{"id":"CVE-2019-7165","aliases":["DEBIAN-CVE-2019-7165","DLA-1845-1","DSA-4478-1","EUVD-2019-16714","GHSA-p4fr-fcfj-54mh","MGASA-2019-0205","UBUNTU-CVE-2019-7165","USN-5356-1","openSUSE-SU-2019:1905-1","openSUSE-SU-2019:1920-1","openSUSE-SU-2024:10725-1"],"status":"published","title":"A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.","description":"A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03823,"percentile":0.90158,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2019-07-03T17:25:07Z","modified":"2026-09-21T07:03:22Z","fixes":[{"ecosystem":"Debian:12","package":"dosbox","fixed_in":["0.74-3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dosbox","fixed_in":["0.74-3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dosbox","fixed_in":["0.74-3-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"dosbox","fixed_in":["0.74-4.2+deb9u2build0.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"dosbox","fixed_in":["0.74-4.3ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dosbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74-3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dosbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74-3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dosbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74-3-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"dosbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74-4+deb8u1"}]}],"versions":["0.74-4"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"dosbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74-4.2+deb9u2"}]}],"versions":["0.74-4.2","0.74-4.2+deb9u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"dosbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74-2-3+deb10u1"}]}],"versions":["0.74-2-3"],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"dosbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.3-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:7","package":"dosbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.3-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dosbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74-4.2+deb9u2build0.16.04.1"}]}],"versions":["0.74-4.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dosbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74-4.3ubuntu0.1"}]}],"versions":["0.74-4.2build1","0.74-4.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"dosbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74-4.3ubuntu0.1"}]}],"versions":["0.74-4.2build1","0.74-4.3"],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"dosbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.3-bp150.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"dosbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.3-bp150.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"dosbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.3-bp150.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"dosbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.3-bp151.4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dosbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.74.3-5.2"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"dosbox","product":"dosbox"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2019-7165","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.dosbox.com","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/07/msg00004.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYV27Z3QZTDHUZJLW3LDJYO7HBVIMJ5F/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.debian.org/security/2019/dsa-4478","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://seclists.org/bugtraq/2019/Jul/14","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00047.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00053.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7165"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYV27Z3QZTDHUZJLW3LDJYO7HBVIMJ5F"},{"url":"https://github.com/advisories/GHSA-p4fr-fcfj-54mh"},{"url":"https://advisories.mageia.org/MGASA-2019-0205.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25013","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-7165","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5356-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7165","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12594","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NVX4GYW7OLUYCATD3XTOCGFTXKEEAYYP/#NVX4GYW7OLUYCATD3XTOCGFTXKEEAYYP","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1140254","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-7165","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UPDRBLIDO5U3CUPDW6HCUJL2MTXAQWIL/#UPDRBLIDO5U3CUPDW6HCUJL2MTXAQWIL","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-7165","description":"A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.","status":"published","published":"2019-07-03T17:25:07Z","modified":"2024-08-04T20:38:33.425Z","updated_at":"2026-11-02T14:32:22.854093Z"}],"euvd":[{"id":"EUVD-2019-16714","description":"A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.","status":"published","published":"2019-07-03T17:25:07Z","modified":"2024-08-04T20:38:33Z","updated_at":"2026-11-03T03:06:46.960087Z"}],"ghsa":[{"id":"GHSA-p4fr-fcfj-54mh","title":"A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.","description":"A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.","status":"published","published":"2022-05-24T16:49:25Z","modified":"2024-04-04T01:11:02Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:55:55.605227Z"}],"nvd":[{"id":"CVE-2019-7165","description":"A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.","status":"published","published":"2019-07-03T18:15:11.1Z","modified":"2026-06-17T02:40:12.237Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:05:17.695191Z"}],"osv":[{"id":"CVE-2019-7165","description":"A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.","status":"published","published":"2019-07-03T18:15:11.1Z","modified":"2026-04-16T04:30:31.713477397Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"DEBIAN-CVE-2019-7165","description":"A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.","status":"published","published":"2019-07-03T18:15:11.1Z","modified":"2026-09-21T07:03:22.868735406Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"UBUNTU-CVE-2019-7165","description":"A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.","status":"published","published":"2019-07-03T18:15:00Z","modified":"2026-02-04T04:12:40.967878Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:21.741399Z"},{"id":"DLA-1845-1","title":"dosbox - security update","status":"published","published":"2019-07-07T00:00:00Z","modified":"2026-03-09T01:21:44.774732Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4478-1","title":"dosbox - security update","status":"published","published":"2019-07-10T00:00:00Z","modified":"2026-03-09T02:11:36.213583Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2019-0205","title":"Updated dosbox package fixes security vulnerabilities","description":"Dosbox 0.74-3 is a security release:\n* Fixed that a very long line inside a bat file would overflow the\n  parsing buffer. (CVE-2019-7165 by Alexandre Bartel)\n* Added a basic permission system so that a program running inside\n  DOSBox can't access the contents of /proc (e.g. /proc/self/mem) when\n  / or /proc were (to be) mounted. (CVE-2019-12594 by Alexandre Bartel)\n\nIt also brings several other fixes for out of bounds access and buffer\noverflows, and some fixes to the OpenGL rendering.\n\nThe game compatibility should be identical to 0.74 and 0.74-2.\nIt is recommended to use config -securemode when dealing with untrusted\nfiles.\n","status":"published","published":"2019-07-10T10:44:10Z","modified":"2026-04-16T04:42:51.885173483Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1905-1","title":"Security update for dosbox","description":"This update for dosbox fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-7165: Fixed that a very long line inside a bat file would overflow the parsing buffer (bnc#1140254).\n- CVE-2019-12594: Added a basic permission system so that a program running inside DOSBox can't access the contents of /proc (e.g. /proc/self/mem) when / or /proc were (to be) mounted (bnc#1140254).\n- Several other fixes for out of bounds access and buffer overflows.\n","status":"published","published":"2019-08-15T09:42:04Z","modified":"2026-02-04T02:13:32.435087Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1920-1","title":"Security update for dosbox","description":"This update for dosbox fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-7165: Fixed that a very long line inside a bat file would overflow the parsing buffer (bnc#1140254).\n- CVE-2019-12594: Added a basic permission system so that a program running inside DOSBox can't access the contents of /proc (e.g. /proc/self/mem) when / or /proc were (to be) mounted (bnc#1140254).\n- Several other fixes for out of bounds access and buffer overflows.\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-08-15T15:08:40Z","modified":"2026-02-04T04:34:32.702918Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10725-1","title":"dosbox-0.74.3-5.2 on GA media","description":"These are all security issues fixed in the dosbox-0.74.3-5.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:31:10.87249Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-5356-1","title":"dosbox vulnerabilities","description":"Alexandre Bartel discovered that DOSBox incorrectly handled\nlong lines in certain files. An attacker could possibly use\nthis issue to execute arbitrary code. (CVE-2019-7165)\n\nAlexandre Bartel discovered that DOSBox incorrectly performed\naccess control over certain directories. An attacker could\npossibly use this issue to execute arbitrary code.\n(CVE-2019-12594)\n","status":"published","published":"2022-03-30T15:47:44Z","modified":"2026-02-10T04:42:33Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}