CVE-2019-5481
Critical
Description
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Haxx Curl
PublishedSep 16, 2019
First seenSep 16, 2019
Weakness typeCWE-415CWE-415
How to fix
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/
- debian.org/security/2020/dsa-4633
- security.gentoo.org/glsa/202003-29
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| haxx curl | 7.52.0 ≤ v ≤ 7.65.3 | — |
| fedoraproject fedora | 29, 30, 31 | — |
| netapp cloud_backup | No range specified | — |
| netapp steelstore | No range specified | — |
| netapp solidfire_baseboard_management_controller_firmware | No range specified | — |
| oracle communications_operations_monitor | 3.4, 4.0, 4.1, 4.2, 4.3 | — |
| oracle communications_session_border_controller | 8.3, 8.4 | — |
| oracle enterprise_manager_ops_center | 12.3.3, 12.4.0 | — |
| oracle mysql_server | 5.7.0 ≤ v ≤ 5.7.28, 8.0.0 ≤ v ≤ 8.0.18 | — |
| oracle oss_support_tools | 20.0 | — |
| debian debian_linux | 9.0, 10.0 | — |
| opensuse leap | 15.0, 15.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.