The vulnerability of the tftp_receive_packet() function in the libcurl library, related to the issue of outputting operations beyond the buffer in memory, allows a attacker to cause a service failure or execute arbitrary code.

🗓️ 29 Oct 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

The vulnerability in libcurl tftp_receive_packet allows a buffer overread, risking service failure or arbitrary code execution.

Reporter	Title	Published	Views	Family All 239
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Curl affect PowerSC (CVE-2019-5435, CVE-2019-5436)	20 Dec 201908:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	13 Aug 202122:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Flex System switch firmware products are affected by a vulnerability in libcurl (CVE-2019-5436)	7 Dec 202322:45	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in libcurl affects the OS image for RedHat Enterprise Linux for IBM Cloud Pak System (CVE-2019-5436)	11 Sep 202012:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by a vulnerability in libcurl (CVE-2019-5436)	11 Mar 202119:35	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in libCurl affects IBM Watson Studio Local	20 Dec 201913:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM RackSwitch firmware products are affected by a vulnerability in libcurl (CVE-2019-5436)	7 Dec 202322:45	–	ibm
IBM Security Bulletins	Security Bulletin: WebSphere Cast Iron and App Connect Professional are affected by vulnerabilities in Pacemaker, ImageMagick, gd-libgd, libxslt, cURL libcurl , Ghostscript.	21 Feb 202204:39	–	ibm
Tenable Nessus	Amazon Linux 2 : curl (ALAS-2019-1233)	24 Jul 201900:00	–	nessus
Tenable Nessus	Amazon Linux AMI : curl (ALAS-2019-1233)	26 Jul 201900:00	–	nessus

Vulners

Node

oracle enterprise_manager_ops_centerMatch12.3.3

OR

novell suse_enterprise_storageMatch4

OR

novell suse_openstack_cloudMatch7

OR

novell suse_linux_enterprise_module_for_open_buildservice_development_toolsMatch15

OR

daniel_stenberg libcurlRange7.19.4–7.64.1

OR

novell suse_linux_enterprise_module_for_basesystemMatch15

OR

novell suse_caas_platformMatch3.0

OR

oracle enterprise_manager_ops_centerMatch12.4.0

OR

novell openstack_cloud_magnum_orchestrationMatch7

OR

oracle mysql_serverRange≤5.7.27

OR

oracle mysql_serverRange<8.0.17

OR

oracle mysql_serverRange≤8.0.17

OR

novell opensuse_leapMatch42.3

OR

fedora fedoraMatch29

OR

novell opensuse_leapMatch15.0

OR

novell suse_linux_enterprise_serverMatch12-ltss

OR

novell suse_linux_enterprise_server_for_sap_applicationsMatch12-ltss

OR

novell opensuse_leapMatch15.1

OR

novell suse_linux_enterprise_serverMatch11-security

OR

novell suse_linux_enterprise_server_for_sap_applicationsMatch11-security

Source	Link
oracle	www.oracle.com/technetwork/topics/security/public-vuln-to-advisory-mapping-093627.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-5436
curl	www.curl.haxx.se/docs/CVE-2019-5436.html
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/
suse	www.suse.com/security/cve/CVE-2019-5436/
wiki	www.wiki.astralinux.ru/astra-linux-se15-bulletin-20201201SE15
strelets	www.strelets.net/patchi-i-obnovleniya-bezopasnosti
strelets	www.strelets.net/patchi-i-obnovleniya-bezopasnosti
web	www.web.nvd.nist.gov/view/vuln/detail

21 Nov 2023 00:00Current

6.2Medium risk

Vulners AI Score6.2

CVSS 24.6

CVSS 37.8

EPSS0.49739

tftp receive packet libcurl vulnerability buffer overread service failure arbitrary code execution memory buffer