CVE-2019-5481 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 87%

Affected Products (NVD)

Vendor	Product	Version
haxx	curl	7.52.0 ≤ 𝑥 ≤ 7.65.3
netapp	cloud_backup	-
netapp	steelstore	-
netapp	solidfire_baseboard_management_controller_firmware	-
oracle	communications_operations_monitor	3.4
oracle	communications_operations_monitor	4.0
oracle	communications_operations_monitor	4.1
oracle	communications_operations_monitor	4.2
oracle	communications_operations_monitor	4.3
oracle	communications_session_border_controller	8.3
oracle	communications_session_border_controller	8.4
oracle	enterprise_manager_ops_center	12.3.3
oracle	enterprise_manager_ops_center	12.4.0
oracle	mysql_server	5.7.0 ≤ 𝑥 ≤ 5.7.28
oracle	mysql_server	8.0.0 ≤ 𝑥 ≤ 8.0.18
oracle	oss_support_tools	20.0
debian	debian_linux	9.0
debian	debian_linux	10.0
opensuse	leap	15.0
opensuse	leap	15.1

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

curl

bookworm	7.88.1-10+deb12u7 fixed
bookworm (security)	7.88.1-10+deb12u5 fixed
bullseye	7.74.0-1.3+deb11u13 fixed
bullseye (security)	7.74.0-1.3+deb11u11 fixed
jessie	not-affected
sid	8.10.1-2 fixed
trixie	8.10.1-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

curl

bionic	Fixed 7.58.0-2ubuntu3.8 released
disco	Fixed 7.64.0-2ubuntu1.2 released
trusty	not-affected
xenial	not-affected

openSUSE / SLES Releases

openSUSE Product

Release

curl

suse enterprise desktop 15	7.60.0-3.23.1 fixed
suse enterprise desktop 15 SP1	7.60.0-3.23.1 fixed
suse enterprise desktop 15 SP2	7.66.0-2.59 fixed
suse enterprise desktop 15 SP3	7.66.0-4.14.1 fixed
suse enterprise desktop 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise desktop 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise desktop 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise desktop 15 SP7	8.6.0-150600.4.21.1 fixed
suse enterprise sap 12 SP4	7.60.0-4.9.1 fixed
suse enterprise sap 12 SP5	7.60.0-9.8 fixed
suse enterprise sap 15	7.60.0-3.23.1 fixed
suse enterprise sap 15 SP1	7.60.0-3.23.1 fixed
suse enterprise sap 15 SP2	7.66.0-2.59 fixed
suse enterprise sap 15 SP3	7.66.0-4.14.1 fixed
suse enterprise sap 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise sap 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise sap 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise sap 15 SP7	8.6.0-150600.4.21.1 fixed
suse enterprise server 12 SP4	7.60.0-4.9.1 fixed
suse enterprise server 12 SP5	7.60.0-9.8 fixed
suse enterprise server 15	7.60.0-3.23.1 fixed
suse enterprise server 15 SP1	7.60.0-3.23.1 fixed
suse enterprise server 15 SP2	7.66.0-2.59 fixed
suse enterprise server 15 SP3	7.66.0-4.14.1 fixed
suse enterprise server 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise server 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise server 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise server 15 SP7	8.6.0-150600.4.21.1 fixed

libcurl-devel

suse enterprise desktop 15	7.60.0-3.23.1 fixed
suse enterprise desktop 15 SP1	7.60.0-3.23.1 fixed
suse enterprise desktop 15 SP2	7.66.0-2.59 fixed
suse enterprise desktop 15 SP3	7.66.0-4.14.1 fixed
suse enterprise desktop 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise desktop 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise desktop 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise desktop 15 SP7	8.6.0-150600.4.21.1 fixed
suse enterprise sap 15	7.60.0-3.23.1 fixed
suse enterprise sap 15 SP1	7.60.0-3.23.1 fixed
suse enterprise sap 15 SP2	7.66.0-2.59 fixed
suse enterprise sap 15 SP3	7.66.0-4.14.1 fixed
suse enterprise sap 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise sap 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise sap 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise sap 15 SP7	8.6.0-150600.4.21.1 fixed
suse enterprise server 15	7.60.0-3.23.1 fixed
suse enterprise server 15 SP1	7.60.0-3.23.1 fixed
suse enterprise server 15 SP2	7.66.0-2.59 fixed
suse enterprise server 15 SP3	7.66.0-4.14.1 fixed
suse enterprise server 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise server 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise server 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise server 15 SP7	8.6.0-150600.4.21.1 fixed

