CVE-2019-5436

Description

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

CVSS breakdown

Affected products

• curl / curlFixed in 7.65.0 – Fixed in 7.65.0
• Debian / debian_linux9.0 – 9.0
• Debian / debian_linux10.0 – 10.0
• F5 / traffix_signaling_delivery_controller5.0.0 – 5.1.0
• fedoraproject / fedora29 – 29
• haxx / libcurl7.19.4 – 7.64.1
• NetApp / hci_management_node
• NetApp / solidfire
• NetApp / steelstore_cloud_integrated_storage
• openSUSE / Leap42.3 – 42.3
• openSUSE / Leap15.1 – 15.1
• openSUSE / Leap15.0 – 15.0
• oracle / enterprise_manager_ops_center12.3.3 – 12.3.3
• oracle / enterprise_manager_ops_center12.4.0 – 12.4.0
• oracle / mysql_server5.7.27
• oracle / oss_support_tools20.0 – 20.0

References

• MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html
• MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/
• MAILING_LISThttp://www.openwall.com/lists/oss-security/2019/09/11/6
• VENDOR_ADVISORYhttps://www.debian.org/security/2020/dsa-4633
• MAILING_LISThttps://seclists.org/bugtraq/2020/Feb/36
• MISChttps://security.gentoo.org/glsa/202003-29
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2020.html
• VENDOR_ADVISORYhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2020.html
• MISChttps://security.netapp.com/advisory/ntap-20190606-0004/
• MISChttps://curl.haxx.se/docs/CVE-2019-5436.html
• MISChttps://support.f5.com/csp/article/K55133295
• MISChttps://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_medium=RSS