CVE-2019-5482

Опубликовано: 16 сент. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Средний

Уязвимость переполнения буфера в куче в TFTP-протоколе в cURL

Описание

В обработчике протокола TFTP в cURL происходит переполнение буфера в куче.

Затронутые версии ПО

cURL 7.19.4 до 7.65.3

Тип уязвимости

Выполнение произвольного кода
Переполнение буфера в куче

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html
Mailing List
Third Party Advisory
https://curl.haxx.se/docs/CVE-2019-5482.html
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/
https://seclists.org/bugtraq/2020/Feb/36
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/202003-29
Third Party Advisory
https://security.netapp.com/advisory/ntap-20191004-0003/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200416-0003/
Third Party Advisory
https://www.debian.org/security/2020/dsa-4633
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.html
Patch
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
Patch
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html
Mailing List
Third Party Advisory
https://curl.haxx.se/docs/CVE-2019-5482.html
Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Версия от 7.19.4 (включая) до 7.65.3 (включая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:windows:*:*

Версия от 7.3 (включая)

cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vmware_vsphere:*:*

Версия от 9.5 (включая)

cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*

cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_operations_monitor:4.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_operations_monitor:4.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_session_border_controller:8.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:hyperion_essbase:11.1.2.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*

Версия от 5.0.0 (включая) до 5.7.28 (включая)

cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*

Версия от 8.0.0 (включая) до 8.0.18 (включая)

cpe:2.3:a:oracle:oss_support_tools:20.0:*:*:*:*:*:*:*

Конфигурация 6

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 93%

0.10791

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-122

CWE-787

Связанные уязвимости

CVE-2019-5482

CVSS3: 9.8

ubuntu

почти 6 лет назад

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

CVE-2019-5482

CVSS3: 6.3

redhat

почти 6 лет назад

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

CVE-2019-5482

CVSS3: 9.8

debian

почти 6 лет назад

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7. ...

SUSE-SU-2019:2339-2

suse-cvrf

почти 6 лет назад

Security update for curl

SUSE-SU-2019:14172-1

suse-cvrf

почти 6 лет назад

Security update for curl

EPSS

Процентиль: 93%

0.10791

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-122

CWE-787