Published: 16/09/2019 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

Vulnerable Product	Search on Vulmon	Subscribe to Product
haxx curl
fedoraproject fedora 29
fedoraproject fedora 30
fedoraproject fedora 31
netapp cloud backup -
netapp steelstore -
netapp solidfire_baseboard_management_controller_firmware -
oracle enterprise manager ops center 12.3.3
oracle communications operations monitor 3.4
oracle communications operations monitor 4.0
oracle enterprise manager ops center 12.4.0
oracle oss support tools 20.0
oracle communications operations monitor 4.2
oracle communications operations monitor 4.1
oracle communications operations monitor 4.3
oracle communications session border controller 8.3
oracle communications session border controller 8.4
oracle mysql server
debian debian linux 9.0
debian debian linux 10.0
opensuse leap 15.0
opensuse leap 15.1

Debian Bug report logs - #940009 curl: CVE-2019-5481: FTP-KRB double-free Package: src:curl; Maintainer for src:curl is Alessandro Ghedini <ghedo@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 11 Sep 2019 06:48:02 UTC Severity: important Tags: security, upstream Found in versions curl/ ...

Several security issues were fixed in curl ...

Multiple vulnerabilities were discovered in cURL, an URL transfer library CVE-2019-5436 A heap buffer overflow in the TFTP receiving code was discovered, which could allow DoS or arbitrary code execution This only affects the oldstable distribution (stretch) CVE-2019-5481 Thomas Vegas discovered a double-free in the FTP-KRB code ...

Synopsis Moderate: curl security update Type/Severity Security Advisory: Moderate Topic An update for curl is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gi ...

Synopsis Important: Container-native Virtualization security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Virtualization release 240 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Securi ...

Synopsis Moderate: OpenShift Container Platform 461 image security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat OpenShift Container Platform 46Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability S ...

Double-free vulnerability in the FTP-kerberos code in cURL 7520 to 7653(CVE-2019-5481) Heap buffer overflow in the TFTP protocol handler in cURL 7194 to 7653(CVE-2019-5482) ...

Heap buffer overflow in the TFTP protocol handler in cURL 7194 to 7653 (CVE-2019-5482) Double-free vulnerability in the FTP-kerberos code in cURL 7520 to 7653 (CVE-2019-5481) ...

libcurl can be told to use kerberos over FTP to a server, as set with the CURLOPT_KRBLEVEL option During such kerberos FTP data transfer, the server sends data to curl in blocks with the 32 bit size of each block first and then that amount of data immediately following A malicious or just broken server can claim to send a very large block and if ...

Critical Infrastructure Sectors: Critical Manufacturing

CWE-415 https://curl.haxx.se/docs/CVE-2019-5481.html http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html https://security.netapp.com/advisory/ntap-20191004-0003/https://www.oracle.com/security-alerts/cpujan2020.html https://seclists.org/bugtraq/2020/Feb/36 https://www.debian.org/security/2020/dsa-4633 https://security.gentoo.org/glsa/202003-29 https://www.oracle.com/security-alerts/cpuapr2020.html https://www.oracle.com/security-alerts/cpuoct2020.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=940009 https://usn.ubuntu.com/4129-1/https://nvd.nist.gov https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10

CVE-2019-5481

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

References

Vulmon Search

About

Products

Connect