CVE-2019-5435 - curl: Integer overflows in curl_url_set() function

Back Back to CVE browser

LOW

curl: Integer overflows in curl_url_set() function

Published May 28, 2019

3.7

LOW

CVSS 3.0

EPSS 4.71%

Description

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.

Affected products

Vendor Curl Product Curl Default
n/a
- Version
  Fixed in 7.65.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Curl

n/a

Version	Status	Constraints
Fixed in 7.65.0	affected	-

JBoss Core Services on RHEL 6

jbcs-httpd24-apr-0:1.6.3-104.jbcs.el6

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6

jbcs-httpd24-apr-util-0:1.6.1-75.jbcs.el6

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6

jbcs-httpd24-brotli-0:1.0.6-38.jbcs.el6

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6

jbcs-httpd24-curl-0:7.64.1-44.jbcs.el6

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6

jbcs-httpd24-httpd-0:2.4.37-64.jbcs.el6

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6

jbcs-httpd24-jansson-0:2.11-53.jbcs.el6

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6

jbcs-httpd24-mod_cluster-native-0:1.3.14-11.Final_redhat_2.jbcs.el6

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6

jbcs-httpd24-mod_http2-0:1.15.7-11.jbcs.el6

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6

jbcs-httpd24-mod_jk-0:1.2.48-10.redhat_1.jbcs.el6

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6

jbcs-httpd24-mod_md-1:2.0.8-30.jbcs.el6

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6

jbcs-httpd24-mod_security-0:2.9.2-57.GA.jbcs.el6

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6

jbcs-httpd24-nghttp2-0:1.39.2-34.jbcs.el6

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 6

jbcs-httpd24-openssl-1:1.1.1c-32.jbcs.el6

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7

jbcs-httpd24-apr-0:1.6.3-104.jbcs.el7

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7

jbcs-httpd24-apr-util-0:1.6.1-75.jbcs.el7

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7

jbcs-httpd24-brotli-0:1.0.6-38.jbcs.el7

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7

jbcs-httpd24-curl-0:7.64.1-44.jbcs.el7

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7

jbcs-httpd24-httpd-0:2.4.37-64.jbcs.el7

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7

jbcs-httpd24-jansson-0:2.11-53.jbcs.el7

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_cluster-native-0:1.3.14-11.Final_redhat_2.jbcs.el7

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_http2-0:1.15.7-11.jbcs.el7

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_jk-0:1.2.48-10.redhat_1.jbcs.el7

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_md-1:2.0.8-30.jbcs.el7

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_security-0:2.9.2-57.GA.jbcs.el7

