{"id":"CVE-2019-9578","details":"In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device.","modified":"2026-07-08T20:57:34.670943Z","published":"2019-03-05T23:29:02.943Z","related":["SUSE-SU-2019:1749-1","SUSE-SU-2019:1750-1","SUSE-SU-2021:1755-1","openSUSE-SU-2019:1708-1","openSUSE-SU-2019:1725-1","openSUSE-SU-2021:0799-1","openSUSE-SU-2021:1755-1"],"references":[{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00018.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMA4H6AZFYIR3LA5VKKEJZNCCIVMUCFQ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S4YCFMSNMXZ7XC4U6WXPQA7JCXC6VOAJ/"},{"type":"ADVISORY","url":"https://developers.yubico.com/libu2f-host/Release_Notes.html"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202004-15"},{"type":"FIX","url":"https://github.com/Yubico/libu2f-host/commit/e4bb58cc8b6202a421e65f8230217d8ae6e16eb5"},{"type":"ARTICLE","url":"https://blog.inhq.net/posts/yubico-libu2f-host-vuln-part2/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/yubico/libu2f-host","events":[{"introduced":"0"},{"fixed":"5e1d2dd3310586a0cd603ba6d1c0ae41b0e2d901"},{"fixed":"e4bb58cc8b6202a421e65f8230217d8ae6e16eb5"}],"database_specific":{"cpe":"cpe:2.3:a:yubico:libu2f-host:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.1.8"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["libu2f-host-1.1.6","libu2f-host-1.1.5","libu2f-host-1.1.4","libu2f-host-1.1.3","libu2f-host-1.1.2","libu2f-host-1.1.1","libu2f-host-1.1.0","libu2f-host-1.0.0","libu2f-host-0.0.4","libu2f-host-0.0.3","libu2f-host-0.0.2","libu2f-host-0.0.1","libu2f-host-0.0"],"database_specific":{"vanir_signatures_modified":"2026-07-08T20:57:34Z","vanir_signatures":[{"digest":{"line_hashes":["11567275744523841877518153416187518118","44370850034924077708171989660832381896","188303028343851327688763961351998290166","145078100563149133988154089729284353283","216224806556506021471973488479284945323","78543609262864008034404409691289906146","298195757489697171354479924323044485927","314185290226119270872259819350989570243","24939522874790354133884502489879271461","76490889385848227444144861291301719677","314261858854284419405726470030233727425","148922957106482978517489830381474987071","314370417866445732464821320395808641267","14486720878436553949349358003086576635"],"threshold":0.9},"id":"CVE-2019-9578-240562e0","signature_type":"Line","signature_version":"v1","source":"https://github.com/yubico/libu2f-host/commit/e4bb58cc8b6202a421e65f8230217d8ae6e16eb5","target":{"file":"u2f-host/devs.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/yubico/libu2f-host/commit/e4bb58cc8b6202a421e65f8230217d8ae6e16eb5","target":{"file":"u2f-host/devs.c","function":"init_device"},"deprecated":false,"digest":{"function_hash":"147196423138426783156581629780352000219","length":712},"id":"CVE-2019-9578-c6e7e14f","signature_type":"Function"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9578.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}