High
Security advisory
objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-25051
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:35 UTC · Revision 1
Source evidence
objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).
osv:CVE-2019-25051
Complete source record
{
"id": "cb39906fa4706acd470c8291fff589d05e4f36f934a1ce59ced30fc85ac8de54",
"url": "https://osv.dev/vulnerability/CVE-2019-25051",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-25051",
"summary": "objstack in GNU Aspell 0.60.8 has a heap-based buffer overflow in acommon::ObjStack::dup_top (called from acommon::StringMap::add and acommon::Config::lookup_list).",
"evidence": "osv:CVE-2019-25051",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2019-25051",
"aliases": [
"CVE-2019-25051"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/gnuaspell/aspell",
"type": "GIT",
"events": [
{
"introduced": "c96f9b06576cde08300c14f288727c754038fe3f"
},
{
"last_affected": "c96f9b06576cde08300c14f288727c754038fe3f"
},
{
"fixed": "0718b375425aad8e54e1150313b862e4c6fd324a"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:gnu:aspell:0.60.8:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.60.8"
},
{
"last_affected": "0.60.8"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "0718b375425aad8e54e1150313b862e4c6fd324a"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"0.60.8",
"rel-0.60.8"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-25051.json",
"vanir_signatures": [
{
"id": "CVE-2019-25051-12953271",
"digest": {
"threshold": 0.9,
"line_hashes": [
"20741968054567667006840823718416843555",
"48669766990622990348110031277074531386",
"124478308237746286355263336210279774169",
"254171296138168226185731254767453214863",
"153130692224193140312513925859179788942",
"156472988026344010173180164208788218399",
"323763241861885492035366980822390709317",
"149210157173490313495831924725928229579",
"12064939868332011875054441098367037482",
"208546510027406812798791188077004362261",
"300012719372335497388691665153054731688",
"77184948482378228181740127854690497486",
"316060089257361314713213843910858750339",
"95422536966481986374742996418114234753",
"139530028569518203681300622749453340292",
"167931004292016475039514338429632601662",
"241598196685381485387944596351656742172",
"14249314018426004808875882964542643965",
"251432815606490957619682021619273892766",
"280312080848088951382755087602490042658",
"136630194393778155215785802581261531097",
"333361429658487439591629222400279209701",
"265385935685096533683588504798833224273",
"87194131836508631733108062242565292159",
"276704930757797464928980171564658936648",
"217840305157519485693617483665134267671",
"328697697676029868190506994853673465512",
"129392233186770180308298008870256738568",
"41363740877498903553993260101090087717",
"291806133784570566236115968372994891271",
"20923778386564086176919216718681975547",
"163001508768730742241893228893671638437",
"41363740877498903553993260101090087717",
"291806133784570566236115968372994891271",
"20923778386564086176919216718681975547",
"163001508768730742241893228893671638437"
]
},
"source": "https://github.com/gnuaspell/aspell/commit/0718b375425aad8e54e1150313b862e4c6fd324a",
"target": {
"file": "common/objstack.hpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:56:02Z"
}
}
],
"modified": "2026-10-20T13:56:02.140050667Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H7E4EI7F6TVN7K6XWU6HSANMCOKKEREE/",
"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18462",
"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/aspell/OSV-2020-521.yaml",
"https://lists.debian.org/debian-lts-announce/2021/07/msg00021.html",
"https://www.debian.org/security/2021/dsa-4948",
"https://github.com/gnuaspell/aspell/commit/0718b375425aad8e54e1150313b862e4c6fd324a"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
},
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "34"
},
{
"last_affected": "34"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-25051",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388399,
"published_at": "2021-07-20T07:15:07.677+00:00"
}