CVE-2019-5482: Buffer Overflow
cURL libcurl is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the tftpreceivepacket function. By sending specially-crafted request containing an OACK without the BLKSIZE option, a remote attacker could overflow a buffer and execute arbitrary code on the system.
Other sources
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2019-5482.
What is the title of the vulnerability?
The title of the vulnerability is 'Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.'
What is the severity of CVE-2019-5482?
The severity of CVE-2019-5482 is critical, with a severity value of 9.8.
What is the affected software for this vulnerability?
The affected software includes cURL versions 7.19.4 to 7.65.3, IBM Security Guardium versions up to 11.3, Haxx Curl, and various other products and versions listed in the vulnerability description.
How do I fix CVE-2019-5482?
The recommended fix for CVE-2019-5482 is to update the affected software to the versions specified in the vulnerability description.