{"id":"CVE-2019-13508","aliases":["ALPINE-CVE-2019-13508","DEBIAN-CVE-2019-13508","EUVD-2019-4964","GHSA-865m-p9hx-mgvh","MGASA-2019-0319","OESA-2022-1516","OESA-2022-2075","SUSE-SU-2020:1417-1","SUSE-SU-2020:1417-2","UBUNTU-CVE-2019-13508","USN-4173-1","openSUSE-SU-2020:0741-1","openSUSE-SU-2024:10769-1"],"status":"published","title":"FreeTDS through 1.1.11 has a Buffer Overflow.","description":"FreeTDS through 1.1.11 has a Buffer Overflow.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01781,"percentile":0.78416,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2019-08-01T00:00:00Z","modified":"2026-09-21T07:01:51Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"freetds","fixed_in":["1.1.6-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"freetds","fixed_in":["1.1.6-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"freetds","fixed_in":["1.1.6-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"freetds","fixed_in":["1.1.6-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"freetds","fixed_in":["1.1.6-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"freetds","fixed_in":["1.1.6-1.1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"freetds","fixed_in":["1.00.83-2.1.mga7"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"freetds","fixed_in":["1.00.38-8.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"freetds","fixed_in":["1.00.38-8.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"freetds","fixed_in":["1.00.38-8.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"freetds","fixed_in":["1.00.38-8.oe2203"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"freetds","fixed_in":["1.1.36-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP1","package":"freetds","fixed_in":["1.1.36-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"freetds","fixed_in":["1.1.36-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"freetds","fixed_in":["1.1.36-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"freetds","fixed_in":["1.00.82-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"freetds","fixed_in":["1.1.36-lp151.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"freetds","fixed_in":["1.2.21-1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6-1.1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.00.83-2.1.mga7"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.00.38-8.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.00.38-8.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.00.38-8.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.00.38-8.oe2203"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.36-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP1","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.36-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.36-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.36-3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.00.82-2ubuntu0.1"}]}],"versions":["0.91-6.1build2","1.00.82-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.00.82-2ubuntu0.1"}]}],"versions":["0.91-6.1build2","1.00.82-2"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.36-lp151.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freetds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.21-1.3"}]}]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"freetds","product":"freetds"}],"references":[{"url":"https://usn.ubuntu.com/4173-1/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00067.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13508","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-865m-p9hx-mgvh"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-13508","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13508","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0319.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25653","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1516","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2075","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201417-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1141132","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13508","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201417-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-13508","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4173-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13508","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/26IWTUFQ3E2LZ7VE3BQ4MWLY5TNXGHAB/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-13508","description":"FreeTDS through 1.1.11 has a Buffer Overflow.","status":"published","published":"2019-10-31T20:55:15Z","modified":"2024-08-04T23:57:39.074Z","updated_at":"2026-11-02T14:20:24.357095Z"}],"euvd":[{"id":"EUVD-2019-4964","description":"FreeTDS through 1.1.11 has a Buffer Overflow.","status":"published","published":"2019-10-31T20:55:15Z","modified":"2024-08-04T23:57:39Z","updated_at":"2026-11-03T02:40:42.441902Z"}],"ghsa":[{"id":"GHSA-865m-p9hx-mgvh","title":"FreeTDS through 1.1.11 has a Buffer Overflow.","description":"FreeTDS through 1.1.11 has a Buffer Overflow.","status":"published","published":"2022-05-24T17:00:09Z","modified":"2023-01-28T05:08:05Z","updated_at":"2026-11-02T14:44:35.9832Z"}],"nvd":[{"id":"CVE-2019-13508","description":"FreeTDS through 1.1.11 has a Buffer Overflow.","status":"published","published":"2019-10-31T21:15:12.827Z","modified":"2026-06-17T02:16:52.193Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:05:32.982925Z"}],"osv":[{"id":"ALPINE-CVE-2019-13508","description":"FreeTDS through 