VYPR
← All advisories
Medium severity6.7OSV Advisory· Published Dec 3, 2018· Updated Jun 17, 2026

CVE-2018-19792

CVE-2018-19792

Description

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow) or possibly have unspecified other impact by creating a symlink through which the openlitespeed program can be invoked with a long command name (involving ../ characters), which is mishandled in the LshttpdMain::getServerRootFromExecutablePath function.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

8
  • Litespeedtech/OpenlitespeedOSV7 versions
    v1.0.4, v1.3, v1.3.2, …+ 6 more
    • (no CPE)range: v1.0.4, v1.3, v1.3.2, …
    • cpe:2.3:a:litespeedtech:openlitespeed:*:*:*:*:*:*:*:*range: <=1.4.41
    • cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc3:*:*:*:*:*:*
    • cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc4:*:*:*:*:*:*
    • cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc5:*:*:*:*:*:*
  • Open Litespeed/Open Litespeedllm-fuzzy
    Range: <1.5.0 RC6

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.