CVE-2019-17545: gdal (PyPI) – CVSS 9.8 · Watchpost

← All vulnerabilities

CVE-2019-17545

CRITICAL 9.8CVE-2019-17545 · PYSEC-2019-241 · Published 14/10/2019 · updated 17/06/2026

In short

CVE-2019-17545 is a CRITICAL (CVSS 9.8) vulnerability affecting gdal, backports sle (opensuse), spatial and graph (oracle).
Chance of exploitation in the next 30 days (EPSS): 2.6%, higher than 85.2% of all vulnerabilities.
Fix: update to 3.0.2 or later.

Package	Affected versions	Patched versions
gdal PyPI	`< 3.0.2`	`3.0.2`
backports sle opensuse	`= 15.0`	No fix yet
spatial and graph oracle	`= 12.2.0.1= 19c`	No fix yet
gdal osgeo	`≤ 3.0.1`	No fix yet

Description

GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.

NVD description

GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.

References

OSGeo/gdal commit 148115f · FIX
bugs.chromium.org/p/oss-fuzz/issues/detail · WEB
lists.debian.org/debian-lts-announce/2019/11/msg00005.html · WEB
lists.opensuse.org/opensuse-security-announce/2019-11/msg00022.html · WEB
oracle.com//security-alerts/cpujul2021.html · WEB
lists.debian.org/debian-lts-announce/2022/01/msg00004.html · WEB
lists.debian.org/debian-lts-announce/2022/09/msg00040.html · WEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVRC3EBQBFBVQC26XJE3AI3KQXC2NGTP · WEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CB7RRPCQP253XA5MYUOLHLRPKNGKVZNT · WEB

More vulnerabilities in gdal

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free