1.1.11 has a Buffer Overflow.","status":"published","published":"2019-10-31T21:15:12.827Z","modified":"2026-09-21T06:17:52.480089915Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"CVE-2019-13508","description":"FreeTDS through 1.1.11 has a Buffer Overflow.","status":"published","published":"2019-10-31T21:15:12.827Z","modified":"2026-04-16T04:37:23.433184612Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-13508","description":"FreeTDS through 1.1.11 has a Buffer Overflow.","status":"published","published":"2019-10-31T21:15:12.827Z","modified":"2026-09-21T07:01:51.314962997Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"OESA-2022-1516","title":"freetds security update","description":"FreeTDS is an open source implementation of the TDS (Tabular Data Stream) protocol used by these databases for their own clients. It supports many different flavors of the protocol and three APIs to access it. FreeTDS includes call level interfaces for DB-Lib, CT-Lib, and ODBC.\r\n\r\nSecurity Fix(es):\r\n\r\nFreeTDS through 1.1.11 has a Buffer Overflow.(CVE-2019-13508)","status":"published","published":"2022-02-11T11:04:47Z","modified":"2026-08-18T01:15:42.239494372Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2022-2075","title":"freetds security update","description":"FreeTDS is an open source implementation of the TDS (Tabular Data Stream) protocol used by these databases for their own clients. It supports many different flavors of the protocol and three APIs to access it. FreeTDS includes call level interfaces for DB-Lib, CT-Lib, and ODBC.\r\n\r\nSecurity Fix(es):\r\n\r\nFreeTDS through 1.1.11 has a Buffer Overflow.(CVE-2019-13508)","status":"published","published":"2022-11-11T11:05:23Z","modified":"2026-08-18T01:17:21.592372024Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2019-13508","description":"FreeTDS through 1.1.11 has a Buffer Overflow.","status":"published","published":"2019-08-01T00:00:00Z","modified":"2026-04-22T12:10:34.779024Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"MGASA-2019-0319","title":"Updated freetds packages fix security vulnerability","description":"Updated freetds packages fix security vulnerability:\n\nFelix Wilhelm discovered that FreeTDS incorrectly handled certain types\nafter a protocol downgrade. A remote attacker could use this issue to\ncause FreeTDS to crash, resulting in a denial of service, or possibly\nexecute arbitrary code (CVE-2019-13508).\n","status":"published","published":"2019-11-07T23:36:48Z","modified":"2026-04-16T04:40:37.199977703Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0741-1","title":"Security update for freetds","description":"This update for freetds to 1.1.36 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-13508: Fixed a heap overflow that could have been caused by malicious servers sending UDT types over protocol version 5.0 (bsc#1141132).\n\nNon-security issues fixed:\n\n- Enabled Kerberos support\n- Version update to 1.1.36:\n  * Default TDS protocol version is now 'auto'\n  * Improved UTF-8 performances\n  * TDS Pool Server is enabled\n  * MARS support is enabled\n  * NTLMv2 is enabled\n  * See NEWS and ChangeLog for a complete list of changes\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-05-29T18:16:10Z","modified":"2026-02-04T04:29:05.189128Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10769-1","title":"freetds-config-1.2.21-1.3 on GA media","description":"These are all security issues fixed in the freetds-config-1.2.21-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:37:23.106136Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2020:1417-1","title":"Security update for freetds","description":"This update for freetds to 1.1.36 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-13508: Fixed a heap overflow that could have been caused by malicious servers sending UDT types over protocol version 5.0 (bsc#1141132).\n\nNon-security issues fixed:\n\n- Enabled Kerberos support\n- Version update to 1.1.36:\n  * Default TDS protocol version is now 'auto'\n  * Improved UTF-8 performances\n  * TDS Pool Server is enabled\n  * MARS support is enabled\n  * NTLMv2 is enabled\n  * See NEWS and ChangeLog for a complete list of changes\n","status":"published","published":"2020-05-26T10:23:10Z","modified":"2026-02-04T02:55:23.52112Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1417-2","title":"Security update for freetds","description":"This update for freetds to 1.1.36 fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-13508: Fixed a heap overflow that could have been caused by malicious servers sending UDT types over protocol version 5.0 (bsc#1141132).\n\nNon-security issues fixed:\n\n- Enabled Kerberos support\n- Version update to 1.1.36:\n  * Default TDS protocol version is now 'auto'\n  * Improved UTF-8 performances\n  * TDS Pool Server is enabled\n  * MARS support is enabled\n  * NTLMv2 is enabled\n  * See NEWS and ChangeLog for a complete list of changes\n","status":"published","published":"2020-07-08T07:55:12Z","modified":"2026-02-04T02:47:29.017955Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-4173-1","title":"freetds vulnerability","description":"Felix Wilhelm discovered that FreeTDS incorrectly handled certain types\nafter a protocol downgrade. A remote attacker could use this issue to cause\nFreeTDS to crash, resulting in a denial of service, or possibly execute\narbitrary code.\n","status":"published","published":"2019-10-30T13:56:11Z","modified":"2026-04-22T10:01:48.313033Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}