CVE catalog

CVE-2019-1010060

cfitsio: CVE-2019-1010060

Severity: Medium
Published: Jul 16, 2019, 1:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 7.17% · Oct 22, 2026

NASA CFITSIO prior to 3.43 is affected by: Buffer Overflow. The impact is: arbitrary code execution. The component is: over 40 source code files were changed. The attack vector is: remote unauthenticated attacker. The fixed version is: 3.43. NOTE: this CVE refers to the issues not covered by CVE-2018-3846, CVE-2018-3847, CVE-2018-3848, and CVE-2018-3849. One example is ftp_status in drvrnet.c mishandling a long string beginning with a '4' character.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	cfitsio	sid	`4.7.0-2`	fixed
Debian	cfitsio	forky	`4.7.0-2`	fixed
Debian	cfitsio	trixie	`4.6.2-2`	fixed
Debian	cfitsio	bookworm	`4.2.0-3`	fixed
Ubuntu	cfitsio	16.04	`3.370-5`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	cfitsio	source	sid	`3.430-1`	low	Not reported	[892458]
Debian	cfitsio	source	forky	`3.430-1`	low	Not reported	[892458]
Debian	cfitsio	source	trixie	`3.430-1`	low	Not reported	[892458]
Debian	cfitsio	source	bookworm	`3.430-1`	low	Not reported	[892458]

[Debian bug #892458]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libcfitsio10]Fixed
Source package: [cfitsio]
Details (2)
- 4.2.0-3 · amd64 · bookworm
  Fixed · Fixed: 3.430-1
  dsa · cfitsio · debian · bookworm; dsa · cfitsio · debian · 12
- 4.2.0-3 · arm64 · bookworm
  Fixed · Fixed: 3.430-1
  dsa · cfitsio · debian · bookworm; dsa · cfitsio · debian · 12
[libcfitsio-bin]Fixed
Source package: [cfitsio]
Details (2)
- 4.2.0-3 · amd64 · bookworm
  Fixed · Fixed: 3.430-1
  dsa · cfitsio · debian · bookworm; dsa · cfitsio · debian · 12
- 4.2.0-3 · arm64 · bookworm
  Fixed · Fixed: 3.430-1
  dsa · cfitsio · debian · bookworm; dsa · cfitsio · debian · 12
[libcfitsio-dev]Fixed
Source package: [cfitsio]
Details (2)
- 4.2.0-3 · amd64 · bookworm
  Fixed · Fixed: 3.430-1
  dsa · cfitsio · debian · bookworm; dsa · cfitsio · debian · 12
- 4.2.0-3 · arm64 · bookworm
  Fixed · Fixed: 3.430-1
  dsa · cfitsio · debian · bookworm; dsa · cfitsio · debian · 12
[libcfitsio-doc]Fixed
Source package: [cfitsio]
Details (2)
- 4.2.0-3 · all · bookworm
  Fixed · Fixed: 3.430-1
  dsa · cfitsio · debian · bookworm; dsa · cfitsio · debian · 12
- 4.2.0-3 · all · bookworm
  Fixed · Fixed: 3.430-1
  dsa · cfitsio · debian · bookworm; dsa · cfitsio · debian · 12

[Debian 13 (Trixie)]

[fitsverify]Fixed
Source package: [cfitsio]
Details (2)
- 4.22+cfitsio4.6.2-2 · all · trixie
  Fixed · Fixed: 3.430-1
  dsa · cfitsio · debian · 13
- 4.22+cfitsio4.6.2-2 · all · trixie
  Fixed · Fixed: 3.430-1
  dsa · cfitsio · debian · 13
[libcfitsio10t64]Fixed
Source package: [cfitsio]
Details (2)
- 4.6.2-2 · amd64 · trixie
  Fixed · Fixed: 3.430-1
  dsa · cfitsio · debian · 13
- 4.6.2-2 · arm64 · trixie
  Fixed · Fixed: 3.430-1
  dsa · cfitsio · debian · 13
[libcfitsio-bin]Fixed
Source package: [cfitsio]
Details (2)
- 4.6.2-2 · amd64 · trixie
  Fixed · Fixed: 3.430-1
  dsa · cfitsio · debian · 13
- 4.6.2-2 · arm64 · trixie
  Fixed · Fixed: 3.430-1
  dsa · cfitsio · debian · 13
[libcfitsio-dev]Fixed
Source package: [cfitsio]
Details (2)
- 4.6.2-2 · amd64 · trixie
  Fixed · Fixed: 3.430-1
  dsa · cfitsio · debian · 13
- 4.6.2-2 · arm64 · trixie
  Fixed · Fixed: 3.430-1
  dsa · cfitsio · debian · 13
[libcfitsio-doc]Fixed
Source package: [cfitsio]
Details (2)
- 4.6.2-2 · all · trixie
  Fixed · Fixed: 3.430-1
  dsa · cfitsio · debian · 13
- 4.6.2-2 · all · trixie
  Fixed · Fixed: 3.430-1
  dsa · cfitsio · debian · 13

Observed: Oct 23, 2026, 5:38:17 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]