CVE-2019-14513

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that result in a read operation beyond the buffer allocated for the packet, a different vulnerability than CVE-2017-14491.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Slovejoy/dnsmasq-pre2.76Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00013.htmlMailing List, Third Party Advisory
https://github.com/Slovejoy/dnsmasq-pre2.76Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00013.htmlMailing List, Third Party Advisory

Timeline

Published: Aug 1, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-145149.8An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a CVE-2019-145167.4The mAadhaar application 1.2.7 for Android lacks SSL Certificate Validation, leading to man-in-the-middle attacks against requests for FAQs CVE-2019-145176.1pandao Editor.md 1.5.0 allows XSS via the Javascript: string.CVE-2019-145185.4Evolution CMS 2.0.x allows XSS via a description and new category location in a template. NOTE: the vendor states that the behavior is consi CVE-2019-145217.5The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location o CVE-2019-145237.8An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a large plen in fmt_okt_load_song in the Amiga CVE-2019-145247.8An issue was discovered in Schism Tracker through 20190722. There is a heap-based buffer overflow via a large number of song patterns in fmt CVE-2019-145254.9In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to CVE-2019-145268.1An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stor CVE-2019-145279.8An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. System commands can be executed, via the web interface, af CVE-2019-145287.8GnuCOBOL 2.2 has a heap-based buffer overflow in read_literal in cobc/scanner.l via crafted COBOL source code.CVE-2019-145299.8OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php.