CVE-2019-17545
Fixed in a distro release EPSS 3%
GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.
Products: osgeo gdal, oracle spatial_and_graph, debian_linux, fedoraproject fedora, opensuse backports_sle, opensuse leap
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | gdal | 148115fcc40f1651a5d15fa34c9a8c528e7147bb |
| PyPI | gdal | 3.0.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | gdal | 2.4.0+dfsg-1+deb10u1 |
| Debian 12 | gdal | 2.4.2+dfsg-2 |
| Debian 13 | gdal | 2.4.2+dfsg-2 |
| Debian 14 | gdal | 2.4.2+dfsg-2 |
| Debian 8 | gdal | 1.10.1+dfsg-8+deb8u1 |
| Debian 9 | gdal | 2.1.2+dfsg-5+deb9u1 |
| SUSE Package Hub 15 SP1 | gdal | 2.4.3-bp151.4.3.1 |
| Ubuntu Pro 14.04 LTS | gdal | 1.10.1+dfsg-5ubuntu1+esm1 |
| Ubuntu Pro 16.04 LTS | gdal | no fix |
| Ubuntu Pro 18.04 LTS | gdal | no fix |
| openSUSE Leap 15.1 | gdal | 2.4.3-bp151.4.3.1 |