Summary
Thomas Vegas discovered that curl incorrectly handled memory when using
Kerberos over FTP. A remote attacker could use this issue to crash curl,
resulting in a denial of service. (CVE-2019-5481)
Thomas Vegas discovered that curl incorrectly handled memory during TFTP
transfers. A remote attacker could use this issue to crash curl, resulting
in a denial of service, or possibly execute arbitrary code. (CVE-2019-5482)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | curl | 7.47.0-1ubuntu2.14 |
| Ubuntu · 18.04 LTS 18.04:LTS | curl | 7.58.0-2ubuntu3.8 |
Vulnerabilities 2
-
Critical 9.8
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
-
Critical 9.8CVE-2019-5482 EPSS 18%
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.