CVE-2019-5435
published 2019-05-28CVE-2019-5435: An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.
PriorityP413low3.7CVSS 3.0
AVNACHPRNUINSUCNINAL
EPSS
0.17%
37.5th percentile
An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| curl | curl | — | — |
| debian | curl | < curl 7.64.0-4 (bookworm) | curl 7.64.0-4 (bookworm) |
| haxx | curl | >= 0 < 7.64.0-4 | 7.64.0-4 |
| haxx | curl | >= 0 < 7.64.0-4 | 7.64.0-4 |
| haxx | curl | >= 0 < 7.64.0-4 | 7.64.0-4 |
| haxx | curl | >= 0 < 7.64.0-4 | 7.64.0-4 |
| haxx | curl | >= 0 < 7.47.0-1ubuntu2.13 | 7.47.0-1ubuntu2.13 |
| haxx | curl | >= 0 < 7.58.0-2ubuntu3.7 | 7.58.0-2ubuntu3.7 |
| haxx | curl | 7.62.0 – 7.64.1 | — |
CVSS provenance
nvdv3.03.7LOWCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv3.7LOW
vendor_debian3.7LOW
vendor_redhat3.7LOW
vendor_ubuntu3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
cisa_ics·2023-12-14
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
ICS Advisory
##
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
Release DateDecember 14, 2023
Alert CodeICSA-23-348-10
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
- Vulnerabilities: Improper Restriction of XML External Entity Reference, Time-of-check Time-of-use (TOCTOU) Race Condition, Command Injection, Miss
Ubuntu
curl vulnerabilities
vendor_ubuntu·2019-05-22·CVSS 3.7
CVE-2019-5435 [LOW] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
Wenchao Li discovered that curl incorrectly handled memory in the
curl_url_set() function. A remote attacker could use this issue to cause
curl to crash, resulting in a denial of service, or possibly execute
arbitrary code. This issue only affected Ubuntu 19.04. (CVE-2019-5435)
It was discovered that curl incorrectly handled memory when receiving data
from a TFTP server. A remote attacker could use this issue to cause curl to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2019-5436)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
curl: Integer overflows in curl_url_set() function
vendor_redhat·2019-05-22·CVSS 3.7
CVE-2019-5435 [LOW] CWE-131 curl: Integer overflows in curl_url_set() function
curl: Integer overflows in curl_url_set() function
An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.
Package: rh-dotnetcore10-curl (.NET Core 1.0 on Red Hat Enterprise Linux) - Not affected
Package: rh-dotnetcore11-curl (.NET Core 1.1 on Red Hat Enterprise Linux) - Not affected
Package: rh-dotnet21-curl (.NET Core 2.1 on Red Hat Enterprise Linux) - Not affected
Package: rh-dotnet22-curl (.NET Core 2.2 on Red Hat Enterprise Linux) - Not affected
Package: curl (Red Hat Enterprise Linux 5) - Not affected
Package: curl (Red Hat Enterprise Linux 6) - Not affected
Package: curl (Red Hat Enterprise Linux 7) - Not affected
Package: curl (Red Hat Enterprise Linux 8) - Not affected
Package: curl (Red Hat JBoss Web Server 5) - Not
Debian
CVE-2019-5435: curl - An integer overflow in curl's URL API results in a buffer overflow in libcurl 7....
vendor_debian·2019·CVSS 3.7
CVE-2019-5435 [LOW] CVE-2019-5435: curl - An integer overflow in curl's URL API results in a buffer overflow in libcurl 7....
An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.
Scope: local
bookworm: resolved (fixed in 7.64.0-4)
bullseye: resolved (fixed in 7.64.0-4)
forky: resolved (fixed in 7.64.0-4)
sid: resolved (fixed in 7.64.0-4)
trixie: resolved (fixed in 7.64.0-4)
GHSA
GHSA-fp2w-w5rc-8fxj: An integer overflow in curl's URL API results in a buffer overflow in libcurl 7
ghsa_unreviewed·2022-05-24
CVE-2019-5435 [MEDIUM] CWE-131 GHSA-fp2w-w5rc-8fxj: An integer overflow in curl's URL API results in a buffer overflow in libcurl 7
An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.
OSV
CVE-2019-5435: An integer overflow in curl's URL API results in a buffer overflow in libcurl 7
osv·2019-05-28·CVSS 3.7
CVE-2019-5435 [LOW] CVE-2019-5435: An integer overflow in curl's URL API results in a buffer overflow in libcurl 7
An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.
