{"id":"CVE-2019-13105","details":"Das U-Boot versions 2019.07-rc1 through 2019.07-rc4 can double-free a cached block of data when listing files in a crafted ext4 filesystem.","modified":"2026-07-08T20:57:00.183410Z","published":"2019-08-06T20:15:12.050Z","references":[{"type":"ADVISORY","url":"https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75"},{"type":"FIX","url":"https://github.com/u-boot/u-boot/commits/master"},{"type":"FIX","url":"https://lists.denx.de/pipermail/u-boot/2019-July/375513.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/u-boot/u-boot","events":[{"introduced":"a69120a0d7c8d4044cdaceea9eb03913ba4e49c7"},{"last_affected":"fc6c0e29a28f6b71dfb728b7f78e9e770f2cd218"}],"database_specific":{"cpe":["cpe:2.3:a:denx:u-boot:2019.07:rc1:*:*:*:*:*:*","cpe:2.3:a:denx:u-boot:2019.07:rc2:*:*:*:*:*:*","cpe:2.3:a:denx:u-boot:2019.07:rc3:*:*:*:*:*:*","cpe:2.3:a:denx:u-boot:2019.07:rc4:*:*:*:*:*:*"],"extracted_events":[{"introduced":"2019.07-rc1"},{"last_affected":"2019.07-rc1"},{"introduced":"2019.07-rc2"},{"last_affected":"2019.07-rc2"},{"introduced":"2019.07-rc3"},{"last_affected":"2019.07-rc3"},{"introduced":"2019.07-rc4"},{"last_affected":"2019.07-rc4"}],"source":"CPE_STRING"}}],"versions":["2019.07-rc1","2019.07-rc2","2019.07-rc3","2019.07-rc4","v2019.07-rc4","v2019.07-rc3","v2019.07-rc2","v2019.07-rc1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-13105.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}