{"id":"CVE-2019-19977","aliases":["AZL-36949","AZL-7260","DEBIAN-CVE-2019-19977","EUVD-2019-9565","GHSA-cxg8-9wrx-2mhp","MGASA-2021-0503","SUSE-SU-2021:14793-1","SUSE-SU-2021:2917-1","SUSE-SU-2021:2937-1","SUSE-SU-2021:2937-2","openSUSE-SU-2021:1235-1","openSUSE-SU-2021:2937-1","openSUSE-SU-2024:12594-1"],"status":"published","title":"libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in...","description":"libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer over-read.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02974,"percentile":0.87345,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2019-12-26T00:07:49Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Azure Linux:3","package":"libesmtp","fixed_in":["1.0.6-21"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libesmtp","fixed_in":["1.0.6-21"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"libesmtp","fixed_in":["1.0.6-12.1.mga8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"libesmtp","fixed_in":["1.0.4-157.18.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"libesmtp","fixed_in":["1.0.4-157.18.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"libesmtp","fixed_in":["1.0.6-17.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"libesmtp","fixed_in":["1.0.6-17.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"libesmtp","fixed_in":["1.0.6-17.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"libesmtp","fixed_in":["1.0.6-17.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"libesmtp","fixed_in":["1.0.6-17.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libesmtp","fixed_in":["1.0.6-17.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libesmtp","fixed_in":["1.0.6-17.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libesmtp","fixed_in":["1.0.6-17.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"libesmtp","fixed_in":["1.0.6-17.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"libesmtp","fixed_in":["1.0.6-17.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"libesmtp","fixed_in":["1.0.6-17.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"libesmtp","fixed_in":["1.0.6-17.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libesmtp","fixed_in":["1.0.6-17.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libesmtp","fixed_in":["1.0.6-17.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"libesmtp","fixed_in":["1.0.6-150.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libesmtp","fixed_in":["1.0.6-150.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"libesmtp","fixed_in":["1.0.6-150.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"libesmtp","fixed_in":["1.0.6-150.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"libesmtp","fixed_in":["1.0.6-150.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"libesmtp","fixed_in":["1.0.6-150.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"libesmtp","fixed_in":["1.0.6-150.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"libesmtp","fixed_in":["1.0.6-150.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"libesmtp","fixed_in":["1.0.6-150.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"libesmtp","fixed_in":["1.0.6-150.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"libesmtp","fixed_in":["1.0.6-150.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.0","package":"libesmtp","fixed_in":["1.0.6-150.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"libesmtp","fixed_in":["1.0.6-150.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.0","package":"libesmtp","fixed_in":["1.0.6-150.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"libesmtp","fixed_in":["1.0.6-150.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"libesmtp","fixed_in":["1.0.6-150.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libesmtp","fixed_in":["1.0.6-150.4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"libesmtp","fixed_in":["1.0.6-lp152.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"libesmtp","fixed_in":["1.0.6-150.4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libesmtp","fixed_in":["1.1.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-21"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-21"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-3","1.1.0-3.1","1.1.0-3.1~deb12u1","1.1.0-3.2"]},{"source":"osv","ecosystem":"Debian:13","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-3.2"]},{"source":"osv","ecosystem":"Debian:14","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-3.2"]},{"source":"osv","ecosystem":"Mageia:8","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-12.1.mga8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-157.18.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-157.18.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-17.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-17.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-17.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-17.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-17.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-17.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-17.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-17.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-17.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-17.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-17.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-17.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-17.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-17.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-150.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-150.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-150.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-150.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-150.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-150.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-150.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-150.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-150.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-150.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-150.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-150.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-150.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-150.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-150.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-150.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-150.4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-lp152.