CVE-2019-5436
Fixed in a distro release EPSS 50%CVSS 7.8
A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.
Products: curl, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | curl | 7.65.0-r0 |
| Alpine 3.11 | curl | 7.65.0-r0 |
| Alpine 3.12 | curl | 7.65.0-r0 |
| Alpine 3.13 | curl | 7.65.0-r0 |
| Alpine 3.14 | curl | 7.65.0-r0 |
| Alpine 3.15 | curl | 7.65.0-r0 |
| Alpine 3.16 | curl | 7.65.0-r0 |
| Alpine 3.17 | curl | 7.65.0-r0 |
| Alpine 3.18 | curl | 7.65.0-r0 |
| Alpine 3.19 | curl | 7.65.0-r0 |
| Alpine 3.20 | curl | 7.65.0-r0 |
| Alpine 3.21 | curl | 7.65.0-r0 |
| Alpine 3.22 | curl | 7.65.0-r0 |
| Alpine 3.23 | curl | 7.65.0-r0 |
| Alpine 3.24 | curl | 7.65.0-r0 |
| Alpine 3.9 | curl | 7.64.0-r2 |
| Arch Linux | curl | 7.65.0-1 |
| Arch Linux | lib32-curl | 7.65.0-1 |
| Arch Linux | lib32-libcurl-compat | 7.65.0-1 |
| Arch Linux | lib32-libcurl-gnutls | 7.65.0-1 |
| Arch Linux | libcurl-compat | 7.65.0-1 |
| Arch Linux | libcurl-gnutls | 7.65.0-1 |
| Debian 12 | curl | 7.64.0-4 |
| Debian 13 | curl | 7.64.0-4 |
| Debian 14 | curl | 7.64.0-4 |
| Debian 8 | curl | 7.38.0-4+deb8u15 |
| Red Hat Enterprise Linux 7 | curl | 0:7.29.0-57.el7 |
| Red Hat Enterprise Linux 7 | curl-debuginfo | 0:7.29.0-57.el7 |
| Red Hat Enterprise Linux 7 | libcurl | 0:7.29.0-57.el7 |
| Red Hat Enterprise Linux 7 | libcurl-devel | 0:7.29.0-57.el7 |
| Red Hat Enterprise Linux 8 | curl | 0:7.61.1-12.el8 |
| Red Hat Enterprise Linux 8 | curl-debuginfo | 0:7.61.1-12.el8 |
| Red Hat Enterprise Linux 8 | curl-debugsource | 0:7.61.1-12.el8 |
| Red Hat Enterprise Linux 8 | curl-minimal-debuginfo | 0:7.61.1-12.el8 |
| Red Hat Enterprise Linux 8 | libcurl | 0:7.61.1-12.el8 |
| Red Hat Enterprise Linux 8 | libcurl-debuginfo | 0:7.61.1-12.el8 |
| Red Hat Enterprise Linux 8 | libcurl-devel | 0:7.61.1-12.el8 |
| Red Hat Enterprise Linux 8 | libcurl-minimal | 0:7.61.1-12.el8 |
| Red Hat Enterprise Linux 8 | libcurl-minimal-debuginfo | 0:7.61.1-12.el8 |
| Red Hat rhel eus 7.7 | curl | 0:7.29.0-54.el7_7.3 |
| Red Hat rhel eus 7.7 | curl-debuginfo | 0:7.29.0-54.el7_7.3 |
| Red Hat rhel eus 7.7 | libcurl | 0:7.29.0-54.el7_7.3 |
| Red Hat rhel eus 7.7 | libcurl-devel | 0:7.29.0-54.el7_7.3 |
| SUSE Enterprise Storage 4 | curl | 7.37.0-37.40.1 |
| SUSE Linux Enterprise Desktop 12 SP3 | curl | 7.37.0-37.40.1 |
| SUSE Linux Enterprise Desktop 12 SP4 | curl | 7.60.0-4.6.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | curl | 7.60.0-3.20.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | curl | 7.60.0-3.20.1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | curl | 7.37.0-70.41.2 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | curl | 7.37.0-70.41.2 |
| SUSE Linux Enterprise Server 11-SECURITY | curl-openssl1 | 7.37.0-70.41.2 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | curl | 7.37.0-37.40.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | curl | 7.37.0-37.40.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | curl | 7.37.0-37.40.1 |
| SUSE Linux Enterprise Server 12 SP3 | curl | 7.37.0-37.40.1 |
| SUSE Linux Enterprise Server 12 SP4 | curl | 7.60.0-4.6.1 |
| SUSE Linux Enterprise Server 12-LTSS | curl | 7.37.0-37.40.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | curl | 7.37.0-37.40.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | curl | 7.37.0-37.40.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | curl | 7.37.0-37.40.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | curl | 7.60.0-4.6.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | curl | 7.37.0-37.40.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | curl | 7.60.0-4.6.1 |
| SUSE OpenStack Cloud 7 | curl | 7.37.0-37.40.1 |
| Ubuntu 16.04 LTS | curl | 7.47.0-1ubuntu2.13 |
| Ubuntu 18.04 LTS | curl | 7.58.0-2ubuntu3.7 |
| Ubuntu Pro 14.04 LTS | curl | 7.35.0-1ubuntu2.20+esm2 |
| openSUSE Leap 15.0 | curl | 7.60.0-lp151.5.3.1 |
| openSUSE Leap 15.0 | curl-mini | 7.60.0-lp151.5.3.1 |
| openSUSE Leap 15.1 | curl | 7.60.0-lp151.5.3.1 |
| openSUSE Leap 15.1 | curl-mini | 7.60.0-lp151.5.3.1 |
| openSUSE Tumbleweed | curl | 7.79.1-1.1 |