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7

jbcs-httpd24-nghttp2-0:1.39.2-34.jbcs.el7

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7

jbcs-httpd24-openssl-1:1.1.1c-32.jbcs.el7

Fixed · RHSA-2020:4384
JBoss Core Services on RHEL 7

jbcs-httpd24-openssl-chil-0:1.0.0-1.jbcs.el7

Fixed · RHSA-2020:4384
Red Hat JBoss Core Services

jbcs-httpd24-curl

Fixed · RHSA-2020:4383
.NET Core 1.0 on Red Hat Enterprise Linux

rh-dotnetcore10-curl

Not affected
.NET Core 1.1 on Red Hat Enterprise Linux

rh-dotnetcore11-curl

Not affected
.NET Core 2.1 on Red Hat Enterprise Linux

rh-dotnet21-curl

Not affected
.NET Core 2.2 on Red Hat Enterprise Linux

rh-dotnet22-curl

Not affected
Red Hat Enterprise Linux 5

curl

Not affected
Red Hat Enterprise Linux 6

curl

Not affected
Red Hat Enterprise Linux 7

curl

Not affected
Red Hat Enterprise Linux 8

curl

Not affected
Red Hat JBoss Web Server 5

curl

Not affected
Red Hat Software Collections

httpd24-curl

Not affected

Product	Package	State	Advisory
JBoss Core Services on RHEL 6	jbcs-httpd24-apr-0:1.6.3-104.jbcs.el6	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 6	jbcs-httpd24-apr-util-0:1.6.1-75.jbcs.el6	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 6	jbcs-httpd24-brotli-0:1.0.6-38.jbcs.el6	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 6	jbcs-httpd24-curl-0:7.64.1-44.jbcs.el6	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 6	jbcs-httpd24-httpd-0:2.4.37-64.jbcs.el6	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 6	jbcs-httpd24-jansson-0:2.11-53.jbcs.el6	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 6	jbcs-httpd24-mod_cluster-native-0:1.3.14-11.Final_redhat_2.jbcs.el6	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 6	jbcs-httpd24-mod_http2-0:1.15.7-11.jbcs.el6	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 6	jbcs-httpd24-mod_jk-0:1.2.48-10.redhat_1.jbcs.el6	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 6	jbcs-httpd24-mod_md-1:2.0.8-30.jbcs.el6	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 6	jbcs-httpd24-mod_security-0:2.9.2-57.GA.jbcs.el6	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 6	jbcs-httpd24-nghttp2-0:1.39.2-34.jbcs.el6	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 6	jbcs-httpd24-openssl-1:1.1.1c-32.jbcs.el6	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 7	jbcs-httpd24-apr-0:1.6.3-104.jbcs.el7	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 7	jbcs-httpd24-apr-util-0:1.6.1-75.jbcs.el7	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 7	jbcs-httpd24-brotli-0:1.0.6-38.jbcs.el7	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 7	jbcs-httpd24-curl-0:7.64.1-44.jbcs.el7	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 7	jbcs-httpd24-httpd-0:2.4.37-64.jbcs.el7	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 7	jbcs-httpd24-jansson-0:2.11-53.jbcs.el7	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_cluster-native-0:1.3.14-11.Final_redhat_2.jbcs.el7	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_http2-0:1.15.7-11.jbcs.el7	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_jk-0:1.2.48-10.redhat_1.jbcs.el7	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_md-1:2.0.8-30.jbcs.el7	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_security-0:2.9.2-57.GA.jbcs.el7	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 7	jbcs-httpd24-nghttp2-0:1.39.2-34.jbcs.el7	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 7	jbcs-httpd24-openssl-1:1.1.1c-32.jbcs.el7	Fixed	RHSA-2020:4384
JBoss Core Services on RHEL 7	jbcs-httpd24-openssl-chil-0:1.0.0-1.jbcs.el7	Fixed	RHSA-2020:4384
Red Hat JBoss Core Services	jbcs-httpd24-curl	Fixed	RHSA-2020:4383
.NET Core 1.0 on Red Hat Enterprise Linux	rh-dotnetcore10-curl	Not affected	n/a
.NET Core 1.1 on Red Hat Enterprise Linux	rh-dotnetcore11-curl	Not affected	n/a
.NET Core 2.1 on Red Hat Enterprise Linux	rh-dotnet21-curl	Not affected	n/a
.NET Core 2.2 on Red Hat Enterprise Linux	rh-dotnet22-curl	Not affected	n/a
Red Hat Enterprise Linux 5	curl	Not affected	n/a
Red Hat Enterprise Linux 6	curl	Not affected	n/a
Red Hat Enterprise Linux 7	curl	Not affected	n/a
Red Hat Enterprise Linux 8	curl	Not affected	n/a
Red Hat JBoss Web Server 5	curl	Not affected	n/a
Red Hat Software Collections	httpd24-curl	Not affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-131

CWE-190

Integer Overflow

References (13)

https://access.redhat.com/security/cve/CVE-2019-5435
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1710609
Issue Tracking
https://curl.haxx.se/docs/CVE-2019-5435.html
x_refsource_CONFIRMExploitPatchVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-15025
Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/
vendor-advisoryx_refsource_FEDORA
https://nvd.nist.gov/vuln/detail/CVE-2019-5435
https://security.gentoo.org/glsa/202003-29
vendor-advisoryx_refsource_GENTOO
https://security.netapp.com/advisory/ntap-20190606-0004/
x_refsource_CONFIRM
https://support.f5.com/csp/article/K08125515
x_refsource_CONFIRM
https://www.cve.org/CVERecord?id=CVE-2019-5435
https://www.oracle.com/security-alerts/cpuapr2020.html
x_refsource_MISC
https://www.oracle.com/security-alerts/cpuoct2020.html
x_refsource_MISC
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
x_refsource_MISC

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-5435		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1710609		Issue Tracking
https://curl.haxx.se/docs/CVE-2019-5435.html		x_refsource_CONFIRMExploitPatchVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-15025		Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/		vendor-advisoryx_refsource_FEDORA
https://nvd.nist.gov/vuln/detail/CVE-2019-5435
https://security.gentoo.org/glsa/202003-29		vendor-advisoryx_refsource_GENTOO
https://security.netapp.com/advisory/ntap-20190606-0004/		x_refsource_CONFIRM
https://support.f5.com/csp/article/K08125515		x_refsource_CONFIRM
https://www.cve.org/CVERecord?id=CVE-2019-5435
https://www.oracle.com/security-alerts/cpuapr2020.html		x_refsource_MISC
https://www.oracle.com/security-alerts/cpuoct2020.html		x_refsource_MISC
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html		x_refsource_MISC