CVE-2019-5436

Published: May 28, 2019Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

Affected (16)

Products: Haxx: Libcurl · Opensuse: Leap · Fedoraproject: Fedora · +4 more

Show all products

Haxx: Libcurl · Opensuse: Leap · Fedoraproject: Fedora · Debian: Debian Linux · F5: Traffix Signaling Delivery Controller · Netapp: Hci Management Node, Solidfire, Steelstore Cloud Integrated Storage · Oracle: Enterprise Manager Ops Center, Mysql Server, Oss Support Tools

1 product

1 product

1 product

1 product

1 product

Traffix Signaling Delivery Controller

3 products

Hci Management Node

Steelstore Cloud Integrated Storage

3 products

Enterprise Manager Ops Center

Oss Support Tools

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Haxx Libcurl	From 7.19.4 to 7.64.1

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.0
Opensuse Leap	Version 15.1
Opensuse Leap	Version 42.3

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 29

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
F5 Traffix Signaling Delivery Controller	From 5.0.0 to 5.1.0

Configuration F

3 vulnerable

Vulnerable Software	Affected Versions
Netapp Hci Management Node	All versions
Netapp Solidfire	All versions
Netapp Steelstore Cloud Integrated Storage	All versions

Configuration G

5 vulnerable

Vulnerable Software	Affected Versions
Oracle Enterprise Manager Ops Center	Version 12.3.3
Oracle Enterprise Manager Ops Center	Version 12.4.0
Oracle Mysql Server	Up to 5.7.27
Oracle Mysql Server	From 5.7.28 to 8.0.17
Oracle Oss Support Tools	Version 20.0

Related CWEs

Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (28)

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html

Source: support@hackerone.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html

Source: support@hackerone.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2019/09/11/6

Source: support@hackerone.com

Mailing ListPatchThird Party Advisory

https://curl.haxx.se/docs/CVE-2019-5436.html

Source: support@hackerone.com

ExploitPatchVendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/

Source: support@hackerone.com

https://seclists.org/bugtraq/2020/Feb/36

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202003-29

Source: support@hackerone.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20190606-0004/

Source: support@hackerone.com

Third Party Advisory

https://support.f5.com/csp/article/K55133295

Source: support@hackerone.com

Third Party Advisory

https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_medium=RSS

Source: support@hackerone.com

https://www.debian.org/security/2020/dsa-4633

Source: support@hackerone.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: support@hackerone.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: support@hackerone.com

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Source: support@hackerone.com

PatchThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2019/09/11/6

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

https://curl.haxx.se/docs/CVE-2019-5436.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchVendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/

Source: af854a3a-2127-422b-91ae-364da2661108

https://seclists.org/bugtraq/2020/Feb/36

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202003-29

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20190606-0004/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.f5.com/csp/article/K55133295

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_medium=RSS

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.debian.org/security/2020/dsa-4633

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.