CVE-2019-16091

Vulnerability

An out-of-bounds read vulnerability exists in the directblockRead function in hdf/fractalhead.c of Symonics libmysofa version 0.7 [1]. The flaw arises when processing crafted SOFA files, allowing an attacker to read beyond allocated memory boundaries.

Exploitation

An attacker can exploit this vulnerability by supplying a specially crafted SOFA file to libmysofa. No authentication or special network access is required; the attack is triggered when the library processes the malicious file [1].

Impact

Successful exploitation can cause a denial of service (crash) or lead to other unspecified impacts, such as information disclosure [1]. The exact potential impact is not fully detailed but is considered a security risk.

Mitigation

The vulnerability is fixed in later versions of libmysofa. Ubuntu released a security update (USN-4473-1) covering this and related CVEs [1]. Users should update to the patched version. The fix is also available in the GitHub repository [2].