CVE-2019-5435

LowCVSS 3.7/10Last modified Oct 14, 2026

Description

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.

Metrics

CVSS 3.0 3.7/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-131CWE-190

Affected software

No affected versions have been published.

Timeline

Published
May 28, 2019
Last modified
Oct 14, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-54367.8A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.CVE-2019-54375.3Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to CVE-2019-54385.3Path traversal using symlink in npm harp module versions <= 0.29.0.CVE-2019-54396.5A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.CVE-2019-54408.1Use of cryptographically weak PRNG in the password recovery token generation of Revive Adserver < v4.2.1 causes a potential authentication bCVE-2019-54427.5XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amountsCVE-2019-54437.8A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= CVE-2019-54445.3Path traversal vulnerability in version up to v1.1.3 in serve-here.js npm module allows attackers to list any file in arbitrary folder.CVE-2019-54454.9DoS in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to Crash the SSH CLI interface by using crafted commands.CVE-2019-54467.2Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root.CVE-2019-54475.3A path traversal vulnerability in <= v0.2.6 of http-file-server npm module allows attackers to list files in arbitrary folders.CVE-2019-54488.1Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication dat