CVE-2019-16747

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In MatrixSSL before 4.2.2 Open, the DTLS server can encounter an invalid pointer free (leading to memory corruption and a daemon crash) via a crafted incoming network message, a different vulnerability than CVE-2019-14431.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/matrixssl/matrixssl/blob/4-2-2-open/doc/CHANGES_v4.x.mdRelease Notes, Third Party Advisory
https://github.com/matrixssl/matrixssl/issues/33Exploit, Third Party Advisory
https://github.com/matrixssl/matrixssl/releases/tag/4-2-2-openThird Party Advisory
https://github.com/matrixssl/matrixssl/blob/4-2-2-open/doc/CHANGES_v4.x.mdRelease Notes, Third Party Advisory
https://github.com/matrixssl/matrixssl/issues/33Exploit, Third Party Advisory
https://github.com/matrixssl/matrixssl/releases/tag/4-2-2-openThird Party Advisory

Timeline

Published: Dec 30, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-167489.8In wolfSSL through 4.1.0, there is a missing sanity check of memory accesses in parsing ASN.1 certificate data while handshaking. Specifical CVE-2019-16757.5A vulnerability in the default configuration of the Cisco Aironet Active Sensor could allow an unauthenticated, remote attacker to restart t CVE-2019-167516.1An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting (X CVE-2019-167524.3An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. It is possible to force wallets to send HTTP re CVE-2019-167537.5An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. The content to be signed is composed of a repre CVE-2019-167547.5RIOT 2019.07 contains a NULL pointer dereference in the MQTT-SN implementation (asymcute), potentially allowing an attacker to crash a netwo CVE-2019-167559.8BMC Remedy ITSM Suite is prone to unspecified vulnerabilities in both DWP and SmartIT components, which can permit remote attackers to perfo CVE-2019-167587.5In Lexmark Services Monitor 2.27.4.0.39 (running on TCP port 2070), a remote attacker can use a directory traversal technique using /../../.CVE-2019-167599.8vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring re CVE-2019-16767.5A vulnerability in the Session Initiation Protocol (SIP) call processing of Cisco Meeting Server (CMS) software could allow an unauthenticat CVE-2019-167607.5Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `p CVE-2019-167616.1A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slp-va