CVE-2019-25051

Vulnerability

A heap-based buffer overflow exists in the ObjStack::dup_top function of GNU Aspell version 0.60.8, which is called from acommon::StringMap::add and acommon::Config::lookup_list. The overflow occurs because the allocation size is not checked against the remaining chunk space, allowing writes beyond the allocated buffer. The fix adds a check_size method that uses assert to ensure the size fits within a chunk [1]. The vulnerability was discovered through OSS-Fuzz [2].

Exploitation

An attacker can trigger this vulnerability by supplying a specially crafted input to Aspell that causes an overly large allocation request via the affected code paths. No authentication is required if the application processes attacker-controlled data (e.g., a document to spell-check). The bug manifests when the allocation size exceeds the available space in the current chunk, leading to a buffer overflow without any precondition on chunk size [1].

Impact

Successful exploitation results in a heap-based buffer overflow, which can corrupt adjacent memory. This can lead to a denial of service (crash) or potentially arbitrary code execution depending on the heap layout and system mitigations. Specific CIA outcomes are not detailed in the references, but heap overflows are generally exploitable for information disclosure or code execution.

Mitigation

The fix was committed to the Aspell repository in commit 0718b3754 [1]. Distributions such as Fedora released updated packages [3]. Users should upgrade to a patched version of Aspell (beyond 0.60.8) or apply the fix source code manually. There is no known workaround other than avoiding processing untrusted input with the vulnerable version.