CVE-2019-5435: An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1

Low severity · published May 28, 2019

CVE-2019-5435

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1

3.7

CVSS

5.7%

EPSS

On KEV

Description

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack vector

Network

Complexity

High

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)5.7% · higher than 93% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

curl · curl

Fixed in 7.65.0 · source: vendor, NVD

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens

V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens

V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · Siemens

V3.1.0 before V3.1.5 · source: CISA

Affected product

curl

All curl CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-5435

CVE.org

https://www.cve.org/CVERecord?id=CVE-2019-5435

Exploit

https://curl.haxx.se/docs/CVE-2019-5435.html

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/

security.gentoo.org

https://security.gentoo.org/glsa/202003-29

security.netapp.com

https://security.netapp.com/advisory/ntap-20190606-0004/

support.f5.com

https://support.f5.com/csp/article/K08125515

www.oracle.com

https://www.oracle.com/security-alerts/cpuapr2020.html