CVE-2019-19725

A double-free vulnerability was found in sysstat in the way the sadf command processes the contents of data files created by the sar command. Saved binary data files with support for extra_desc structures may be vulnerable to this flaw. A remote attacker could exploit this flaw by creating a specially crafted file with malformed data that, when loaded by a victim, would cause the application to potentially execute arbitrary code.

This flaw does not affect the versions of sysstat as shipped with Red Hat Enterprise Linux 5, 6, 7, and 8 as they do not include support for extra_desc structures in binary data files created by the sar command. Consequently, they do not include the vulnerable code leading to the double free vulnerability either.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.