libcurl4

suse enterprise desktop 15	7.60.0-3.23.1 fixed
suse enterprise desktop 15 SP1	7.60.0-3.23.1 fixed
suse enterprise desktop 15 SP2	7.66.0-2.59 fixed
suse enterprise desktop 15 SP3	7.66.0-4.14.1 fixed
suse enterprise desktop 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise desktop 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise desktop 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise desktop 15 SP7	8.6.0-150600.4.21.1 fixed
suse enterprise sap 12 SP4	7.60.0-4.9.1 fixed
suse enterprise sap 12 SP5	7.60.0-9.8 fixed
suse enterprise sap 15	7.60.0-3.23.1 fixed
suse enterprise sap 15 SP1	7.60.0-3.23.1 fixed
suse enterprise sap 15 SP2	7.66.0-2.59 fixed
suse enterprise sap 15 SP3	7.66.0-4.14.1 fixed
suse enterprise sap 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise sap 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise sap 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise sap 15 SP7	8.6.0-150600.4.21.1 fixed
suse enterprise server 12 SP4	7.60.0-4.9.1 fixed
suse enterprise server 12 SP5	7.60.0-9.8 fixed
suse enterprise server 15	7.60.0-3.23.1 fixed
suse enterprise server 15 SP1	7.60.0-3.23.1 fixed
suse enterprise server 15 SP2	7.66.0-2.59 fixed
suse enterprise server 15 SP3	7.66.0-4.14.1 fixed
suse enterprise server 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise server 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise server 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise server 15 SP7	8.6.0-150600.4.21.1 fixed

libcurl4-32bit

suse enterprise desktop 15	7.60.0-3.23.1 fixed
suse enterprise desktop 15 SP1	7.60.0-3.23.1 fixed
suse enterprise desktop 15 SP2	7.66.0-2.59 fixed
suse enterprise desktop 15 SP3	7.66.0-4.14.1 fixed
suse enterprise desktop 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise desktop 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise desktop 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise desktop 15 SP7	8.6.0-150600.4.21.1 fixed
suse enterprise sap 12 SP4	7.60.0-4.9.1 fixed
suse enterprise sap 12 SP5	7.60.0-9.8 fixed
suse enterprise sap 15	7.60.0-3.23.1 fixed
suse enterprise sap 15 SP1	7.60.0-3.23.1 fixed
suse enterprise sap 15 SP2	7.66.0-2.59 fixed
suse enterprise sap 15 SP3	7.66.0-4.14.1 fixed
suse enterprise sap 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise sap 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise sap 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise sap 15 SP7	8.6.0-150600.4.21.1 fixed
suse enterprise server 12 SP4	7.60.0-4.9.1 fixed
suse enterprise server 12 SP5	7.60.0-9.8 fixed
suse enterprise server 15	7.60.0-3.23.1 fixed
suse enterprise server 15 SP1	7.60.0-3.23.1 fixed
suse enterprise server 15 SP2	7.66.0-2.59 fixed
suse enterprise server 15 SP3	7.66.0-4.14.1 fixed
suse enterprise server 15 SP4	7.79.1-150400.3.1 fixed
suse enterprise server 15 SP5	8.0.1-150400.5.23.1 fixed
suse enterprise server 15 SP6	8.6.0-150600.2.2 fixed
suse enterprise server 15 SP7	8.6.0-150600.4.21.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

curl

RHEL 8

0:7.61.1-12.el8

fixed

libcurl

RHEL 8

0:7.61.1-12.el8

fixed

libcurl-devel

RHEL 8

0:7.61.1-12.el8

fixed

libcurl-minimal

RHEL 8

0:7.61.1-12.el8

fixed

Common Weakness Enumeration

CWE-415 - Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html

https://curl.haxx.se/docs/CVE-2019-5481.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/

https://seclists.org/bugtraq/2020/Feb/36

https://security.gentoo.org/glsa/202003-29

https://security.netapp.com/advisory/ntap-20191004-0003/

https://www.debian.org/security/2020/dsa-4633

https://www.oracle.com/security-alerts/cpuapr2020.html

https://www.oracle.com/security-alerts/cpujan2020.html

https://www.oracle.com/security-alerts/cpuoct2020.html

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html

https://curl.haxx.se/docs/CVE-2019-5481.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/

https://seclists.org/bugtraq/2020/Feb/36

https://security.gentoo.org/glsa/202003-29

https://security.netapp.com/advisory/ntap-20191004-0003/

https://www.debian.org/security/2020/dsa-4633

https://www.oracle.com/security-alerts/cpuapr2020.html

https://www.oracle.com/security-alerts/cpujan2020.html

https://www.oracle.com/security-alerts/cpuoct2020.html