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-150.4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libesmtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-1.1"}]}]}],"products":[{"vendor":"libesmtp_project","product":"libesmtp"}],"references":[{"url":"https://github.com/Kirin-say/Vulnerabilities/blob/master/Stack_Overflow_in_libesmtp.md","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/jbouse-debian/libesmtp/blob/ca5bd0800ef1da234315da4c59716568eb5e6402/ntlm/ntlmstruct.c#L228-L242","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://web.archive.org/web/20190528215510/http://brianstafford.info/libesmtp/","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19977","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cxg8-9wrx-2mhp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-19977","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0503.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29416","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2021-August/009358.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TGZ4L5IPYNOJTWC7WZTAMPSFHIGKXQAE/","tags":["web","advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114793-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1160462","tags":["report"]},{"url":"https://bugzilla.suse.com/1189097","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19977","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212917-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212937-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212937-2/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HXOIPTG34E6FHFZ5MRT6B4BEC5ETU6ML/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-19977","description":"libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer over-read.","status":"published","published":"2019-12-26T00:07:49Z","modified":"2024-08-05T02:32:10.156Z","updated_at":"2026-11-02T14:20:21.059499Z"}],"euvd":[{"id":"EUVD-2019-9565","description":"libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer over-read.","status":"published","published":"2019-12-26T00:07:49Z","modified":"2024-08-05T02:32:10Z","updated_at":"2026-11-03T02:40:23.251012Z"}],"ghsa":[{"id":"GHSA-cxg8-9wrx-2mhp","title":"libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in...","description":"libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer over-read.","status":"published","published":"2022-05-24T17:05:04Z","modified":"2023-01-29T05:00:54Z","updated_at":"2026-11-02T14:44:41.662162Z"}],"nvd":[{"id":"CVE-2019-19977","description":"libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer over-read.","status":"published","published":"2019-12-26T01:15:10.973Z","modified":"2026-06-17T02:27:32.227Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:05:40.856496Z"}],"osv":[{"id":"AZL-36949","title":"CVE-2019-19977 affecting package libesmtp for versions less than 1.0.6-21","description":"libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer over-read.","status":"published","published":"2019-12-26T01:15:10Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"AZL-7260","title":"CVE-2019-19977 affecting package libesmtp for versions less than 1.0.6-21","description":"libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer over-read.","status":"published","published":"2019-12-26T01:15:10Z","modified":"2026-04-21T04:36:46.423121Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"CVE-2019-19977","description":"libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer over-read.","status":"published","published":"2019-12-26T01:15:10.973Z","modified":"2026-10-20T10:50:53.23962007Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-19977","description":"libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based buffer over-read.","status":"published","published":"2019-12-26T01:15:10.973Z","modified":"2026-09-21T07:03:17.373400471Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"MGASA-2021-0503","title":"Updated libesmtp packages fix security vulnerability","description":"libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer\nin ntlm_build_type_2 in ntlm/ntlmstruct.c, as demonstrated by a stack-based\nbuffer over-read. (CVE-2019-19977)\n","status":"published","published":"2021-11-10T22:53:34Z","modified":"2026-04-16T04:40:48.302723973Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:1235-1","title":"Security update for libesmtp","description":"This update for libesmtp fixes the following issues:\n\n- CVE-2019-19977: Fixed stack-based buffer over-read in ntlm/ntlmstruct.c (bsc#1160462).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-09-07T09:31:34Z","modified":"2026-02-04T04:10:56.632638Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:2937-1","title":"Security update for libesmtp","description":"This update for libesmtp fixes the following issues:\n\n- CVE-2019-19977: Fixed stack-based buffer over-read in ntlm/ntlmstruct.c (bsc#1160462).\n","status":"published","published":"2021-09-03T07:18:59Z","modified":"2026-02-04T02:27:24.345121Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:12594-1","title":"libesmtp-devel-1.1.0-1.1 on GA media","description":"These are all security issues fixed in the libesmtp-devel-1.1.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:25:55.685378Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2021:14793-1","title":"Security update for libesmtp","description":"This update for libesmtp fixes the following issues:\n\n- CVE-2019-19977: Fixed stack-based buffer over-read in ntlm/ntlmstruct.c (bsc#1160462).\n","status":"published","published":"2021-08-25T15:21:25Z","modified":"2026-02-04T04:19:26.776307Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2917-1","title":"Security update for libesmtp","description":"This update for libesmtp fixes the following issues:\n\n- CVE-2019-19977: Fix stack-based buffer over-read in ntlm/ntlmstruct.c (bsc#1160462).\n","status":"published","published":"2021-09-02T08:00:48Z","modified":"2026-02-04T02:36:52.615871Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2937-1","title":"Security update for libesmtp","description":"This update for libesmtp fixes the following issues:\n\n- CVE-2019-19977: Fixed stack-based buffer over-read in ntlm/ntlmstruct.c (bsc#1160462).\n","status":"published","published":"2021-09-03T07:19:27Z","modified":"2026-02-04T03:19:34.884439Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:2937-2","title":"Security update for libesmtp","description":"This update for libesmtp fixes the following issues:\n\n- CVE-2019-19977: Fixed stack-based buffer over-read in ntlm/ntlmstruct.c (bsc#1160462).\n","status":"published","published":"2021-09-21T14:38:11Z","modified":"2026-02-04T04:19:23.879335Z","updated_at":"2026-11-02T15:53:49.605187Z"}]}}