"published","published":"2021-07-20T06:46:25Z","modified":"2024-08-05T03:00:19Z","updated_at":"2026-11-03T02:40:19.824838Z"}],"ghsa":[{"id":"GHSA-vm7w-rc54-7m7r","title":"objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top ...","description":"objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).","status":"published","published":"2022-05-24T19:08:29Z","modified":"2023-01-30T05:00:52Z","cwes":["CWE-787"],"updated_at":"2026-11-02T14:46:17.249643Z"}],"nvd":[{"id":"CVE-2019-25051","description":"objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).","status":"published","published":"2021-07-20T07:15:07.677Z","modified":"2026-06-17T02:31:33.477Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:05:48.502374Z"}],"osv":[{"id":"ALPINE-CVE-2019-25051","description":"objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).","status":"published","published":"2021-07-20T07:15:07.677Z","modified":"2026-09-21T06:17:52.512735786Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"AZL-11363","title":"CVE-2019-25051 affecting package aspell for versions less than 0.60.8-7","description":"objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).","status":"published","published":"2021-07-20T07:15:07Z","modified":"2026-04-21T04:22:02.436401Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"BELL-CVE-2019-25051","title":"CVE-2019-25051 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:08.7992Z","modified":"2026-01-26T09:47:36.602504Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-25051","description":"objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).","status":"published","published":"2021-07-20T07:15:07.677Z","modified":"2026-10-20T13:56:02.140050667Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-25051","description":"objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).","status":"published","published":"2021-07-20T07:15:07.677Z","modified":"2026-09-21T07:02:55.857264257Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"OESA-2021-1351","title":"aspell security update","description":"GNU Aspell is a spell checker intended to replace Ispell. It can be used as a library and spell checker. Its main feature is that it provides much better suggestions than other inspectors, including Ispell and Microsoft Word. It also has many other technical enhancements to Ispell, such as the use of shared memory to store dictionaries, and intelligent processing of personal dictionaries when multiple Aspell processes are opened at one time.\r\n\r\nSecurity Fix(es):\r\n\r\nobjstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).(CVE-2019-25051)","status":"published","published":"2021-09-30T11:04:37Z","modified":"2026-08-18T01:15:57.403562802Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"OESA-2024-1754","title":"aspell security update","description":"GNU Aspell is a spell checker intended to replace Ispell. It can be used as a library and spell checker. Its main feature is that it provides much better suggestions than other inspectors, including Ispell and Microsoft Word. It also has many other technical enhancements to Ispell, such as the use of shared memory to store dictionaries, and intelligent processing of personal dictionaries when multiple Aspell processes are opened at one time.\r\n\r\nSecurity Fix(es):\r\n\r\nobjstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).(CVE-2019-25051)","status":"published","published":"2024-06-28T11:07:13Z","modified":"2026-08-18T01:17:24.479137316Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1755","title":"aspell security update","description":"GNU Aspell is a spell checker intended to replace Ispell. It can be used as a library and spell checker. Its main feature is that it provides much better suggestions than other inspectors, including Ispell and Microsoft Word. It also has many other technical enhancements to Ispell, such as the use of shared memory to store dictionaries, and intelligent processing of personal dictionaries when multiple Aspell processes are opened at one time.\r\n\r\nSecurity Fix(es):\r\n\r\nobjstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).(CVE-2019-25051)","status":"published","published":"2024-06-28T11:07:13Z","modified":"2026-08-18T01:17:25.261386484Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2022:1808","title":"Red Hat Security Advisory: aspell security update","status":"published","published":"2024-09-16T06:40:27Z","modified":"2026-06-26T12:22:10.112701096Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:1808","title":"Moderate: aspell security update","description":"GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker.\n\nSecurity Fix(es):\n\n* aspell: Heap-buffer-overflow in acommon::ObjStack::dup_top (CVE-2019-25051)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.","status":"published","published":"2022-05-10T08:02:17Z","modified":"2026-02-05T11:30:02.893596Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2019-25051","description":"objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).","status":"published","published":"2021-07-20T07:15:00Z","modified":"2026-04-22T12:18:05.369446Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"ALSA-2022:1808","title":"Moderate: aspell security update","description":"GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker.\n\nSecurity Fix(es):\n\n* aspell: Heap-buffer-overflow in acommon::ObjStack::dup_top (CVE-2019-25051)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-05-10T08:02:17Z","modified":"2026-10-29T11:01:17.032839814Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-2720-1","title":"aspell - security update","status":"published","published":"2021-07-26T00:00:00Z","modified":"2026-03-09T01:23:17.168132Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4948-1","title":"aspell - security update","status":"published","published":"2021-08-01T00:00:00Z","modified":"2026-03-09T02:11:29.767344Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0388","title":"Updated aspell packages fix security vulnerability","description":"objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in\nacommon::ObjStack::dup_top (called from acommon::StringMap::add and\nacommon::Config::lookup_list) (CVE-2019-25051).\n","status":"published","published":"2021-07-28T20:00:51Z","modified":"2026-04-16T04:41:46.622513596Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:1181-1","title":"Security update for aspell","description":"This update for aspell fixes the following issues:\n\n- CVE-2019-25051: Fixed heap-buffer-overflow in acommon:ObjStack:dup_top (bsc#1188576).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-08-23T10:23:07Z","modified":"2026-02-04T04:32:51.415772Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:2794-1","title":"Security update for aspell","description":"This update for aspell fixes the following issues:\n\n- CVE-2019-25051: Fixed heap-buffer-overflow in acommon:ObjStack:dup_top (bsc#1188576).\n","status":"published","published":"2021-08-20T08:25:54Z","modified":"2026-02-04T03:02:37.933037Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:10635-1","title":"aspell-0.60.8-4.2 on GA media","description":"These are all security issues fixed in the aspell-0.60.8-4.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:48:17.042783Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:14783-1","title":"Security update for aspell","description":"This update for aspell fixes the following issues:\n\n- CVE-2019-25051: Fixed heap-buffer-overflow in acommon:ObjStack:dup_top (bsc#1188576).\n","status":"published","published":"2021-08-12T12:24:35Z","modified":"2026-02-04T03:55:25.77907Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2794-1","title":"Security update for aspell","description":"This update for aspell fixes the following issues:\n\n- CVE-2019-25051: Fixed heap-buffer-overflow in acommon:ObjStack:dup_top (bsc#1188576).\n","status":"published","published":"2021-08-20T08:25:48Z","modified":"2026-02-04T03:19:18.730856Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2848-1","title":"Security update for aspell","description":"This update for aspell fixes the following issues:\n\n- CVE-2019-25051: Fixed heap-buffer-overflow in acommon:ObjStack:dup_top (bsc#1188576).\n","status":"published","published":"2021-08-25T15:22:54Z","modified":"2026-02-04T04:30:38.534237Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"USN-5023-1","title":"aspell vulnerability","description":"It was discovered that Aspell incorrectly handled certain inputs.\nAn attacker could possibly use this issue to execute arbitrary code or\ncause a crash.\n","status":"published","published":"2021-07-26T15:05:48Z","modified":"2026-06-29T13:49:26.965362505Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}