CVE-2019-5482CWE-122CWE-787

CVE-2019-5482

Critical · published September 16, 2019

CVSS v3.1
9.8
EPSS
18%
Percentile
97.2
In the wild
Unconfirmed
What it is

🚨 A heap buffer overflow in cURL could spell disaster for versions 7.19.4 to 7.65.3, putting critical operations at risk! 🔥 Think of it as a restaurant where one too many customers are crammed into a tiny kitchen—eventually, it can't handle the pressure, and everything spills over! With this critical vulnerability, an attacker could exploit the overflow to crash services, run harmful code, or even compromise entire systems. The potential for chaos is absolutely devastating, as any process utilizing these cURL versions could be at risk!

Put simply

Think of it as a restaurant where one too many customers are crammed into a tiny kitchen—eventually, it can't handle the pressure, and everything spills over! This vulnerability arises in the TFTP protocol handler of cURL, where an attacker can craft requests that cause the heap to overflow, leading to unpredictable behavior and potential code execution.

What to do

With this critical vulnerability, an attacker could exploit the overflow to crash services, run harmful code, or even compromise entire systems. The potential for chaos is absolutely devastating, as any process utilizing these cURL versions could be at risk! Immediately patch your cURL installation to the latest version beyond 7.65.3. Review your system configurations and ensure that the TFTP handler is not exposed to untrusted sources. It's crucial to stay vigilant and tighten your security measures! You've got this! By following these steps, you're well on your way to securing your systems like a pro! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.17939 · 97.2th percentile
Weaknesses
CWE-122 · Heap-based Buffer Overflow; CWE-787 · Out-of-bounds Write
Published
2019-09-16T23:15Z
Affected products (30)
ProductVersionsFixed in
haxx/curl≥ 7.19.4, ≤ 7.65.3—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
opensuse/leapall versions—
opensuse/leapall versions—
netapp/cloud_backupall versions—
netapp/oncommand_insightall versions—
netapp/oncommand_unified_manager≥ 7.3—
netapp/oncommand_unified_manager≥ 9.5—
netapp/oncommand_workflow_automationall versions—
netapp/snapcenterall versions—
netapp/steelstore_cloud_integrated_storageall versions—
oracle/communications_operations_monitorall versions—
oracle/communications_operations_monitorall versions—
oracle/communications_operations_monitorall versions—
oracle/communications_operations_monitorall versions—
oracle/communications_operations_monitorall versions—
oracle/communications_session_border_controllerall versions—
oracle/communications_session_border_controllerall versions—
oracle/enterprise_manager_ops_centerall versions—
oracle/enterprise_manager_ops_centerall versions—
oracle/http_serverall versions—
oracle/http_serverall versions—
oracle/hyperion_essbaseall versions—
oracle/mysql_server≥ 5.0.0, ≤ 5.7.28—
oracle/mysql_server≥ 8.0.0, ≤ 8.0.18—
oracle/oss_support_toolsall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
References (29)
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html · [email protected]https://curl.haxx.se/docs/CVE-2019-5482.html · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/ · [email protected]https://seclists.org/bugtraq/2020/Feb/36 · [email protected]https://security.gentoo.org/glsa/202003-29 · [email protected]https://security.netapp.com/advisory/ntap-20191004-0003/ · [email protected]https://security.netapp.com/advisory/ntap-20200416-0003/ · [email protected]https://www.debian.org/security/2020/dsa-4633 · [email protected]https://www.oracle.com/security-alerts/cpuapr2020.html · [email protected]https://www.oracle.com/security-alerts/cpujan2020.html · [email protected]https://www.oracle.com/security-alerts/cpuoct2020.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html · af854a3a-2127-422b-91ae-364da2661108https://curl.haxx.se/docs/CVE-2019-5482.html · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/ · af854a3a-2127-422b-91ae-364da2661108https://seclists.org/bugtraq/2020/Feb/36 · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202003-29 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20191004-0003/ · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200416-0003/ · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4633 · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2020.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2020.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2020.html · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 16 SEP 18:06Z
    Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3
    cvelistv5