CVE-2019-5481

Published: Sep 16, 2019Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

Affected (23)

Products: Haxx: Curl · Fedoraproject: Fedora · Netapp: Cloud Backup, Steelstore, Solidfire Baseboard Management Controller Firmware · +3 more

Show all products

Haxx: Curl · Fedoraproject: Fedora · Netapp: Cloud Backup, Steelstore, Solidfire Baseboard Management Controller Firmware · Oracle: Communications Operations Monitor, Communications Session Border Controller, Enterprise Manager Ops Center, Mysql Server, Oss Support Tools · Debian: Debian Linux · Opensuse: Leap

1 product

1 product

3 products

Solidfire Baseboard Management Controller Firmware

5 products

Communications Operations Monitor

Communications Session Border Controller

Enterprise Manager Ops Center

Oss Support Tools

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Haxx Curl	From 7.52.0 to 7.65.3

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 29
Fedoraproject Fedora	Version 30
Fedoraproject Fedora	Version 31

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Netapp Cloud Backup	All versions
Netapp Steelstore	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Solidfire Baseboard Management Controller Firmware	All versions

Running on/with	Platform Versions
Netapp Solidfire Baseboard Management Controller	All versions

Configuration E

12 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Operations Monitor	Version 3.4
Oracle Communications Operations Monitor	Version 4.0
Oracle Communications Operations Monitor	Version 4.1
Oracle Communications Operations Monitor	Version 4.2
Oracle Communications Operations Monitor	Version 4.3
Oracle Communications Session Border Controller	Version 8.3
Oracle Communications Session Border Controller	Version 8.4
Oracle Enterprise Manager Ops Center	Version 12.3.3
Oracle Enterprise Manager Ops Center	Version 12.4.0
Oracle Mysql Server	From 5.7.0 to 5.7.28
Oracle Mysql Server	From 8.0.0 to 8.0.18
Oracle Oss Support Tools	Version 20.0

Configuration F

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0

Configuration G

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.0
Opensuse Leap	Version 15.1

Related CWEs

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References (26)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html

Source: support@hackerone.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://curl.haxx.se/docs/CVE-2019-5481.html

Source: support@hackerone.com

Vendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/

Source: support@hackerone.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/

Source: support@hackerone.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/

Source: support@hackerone.com

https://seclists.org/bugtraq/2020/Feb/36

Source: support@hackerone.com

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202003-29

Source: support@hackerone.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20191004-0003/

Source: support@hackerone.com

Third Party Advisory

https://www.debian.org/security/2020/dsa-4633

Source: support@hackerone.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2020.html

Source: support@hackerone.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: support@hackerone.com

PatchThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://curl.haxx.se/docs/CVE-2019-5481.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/

Source: af854a3a-2127-422b-91ae-364da2661108

https://seclists.org/bugtraq/2020/Feb/36

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202003-29

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20191004-0003/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2020/dsa-4633

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.