CVE-2019-16225
CriticalSummary
An issue was discovered in py-lmdb 0.97 where mdb_page_touch does not properly set up mc->mc_pg[mc->top] for certain mp_flags values, leading to an invalid write operation. The vulnerability can be triggered by supplying a crafted data.mdb file.
Risk Assessment
An attacker could cause application crashes or potentially gain unauthorized access to data if the application processes malicious data.mdb files.
Recommendation
Update the py-lmdb library to the latest available version that includes a fix for this vulnerability. Avoid processing data.mdb files from untrusted sources.
Original NVD description (English source)
An issue was discovered in py-lmdb 0.97. For certain values of mp_flags, mdb_page_touch does not properly set up mc->mc_pg[mc->top], leading to an invalid write operation. NOTE: this outcome occurs when accessing a data.mdb file supplied by an attacker.