CVE-2019-20006

Name	CVE-2019-20006
Description	An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_char_content puts a pointer to the internal address of a larger block as xml->txt. This is later deallocated (using free), leading to a segmentation fault.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	989360, 989361, 989363, 989364

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mapcache (PTS)	jessie	1.2.1-2	vulnerable
	stretch	1.4.1-3	vulnerable
	buster	1.6.1-3	vulnerable
	bullseye	1.10.0-2	vulnerable
	bookworm	1.14.0-1	vulnerable
	sid, trixie	1.14.1-1	vulnerable
netcdf (PTS)	jessie	1:4.1.3-7.2	fixed
	stretch	1:4.4.1.1-2	fixed
	buster	1:4.6.2-1	vulnerable
	bullseye	1:4.7.4-1	vulnerable
	bookworm	1:4.9.0-3	fixed
	sid, trixie	1:4.9.2-7	fixed
netcdf-parallel (PTS)	buster	1:4.6.2-1	vulnerable
	bullseye	1:4.7.4-1	vulnerable
	bookworm	1:4.9.0-1	fixed
	trixie	1:4.9.0-5	fixed
	sid	1:4.9.0-6	fixed
scilab (PTS)	jessie	5.5.1-7	vulnerable
	stretch (security), stretch (lts), stretch	5.5.2-4+deb9u1	vulnerable
	buster	6.0.1-10+deb10u1	vulnerable
	bullseye	6.1.0+dfsg1-7	vulnerable
	bookworm	6.1.1+dfsg2-6	vulnerable
	sid, trixie	2024.1.0+dfsg-6	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
mapcache	source	(unstable)	(unfixed)	unimportant	989363
netcdf	source	jessie	(not affected)
netcdf	source	stretch	(not affected)
netcdf	source	(unstable)	1:4.9.0-1		989360
netcdf-parallel	source	(unstable)	1:4.9.0-1		989361
scilab	source	(unstable)	(unfixed)	unimportant	989364

Notes

[bullseye] - netcdf <ignored> (Minor issue)
[buster] - netcdf <ignored> (Minor issue)
[stretch] - netcdf <not-affected> (vulnerable code not present)
[bullseye] - netcdf-parallel <ignored> (Minor issue)
[buster] - netcdf-parallel <ignored> (Minor issue)
https://sourceforge.net/p/ezxml/bugs/15/
mapcache only uses ezxml to parse config files which are trusted
[jessie] - netcdf <not-affected> (vulnerable code introduced later)