OSV
curl vulnerabilities
osv·2019-05-22·CVSS 3.7
CVE-2019-5435 [LOW] curl vulnerabilities
curl vulnerabilities
Wenchao Li discovered that curl incorrectly handled memory in the
curl_url_set() function. A remote attacker could use this issue to cause
curl to crash, resulting in a denial of service, or possibly execute
arbitrary code. This issue only affected Ubuntu 19.04. (CVE-2019-5435)
It was discovered that curl incorrectly handled memory when receiving data
from a TFTP server. A remote attacker could use this issue to cause curl to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2019-5436)
No detection rules found.
No public exploits indexed.
HackerOne
Integer overflows in unescape_word()
hackerone·2022-06-09·CVSS 3.7
CVE-2019-5435 [LOW] Integer overflows in unescape_word()
Integer overflows in unescape_word()
## Summary:
A similiar issue to [CVE-2019-5435](https://hackerone.com/reports/547630)
## Steps To Reproduce:
### analysis
DICT protocol can use one url like "dict://localhost:3306", and function unescape_word() is used to deal with the character in url like this comment
```c
/* According to RFC2229 section 2.2, these letters need to be escaped with
\[letter] */
if((ch <= 32) || (ch == 127) ||
(ch == '\'') || (ch == '\"') || (ch == '\\')) {
dictp[olen++] = '\\';
}
```
and the bug case here /curl/lib/dict.c
```c
static char *unescape_word(const char *inputbuff)
{
char *newp = NULL;
char *dictp;
size_t len;
CURLcode result = Curl_urldecode(inputbuff, 0, &newp, &len, <------------- get len
REJECT_NADA);
if(!newp || result)
return NULL;
dictp = malloc(
HackerOne
CVE-2019-5435: An integer overflow found in /lib/urlapi.c
hackerone·2020-12-05·CVSS 7.5
CVE-2019-5435 [HIGH] CVE-2019-5435: An integer overflow found in /lib/urlapi.c
CVE-2019-5435: An integer overflow found in /lib/urlapi.c
## Summary:
libcurl contains a heap-based buffer overrun in /lib/urlapi.c. A similiar issue to CVE-2018-14618.
## Steps To Reproduce:
### analysis
I found a potential integer overflow which may lead to a buffer overrun in /curl/lib/urlapi.c. In function `seturl`, urllen was multiplied by 2 and then passed to malloc. So an integer overflow will happen when the url is as long as 2GB in a 32 bit OS.
```c
static CURLUcode seturl(const char *url, CURLU *u, unsigned int flags)
{
char *path;
bool path_alloced = FALSE;
char *hostname;
char *query = NULL;
char *fragment = NULL;
CURLUcode result;
bool url_has_scheme = FALSE;
char schemebuf[MAX_SCHEME_LEN];
char *schemep = NULL;
size_t schemelen = 0;
size_t urllen;
const struct Curl_hand
Bugzilla
CVE-2019-5435 curl: Integer overflows in curl_url_set() function [fedora-all]
bugzilla·2019-05-22·CVSS 3.7
CVE-2019-5435 [LOW] CVE-2019-5435 curl: Integer overflows in curl_url_set() function [fedora-all]
CVE-2019-5435 curl: Integer overflows in curl_url_set() function [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions
Bugzilla
CVE-2019-5435 curl: Integer overflows in curl_url_set() function
bugzilla·2019-05-15·CVSS 3.7
CVE-2019-5435 [LOW] CVE-2019-5435 curl: Integer overflows in curl_url_set() function
CVE-2019-5435 curl: Integer overflows in curl_url_set() function
libcurl contains two integer overflows in the `curl_url_set()` function that
if triggered, can lead to a too small buffer allocation and a subsequent heap
buffer overflow.
Upstream patch:
https://github.com/curl/curl/commit/5fc28510a4664f4
References:
https://curl.haxx.se/docs/CVE-2019-5435.html
Discussion:
This flaw only manifests itself on 32bit arches.
There are two entry points to this issue, on 32 bit architectures.
By asking libcurl to parse a string, passing in a string longer than 2GB to this API: `curl_url_set(uh, CURLUPART_URL, "string", 0);` triggers the bug.
Asking libcurl to update a URL with a new string, and URL encoded it in the process, by passing in a string longer than 1.33GB to this API:
`curl_ur
https://curl.haxx.se/docs/CVE-2019-5435.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/https://security.gentoo.org/glsa/202003-29https://security.netapp.com/advisory/ntap-20190606-0004/https://support.f5.com/csp/article/K08125515https://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttps://curl.haxx.se/docs/CVE-2019-5435.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/https://security.gentoo.org/glsa/202003-29https://security.netapp.com/advisory/ntap-20190606-0004/https://support.f5.com/csp/article/K08125515https://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
2019-05-28
Published