CVE-2019-10055

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Suricata 4.1.3. The function ftp_pasv_response lacks a check for the length of part1 and part2, leading to a crash within the ftp/mod.rs file.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-190 CWE-617

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://redmine.openinfosecfoundation.org/issues/2949Exploit, Issue Tracking, Third Party Advisory
https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/Release Notes, Vendor Advisory
https://redmine.openinfosecfoundation.org/issues/2949Exploit, Issue Tracking, Third Party Advisory
https://suricata-ids.org/2019/04/30/suricata-4-1-4-released/Release Notes, Vendor Advisory

Timeline

Published: Aug 28, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-100567.5An issue was discovered in Suricata 4.1.3. The code mishandles the case of sending a network packet with the right type, such that the funct CVE-2019-100576.5Various Lexmark products have CSRF.CVE-2019-100589.1Various Lexmark products have Incorrect Access Control.CVE-2019-100595.3The legacy finger service (TCP port 79) is enabled by default on various older Lexmark devices.CVE-2019-10067.5An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing sign CVE-2019-100608.1The Verix Multi-app Conductor application 2.7 for Verifone Verix suffers from a buffer overflow vulnerability that allows attackers to execu CVE-2019-100619.8utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validat CVE-2019-100626.1The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sani CVE-2019-100639.0Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE CVE-2019-100647.5hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom(CVE-2019-100654.3An issue was discovered in Open Ticket Request System (OTRS) 7.0 through 7.0.6. An attacker who is logged into OTRS as a customer user can u CVE-2019-100665.4An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6, Community Edition 6.0.x through 6.0.17, and OTRSAppointmentC