CVE-2019-5436

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

• CVE-2019-5436: tftp: use the current blksize for recvfrom()
• CVE-2016-8615: cookie: replace use of fgets() with custom version

• CVE-2019-5436: tftp: use the current blksize for recvfrom()
• CVE-2016-8615: cookie: replace use of fgets() with custom version

libcurl contains a heap buffer overflow in the function (tftp_receive_packet()) that receives data from a TFTP server. It calls recvfrom() with the default size for the buffer rather than with the size that was used to allocate it. Thus, the content that might overwrite the heap memory is entirely controlled by the server.

The flaw exists if the user selects to use a blksize of 504 or smaller (default is 512). The smaller size that is used, the larger the possible overflow becomes.

Users choosing a smaller size than default should be rare as the primary use case for changing the size is to make it larger.

It is rare for users to use TFTP across the Internet. It is most commonly used within local networks.

The updated packages fix security vulnerabilities:

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. (CVE-2019-5435)

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1 (CVE-2019-5436).

Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3 (CVE-2019-5481).

Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3 (CVE-2019-5482).

This update for curl fixes the following issues:

Security issue fixed:

• CVE-2019-5436: Fixed a heap buffer overflow exists in tftp_receive_packet that receives data from a TFTP server (bsc#1135170).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the curl-7.79.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for curl fixes the following issues:

Security issue fixed:

• CVE-2019-5436: Fixed a heap buffer overflow exists in tftp_receive_packet that receives data from a TFTP server (bsc#1135170).

This update for curl fixes the following issues:

Security issue fixed:

• CVE-2019-5436: Fixed a heap buffer overflow exists in tftp_receive_packet that receives data from a TFTP server (bsc#1135170).

This update for curl fixes the following issues:

Security issue fixed:

• CVE-2019-5436: Fixed a heap buffer overflow exists in tftp_receive_packet that receives data from a TFTP server (bsc#1135170).

This update for curl fixes the following issues:

Security issue fixed:

• CVE-2019-5436: Fixed a heap buffer overflow exists in tftp_receive_packet that receives data from a TFTP server (bsc#1135170).

This update for curl fixes the following issues:

Security issue fixed:

• CVE-2019-5436: Fixed a heap buffer overflow in tftp_receive_packet() (bsc#1135170).

Wenchao Li discovered that curl incorrectly handled memory in the curl_url_set() function. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 19.04. (CVE-2019-5435)

It was discovered that curl incorrectly handled memory when receiving data from a TFTP server. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-5436)

USN-3993-1 fixed a vulnerability in curl. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that curl incorrectly handled memory when receiving data from a TFTP server. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-5436)