CVE-2019-5436
28.05.2019, 19:29
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| haxx | libcurl | 7.19.4 ≤ 𝑥 ≤ 7.64.1 |
| opensuse | leap | 15.0 |
| opensuse | leap | 15.1 |
| opensuse | leap | 42.3 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| f5 | traffix_signaling_delivery_controller | 5.0.0 ≤ 𝑥 ≤ 5.1.0 |
| netapp | hci_management_node | - |
| netapp | solidfire | - |
| netapp | steelstore_cloud_integrated_storage | - |
| oracle | enterprise_manager_ops_center | 12.3.3 |
| oracle | enterprise_manager_ops_center | 12.4.0 |
| oracle | mysql_server | 𝑥 ≤ 5.7.27 |
| oracle | mysql_server | 5.7.28 ≤ 𝑥 ≤ 8.0.17 |
| oracle | oss_support_tools | 20.0 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| curl | curl | 𝑥 ≤ 7.65.0 | CNA |
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| curl |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| libcurl-devel |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| libcurl4 |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| libcurl4-32bit |
|
Red Hat Enterprise Linux Releases
Common Weakness Enumeration
- CWE-122 - Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
- CWE-787 - Out-of-bounds WriteThe software writes data past the end, or before the beginning, of the intended buffer.
References