CVE-2019-5436

high-risk

Published 2019-05-28

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

Do I need to act?

13.3% chance of exploitation in next 30 days

EPSS score — higher than 87% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.8/10 High

LOCAL / LOW complexity

Affected Products (15)

Libcurl

Leap

Fedora

Debian Linux

Traffix Signaling Delivery Controller

Hci Management Node

Solidfire

Steelstore Cloud Integrated Storage

Enterprise Manager Ops Center

Mysql Server

Oss Support Tools

Affected Vendors

Debian Oracle F5 Haxx Fedoraproject Netapp Opensuse

References (28)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html

Mailing List http://www.openwall.com/lists/oss-security/2019/09/11/6

Exploit https://curl.haxx.se/docs/CVE-2019-5436.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Mailing List https://seclists.org/bugtraq/2020/Feb/36

Third Party Advisory https://security.gentoo.org/glsa/202003-29

Third Party Advisory https://security.netapp.com/advisory/ntap-20190606-0004/

Third Party Advisory https://support.f5.com/csp/article/K55133295

https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_medi...

Third Party Advisory https://www.debian.org/security/2020/dsa-4633

Third Party Advisory https://www.oracle.com/security-alerts/cpuapr2020.html

https://www.oracle.com/security-alerts/cpuoct2020.html

Patch https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html

Mailing List http://www.openwall.com/lists/oss-security/2019/09/11/6

Exploit https://curl.haxx.se/docs/CVE-2019-5436.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Mailing List https://seclists.org/bugtraq/2020/Feb/36

and 8 more references

/ 100

high-risk

Severity 24/34 · High

Exploitability 12/34 · Low

Exposure 18/34 · Moderate