CVE-2019-9578 - In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device

HIGH

In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device

Published Mar 5, 2019

7.5

HIGH

CVSS 3.0

EPSS 2.30%

In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device.

No remediation recorded yet.

Weaknesses (1)

CWE-908

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html		vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00018.html		vendor-advisoryx_refsource_SUSE
https://blog.inhq.net/posts/yubico-libu2f-host-vuln-part2/		x_refsource_MISC
https://developers.yubico.com/libu2f-host/Release_Notes.html		x_refsource_MISCRelease NotesVendor Advisory
https://github.com/Yubico/libu2f-host/commit/e4bb58cc8b6202a421e65f8230217d8ae6e16eb5		x_refsource_MISCPatchThird Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMA4H6AZFYIR3LA5VKKEJZNCCIVMUCFQ/		vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S4YCFMSNMXZ7XC4U6WXPQA7JCXC6VOAJ/		vendor-advisoryx_refsource_FEDORA
https://security.gentoo.org/glsa/202004-15		vendor-advisoryx_refsource_GENTOO

No recorded changes yet.

Sources

Status PUBLISHED

Assigner mitre

Published Mar 5, 2019

Updated Aug 4, 2024

Reserved Mar 5, 2019

Updated n/a

Status Modified

Modified Jun 17, 2026

Severity n/a

Public date n/a