CVE-2019-25656 - Vulnerability Analysis

Overview

R i386 3.5.0 contains a buffer overflow caused by improper input handling in the GUI Preferences dialog's 'Language for menus and messages' field, letting local attackers overwrite SEH records and execute arbitrary code, exploit requires local access.

Severity & Score

Impact

Local attackers can execute arbitrary code with the privileges of the application, potentially leading to full system compromise.

Mitigation

Update to the latest version of R.

References

• https://www.exploit-db.com/exploits/46288
• https://www.r-project.org/
• https://www.vulncheck.com/advisories/r-i386-local-buffer-overflow-seh
• https://cran.r-project.org/bin/windows/base/old/3.5.0/R-3.5.0-win.exe

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner