CVE-2019-5481: Double Free
Published Sep 11, 2019
·Updated
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
Affected Software
28 affected componentsFixes available
debian/curl
7.64.0-4+deb10u27.64.0-4+deb10u77.74.0-1.3+deb11u97.74.0-1.3+deb11u107.88.1-10+deb12u37.88.1-10+deb12u48.4.0-2
debian/curl<=7.52.1-5+deb9u9, <=7.64.0-4, <=7.65.3-1, <=7.52.1-1
haxx curl>=7.52.0<=7.65.3
Fedoraproject Fedora=29
Fedoraproject Fedora=30
Fedoraproject Fedora=31
NetApp Cloud Backup
NetApp Steelstore
NetApp Solidfire Baseboard Management Controller Firmware
NetApp Solidfire Baseboard Management Controller
Oracle Communications Operations Monitor=3.4
Oracle Communications Operations Monitor=4.0
Oracle Communications Operations Monitor=4.1
Oracle Communications Operations Monitor=4.2
Oracle Communications Operations Monitor=4.3
Oracle Communications Session Border Controller=8.3
Oracle Communications Session Border Controller=8.4
Oracle Enterprise Manager Ops Center=12.3.3
Oracle Enterprise Manager Ops Center=12.4.0
Oracle MySQL Server>=5.7.0<=5.7.28
Oracle MySQL Server>=8.0.0<=8.0.18
Oracle OSS Support Tools=20.0
Debian Debian Linux=9.0
Debian Debian Linux=10.0
openSUSE Leap=15.0
openSUSE Leap=15.1
All of the following
NetApp Solidfire Baseboard Management Controller Firmware
NetApp Solidfire Baseboard Management Controller
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.64.0-4+deb10u2Fixed in 7.64.0-4+deb10u7Fixed in 7.74.0-1.3+deb11u9Fixed in 7.74.0-1.3+deb11u10Fixed in 7.88.1-10+deb12u3Fixed in 7.88.1-10+deb12u4Fixed in 8.4.0-2
Event History
Sep 16, 2019
CVE Published
via MITRE·06:05 PM
Data Sourced
via MITRE·06:05 PM
DescriptionWeakness
Data Sourced
via NVD·07:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2019-5481?
CVE-2019-5481 is a double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
2
What is the severity of CVE-2019-5481?
CVE-2019-5481 has a severity rating of 9.8 (critical).
3
How can I fix the double-free vulnerability in cURL (CVE-2019-5481)?
To fix the double-free vulnerability in cURL (CVE-2019-5481), update to version 7.64.0-4+deb10u2, 7.64.0-4+deb10u7, 7.74.0-1.3+deb11u9, 7.74.0-1.3+deb11u10, 7.88.1-10+deb12u3, 7.88.1-10+deb12u4, or 8.4.0-2.
4
What software versions are affected by CVE-2019-5481?
CVE-2019-5481 affects cURL versions 7.52.0 to 7.65.3.
5
What is the Common Weakness Enumeration (CWE) ID for CVE-2019-5481?
The Common Weakness Enumeration (CWE) ID for CVE-2019-5481 is 415.